diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index b7d6b66..cb7eb22 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -163,6 +163,7 @@
     statscompanion_service
     storaged_data_file
     super_block_device
+    surfaceflinger_color_prop
     surfaceflinger_prop
     sysfs_fs_ext4_features
     system_boot_reason_prop
diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil
index 3fdb0b4..19cd7fb 100644
--- a/private/compat/27.0/27.0.ignore.cil
+++ b/private/compat/27.0/27.0.ignore.cil
@@ -149,6 +149,7 @@
     statsdw_socket
     storaged_data_file
     super_block_device
+    surfaceflinger_color_prop
     surfaceflinger_prop
     staging_data_file
     system_boot_reason_prop
diff --git a/private/compat/29.0/29.0.cil b/private/compat/29.0/29.0.cil
index 26a2d34..680d511 100644
--- a/private/compat/29.0/29.0.cil
+++ b/private/compat/29.0/29.0.cil
@@ -1201,7 +1201,9 @@
 (typeattributeset exported2_config_prop_29_0 (exported2_config_prop systemsound_config_prop))
 (typeattributeset exported2_default_prop_29_0 (exported2_default_prop))
 (typeattributeset exported2_radio_prop_29_0 (exported2_radio_prop))
-(typeattributeset exported2_system_prop_29_0 (exported2_system_prop))
+(typeattributeset exported2_system_prop_29_0
+  ( exported2_system_prop
+    surfaceflinger_color_prop))
 (typeattributeset exported2_vold_prop_29_0 (exported2_vold_prop vold_config_prop))
 (typeattributeset exported3_default_prop_29_0 (exported3_default_prop))
 (typeattributeset exported3_radio_prop_29_0 (exported3_radio_prop))
diff --git a/private/domain.te b/private/domain.te
index 5b6dd80..9eed3db 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -82,6 +82,7 @@
     get_prop(domain, exported3_default_prop)
     get_prop(domain, exported3_radio_prop)
     get_prop(domain, exported3_system_prop)
+    get_prop(domain, surfaceflinger_color_prop)
     get_prop(domain, systemsound_config_prop)
     get_prop(domain, vendor_default_prop)
     get_prop(domain, vold_config_prop)
@@ -98,6 +99,7 @@
     get_prop({coredomain appdomain shell}, exported3_radio_prop)
     get_prop({coredomain appdomain shell}, exported3_system_prop)
     get_prop({coredomain appdomain shell}, exported_camera_prop)
+    get_prop({coredomain appdomain shell}, surfaceflinger_color_prop)
     get_prop({coredomain appdomain shell}, systemsound_config_prop)
     get_prop({coredomain appdomain shell}, userspace_reboot_config_prop)
     get_prop({coredomain appdomain shell}, vold_config_prop)
diff --git a/private/property.te b/private/property.te
index 84651ef..d479502 100644
--- a/private/property.te
+++ b/private/property.te
@@ -331,3 +331,11 @@
 } {
   userspace_reboot_test_prop
 }:property_service set;
+
+neverallow {
+  -init
+  -system_server
+  -vendor_init
+} {
+  surfaceflinger_color_prop
+}:property_service set;
diff --git a/private/property_contexts b/private/property_contexts
index 640ae88..fd052aa 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -350,9 +350,6 @@
 persist.sys.dalvik.vm.lib.2     u:object_r:exported2_system_prop:s0 exact string
 persist.sys.media.avsync        u:object_r:exported2_system_prop:s0 exact bool
 persist.sys.hdmi.keep_awake     u:object_r:exported2_system_prop:s0 exact bool
-persist.sys.sf.color_mode       u:object_r:exported2_system_prop:s0 exact int
-persist.sys.sf.color_saturation u:object_r:exported2_system_prop:s0 exact string
-persist.sys.sf.native_mode      u:object_r:exported2_system_prop:s0 exact int
 
 pm.dexopt.ab-ota                        u:object_r:exported_pm_prop:s0 exact string
 pm.dexopt.bg-dexopt                     u:object_r:exported_pm_prop:s0 exact string
@@ -455,9 +452,6 @@
 
