commit a2b408fc6673679c0b9b0a75ac2433261cc5f77b
author Will Harris <wfh@chromium.org> Wed Dec 08 22:40:14 2021
committer Copybara-Service <copybara-worker@google.com> Wed Dec 08 22:56:15 2021
tree 1a22287eaf135565b7def6320984da29f977290b
parent 67127c651d5484252c58fd54d0593b9d0ec5837b

Add ERROR log message for sandbox file system permissions issues.

This will be needed to be visible to downstream to be able to
diagnose configuration issues when the network service sandbox is
enabled.

BUG=841001

Change-Id: I4286905c6a5ff84555932c72406e589669cea44c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3323848
Reviewed-by: James Forshaw <forshaw@chromium.org>
Commit-Queue: Will Harris <wfh@chromium.org>
Cr-Commit-Position: refs/heads/main@{#949765}
NOKEYCHECK=True
GitOrigin-RevId: 3b7323e55a734d03f135ea1fe86264d32263ea2e

policy/win/sandbox_win.cc

diff --git a/policy/win/sandbox_win.cc b/policy/win/sandbox_win.cc
index ba68235..497d535 100644
--- a/policy/win/sandbox_win.cc
+++ b/policy/win/sandbox_win.cc
@@ -916,8 +916,11 @@
                              GENERIC_READ | GENERIC_EXECUTE, &granted_access,
                              &granted_access_status) &&
       granted_access_status;
-  if (!access_check)
+  if (!access_check) {
+    PLOG(ERROR) << "Sandbox cannot access executable. Check filesystem "
+                   "permissions are valid. See https://bit.ly/31yqMJR.";
     return SBOX_ERROR_CREATE_APPCONTAINER_ACCESS_CHECK;
+  }
 
   return SBOX_ALL_OK;
 }