allow mediadrmserver ion_device:chr_file { open read ioctl };
allow mediadrmserver vendor_file:file { open read getattr execute };
allow mediadrmserver vendor_file:dir { read };