Surface EnableCsrssLockdown on chrome://sandbox

Moves the variable backing 'EnableCsrssLockdown' to
sandbox/policy/features.h and exposes it on chrome://sandbox.
The variable is also renamed to remove the redundant 'Feature'
suffix.

The feature's exposed name is not changed so fieldtrials and
commandlines using it are not affected.

Bug: 40408399
Change-Id: I94cb8d8802e81ceaef0369c35c1bcc633d9fcf17
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6091995
Auto-Submit: Alex Gough <ajgo@chromium.org>
Reviewed-by: Will Harris <wfh@chromium.org>
Commit-Queue: Alex Gough <ajgo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1395801}

chrome/browser/ui/webui/sandbox/sandbox_handler.cc

@@ -91,6 +91,8 @@ base::Value::List FetchSandboxFeatures() {
       FeatureToValue(sandbox::policy::features::kWinSboxNoFakeGdiInit));
   features.Append(FeatureToValue(
       sandbox::policy::features::kWinSboxRestrictCoreSharingOnRenderer));
+  features.Append(
+      FeatureToValue(sandbox::policy::features::kEnableCsrssLockdown));
   return features;
 }
 

sandbox/policy/features.cc

@@ -111,6 +111,12 @@ BASE_FEATURE(kWinSboxRestrictCoreSharingOnRenderer,
 BASE_FEATURE(kWinSboxParallelProcessLaunch,
              "WinSboxParallelProcessLaunch",
              base::FEATURE_DISABLED_BY_DEFAULT);
+
+// Enables Csrss lockdown in supported processes by closing all ALPC
+// ports before sandbox lockdown. See crbug.com/40408399 for details.
+BASE_FEATURE(kEnableCsrssLockdown,
+             "EnableCsrssLockdown",
+             base::FEATURE_DISABLED_BY_DEFAULT);
 #endif  // BUILDFLAG(IS_WIN)
 
 #if BUILDFLAG(IS_CHROMEOS_ASH)

sandbox/policy/features.h

@@ -37,6 +37,7 @@ SANDBOX_POLICY_EXPORT BASE_DECLARE_FEATURE(kWinSboxNoFakeGdiInit);
 SANDBOX_POLICY_EXPORT BASE_DECLARE_FEATURE(
     kWinSboxRestrictCoreSharingOnRenderer);
 SANDBOX_POLICY_EXPORT BASE_DECLARE_FEATURE(kWinSboxParallelProcessLaunch);
+SANDBOX_POLICY_EXPORT BASE_DECLARE_FEATURE(kEnableCsrssLockdown);
 #endif  // BUILDFLAG(IS_WIN)
 
 #if BUILDFLAG(IS_CHROMEOS_ASH)

sandbox/policy/win/sandbox_win.cc

@@ -92,11 +92,6 @@ const wchar_t* const kTroublesomeDlls[] = {
     L"rpchromebrowserrecordhelper.dll",    // RealPlayer.
 };
 
-// This is for finch. See also crbug.com/464430 for details.
-BASE_FEATURE(kEnableCsrssLockdownFeature,
-             "EnableCsrssLockdown",
-             base::FEATURE_DISABLED_BY_DEFAULT);
-
 // Return a mapping between the long and short names for all loaded modules in
 // the current process. The mapping excludes modules which don't have a typical
 // short name, e.g. EXAMPL~1.DLL.
@@ -690,7 +685,7 @@ ResultCode SandboxWin::SetJobLevel(Sandbox sandbox_type,
 void SandboxWin::AddBaseHandleClosePolicy(TargetConfig* config) {
   DCHECK(!config->IsConfigured());
 
-  if (base::FeatureList::IsEnabled(kEnableCsrssLockdownFeature)) {
+  if (base::FeatureList::IsEnabled(features::kEnableCsrssLockdown)) {
     // Close all ALPC ports.
     config->SetDisconnectCsrss();
   }