sandbox: whitelist V4L2 media device files

New V4L2 stateless video decoders depend on the request API in order to
submit jobs to the decoder. Requests are created from the media device
associated to a V4L2 decoder, so said devices need to be accessible by
the GPU process.

Whitelist /dev/media-dec* devices so that requests can be created and
stateless decoders used.

Bug:917279
Bug:b:123551776
Test: video decoding working on Kukui.

Change-Id: Ib98d890fb663399d610c0e99b1e4e96a6405c600
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1763272
Auto-Submit: Alexandre Courbot <acourbot@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Kenneth Russell <kbr@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Kenneth Russell <kbr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#689236}

content/gpu/gpu_sandbox_hook_linux.cc

@@ -105,11 +105,20 @@ void AddV4L2GpuWhitelist(
     static const base::FilePath::CharType kDevicePath[] =
         FILE_PATH_LITERAL("/dev/");
     static const base::FilePath::CharType kVideoDecPattern[] = "video-dec[0-9]";
-    base::FileEnumerator enumerator(base::FilePath(kDevicePath), false,
-                                    base::FileEnumerator::FILES,
-                                    base::FilePath(kVideoDecPattern).value());
-    for (base::FilePath name = enumerator.Next(); !name.empty();
-         name = enumerator.Next())
+    base::FileEnumerator video_enumerator(
+        base::FilePath(kDevicePath), false, base::FileEnumerator::FILES,
+        base::FilePath(kVideoDecPattern).value());
+    for (base::FilePath name = video_enumerator.Next(); !name.empty();
+         name = video_enumerator.Next())
+      permissions->push_back(BrokerFilePermission::ReadWrite(name.value()));
+
+    // Device nodes for V4L2 media devices (for request API and camera)
+    static const base::FilePath::CharType kMediaDecPattern[] = "media-dec[0-9]";
+    base::FileEnumerator media_enumerator(
+        base::FilePath(kDevicePath), false, base::FileEnumerator::FILES,
+        base::FilePath(kMediaDecPattern).value());
+    for (base::FilePath name = media_enumerator.Next(); !name.empty();
+         name = media_enumerator.Next())
       permissions->push_back(BrokerFilePermission::ReadWrite(name.value()));
   }