allow surfaceflinger self:process execmem;
allow surfaceflinger ashmem_device:chr_file execute;
allow surfaceflinger gpu_device:chr_file { ioctl open read write map };
allow surfaceflinger self:vsock_socket create_socket_perms_no_ioctl;
allow surfaceflinger hal_graphics_allocator_default:vsock_socket { read write getattr };