Remove /dev/dri/card0 from sandbox whitelist

content/common/sandbox_linux/bpf_gpu_policy_linux.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/sandbox_linux/bpf_gpu_policy_linux.h"
 
 #include <dlfcn.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <sys/socket.h>
@@ skipping 319 matching lines @@
     }
   }
 
   return true;
 }
 
 void GpuProcessPolicy::InitGpuBrokerProcess(
     sandbox::bpf_dsl::Policy* (*broker_sandboxer_allocator)(void),
     const std::vector<BrokerFilePermission>& permissions_extra) {
   static const char kDriRcPath[] = "/etc/drirc";
-  static const char kDriCard0Path[] = "/dev/dri/card0";
   static const char kDriCardBasePath[] = "/dev/dri/card";
 
   static const char kNvidiaCtlPath[] = "/dev/nvidiactl";
   static const char kNvidiaDeviceBasePath[] = "/dev/nvidia";
   static const char kNvidiaParamsPath[] = "/proc/driver/nvidia/params";
 
   static const char kDevShm[] = "/dev/shm/";
 
   CHECK(broker_process_ == NULL);
 
   // All GPU process policies need these files brokered out.
   std::vector<BrokerFilePermission> permissions;
-  permissions.push_back(BrokerFilePermission::ReadWrite(kDriCard0Path));
   permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath));
 
   if (!IsChromeOS()) {
     // For shared memory.
     permissions.push_back(
         BrokerFilePermission::ReadWriteCreateUnlinkRecursive(kDevShm));
     // For multi-card DRI setups. NOTE: /dev/dri/card0 was already added above.

[Jorge Lucangeli Obes (Google), 2017/05/16 14:40:06]

Remove NOTE, and change comment since this will cover single-card setups too.

[dnicoara, 2017/05/16 16:14:41]

Done. Ahh, I can't believe I didn't spot it. Thank you!

-    for (int i = 1; i <= 9; ++i) {
+    for (int i = 0; i <= 9; ++i) {
       permissions.push_back(BrokerFilePermission::ReadWrite(
           base::StringPrintf("%s%d", kDriCardBasePath, i)));
     }
     // For Nvidia GLX driver.
     permissions.push_back(BrokerFilePermission::ReadWrite(kNvidiaCtlPath));
     for (int i = 0; i <= 9; ++i) {
       permissions.push_back(BrokerFilePermission::ReadWrite(
           base::StringPrintf("%s%d", kNvidiaDeviceBasePath, i)));
     }
     permissions.push_back(BrokerFilePermission::ReadOnly(kNvidiaParamsPath));
@@ skipping 13 matching lines @@
   }
 
   broker_process_ = new BrokerProcess(GetFSDeniedErrno(), permissions);
   // The initialization callback will perform generic initialization and then
   // call broker_sandboxer_callback.
   CHECK(broker_process_->Init(base::Bind(&UpdateProcessTypeAndEnableSandbox,
                                          broker_sandboxer_allocator)));
 }
 
 }  // namespace content