From d3ad14be0cab02da57d1a030d3fa56c7f851e5af Mon Sep 17 00:00:00 2001
From: Hirokazu Honda <hiroh@chromium.org>
Date: Mon, 25 May 2026 22:31:17 -0700
Subject: [PATCH] media/gpu/sandbox: Allow reading GPU device info in hardware video decoding sandbox

libdrm and graphics drivers query specific sysfs files inside the
sandbox (e.g. during vaInitialize) to identify the GPU and select/
configure the correct driver.

This CL explicitly whitelists these files in the sandbox hook:
- vendor
- device
- revision
- subsystem_vendor
- subsystem_device
- subsystem
- uevent
- drm

Additionally, allow the READLINK broker command, as libdrm calls
readlink on the 'subsystem' symlink to determine the bus type.

Bug: 501888426
Test: video.Play.* on chromeos
Change-Id: I2e5cf3088ed91ac094a31ac3f3f8e0b6af69a793
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7873665
Commit-Queue: Hirokazu Honda <hiroh@chromium.org>
Reviewed-by: Elly <ellyjones@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1635936}
---

diff --git a/media/gpu/sandbox/hardware_video_decoding_sandbox_hook_linux.cc b/media/gpu/sandbox/hardware_video_decoding_sandbox_hook_linux.cc
index 3ca9f767..58a9b95 100644
--- a/media/gpu/sandbox/hardware_video_decoding_sandbox_hook_linux.cc
+++ b/media/gpu/sandbox/hardware_video_decoding_sandbox_hook_linux.cc
@@ -53,6 +53,27 @@
             BrokerFilePermission::ReadOnly(char_device_path + "/uevent"));
         permissions.push_back(
             BrokerFilePermission::ReadOnly(char_device_path + "/dev"));
+
+        // libdrm and graphics drivers query these specific sysfs files inside
+        // the sandbox (e.g. during vaInitialize) to identify the GPU and
+        // select/configure the correct driver. We whitelist them explicitly
+        // to avoid granting recursive read access to the whole device
+        // directory. Note: 'config' is omitted because 'revision' exists on
+        // target devices.
+        std::string device_path = char_device_path + "/device/";
+        for (const char* file : {
+                 "vendor",
+                 "device",
+                 "revision",
+                 "subsystem_vendor",
+                 "subsystem_device",
+                 "subsystem",
+                 "uevent",
+                 "drm",
+             }) {
+          permissions.push_back(
+              BrokerFilePermission::ReadOnly(device_path + file));
+        }
       }
     }
   }
@@ -85,6 +106,9 @@
   // TODO(b/210759684): we probably will need to do this for Linux as well.
   command_set.set(sandbox::syscall_broker::COMMAND_ACCESS);
 
+  // libdrm calls readlink on the 'subsystem' symlink to determine the bus type.
+  command_set.set(sandbox::syscall_broker::COMMAND_READLINK);
+
   AllowAccessToRenderNodes(permissions, /*include_sys_dev_char=*/true,
                            /*read_write=*/false);
 #endif  // BUILDFLAG(IS_CHROMEOS)