 ro.statsd.enable u:object_r:exported3_default_prop:s0 exact bool
 
-ro.sf.disable_triple_buffer u:object_r:exported3_default_prop:s0 exact bool
-ro.sf.lcd_density           u:object_r:exported3_default_prop:s0 exact int
-
 ro.storage_manager.enabled u:object_r:exported3_default_prop:s0 exact bool
 
 ro.telephony.call_ring.multiple u:object_r:exported3_default_prop:s0 exact bool
@@ -787,7 +781,7 @@
 
 sys.shutdown.requested u:object_r:exported_system_prop:s0 exact string
 
-# Using Sysprop as API. So the ro.surface_flinger.* are guaranteed to be API-stable
+# surfaceflinger properties
 ro.surface_flinger.default_composition_dataspace          u:object_r:surfaceflinger_prop:s0 exact int
 ro.surface_flinger.default_composition_pixel_format       u:object_r:surfaceflinger_prop:s0 exact int
 ro.surface_flinger.force_hwc_copy_for_virtual_displays    u:object_r:surfaceflinger_prop:s0 exact bool
@@ -822,6 +816,13 @@
 ro.surface_flinger.color_space_agnostic_dataspace         u:object_r:surfaceflinger_prop:s0 exact int
 ro.surface_flinger.refresh_rate_switching                 u:object_r:surfaceflinger_prop:s0 exact bool
 
+ro.sf.disable_triple_buffer u:object_r:surfaceflinger_prop:s0 exact bool
+ro.sf.lcd_density           u:object_r:surfaceflinger_prop:s0 exact int
+
+persist.sys.sf.color_mode       u:object_r:surfaceflinger_color_prop:s0 exact int
+persist.sys.sf.color_saturation u:object_r:surfaceflinger_color_prop:s0 exact string
+persist.sys.sf.native_mode      u:object_r:surfaceflinger_color_prop:s0 exact int
+
 # Binder cache properties.  These are world-readable
 cache_key.app_inactive                   u:object_r:binder_cache_system_server_prop:s0
 cache_key.is_compat_change_enabled       u:object_r:binder_cache_system_server_prop:s0
diff --git a/private/surfaceflinger.te b/private/surfaceflinger.te
index cf709df..973350e 100644
--- a/private/surfaceflinger.te
+++ b/private/surfaceflinger.te
@@ -54,7 +54,6 @@
 # Set properties.
 set_prop(surfaceflinger, system_prop)
 set_prop(surfaceflinger, exported_system_prop)
-set_prop(surfaceflinger, exported2_system_prop)
 set_prop(surfaceflinger, exported3_system_prop)
 set_prop(surfaceflinger, ctl_bootanim_prop)
 
diff --git a/private/system_server.te b/private/system_server.te
index 4fc507f..8cdbe90 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -621,6 +621,7 @@
 set_prop(system_server, socket_hook_prop)
 set_prop(system_server, audio_prop)
 set_prop(system_server, boot_status_prop)
+set_prop(system_server, surfaceflinger_color_prop)
 userdebug_or_eng(`set_prop(system_server, wifi_log_prop)')
 
 # ctl interface
diff --git a/public/property.te b/public/property.te
index 96866b3..d528778 100644
--- a/public/property.te
+++ b/public/property.te
@@ -152,6 +152,7 @@
 system_public_prop(powerctl_prop)
 system_public_prop(radio_prop)
 system_public_prop(serialno_prop)
+system_public_prop(surfaceflinger_color_prop)
 system_public_prop(system_prop)
 system_public_prop(wifi_log_prop)
 system_public_prop(wifi_prop)
diff --git a/public/vendor_init.te b/public/vendor_init.te
index d661d81..7406699 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -230,6 +230,7 @@
 set_prop(vendor_init, log_prop)
 set_prop(vendor_init, rebootescrow_hal_prop)
 set_prop(vendor_init, serialno_prop)
+set_prop(vendor_init, surfaceflinger_color_prop)
 set_prop(vendor_init, userspace_reboot_config_prop)
 set_prop(vendor_init, vehicle_hal_prop)
 set_prop(vendor_init, vendor_default_prop)