commit 5cb6a47ab9373d5e833d448eb73617ecdd379d84
author Will Harris <wfh@chromium.org> Sat Feb 25 01:56:14 2023
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Sat Feb 25 01:56:14 2023
tree d12395422cbb143c83ed13c69f241a68aa1a96ad
parent d5083ae61b2b4e5db108e22aaec322c2b7cc72bf

Refactor logic determining untrusted mojo invitation flag.

Renderer processes use the MOJO_SEND_INVITATION_FLAG_UNTRUSTED_PROCESS
flag on their mojo invitation to ensure security constraints related to
Windows handles are respected by mojo.

Before this CL, this flag was being set in the renderer process host
code unconditionally, on all platforms.

This CL moves the decision on whether or not to set this flag to the
SandboxedProcessLauncherDelegate implementation specific to the
sandboxed process.

This allows more flexibility going forward about applying this
mitigation to more sandboxed process types.

This CL makes no functional changes as the same flag is just being
set in a different place, and still only for renderers, but now just
on Windows.

This CL also contains some cleanups for header files to specify
which interface is being implemented by which class, as well as
passing a const ref base::CommandLine to the Windows sandboxed
process launcher delegate to make it clear that it does not
modify the command line in the constructor.

BUG=1419544

Change-Id: I1df21dc0663a6cf541ab85fb08e66484b8155e96
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4291989
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Commit-Queue: Will Harris <wfh@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1109927}