diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
new file mode 100644
index 0000000..9c73aa4
--- /dev/null
+++ b/sepolicy/file_contexts
@@ -0,0 +1 @@
+/system/bin/vncflinger   u:object_r:vncflinger_exec:s0
diff --git a/sepolicy/vncflinger.te b/sepolicy/vncflinger.te
new file mode 100644
index 0000000..21213e0
--- /dev/null
+++ b/sepolicy/vncflinger.te
@@ -0,0 +1,17 @@
+type vncflinger_exec, exec_type, file_type;
+type vncflinger, domain;
+
+init_daemon_domain(vncflinger)
+binder_use(vncflinger)
+net_domain(vncflinger);
+
+# uinput
+allow vncflinger uhid_device:chr_file rw_file_perms;
+
+# read buffers from surfaceflinger
+allow vncflinger ion_device:chr_file r_file_perms;
+allow vncflinger surfaceflinger_service:service_manager find;
+binder_call(vncflinger, surfaceflinger);
+
+# buffer callbacks
+binder_call(surfaceflinger, vncflinger);