724ca7cc24
WebContent is about to stop using the broad GPU device sandbox allowance. That also removes the accidental permission for every ioctl, which exposes ordinary terminal attribute queries made while printing diagnostics. The media decode error path can ask stderr for TCGETS2 while reporting a corrupt video frame. Allow that narrow fd metadata query alongside TCGETS, FIONBIO, and FIONREAD so renderer processes can keep the GPU ioctl denial without crashing the media decode-error coverage. |
||
|---|---|---|
| .. | ||
| CMakeLists.txt | ||
| Sandbox.cpp | ||
| Sandbox.h | ||
| Seccomp.cpp | ||
| Seccomp.h | ||