Add sandbox support for Windows process mitigations

content/common/sandbox_policy.cc

Index: content/common/sandbox_policy.cc
===================================================================
--- content/common/sandbox_policy.cc	(revision 155197)
+++ content/common/sandbox_policy.cc	(working copy)
@@ -25,6 +25,7 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/process_type.h"
 #include "content/public/common/sandbox_init.h"
+#include "sandbox/win/src/process_mitigations.h"
 #include "sandbox/win/src/sandbox.h"
 #include "sandbox/win/src/sandbox_nt_util.h"
 #include "sandbox/win/src/win_utils.h"
@@ -726,6 +727,28 @@
     return process;
   }
 
+  uint64 mitigations = TargetPolicy::MITIGATION_RELOCATE_IMAGE |
+                       TargetPolicy::MITIGATION_RELOCATE_IMAGE_REQUIRED |
+                       TargetPolicy::MITIGATION_HEAP_TERMINATE |
+                       TargetPolicy::MITIGATION_BOTTOM_UP_ASLR |
+                       TargetPolicy::MITIGATION_HIGH_ENTROPY_ASLR |
+                       TargetPolicy::MITIGATION_DLL_SEARCH_ORDER;
+  // TODO(jschuh): Make NaCl work with DEP and SEHOP

[cpu_(ooo_6.6-7.5), 2012/09/07 19:22:55]

period

[jschuh, 2012/09/07 20:23:14]

Done.

+  if (type != content::PROCESS_TYPE_NACL_LOADER) {
+    mitigations |= TargetPolicy::MITIGATION_DEP |
+                   TargetPolicy::MITIGATION_DEP_NO_ATL_THUNK |
+                   TargetPolicy::MITIGATION_SEHOP;
+  }
+  if (policy->SetProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK)
+    return 0;
+
+  mitigations = TargetPolicy::MITIGATION_STRICT_HANDLE_CHECKS |
+                TargetPolicy::MITIGATION_EXTENSION_DLL_DISABLE;
+  if (policy->SetDelayedProcessMitigations(mitigations) !=
+      sandbox::SBOX_ALL_OK) {
+    return 0;
+  }
+
   if (type == content::PROCESS_TYPE_PLUGIN) {
     AddGenericDllEvictionPolicy(policy);
     AddPluginDllEvictionPolicy(policy);