From 791d7b4fedb768bb0beb36cae928486ba34cf245 Mon Sep 17 00:00:00 2001 From: Bob Owen Date: Fri, 19 Jun 2015 23:35:43 +0100 Subject: [PATCH] Bug 1172388: Use a USER_RESTRICTED access level token on Windows 10. r=cpearce --- .../sandbox/win/src/sandboxbroker/sandboxBroker.cpp | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp b/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp index 3ed28d6d4aa..30eb8ec0a48 100644 --- a/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp +++ b/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp @@ -5,6 +5,8 @@ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ #include "sandboxBroker.h" + +#include "base/win/windows_version.h" #include "sandbox/win/src/sandbox.h" #include "sandbox/win/src/sandbox_factory.h" #include "sandbox/win/src/security_level.h" @@ -293,9 +295,13 @@ SandboxBroker::SetSecurityLevelForGMPlugin() auto result = mPolicy->SetJobLevel(sandbox::JOB_LOCKDOWN, 0); bool ret = (sandbox::SBOX_ALL_OK == result); - result = - mPolicy->SetTokenLevel(sandbox::USER_RESTRICTED_SAME_ACCESS, - sandbox::USER_LOCKDOWN); + if (base::win::GetVersion() > base::win::VERSION_WIN8_1) { + result = mPolicy->SetTokenLevel(sandbox::USER_RESTRICTED_SAME_ACCESS, + sandbox::USER_RESTRICTED); + } else { + result = mPolicy->SetTokenLevel(sandbox::USER_RESTRICTED_SAME_ACCESS, + sandbox::USER_LOCKDOWN); + } ret = ret && (sandbox::SBOX_ALL_OK == result); result = mPolicy->SetAlternateDesktop(true);