# Policy to enable only production gpu ioctls.
is_flag_enabled(RELEASE_PIXEL_MALI_SEPOLICY_ENABLED, `
  # Allow gpu ioctls used in production.
  allowxperm appdomain gpu_device:chr_file ioctl { unpriv_gpu_ioctls instrumentation_gpu_ioctls };
  # Audit gpu ioctl commands which have been deprecated,
  # or are intended for development of the GPU.
  auditallow appdomain gpu_device:chr_file ioctl;
  allowxperm appdomain gpu_device:chr_file ioctl { debug_gpu_ioctls deprecated_gpu_ioctls };
  auditallowxperm appdomain gpu_device:chr_file ioctl { debug_gpu_ioctls deprecated_gpu_ioctls };
')
