diff --git a/domain.te b/domain.te
index 9614ab31c7bac3c68ade2dc80891da7524e4b106..bf3295c8392c305bc29a174d27312264e1d86d4a 100644
--- a/domain.te
+++ b/domain.te
@@ -182,6 +182,7 @@ neverallow {
   -dumpstate
   -system_server
   userdebug_or_eng(`-procrank')
+  userdebug_or_eng(`-perfprofd')
 } self:capability sys_ptrace;
 
 # Limit device node creation to these whitelisted domains.
diff --git a/file.te b/file.te
index e6ad9e21b51b0e071c7b449df6d4a42c45e9fae7..815c892169186fd2889d2006efbb51019e6ee73d 100644
--- a/file.te
+++ b/file.te
@@ -116,6 +116,7 @@ type vpn_data_file, file_type, data_file_type;
 type wifi_data_file, file_type, data_file_type;
 type zoneinfo_data_file, file_type, data_file_type;
 type vold_data_file, file_type, data_file_type;
+type perfprofd_data_file, file_type, data_file_type, mlstrustedobject;
 
 # Compatibility with type names used in vanilla Android 4.3 and 4.4.
 typealias audio_data_file alias audio_firmware_file;
diff --git a/file_contexts b/file_contexts
index 48fbb5a48a28148b87aa752f4ba648fe25ee96ef..9575fb0ed30c26a55308a6a043c8f92bc555e413 100644
--- a/file_contexts
+++ b/file_contexts
@@ -248,6 +248,7 @@
 /data/misc/wifi/hostapd(/.*)?   u:object_r:wpa_socket:s0
 /data/misc/zoneinfo(/.*)?       u:object_r:zoneinfo_data_file:s0
 /data/misc/vold(/.*)?           u:object_r:vold_data_file:s0
+/data/misc/perfprofd(/.*)?      u:object_r:perfprofd_data_file:s0
 /data/system/heapdump(/.*)?     u:object_r:heapdump_data_file:s0
 
 # Bootchart data
diff --git a/perfprofd.te b/perfprofd.te
index 30b438b307e71498e47c57a91feafc7b72c991d2..c9f7f35edcb39730358b48abfe5e0ebc63c13b61 100644
--- a/perfprofd.te
+++ b/perfprofd.te
@@ -18,19 +18,13 @@ userdebug_or_eng(`
   allow perfprofd system_file:file rx_file_perms;
 
   # perfprofd reads a config file from /data/data/com.google.android.gms/files
-  # opens a file for writing in the same directory
-  allow perfprofd app_data_file:file rw_file_perms;
-  allow perfprofd app_data_file:dir rw_dir_perms;
-
-  # perfprofd looks for the existence of a semaphore file to determine
-  # whether collection is enabled/disabled (where the semphore file is
-  # created by some other entity, e.g. gms)
+  allow perfprofd app_data_file:file r_file_perms;
   allow perfprofd app_data_file:dir search;
   allow perfprofd self:capability { dac_override };
 
-  # perfprofd reads profiles from /data/data/..., encodes them,
-  # and then dumps the encoded profiles back to /data/data/....
-  allow perfprofd app_data_file:dir_file_class_set create_file_perms;
+  # perfprofd opens a file for writing in /data/misc/perfprofd
+  allow perfprofd perfprofd_data_file:file create_file_perms;
+  allow perfprofd perfprofd_data_file:dir rw_dir_perms;
 
   # perfprofd uses the system log
   read_logd(perfprofd);
@@ -39,6 +33,17 @@ userdebug_or_eng(`
   # simpleperf uses ioctl() to turn on kernel perf events measurements
   allow perfprofd self:capability sys_admin;
 
+  # simpleperf needs to examine /proc to collect task/thread info
+  r_dir_file(perfprofd, domain)
+
+  # simpleperf needs to access /proc/<pid>/exec
+  allow perfprofd self:capability { sys_resource sys_ptrace };
+  neverallow perfprofd domain:process ptrace;
+
+  # simpleperf needs open/read any file that turns up in a profile
+  # to see whether it has a build ID
+  allow perfprofd exec_type:file r_file_perms;
+
   # simpleperf is going to execute "sleep"
   allow perfprofd toolbox_exec:file x_file_perms;
 
diff --git a/untrusted_app.te b/untrusted_app.te
index 215898f63e709527c25d4794fba91acdfe9db3a4..7a9e2dd3da37a800ea4850ca1d0611197051976b 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -104,6 +104,13 @@ allow untrusted_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
 # #define SIOCSIWCOMMIT 0x8B00 /* Commit pending changes to driver */
 allow untrusted_app self:{ rawip_socket tcp_socket udp_socket } { 0x8900-0x8926 0x8928-0x89ff 0x8b00 };
 
+# Allow GMS core to access perfprofd output, which is stored
+# in /data/misc/perfprofd/. GMS core will need to list all
+# data stored in that directory to process them one by one.
+userdebug_or_eng(`
+  allow untrusted_app perfprofd_data_file:file r_file_perms;
+  allow untrusted_app perfprofd_data_file:dir r_dir_perms;
+')
 ###
 ### neverallow rules
 ###