Supply Windows handle-passing function to NaCl

Pass BrokerDuplicateHandle() to the NaCl loader process in
nacl_listener.cc.

Pass BrokerDuplicateHandle() to the NaCl trusted plugin.  We need to
add this to PPB_NaCl_Private in order to pass it through.

Remove the use of the "init_handle_passing" SRPC call.  Otherwise the
NaCl process will attempt to do an imc_connect() to the renderer,
which involves sending a handle to it, which fails.

Add a wrapper for AddTargetPeer() to 'content' so that
nacl_process_host.cc can use it.

Change the renderer's handle-passing policy to allow sending handles
other than Sections.  The NaCl trusted plugin sends other handle types
to the NaCl loader process.

This change will allow the sandbox to be tightened up, in the future,
so that the NaCl loader process and the renderer process do not have
handles to each other.

BUG=http://code.google.com/p/nativeclient/issues/detail?id=2719
TEST=nacl_integration etc.

Review URL: https://chromiumcodereview.appspot.com/10039001

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@132496 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 9 insertions, 0 deletions

diff --git a/content/public/common/sandbox_init.h b/content/public/common/sandbox_init.h
index 8952323..24da5a9 100644
--- a/content/public/common/sandbox_init.h
+++ b/content/public/common/sandbox_init.h
@@ -42,6 +42,15 @@ CONTENT_EXPORT bool BrokerDuplicateHandle(HANDLE source_handle,
                                           DWORD desired_access,
                                           DWORD options);
 
+// Inform the current process's sandbox broker (e.g. the broker for
+// 32-bit processes) about a process created under a different sandbox
+// broker (e.g. the broker for 64-bit processes).  This allows
+// BrokerDuplicateHandle() to send handles to a process managed by
+// another broker.  For example, it allows the 32-bit renderer to send
+// handles to 64-bit NaCl processes.  This returns true on success,
+// false otherwise.
+CONTENT_EXPORT bool BrokerAddTargetPeer(HANDLE peer_process);
+
 #elif defined(OS_MACOSX)
 
 // Initialize the sandbox of the given |sandbox_type|, optionally specifying a