diff --git a/BoardConfigCommon.mk b/BoardConfigCommon.mk
index 1c19545..f4bd99c 100755
--- a/BoardConfigCommon.mk
+++ b/BoardConfigCommon.mk
@@ -102,6 +102,10 @@
 
 # The list below is order dependent
 BOARD_SEPOLICY_UNION += \
+        app.te \
+        device.te \
         rmt.te \
         ueventd.te \
+        surfaceflinger.te \
+        system_server.te \
         file_contexts
diff --git a/sepolicy/app.te b/sepolicy/app.te
new file mode 100644
index 0000000..eb71391
--- /dev/null
+++ b/sepolicy/app.te
@@ -0,0 +1,3 @@
+# Grant GPU access to all processes started by Zygote.
+# They need that to render the standard UI.
+allow appdomain gpu_device:chr_file rw_file_perms;
diff --git a/sepolicy/device.te b/sepolicy/device.te
new file mode 100644
index 0000000..f29322b
--- /dev/null
+++ b/sepolicy/device.te
@@ -0,0 +1,2 @@
+# GPU (used by most UI apps)
+type gpu_device, dev_type;
diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index 4de259d..fad561b 100644
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -1,6 +1,10 @@
 # Used by keystore to access trustzone
 /dev/qseecom        u:object_r:tee_device:s0
 
+###### GPU device (world r/w)
+/dev/kgsl-3d0       u:object_r:gpu_device:s0
+/dev/kgsl           u:object_r:gpu_device:s0
+
 # rmt_storage is a qualcomm specific daemon responsible
 # for servicing modem filesystem requests.
 /system/bin/rmt_storage            u:object_r:rmt_exec:s0
diff --git a/sepolicy/surfaceflinger.te b/sepolicy/surfaceflinger.te
new file mode 100644
index 0000000..8430fe1
--- /dev/null
+++ b/sepolicy/surfaceflinger.te
@@ -0,0 +1,2 @@
+# Grant GPU access to SurfaceFlinger
+allow surfaceflinger gpu_device:chr_file rw_file_perms;
diff --git a/sepolicy/system_server.te b/sepolicy/system_server.te
new file mode 100644
index 0000000..c100803
--- /dev/null
+++ b/sepolicy/system_server.te
@@ -0,0 +1,2 @@
+# Grant GPU access to system services (e.g., PowerManagerService)
+allow system_server gpu_device:chr_file rw_file_perms;