Add libvulkan.so read permission to GPU sandbox
Under the hood, WebGPU on Chrome OS uses Vulkan to fulfill WebGPU
API calls. Thus, as part of initialization, Dawn (Chrome's WebGPU
implementation) needs to initialize Vulkan [1]. The library is
lazily loaded when Chrome first encounters a WebGPU canvas, well
after the GPU sandbox has started, so this CL adds a read permission
on libvulkan.so.1.
[1] https://source.chromium.org/chromium/chromium/src/+/main:third_party/dawn/src/dawn_native/vulkan/BackendVk.cpp;l=130;drc=0d99d5d1985df1f0788ccdaa43b34e8d248bf2c1
BUG=b:172208313
Change-Id: I0c8531acdd30949523cf9a3732b00334d6f429f5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3053493
Reviewed-by: Robert Sesek <rsesek@chromium.org>
Reviewed-by: Zhenyao Mo <zmo@chromium.org>
Commit-Queue: Brian Ho <hob@chromium.org>
Cr-Commit-Position: refs/heads/master@{#905401}
ce29888460