[Bug 52845] Recent versions of chromium have broken sandbox again

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=52845

--- Comment #3 from Fabian Maurer  ---
To be exact, what breaks it is the changes to RevokeLogonSidFromDefaultDacl,
see
https://github.com/chromium/chromium/commit/158c5fad3ef830e95f1eedb702878697...

Take the following code:
> absl::optionalbase::win::Sid logon_sid = query_token->LogonId();
> if (!logon_sid)
>   return ::GetLastError() == ERROR_NOT_FOUND;

if calls into
> absl::optional<Sid> AccessToken::LogonId() const {
> std::vectorAccessToken::Group groups =
>     GetGroupsFromToken(token_.Get(), TokenLogonSid);
> for (const AccessToken::Group& group : groups) {
>   if (group.IsLogonId())
>     return group.GetSid().Clone();
> }
>  return absl::nullopt;

using
> bool AccessToken::Group::IsLogonId() const {
>  return (attributes_ & SE_GROUP_LOGON_ID) == SE_GROUP_LOGON_ID;
> }

In short, chromium expects one group of the token to belong to the logon group.
If that's not the case, it errors out.

Sending in a patch soon.