1 allow surfaceflinger self:process execmem; 2 3 # Read GCE initial metadata file 4 allow surfaceflinger initial_metadata_file:file r_file_perms; 5