[Ozone] VAAPI wrapper should open its own render node.

content/common/sandbox_linux/bpf_gpu_policy_linux.cc

Index: content/common/sandbox_linux/bpf_gpu_policy_linux.cc
diff --git a/content/common/sandbox_linux/bpf_gpu_policy_linux.cc b/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
index f47e703dd400a2767fc2fe96279d6c9b7a8d519c..fe9a8340c74be7d010bb9a429a255140d5e68048 100644
--- a/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
+++ b/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
@@ -321,6 +321,7 @@ void GpuProcessPolicy::InitGpuBrokerProcess(
     const std::vector<BrokerFilePermission>& permissions_extra) {
   static const char kDriRcPath[] = "/etc/drirc";
   static const char kDriCard0Path[] = "/dev/dri/card0";
+  static const char kDriRenderNode0Path[] = "/dev/dri/renderD128";
   static const char kDevShm[] = "/dev/shm/";
 
   CHECK(broker_process_ == NULL);
@@ -328,6 +329,7 @@ void GpuProcessPolicy::InitGpuBrokerProcess(
   // All GPU process policies need these files brokered out.
   std::vector<BrokerFilePermission> permissions;
   permissions.push_back(BrokerFilePermission::ReadWrite(kDriCard0Path));
+  permissions.push_back(BrokerFilePermission::ReadWrite(kDriRenderNode0Path));
   permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath));
   if (!IsChromeOS()) {
     permissions.push_back(