Allow GPU access inside of landlock sandbox

[etraut-openai]

This PR extends the landlock sandbox policy to allow access to GPU device paths.

This addresses #3141

[etraut-openai]

@codex review

[chatgpt-codex-connector[bot]]

Codex Review: Didn't find any major issues. Keep it up!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[bolinfest]

@per-mathisen-arm I don't know that making all of these /dev entries read-write by default is appropriate for our users.

Does the following work if you add this to your ~/.codex/config.toml?

[sandbox_workspace_write]
writable_roots = [
    "/dev/dri",
    "/dev/kfd",
    # Not sure what these are on your system:
    "/dev/nvidia0",
]

[bolinfest]

Oh, whoops, I directed my comment at @per-mathisen-arm though I see @etraut-openai is the author!

[etraut-openai]

I'm going to close this PR for now. This feature requires additional thought from a security perspective.