sepolicy/common/system_server.te

allow system_server self:vsock_socket create_socket_perms_no_ioctl;
allow system_server hal_graphics_allocator_default:vsock_socket { read write getattr };