Further Hardening Android GPUs

Google’s Android Red Team, in partnership with Arm, analyzed the Mali GPU stack and implemented SELinux-based IOCTL filtering to reduce the GPU driver’s attack surface on Android devices. The effort blocks deprecated and debug IOCTLs, restricts instrumentation to controlled contexts, and preserves access to production IOCTLs, delivered through a staged rollout (opt-in to opt-out). The post provides implementation steps using a platform-level macro, device-specific IOCTL lists, and guidance for testing and enforcement to harden GPUs across the ecosystem and mitigate present and future vulnerabilities.