diff --git a/mediaserver.te b/mediaserver.te
index ab978fa90a1c1bba4b6ad9a265d29f0087e383d8..ad7cdcb467da9ca2a49579540363c22bf0e4261b 100644
--- a/mediaserver.te
+++ b/mediaserver.te
@@ -24,7 +24,7 @@ allow mediaserver app_data_file:dir search;
 allow mediaserver app_data_file:file rw_file_perms;
 allow mediaserver platform_app_data_file:file { getattr read };
 allow mediaserver sdcard_type:file write;
-allow mediaserver graphics_device:chr_file rw_file_perms;
+allow mediaserver { gpu_device graphics_device }:chr_file rw_file_perms;
 allow mediaserver video_device:dir r_dir_perms;
 allow mediaserver video_device:chr_file rw_file_perms;
 allow mediaserver audio_device:dir r_dir_perms;
diff --git a/surfaceflinger.te b/surfaceflinger.te
index 9c58afafc6b186c527d2d25005846d25de9a4398..2a3087b6f9f6648272c5f31a26868c68f6149bf1 100644
--- a/surfaceflinger.te
+++ b/surfaceflinger.te
@@ -13,6 +13,7 @@ unix_socket_connect(surfaceflinger, property, init)
 binder_use(surfaceflinger)
 binder_call(surfaceflinger, system_server)
 binder_call(surfaceflinger, nfc)
+binder_call(surfaceflinger, mediaserver)
 binder_service(surfaceflinger)
 
 # Access the GPU.