When neither gpu.opengl nor gpu.vulkan is enabled (wayland-only cross-domain),
the gpu service no longer binds /dev/dri, /dev/udmabuf, /sys/dev/char,
/sys/devices, or /run/opengl-driver. GL-related environment variables
(LD_LIBRARY_PATH, LIBGL_DRIVERS_PATH, __EGL_VENDOR_LIBRARY_DIRS,
__GL_SHADER_DISK_CACHE_PATH) are omitted, MemoryDenyWriteExecute is
enforced regardless of allowWX, and DeviceAllow is empty. DevicePolicy
is now explicitly set to "closed" in all cases.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Davíð Steinn Geirsson
e59ad9722c