Remove /dev/dri/card0 from sandbox whitelist

content/common/sandbox_linux/bpf_gpu_policy_linux.cc

Index: content/common/sandbox_linux/bpf_gpu_policy_linux.cc
diff --git a/content/common/sandbox_linux/bpf_gpu_policy_linux.cc b/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
index daace41ca7b5f0ffe48974dc3c649d7c1db7a355..0691ef266cb224877502a32475773835db6b8aa0 100644
--- a/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
+++ b/content/common/sandbox_linux/bpf_gpu_policy_linux.cc
@@ -337,7 +337,6 @@ void GpuProcessPolicy::InitGpuBrokerProcess(
     sandbox::bpf_dsl::Policy* (*broker_sandboxer_allocator)(void),
     const std::vector<BrokerFilePermission>& permissions_extra) {
   static const char kDriRcPath[] = "/etc/drirc";
-  static const char kDriCard0Path[] = "/dev/dri/card0";
   static const char kDriCardBasePath[] = "/dev/dri/card";
 
   static const char kNvidiaCtlPath[] = "/dev/nvidiactl";
@@ -350,7 +349,6 @@ void GpuProcessPolicy::InitGpuBrokerProcess(
 
   // All GPU process policies need these files brokered out.
   std::vector<BrokerFilePermission> permissions;
-  permissions.push_back(BrokerFilePermission::ReadWrite(kDriCard0Path));
   permissions.push_back(BrokerFilePermission::ReadOnly(kDriRcPath));
 
   if (!IsChromeOS()) {
@@ -358,7 +356,7 @@ void GpuProcessPolicy::InitGpuBrokerProcess(
     permissions.push_back(
         BrokerFilePermission::ReadWriteCreateUnlinkRecursive(kDevShm));
     // For multi-card DRI setups. NOTE: /dev/dri/card0 was already added above.

[Jorge Lucangeli Obes (Google), 2017/05/16 14:40:06]

Remove NOTE, and change comment since this will cover single-card setups too.

[dnicoara, 2017/05/16 16:14:41]

Done. Ahh, I can't believe I didn't spot it. Thank you!

-    for (int i = 1; i <= 9; ++i) {
+    for (int i = 0; i <= 9; ++i) {
       permissions.push_back(BrokerFilePermission::ReadWrite(
           base::StringPrintf("%s%d", kDriCardBasePath, i)));
     }