Add sandbox support for Windows process mitigations

sandbox/win/src/process_mitigations.h

+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SANDBOX_SRC_WIN_PROCESS_MITIGATIONS_H_
+#define SANDBOX_SRC_WIN_PROCESS_MITIGATIONS_H_
+
+#include <windows.h>
+
+#include "base/basictypes.h"
+
+namespace sandbox {
+
+// Returns the flags that must be enforced after startup.
+uint64 GetPostStartupProcessMitigations(uint64 flags);
+
+// Converts sandbox flags to the PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES
+// flags used by UpdateProcThreadAttribute().
+DWORD64 GetProcessMitigationPolicyFlags(uint64 flags);
+
+// Sets the mitigation policy for the current process, ignoring any settings
+// that are invalid for the current version of Windows.
+bool SetProcessMitigationsForCurrentProcess(uint64 flags);
+
+// Adds mitigations that need to be performed on the suspended target process
+// before execution begins.
+bool SetProcessMitigationsForSuspendedProcess(HANDLE process, uint64 flags);
+
+// Returns true if all the supplied flags can be set after a process starts.
+bool CanSetProcessMitigationsPostStartup(uint64 flags);
+
+// Returns true if all the supplied flags can be set before a process starts.
+bool CanSetProcessMitigationsPreStartup(uint64 flags);
+
+}  // namespace sandbox
+
+#endif  // SANDBOX_SRC_WIN_PROCESS_MITIGATIONS_H_
+