diff --git a/app.te b/app.te
index fe0b25072c76057cf498c106aa44c3494c13fc3a..34f99e63f358933b2ff8127d415323fc867d4c43 100644
--- a/app.te
+++ b/app.te
@@ -74,6 +74,10 @@ allow appdomain qtaguid_proc:file rw_file_perms;
 # So allow all apps to read from /dev/xt_qtaguid.
 allow appdomain qtaguid_device:chr_file r_file_perms;
 
+# Grant GPU access to all processes started by Zygote.
+# They need that to render the standard UI.
+allow appdomain gpu_device:chr_file { rw_file_perms execute };
+
 # Use the Binder.
 binder_use(appdomain)
 # Perform binder IPC to binder services.
diff --git a/device.te b/device.te
index d13ca292de4b3d787f25779749c48f3f161f472a..5d3ba9c00158e39ecc9418632088751a9a771316 100644
--- a/device.te
+++ b/device.te
@@ -17,6 +17,8 @@ type console_device, dev_type;
 type cpuctl_device, dev_type;
 type fscklogs, dev_type;
 type full_device, dev_type;
+# GPU (used by most UI apps)
+type gpu_device, dev_type, mlstrustedobject;
 type graphics_device, dev_type;
 type hw_random_device, dev_type;
 type input_device, dev_type;
diff --git a/surfaceflinger.te b/surfaceflinger.te
index f0c5d8efde118f9d5d063e1a0b82e6a633571309..4f2838220181f92b3761dd4891491c341a4fa1a2 100644
--- a/surfaceflinger.te
+++ b/surfaceflinger.te
@@ -15,6 +15,9 @@ binder_call(surfaceflinger, system_server)
 binder_service(surfaceflinger)
 allow surfaceflinger init:binder transfer;
 
+# Access the GPU.
+allow surfaceflinger gpu_device:chr_file rw_file_perms;
+
 # Access /dev/graphics/fb0.
 allow surfaceflinger graphics_device:dir search;
 allow surfaceflinger graphics_device:chr_file rw_file_perms;
diff --git a/system_server.te b/system_server.te
index f603ea310babfc739dabb433c8a563c78c35c92f..2afafa6e1944b6f09d138f0d33b370f7e05943af 100644
--- a/system_server.te
+++ b/system_server.te
@@ -110,6 +110,7 @@ allow system_server sysfs_nfc_power_writable:file rw_file_perms;
 allow system_server device:dir r_dir_perms;
 allow system_server mdns_socket:sock_file rw_file_perms;
 allow system_server alarm_device:chr_file rw_file_perms;
+allow system_server gpu_device:chr_file rw_file_perms;
 allow system_server graphics_device:dir search;
 allow system_server graphics_device:chr_file rw_file_perms;
 allow system_server iio_device:chr_file rw_file_perms;