diff --git a/private/fwk_bufferhub.te b/private/fwk_bufferhub.te
index fe84317..6b69cca 100644
--- a/private/fwk_bufferhub.te
+++ b/private/fwk_bufferhub.te
@@ -1,5 +1,8 @@
 type fwk_bufferhub, domain, coredomain;
 type fwk_bufferhub_exec, system_file_type, exec_type, file_type;
 
+hal_client_domain(fwk_bufferhub, hal_graphics_allocator)
+allow fwk_bufferhub ion_device:chr_file r_file_perms;
+
 hal_server_domain(fwk_bufferhub, hal_bufferhub)
 init_daemon_domain(fwk_bufferhub)