diff --git a/priv_app.te b/priv_app.te
index 416d534b81f05f39a9213de96c2f8982cf8140a5..d31bf477aed7969a2960bc55dbbbd9d8fa2622a1 100644
--- a/priv_app.te
+++ b/priv_app.te
@@ -77,6 +77,10 @@ allow priv_app sysfs_zram:file r_file_perms;
 # access the mac address
 allowxperm priv_app self:udp_socket ioctl SIOCGIFHWADDR;
 
+# Allow GMS core to communicate with update_engine for A/B update.
+binder_call(priv_app, update_engine)
+allow priv_app update_engine_service:service_manager find;
+
 ###
 ### neverallow rules
 ###
diff --git a/service.te b/service.te
index e770fd87a5892043c4b4680900e406a54c178722..6c284e6680169174ef2e3f51f073a5b955acc17e 100644
--- a/service.te
+++ b/service.te
@@ -13,6 +13,7 @@ type nfc_service,               service_manager_type;
 type radio_service,             service_manager_type;
 type surfaceflinger_service,    service_manager_type;
 type system_app_service,        service_manager_type;
+type update_engine_service,     service_manager_type;
 
 # system_server_services broken down
 type accessibility_service, app_api_service, system_server_service, service_manager_type;
diff --git a/service_contexts b/service_contexts
index 6647881c086c03a1350d40bf1112f544c5fb9f83..0314c6908aeae8d9463b1ad7e56d774efdfce72e 100644
--- a/service_contexts
+++ b/service_contexts
@@ -2,6 +2,7 @@ accessibility                             u:object_r:accessibility_service:s0
 account                                   u:object_r:account_service:s0
 activity                                  u:object_r:activity_service:s0
 alarm                                     u:object_r:alarm_service:s0
+android.os.IUpdateEngine                  u:object_r:update_engine_service:s0
 android.security.keystore                 u:object_r:keystore_service:s0
 android.service.gatekeeper.IGateKeeperService    u:object_r:gatekeeper_service:s0
 appops                                    u:object_r:appops_service:s0
diff --git a/update_engine.te b/update_engine.te
index ea7fcaff809a87996f0fc7c1ce54d0965fbf7655..3fbfd8a15699bbfa35cc9250baa4647100a440e2 100644
--- a/update_engine.te
+++ b/update_engine.te
@@ -26,3 +26,10 @@ allow update_engine system_block_device:blk_file rw_file_perms;
 
 # Don't allow kernel module loading, just silence the logs.
 dontaudit update_engine kernel:system module_request;
+
+# Register the service to perform Binder IPC.
+binder_use(update_engine)
+allow update_engine update_engine_service:service_manager { add };
+
+# Allow update_engine to call the callback function provided by priv_app.
+binder_call(update_engine, priv_app)