diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index fe3b1dcfa56b54c4aba195f9a6a749daf224fe7c..b38eb15b238900efc373f23f28556a4404d3ecf9 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -52,6 +52,14 @@
     tombstone_wifi_data_file
     traceur_app
     traceur_app_tmpfs
+    traced
+    traced_consumer_socket
+    traced_exec
+    traced_probes
+    traced_probes_exec
+    traced_probes_tmpfs
+    traced_producer_socket
+    traced_tmpfs
     update_engine_log_data_file
     vendor_init
     vold_prepare_subdirs
diff --git a/private/domain.te b/private/domain.te
index 1fd75bc78f4a90a37f7eebd6b787b08c8c0000b6..72c3855e3911b72b285934eea4dcd619a46fd0cc 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -71,6 +71,7 @@ full_treble_only(`
     -dumpstate
     -init
     userdebug_or_eng(`-perfprofd')
+    userdebug_or_eng(`-traced_probes')
     -shell
     userdebug_or_eng(`-traceur_app')
     -vendor_init
diff --git a/private/ephemeral_app.te b/private/ephemeral_app.te
index 7694739bdb5ec822b9e25bc7e98575b99d26435f..dbfbcf9e8531c2042233f8bc7ddb10b2b7beda3c 100644
--- a/private/ephemeral_app.te
+++ b/private/ephemeral_app.te
@@ -35,6 +35,12 @@ allow ephemeral_app drmserver_service:service_manager find;
 allow ephemeral_app radio_service:service_manager find;
 allow ephemeral_app ephemeral_app_api_service:service_manager find;
 
+# Write app-specific trace data to the Perfetto traced damon. This requires
+# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
+allow ephemeral_app traced:fd use;
+allow ephemeral_app traced_tmpfs:file { read write getattr map };
+unix_socket_connect(ephemeral_app, traced_producer, traced)
+
 ###
 ### neverallow rules
 ###
diff --git a/private/file_contexts b/private/file_contexts
index a678e523c3527238bc877da039c82b94e60312ac..1829b1ce0b4790dc10a7c591d454757c34d4f3c4 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -145,6 +145,8 @@
 /dev/socket/tombstoned_crash u:object_r:tombstoned_crash_socket:s0
 /dev/socket/tombstoned_java_trace u:object_r:tombstoned_java_trace_socket:s0
 /dev/socket/tombstoned_intercept u:object_r:tombstoned_intercept_socket:s0
+/dev/socket/traced_producer	u:object_r:traced_producer_socket:s0
+/dev/socket/traced_consumer	u:object_r:traced_consumer_socket:s0
 /dev/socket/uncrypt	u:object_r:uncrypt_socket:s0
 /dev/socket/webview_zygote	u:object_r:webview_zygote_socket:s0
 /dev/socket/wpa_eth[0-9] u:object_r:wpa_socket:s0
@@ -238,6 +240,8 @@
 /system/bin/lmkd        u:object_r:lmkd_exec:s0
 /system/bin/inputflinger u:object_r:inputflinger_exec:s0
 /system/bin/logd        u:object_r:logd_exec:s0
+/system/bin/traced        u:object_r:traced_exec:s0
+/system/bin/traced_probes        u:object_r:traced_probes_exec:s0
 /system/bin/uncrypt     u:object_r:uncrypt_exec:s0
 /system/bin/update_verifier u:object_r:update_verifier_exec:s0
 /system/bin/logwrapper  u:object_r:system_file:s0
diff --git a/private/isolated_app.te b/private/isolated_app.te
index 30253af60be10eecd8ba1fcac0e2448b9ddbb9ac..06ed2c82cf4e71ccc3c7b4b80ace561c2835cc21 100644
--- a/private/isolated_app.te
+++ b/private/isolated_app.te
@@ -47,6 +47,12 @@ allow isolated_app webview_zygote_tmpfs:file read;
 # suppress denials to /data/local/tmp
 dontaudit isolated_app shell_data_file:dir search;
 
+# Write app-specific trace data to the Perfetto traced damon. This requires
+# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
+allow isolated_app traced:fd use;
+allow isolated_app traced_tmpfs:file { read write getattr map };
+unix_socket_connect(isolated_app, traced_producer, traced)
+
 #####
 ##### Neverallow
 #####
diff --git a/private/priv_app.te b/private/priv_app.te
index ea1ce5b1668e525703535f17c4649fd1ab3afa10..92bfc570aa5e1f297068ace3ec03d772c1333947 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -116,6 +116,12 @@ allow priv_app selinuxfs:file r_file_perms;
 
 read_runtime_log_tags(priv_app)
 
