diff --git a/priv_app.te b/priv_app.te
index dc792e8f45456f7a2cbc41f9a620d18049b32162..68b588cfb591265f4b523dbc206318ef96b1a322 100644
--- a/priv_app.te
+++ b/priv_app.te
@@ -72,6 +72,10 @@ allow priv_app fuse_device:chr_file { read write };
 allow priv_app sysfs_zram:dir search;
 allow priv_app sysfs_zram:file r_file_perms;
 
+# Allow GMS core to communicate with update_engine for A/B update.
+binder_call(priv_app, update_engine)
+allow priv_app update_engine_service:service_manager find;
+
 ###
 ### neverallow rules
 ###
diff --git a/service.te b/service.te
index bac387ff24816af9492a1b8768c21ad33ae4f1c8..70bb34c20774013c73c4464c5c12e19ebbc6e60f 100644
--- a/service.te
+++ b/service.te
@@ -11,6 +11,7 @@ type nfc_service,               service_manager_type;
 type radio_service,             service_manager_type;
 type surfaceflinger_service,    service_manager_type;
 type system_app_service,        service_manager_type;
+type update_engine_service,     service_manager_type;
 
 # system_server_services broken down
 type accessibility_service, app_api_service, system_server_service, service_manager_type;
diff --git a/service_contexts b/service_contexts
index 85dcd3d0eeb720f8e8c0d99c8c309bb7ad5a7165..411638331fdd55b0833752ab09255b33bef397c8 100644
--- a/service_contexts
+++ b/service_contexts
@@ -2,6 +2,7 @@ accessibility                             u:object_r:accessibility_service:s0
 account                                   u:object_r:account_service:s0
 activity                                  u:object_r:activity_service:s0
 alarm                                     u:object_r:alarm_service:s0
+android.os.IUpdateEngine                  u:object_r:update_engine_service:s0
 android.security.keystore                 u:object_r:keystore_service:s0
 android.service.gatekeeper.IGateKeeperService    u:object_r:gatekeeper_service:s0
 appops                                    u:object_r:appops_service:s0
diff --git a/update_engine.te b/update_engine.te
index ea7fcaff809a87996f0fc7c1ce54d0965fbf7655..3fbfd8a15699bbfa35cc9250baa4647100a440e2 100644
--- a/update_engine.te
+++ b/update_engine.te
@@ -26,3 +26,10 @@ allow update_engine system_block_device:blk_file rw_file_perms;
 
 # Don't allow kernel module loading, just silence the logs.
 dontaudit update_engine kernel:system module_request;
+
+# Register the service to perform Binder IPC.
+binder_use(update_engine)
+allow update_engine update_engine_service:service_manager { add };
+
+# Allow update_engine to call the callback function provided by priv_app.
+binder_call(update_engine, priv_app)