[Windows Sandbox] Remove temp emergency-off switch.

Remove "WinSboxForceMsSigned" feature off switch.  The mitigation has been on for
all sandboxed child processes since M62.

R: forshaw@chromium.org
BUG: 750886
Change-Id: I9ea899e512d16db110fe9da33fa2d50758c3da82
Reviewed-on: https://chromium-review.googlesource.com/972360
Commit-Queue: Penny MacNeil <pennymac@chromium.org>
Reviewed-by: James Forshaw <forshaw@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Cr-Commit-Position: refs/heads/master@{#546196}

services/service_manager/sandbox/features.cc

@@ -14,11 +14,6 @@ namespace features {
 // sandbox::MITIGATION_EXTENSION_POINT_DISABLE.
 const base::Feature kWinSboxDisableExtensionPoints{
     "WinSboxDisableExtensionPoint", base::FEATURE_ENABLED_BY_DEFAULT};
-
-// Emergency "off switch" for new Windows sandbox security mitigation,
-// sandbox::MITIGATION_FORCE_MS_SIGNED_BINS.
-const base::Feature kWinSboxForceMsSigned{"WinSboxForceMsSigned",
-                                          base::FEATURE_ENABLED_BY_DEFAULT};
 #endif  // defined(OS_WIN)
 
 }  // namespace features

services/service_manager/sandbox/features.h

@@ -18,7 +18,6 @@ namespace features {
 #if defined(OS_WIN)
 SERVICE_MANAGER_SANDBOX_EXPORT extern const base::Feature
     kWinSboxDisableExtensionPoints;
-SERVICE_MANAGER_SANDBOX_EXPORT extern const base::Feature kWinSboxForceMsSigned;
 #endif  // defined(OS_WIN)
 
 }  // namespace features

services/service_manager/sandbox/win/sandbox_win.cc

@@ -13,7 +13,6 @@
 #include "base/command_line.h"
 #include "base/debug/activity_tracker.h"
 #include "base/debug/profiler.h"
-#include "base/feature_list.h"
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/hash.h"
@@ -872,11 +871,9 @@ sandbox::ResultCode SandboxWin::StartSandboxedProcess(
   // Post-startup mitigations.
   mitigations = sandbox::MITIGATION_STRICT_HANDLE_CHECKS |
                 sandbox::MITIGATION_DLL_SEARCH_ORDER;
-  if (base::FeatureList::IsEnabled(
-          service_manager::features::kWinSboxForceMsSigned) &&
-      !cmd_line->HasSwitch(switches::kAllowThirdPartyModules)) {
+  if (!cmd_line->HasSwitch(switches::kAllowThirdPartyModules))
     mitigations |= sandbox::MITIGATION_FORCE_MS_SIGNED_BINS;
-  }
+
   result = policy->SetDelayedProcessMitigations(mitigations);
   if (result != sandbox::SBOX_ALL_OK)
     return result;