Revert 127820 - Revert 127795 - Make sandbox explicitly block opening broker and sandboxed processes

sandbox/src/broker_services.h

-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_SRC_BROKER_SERVICES_H__
 #define SANDBOX_SRC_BROKER_SERVICES_H__
 
 #include <list>
 #include "base/basictypes.h"
 #include "sandbox/src/crosscall_server.h"
 #include "sandbox/src/job.h"
@@ skipping 55 matching lines @@
   // the worker thread.
   HANDLE job_port_;
 
   // Handle to a manual-reset event that is signaled when the total target
   // process count reaches zero.
   HANDLE no_targets_;
 
   // Handle to the worker thread that reacts to job notifications.
   HANDLE job_thread_;
 
+  // Copy of our security descriptor containing deny ACEs to block children.
+  PSECURITY_DESCRIPTOR security_descriptor_;
+
   // Lock used to protect the list of targets from being modified by 2
   // threads at the same time.
   CRITICAL_SECTION lock_;
 
   // provides a pool of threads that are used to wait on the IPC calls.
   ThreadProvider* thread_pool_;
 
   // List of the trackers for closing and cleanup purposes.
   typedef std::list<JobTracker*> JobTrackerList;
   JobTrackerList tracker_list_;
 
   DISALLOW_COPY_AND_ASSIGN(BrokerServicesBase);
 };
 
 }  // namespace sandbox
 
 
 #endif  // SANDBOX_SRC_BROKER_SERVICES_H__