From f6f68ece4404e9e407ad5e3347b4d424b7703c57 Mon Sep 17 00:00:00 2001
From: Aliaksandr Kalenik <kalenik.aliaksandr@gmail.com>
Date: Thu, 18 Jun 2026 09:15:23 +0200
Subject: [PATCH] Services: Deny GPU operations in WebContent

WebContent no longer creates a GPU-backed Skia context, so its Linux
sandbox does not need the broad GPU device syscall allowance. Remove
allow_gpu_device_operations() from the renderer policy while keeping the
narrower file descriptor ioctl allowances used by IPC transport setup.
---
 Services/RendererSandboxLinux.cpp | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Services/RendererSandboxLinux.cpp b/Services/RendererSandboxLinux.cpp
index ce8e3a059d..304da79fb1 100644
--- a/Services/RendererSandboxLinux.cpp
+++ b/Services/RendererSandboxLinux.cpp
@@ -57,7 +57,6 @@ ErrorOr<void> apply_sandbox(Optional<StringView> config_path)
     policy.allow_file_descriptor_operations();
     policy.allow_process_creation();
     policy.allow_ipc();
-    policy.allow_gpu_device_operations();
     policy.allow_common_runtime();
     policy.allow_executable_memory_mappings();
     TRY(policy.install());