Add sandbox support (issue #524).

- The sandbox is now enabled by default on all platforms. Use the CefSettings.no_sandbox option or the "no-sandbox" command-line flag to disable sandbox support.
- Windows: See cef_sandbox_win.h for requirements to enable sandbox support.
- Windows: If Visual Studio isn't installed in the standard location set the CEF_VCVARS environment variable before running make_distrib.py or automate.py (see msvs_env.bat).
- Linux: For binary distributions a new chrome-sandbox executable with SUID permissions must be placed next to the CEF executable. See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for details on setting up the development environment when building CEF from source code.

git-svn-id: https://chromiumembedded.googlecode.com/svn/trunk@1518 5089003a-bbd8-11dd-ad1f-f1f9622dbc98

libcef_dll/sandbox/sandbox_win.cc

@@ -0,0 +1,36 @@
+// Copyright 2013 The Chromium Embedded Framework Authors. Portions Copyright
+// 2011 the Chromium Authors. All rights reserved. Use of this source code is
+// governed by a BSD-style license that can be found in the LICENSE file.
+
+#include "include/cef_sandbox_win.h"
+
+#include "sandbox/win/src/process_mitigations.h"
+#include "sandbox/win/src/sandbox_factory.h"
+
+namespace {
+
+// From content/app/startup_helper_win.cc:
+void InitializeSandboxInfo(sandbox::SandboxInterfaceInfo* info) {
+  info->broker_services = sandbox::SandboxFactory::GetBrokerServices();
+  if (!info->broker_services) {
+    info->target_services = sandbox::SandboxFactory::GetTargetServices();
+  } else {
+    // Ensure the proper mitigations are enforced for the browser process.
+    sandbox::ApplyProcessMitigationsToCurrentProcess(
+        sandbox::MITIGATION_DEP |
+        sandbox::MITIGATION_DEP_NO_ATL_THUNK);
+  }
+}
+
+}  // namespace
+
+void* cef_sandbox_info_create() {
+  sandbox::SandboxInterfaceInfo* info = new sandbox::SandboxInterfaceInfo();
+  memset(info, 0, sizeof(sandbox::SandboxInterfaceInfo));
+  InitializeSandboxInfo(info);
+  return info;
+}
+
+void cef_sandbox_info_destroy(void* sandbox_info) {
+  delete static_cast<sandbox::SandboxInterfaceInfo*>(sandbox_info);
+}