+# Write app-specific trace data to the Perfetto traced damon. This requires
+# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
+allow priv_app traced:fd use;
+allow priv_app traced_tmpfs:file { read write getattr map };
+unix_socket_connect(priv_app, traced_producer, traced)
+
 # suppress denials when safetynet scans /system
 dontaudit priv_app exec_type:file getattr;
 dontaudit priv_app device:dir read;
diff --git a/private/shell.te b/private/shell.te
index 5299532ac64e15c88232b8a37da11609c585d578..a3c49db3708d7467b09d3c572b77e4543ab6dbc2 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -26,3 +26,13 @@ binder_call(shell, storaged)
 # Perform SELinux access checks, needed for CTS
 selinux_check_access(shell)
 selinux_check_context(shell)
+
+# Control Perfetto traced and obtain traces from it.
+# Needed for Studio and debugging.
+unix_socket_connect(shell, traced_consumer, traced)
+
+# Allow shell binaries to write trace data to Perfetto. Used for testing and
+# cmdline utils.
+allow shell traced:fd use;
+allow shell traced_tmpfs:file { read write getattr map };
+unix_socket_connect(shell, traced_producer, traced)
diff --git a/private/statsd.te b/private/statsd.te
index 9d78ebb40c3b885d588cb699f2e143461a81451d..6b7f8cdd7bf3300b8594cb2358dc1b1071f16f42 100644
--- a/private/statsd.te
+++ b/private/statsd.te
@@ -30,6 +30,9 @@ binder_call(statsd, statscompanion_service)
 read_logd(statsd)
 control_logd(statsd)
 
+# Allow to control Perfetto traced and consume its traces.
+unix_socket_connect(statsd, traced_consumer, traced)
+
 # Grant statsd with permissions to register the services.
 allow statsd {
   statscompanion_service
@@ -71,4 +74,3 @@ neverallow { domain -statsd -init -vold -vendor_init } stats_data_file:file *;
 
 # Limited access to the directory itself.
 neverallow { domain -statsd -init -vold -vendor_init } stats_data_file:dir *;
-
diff --git a/private/traced.te b/private/traced.te
new file mode 100644
index 0000000000000000000000000000000000000000..bb7a09191b5316c223f81da7a60678eb0e101d12
--- /dev/null
+++ b/private/traced.te
@@ -0,0 +1,38 @@
+# Perfetto user-space tracing daemon (unprivileged)
+type traced, domain, coredomain;
+type traced_exec, exec_type, file_type;
+
+# Allow init to exec the daemon.
+init_daemon_domain(traced)
+
+# Allow traced to start with a lower scheduling class and change
+# class accordingly to what defined in the config provided by
+# the privileged process that controls it.
+allow traced self:global_capability_class_set { sys_nice };
+
+###
+### Neverallow rules
+###
+### traced should NEVER do any of this
+
+# Disallow mapping executable memory (execstack and exec are already disallowed
+# globally in domain.te).
+neverallow traced self:process execmem;
+
+# Block device access.
+neverallow traced dev_type:blk_file { read write };
+
+# ptrace any other process
+neverallow traced domain:process ptrace;
+
+# Disallows access to /data files, still allowing to write to file descriptors
+# passed through the socket.
+neverallow traced { data_file_type -system_data_file -zoneinfo_data_file }:dir *;
+neverallow traced system_data_file:dir ~{ getattr search };
+neverallow traced zoneinfo_data_file:dir ~r_dir_perms;
+neverallow traced { data_file_type -zoneinfo_data_file }:lnk_file *;
+neverallow traced { data_file_type -zoneinfo_data_file }:file ~write;
+
+# Only init is allowed to enter the traced domain via exec()
+neverallow { domain -init } traced:process transition;
+neverallow * traced:process dyntransition;
diff --git a/private/traced_probes.te b/private/traced_probes.te
new file mode 100644
index 0000000000000000000000000000000000000000..15c51d4cd8561d64cc55fa7cb4002f9740d37abf
--- /dev/null
+++ b/private/traced_probes.te
@@ -0,0 +1,55 @@
+# Perfetto tracing probes, has tracefs access.
+type traced_probes, domain, coredomain;
+type traced_probes_exec, exec_type, file_type;
+
+# Allow init to exec the daemon.
+init_daemon_domain(traced_probes)
+
+# Write trace data to the Perfetto traced damon. This requires connecting to its
+# producer socket and obtaining a (per-process) tmpfs fd.
+allow traced_probes traced:fd use;
+allow traced_probes traced_tmpfs:file { read write getattr map };
+unix_socket_connect(traced_probes, traced_producer, traced)
+
+# Allow traced_probes to access tracefs.
+# TODO(primiano): For the moment this is userdebug/eng only until we get an
+# approval for user builds.
+userdebug_or_eng(`
+allow traced_probes debugfs_tracing:dir r_dir_perms;
+allow traced_probes debugfs_tracing:file rw_file_perms;
+allow traced_probes debugfs_tracing_debug:file rw_file_perms;
+allow traced_probes debugfs_trace_marker:file getattr;
+')
+
+# Allow traced_probes to start with a higher scheduling class and then downgrade
+# itself.
+allow traced_probes self:global_capability_class_set { sys_nice };
+
+# Allow procfs access
+r_dir_file(traced_probes, domain)
+
+###
+### Neverallow rules
+###
+### traced_probes should NEVER do any of this
+
+# Disallow mapping executable memory (execstack and exec are already disallowed
+# globally in domain.te).
+neverallow traced_probes self:process execmem;
+
+# Block device access.
+neverallow traced_probes dev_type:blk_file { read write };
+
+# ptrace any other app
+neverallow traced_probes domain:process ptrace;
+
+# Disallows access to /data files.
+neverallow traced { data_file_type -system_data_file -zoneinfo_data_file }:dir *;
+neverallow traced system_data_file:dir ~{ getattr search };
+neverallow traced zoneinfo_data_file:dir ~r_dir_perms;
+neverallow traced { data_file_type -zoneinfo_data_file }:lnk_file *;
+neverallow traced { data_file_type -zoneinfo_data_file }:file *;
+
+# Only init is allowed to enter the traced_probes domain via exec()
+neverallow { domain -init } traced_probes:process transition;
+neverallow * traced_probes:process dyntransition;
diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index f96cae0e1d2d12d51b3c0c83af3bac27d2c7db1f..e76407bc0b2fd8b2c0a05c4df1552c4ab92d7ded 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -105,3 +105,9 @@ allow untrusted_app_all preloads_data_file:dir search;
 allow untrusted_app_all vendor_app_file:dir { open getattr read search };
 allow untrusted_app_all vendor_app_file:file { open getattr read execute };
 allow untrusted_app_all vendor_app_file:lnk_file { open getattr read };
+
+# Write app-specific trace data to the Perfetto traced damon. This requires
+# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
+allow untrusted_app_all traced:fd use;
+allow untrusted_app_all traced_tmpfs:file { read write getattr map };
+unix_socket_connect(untrusted_app_all, traced_producer, traced)
diff --git a/private/untrusted_v2_app.te b/private/untrusted_v2_app.te
index 60634aefb155068c668bc26160fecc763cd65f80..8f4bceb2c61575087a4f35741c3e536c77720226 100644
--- a/private/untrusted_v2_app.te
+++ b/private/untrusted_v2_app.te
@@ -39,3 +39,9 @@ allow untrusted_v2_app app_api_service:service_manager find;
 
