diff --git a/private/compat/26.0/26.0.cil b/private/compat/26.0/26.0.cil
index a587b4df5e80438f5be55c40db9ab2395980e870..d44fd7ad7bc0720d6b1f62f47a96b2852ce421ae 100644
--- a/private/compat/26.0/26.0.cil
+++ b/private/compat/26.0/26.0.cil
@@ -452,6 +452,7 @@
   ( proc
     proc_abi
     proc_asound
+    proc_buddyinfo
     proc_cmdline
     proc_dirty
     proc_diskstats
diff --git a/private/domain.te b/private/domain.te
index 8a410975bbf9e5af109368479cf73ccad7deff52..dae40d25abd0219df9688c3c57f7a77e587edfff 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -24,7 +24,6 @@ full_treble_only(`
   # /proc
   neverallow {
     coredomain
-    -dumpstate
     -vold
     -vendor_init
   } proc:file no_rw_file_perms;
@@ -32,7 +31,6 @@ full_treble_only(`
   # /sys
   neverallow {
     coredomain
-    -dumpstate
     -init
     -ueventd
     -vold
diff --git a/private/genfs_contexts b/private/genfs_contexts
index 1fddb6eb56b459f1df43b1f23ee1cb408859857f..2ff1b4d9bcebb7c8aa94b9e6822b520e4a0b8ac0 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -3,6 +3,7 @@ genfscon rootfs / u:object_r:rootfs:s0
 # proc labeling can be further refined (longest matching prefix).
 genfscon proc / u:object_r:proc:s0
 genfscon proc /asound u:object_r:proc_asound:s0
+genfscon proc /buddyinfo u:object_r:proc_buddyinfo:s0
 genfscon proc /cmdline u:object_r:proc_cmdline:s0
 genfscon proc /config.gz u:object_r:config_gz:s0
 genfscon proc /diskstats u:object_r:proc_diskstats:s0
diff --git a/public/dumpstate.te b/public/dumpstate.te
index 3a9701d3c623c49f46c23049f9279769ed9c20f3..5f6e5f79c2dee9cedf2c0b8adca17aeae5fa17a8 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -82,8 +82,14 @@ allow dumpstate {
 # Connect to tombstoned to intercept dumps.
 unix_socket_connect(dumpstate, tombstoned_intercept, tombstoned)
 
-# TODO: added to match above sysfs rule. Remove me?
-allow dumpstate sysfs_usb:file w_file_perms;
+# Access to /sys
+allow dumpstate sysfs_type:dir r_dir_perms;
+
+allow dumpstate {
+  sysfs_dm
+  sysfs_usb
+  sysfs_zram
+}:file r_file_perms;
 
 # Other random bits of data we want to collect
 allow dumpstate qtaguid_proc:file r_file_perms;
@@ -113,8 +119,6 @@ hal_client_domain(dumpstate, hal_dumpstate)
 hal_client_domain(dumpstate, hal_graphics_allocator)
 # Vibrate the device after we are done collecting the bugreport
 hal_client_domain(dumpstate, hal_vibrator)
-# For passthrough mode:
-allow dumpstate sysfs_vibrator:file { rw_file_perms getattr };
 
 # Reading /proc/PID/maps of other processes
 allow dumpstate self:global_capability_class_set sys_ptrace;
@@ -153,15 +157,18 @@ read_runtime_log_tags(dumpstate)
 
 # Read files in /proc
 allow dumpstate {
+  proc_buddyinfo
   proc_cmdline
   proc_meminfo
+  proc_modules
   proc_net
   proc_pipe_conf
   proc_pagetypeinfo
+  proc_qtaguid_stat
   proc_version
   proc_vmallocinfo
+  proc_vmstat
 }:file r_file_perms;
-r_dir_file(dumpstate, proc)
 
 # Read network state info files.
 allow dumpstate net_data_file:dir search;
@@ -249,9 +256,6 @@ add_service(dumpstate, dumpstate_service)
 # use /dev/ion for screen capture
 allow dumpstate ion_device:chr_file r_file_perms;
 
-# read default labeled files in /sys
-r_dir_file(dumpstate, sysfs)
-
 # Allow dumpstate to run top
 allow dumpstate proc_stat:file r_file_perms;
 
@@ -282,7 +286,3 @@ neverallow {
   userdebug_or_eng(`-traceur_app')
   -dumpstate
 } dumpstate_service:service_manager find;
-
-# Dumpstate should not be writing to any generically labeled sysfs files.
-# Create a specific label for the file type
-neverallow dumpstate sysfs:file no_w_file_perms;
diff --git a/public/file.te b/public/file.te
index 91796c068d12e14729558f6783673678ba7dfc5b..13176972bcf4470ab1eb5095934faef7acd12e7f 100644
--- a/public/file.te
+++ b/public/file.te
@@ -16,6 +16,7 @@ type proc_qtaguid_stat, fs_type, mlstrustedobject;
 type proc_bluetooth_writable, fs_type;
 type proc_abi, fs_type;
 type proc_asound, fs_type;
+type proc_buddyinfo, fs_type;
 type proc_cmdline, fs_type;
 type proc_cpuinfo, fs_type;
 type proc_dirty, fs_type;