diff --git a/private/domain.te b/private/domain.te
index c975ce661059b1da503f06f4b193eab2a63e4ab9..b0c7ac7613d614dafcb9c67c75cd845f07023f9d 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -5,6 +5,7 @@ neverallow {
   -debuggerd
   -vold
   -dumpstate
+  -storaged
   -system_server
   userdebug_or_eng(`-perfprofd')
 } self:capability sys_ptrace;
diff --git a/private/dumpstate.te b/private/dumpstate.te
index a54591d86ecfc79e316db45540ea92d661011f12..6a6629371b26569de9ea75dff0ee7a68d702f830 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -13,3 +13,7 @@ allow dumpstate debugfs_tracing:dir r_dir_perms;
 allow dumpstate debugfs_tracing:file rw_file_perms;
 allow dumpstate debugfs_trace_marker:file getattr;
 allow dumpstate atrace_exec:file rx_file_perms;
+allow dumpstate storaged_exec:file rx_file_perms;
+
+# Allow dumpstate to make binder calls to storaged service
+binder_call(dumpstate, storaged)
diff --git a/private/file_contexts b/private/file_contexts
index f6399fb7b956543868556d93150fcc246a266766..80e192780ea998f189c59f144171510a5548b790 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -227,6 +227,7 @@
 /system/bin/idmap u:object_r:idmap_exec:s0
 /system/bin/update_engine        u:object_r:update_engine_exec:s0
 /system/bin/bspatch              u:object_r:update_engine_exec:s0
+/system/bin/storaged             u:object_r:storaged_exec:s0
 /system/bin/webview_zygote32     u:object_r:webview_zygote_exec:s0
 /system/bin/webview_zygote64     u:object_r:webview_zygote_exec:s0
 /system/fake-lib(64)?/libart.*   u:object_r:libart_file:s0
@@ -422,6 +423,7 @@
 #############################
 # debugfs files
 #
+/sys/kernel/debug/mmc0(/.*)?             u:object_r:debugfs_mmc:s0
 /sys/kernel/debug/tracing(/.*)?          u:object_r:debugfs_tracing:s0
 /sys/kernel/debug/tracing/trace_marker   u:object_r:debugfs_trace_marker:s0
 
diff --git a/private/service_contexts b/private/service_contexts
index 2f313934156a7f5cd9a94e8f499b2cebf8cbbbb3..5414f1123ff0ef0166344ee474456617a03ac7ff 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -133,6 +133,7 @@ simphonebook                              u:object_r:radio_service:s0
 sip                                       u:object_r:radio_service:s0
 soundtrigger                              u:object_r:voiceinteraction_service:s0
 statusbar                                 u:object_r:statusbar_service:s0
+storaged                                  u:object_r:storaged_service:s0
 SurfaceFlinger                            u:object_r:surfaceflinger_service:s0
 task                                      u:object_r:task_service:s0
 telecom                                   u:object_r:telecom_service:s0
diff --git a/private/storaged.te b/private/storaged.te
new file mode 100644
index 0000000000000000000000000000000000000000..bf5c24292903c0203331f058207eb63298d26870
--- /dev/null
+++ b/private/storaged.te
@@ -0,0 +1,32 @@
+# storaged daemon
+type storaged, domain, mlstrustedsubject;
+type storaged_exec, exec_type, file_type;
+
+init_daemon_domain(storaged)
+
+# Write to /dev/kmsg (opened in init)
+allow storaged kmsg_device:chr_file { write append };
+
+# Read access to pseudo filesystems
+allow storaged proc:dir r_dir_perms;
+r_dir_file(storaged, sysfs_type)
+r_dir_file(storaged, proc_net)
+r_dir_file(storaged, domain)
+
+allow storaged self:capability { setgid setuid sys_nice sys_ptrace };
+
+userdebug_or_eng(`
+  # Read access to debugfs
+  allow storaged debugfs_mmc:dir search;
+  allow storaged debugfs_mmc:file r_file_perms;
+')
+
+# Binder permissions
+allow storaged storaged_service:service_manager add;
+binder_use(storaged)
+binder_call(storaged, system_server)
+
+###
+### neverallow
+###
+neverallow storaged domain:process ptrace;
diff --git a/public/file.te b/public/file.te
index 6184eef0c1eae44c936bc5d04d2a658f6a55f3dc..0365dc9e684402a8cedb939fa533ad5c81d3166e 100644
--- a/public/file.te
+++ b/public/file.te
@@ -57,6 +57,7 @@ type fuse, sdcard_type, fs_type, mlstrustedobject;
 type sdcardfs, sdcard_type, fs_type, mlstrustedobject;
 type vfat, sdcard_type, fs_type, mlstrustedobject;
 type debugfs, fs_type;
+type debugfs_mmc, fs_type, debugfs_type;
 type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject;
 type debugfs_tracing, fs_type, debugfs_type;
 type pstorefs, fs_type;
diff --git a/public/service.te b/public/service.te
index 550f79bb7909d91069d7b86bf81dae755fd877e0..376208e4d6b1bfa6136960b83e44e0644e9faa29 100644
--- a/public/service.te
+++ b/public/service.te
@@ -19,6 +19,7 @@ type mediadrmserver_service,    service_manager_type;
 type netd_service,              service_manager_type;
 type nfc_service,               service_manager_type;
 type radio_service,             service_manager_type;
+type storaged_service,          service_manager_type;
 type surfaceflinger_service,    service_manager_type;
 type system_app_service,        service_manager_type;
 type update_engine_service,     service_manager_type;