sandbox: Extend BrokerPolicy to support file creation

content/common/sandbox_linux/bpf_gpu_policy_linux.h

Index: content/common/sandbox_linux/bpf_gpu_policy_linux.h
diff --git a/content/common/sandbox_linux/bpf_gpu_policy_linux.h b/content/common/sandbox_linux/bpf_gpu_policy_linux.h
index 3b60ffe66fbe16021c3a871f2888e941127ec7e7..cc66c5bc96f8768a4eeff4e622c6a34348ebd3a9 100644
--- a/content/common/sandbox_linux/bpf_gpu_policy_linux.h
+++ b/content/common/sandbox_linux/bpf_gpu_policy_linux.h
@@ -13,6 +13,7 @@
 
 namespace sandbox {
 namespace syscall_broker {
+class BrokerFilePermission;
 class BrokerProcess;
 }
 }
@@ -34,13 +35,13 @@ class GpuProcessPolicy : public SandboxBPFBasePolicy {
   // Start a broker process to handle open() inside the sandbox.
   // |broker_sandboxer_allocator| is a function pointer which can allocate a
   // suitable sandbox policy for the broker process itself.
-  // |read_whitelist_extra| and |write_whitelist_extra| are lists of file
-  // names that should be whitelisted by the broker process, in addition to
+  // |permissions_extra| is a list of file permissions
+  // that should be whitelisted by the broker process, in addition to
   // the basic ones.
   void InitGpuBrokerProcess(
       sandbox::bpf_dsl::Policy* (*broker_sandboxer_allocator)(void),
-      const std::vector<std::string>& read_whitelist_extra,
-      const std::vector<std::string>& write_whitelist_extra);
+      const std::vector<sandbox::syscall_broker::BrokerFilePermission>&
+          permissions_extra);
 
   sandbox::syscall_broker::BrokerProcess* broker_process() {
     return broker_process_;