userdebug_or_eng(`
  allow hal_graphics_composer_default diag_device:chr_file rw_file_perms;
')

# misc
allow hal_graphics_composer_default display_data_file:dir create_dir_perms;
allow hal_graphics_composer_default display_data_file:file create_file_perms;

# persist
allow hal_graphics_composer_default persist_file:dir search;

# persist/display
allow hal_graphics_composer_default persist_display_file:dir r_dir_perms;
allow hal_graphics_composer_default persist_display_file:file create_file_perms;

# Binder access (for display.qservice)
# TODO(35706331): Remove once Graphics Composer HAL stops using Binder
typeattribute hal_graphics_composer_default binder_in_vendor_violators;
binder_service(hal_graphics_composer_default)
binder_use(hal_graphics_composer_default)
allow hal_graphics_composer_default surfaceflinger_service:service_manager { add find };

# HWC_UeventThread
allow hal_graphics_composer_default self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;

# Access /sys/devices/virtual/graphics/fb0/mdp/caps and maybe others
r_dir_file(hal_graphics_composer_default, sysfs_type)