diff options
author | jschuh@chromium.org <jschuh@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-09-12 16:58:52 +0000 |
---|---|---|
committer | jschuh@chromium.org <jschuh@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2012-09-12 16:58:52 +0000 |
commit | 4e7c72293596ed6a855a94fdedbb8bc6d91c583d (patch) | |
tree | b018fcd4f2e7db1410b80e4d2dd49d3b469b5923 /sandbox/win/src/sandbox_policy.h | |
parent | c7e0995b1c61558a3a3d12848512e48fef3ade8a (diff) | |
download | chromium_src-4e7c72293596ed6a855a94fdedbb8bc6d91c583d.zip chromium_src-4e7c72293596ed6a855a94fdedbb8bc6d91c583d.tar.gz chromium_src-4e7c72293596ed6a855a94fdedbb8bc6d91c583d.tar.bz2 |
Add sandbox support for Windows process mitigations
BUG=147752
Review URL: https://chromiumcodereview.appspot.com/10690058
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@156315 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'sandbox/win/src/sandbox_policy.h')
-rw-r--r-- | sandbox/win/src/sandbox_policy.h | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/sandbox/win/src/sandbox_policy.h b/sandbox/win/src/sandbox_policy.h index ff487bcc..f0fc2bc 100644 --- a/sandbox/win/src/sandbox_policy.h +++ b/sandbox/win/src/sandbox_policy.h @@ -164,6 +164,22 @@ class TargetPolicy { // Sets a capability to be enabled for the sandboxed process' AppContainer. virtual ResultCode SetCapability(const wchar_t* sid) = 0; + // Sets the mitigations enabled when the process is created. Most of these + // are implemented as attributes passed via STARTUPINFOEX. So they take + // effect before any thread in the target executes. The declaration of + // MitigationFlags is followed by a detailed description of each flag. + virtual ResultCode SetProcessMitigations(MitigationFlags flags) = 0; + + // Returns the currently set mitigation flags. + virtual MitigationFlags GetProcessMitigations() = 0; + + // Sets process mitigation flags that don't take effect before the call to + // LowerToken(). + virtual ResultCode SetDelayedProcessMitigations(MitigationFlags flags) = 0; + + // Returns the currently set delayed mitigation flags. + virtual MitigationFlags GetDelayedProcessMitigations() = 0; + // Sets the interceptions to operate in strict mode. By default, interceptions // are performed in "relaxed" mode, where if something inside NTDLL.DLL is // already patched we attempt to intercept it anyway. Setting interceptions |