Grant GPU access to mediaswcodec
... which will be needed for Cuttlefish with Minigbm
Gralloc 4.
Bug: b/146515640
Test: launch_cvd
Test: launch_cvd --gpu_mode=drm_virgl
Change-Id: Iaacebd15149eb3f07c6a6b4c258a54cf658d4217
diff --git a/shared/sepolicy/vendor/mediaswcodec.te b/shared/sepolicy/vendor/mediaswcodec.te
new file mode 100644
index 0000000..ff9c5b5
--- /dev/null
+++ b/shared/sepolicy/vendor/mediaswcodec.te
@@ -0,0 +1 @@
+gpu_access(mediaswcodec)
diff --git a/shared/sepolicy/vendor/te_macros b/shared/sepolicy/vendor/te_macros
index d49e378..c4f26eb 100644
--- a/shared/sepolicy/vendor/te_macros
+++ b/shared/sepolicy/vendor/te_macros
@@ -3,7 +3,7 @@
# Allow client_domain to communicate with the virgl GPU
define(`gpu_access', `
allow $1 gpu_device:dir { open read search };
-allow $1 gpu_device:chr_file { getattr read write };
+allow $1 gpu_device:chr_file { getattr ioctl map open read write };
allow $1 graphics_device:chr_file { getattr };
allow $1 sysfs_gpu:file { getattr open read };
')