 # gdbserver for ndk-gdb ptrace attaches to app process.
 allow untrusted_v2_app self:process ptrace;
+
+# Write app-specific trace data to the Perfetto traced damon. This requires
+# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
+allow untrusted_v2_app traced:fd use;
+allow untrusted_v2_app traced_tmpfs:file { read write getattr map };
+unix_socket_connect(untrusted_v2_app, traced_producer, traced)
diff --git a/public/domain.te b/public/domain.te
index 142c10b202c5822f06d7bb9492189d74e07a018a..70d8ae20fd3c551c54026ef63de7e5a7120108fa 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -149,7 +149,8 @@ allow domain sysfs:lnk_file { getattr read };
 
 # libc references /data/misc/zoneinfo for timezone related information
 # This directory is considered to be a VNDK-stable
-r_dir_file(domain, zoneinfo_data_file)
+allow domain zoneinfo_data_file:file r_file_perms;
+allow domain zoneinfo_data_file:dir r_dir_perms;
 
 # Lots of processes access current CPU information
 r_dir_file(domain, sysfs_devices_system_cpu)
diff --git a/public/file.te b/public/file.te
index 9856f7716335da693cb21652a91f85a34a85550f..e8e87b88def1c8811e220853454a256f7fc8aa86 100644
--- a/public/file.te
+++ b/public/file.te
@@ -315,6 +315,8 @@ type system_ndebug_socket, file_type, data_file_type, core_data_file_type, cored
 type tombstoned_crash_socket, file_type, coredomain_socket, mlstrustedobject;
 type tombstoned_java_trace_socket, file_type, mlstrustedobject;
 type tombstoned_intercept_socket, file_type, coredomain_socket;
+type traced_producer_socket, file_type, coredomain_socket;
+type traced_consumer_socket, file_type, coredomain_socket;
 type uncrypt_socket, file_type, coredomain_socket;
 type webview_zygote_socket, file_type, coredomain_socket;
 type wpa_socket, file_type, data_file_type;