allow system_server system_server process execmem
allow system_server system_server memprotect mmap_zero
allow zygote app_data_file dir { search read open }
allow zygote app_data_file file { getattr read open }