auditallow gpu_device execute access
This permission appears to be unnecessary on some (most?) devices such
as the Nexus 5. It should be moved to the device policy if it's truly
required by the driver.
Change-Id: I531dc82ba9030b805db2b596e145be2afb324492
diff --git a/app.te b/app.te
index 583495e..9431fd1 100644
--- a/app.te
+++ b/app.te
@@ -108,6 +108,7 @@
# Grant GPU access to all processes started by Zygote.
# They need that to render the standard UI.
allow { appdomain -isolated_app } gpu_device:chr_file { rw_file_perms execute };
+auditallow { appdomain -isolated_app } gpu_device:chr_file execute;
# Use the Binder.
binder_use(appdomain)