diff --git a/app.te b/app.te
index 361530624a34f7e33b2811a0bd3428fd40b262b2..7e53724b9ed64b1f3cbbb27a99bf8d2be9c592b6 100644
--- a/app.te
+++ b/app.te
@@ -15,7 +15,8 @@ allow appdomain ashmem_device:chr_file execute;
 allow appdomain zygote:fd use;
 
 # gdbserver for ndk-gdb reads the zygote.
-allow appdomain zygote_exec:file r_file_perms;
+# valgrind needs mmap exec for zygote
+allow appdomain zygote_exec:file rx_file_perms;
 
 # gdbserver for ndk-gdb ptrace attaches to app process.
 allow appdomain self:process ptrace;