diff options
| author | cpu@chromium.org <cpu@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-09-22 00:58:43 +0000 |
|---|---|---|
| committer | cpu@chromium.org <cpu@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-09-22 00:58:43 +0000 |
| commit | dba45245a854a1e2f7d94576edeb015a911e0bea (patch) | |
| tree | 546a6ff21883f20d797cb55043aa2f22cfb703bd /sandbox | |
| parent | e50eeee4aaea40f3d5644e5e4ce3c54dd7834ecf (diff) | |
| download | chromium_src-dba45245a854a1e2f7d94576edeb015a911e0bea.zip chromium_src-dba45245a854a1e2f7d94576edeb015a911e0bea.tar.gz chromium_src-dba45245a854a1e2f7d94576edeb015a911e0bea.tar.bz2 | |
Sandbox change. Remove inheritance of the duplicated tokens.
I don't think this is necessary at all and coult potentially leak tokens into other
child processes.
BUG=none
TEST=run chrome, verify renderers are sandboxed
Review URL: http://codereview.chromium.org/3386012
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@60136 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'sandbox')
| -rw-r--r-- | sandbox/src/restricted_token.cc | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/sandbox/src/restricted_token.cc b/sandbox/src/restricted_token.cc index ed6279b..bac8816 100644 --- a/sandbox/src/restricted_token.cc +++ b/sandbox/src/restricted_token.cc @@ -138,8 +138,8 @@ unsigned RestrictedToken::GetRestrictedTokenHandle(HANDLE *token_handle) const { ::GetCurrentProcess(), token_handle, TOKEN_ALL_ACCESS, - TRUE, // Inherit handle. - 0); // No options. + FALSE, // Don't inherit. + 0); if (new_token != effective_token_) ::CloseHandle(new_token); @@ -176,8 +176,8 @@ unsigned RestrictedToken::GetRestrictedTokenHandleForImpersonation( ::GetCurrentProcess(), token_handle, TOKEN_ALL_ACCESS, - TRUE, // Inherit handle. - 0); // No options. + FALSE, // Don't inherit. + 0); ::CloseHandle(impersonation_token); |