diff --git a/public/domain_deprecated.te b/public/domain_deprecated.te
index 6e3b671a2910936b5f4d3317b1263de301e433e3..226cc0f580e0061db79f993a181e060ad7062f74 100644
--- a/public/domain_deprecated.te
+++ b/public/domain_deprecated.te
@@ -41,9 +41,35 @@ auditallow domain_deprecated device:file read;
 allow domain_deprecated system_file:dir r_dir_perms;
 allow domain_deprecated system_file:file r_file_perms;
 allow domain_deprecated system_file:lnk_file r_file_perms;
-auditallow { domain_deprecated -appdomain -init -rild -surfaceflinger -system_server -zygote } system_file:dir { open read ioctl lock }; # search getattr in domain
-auditallow { domain_deprecated -appdomain -init -rild -surfaceflinger -system_server -zygote } system_file:file { ioctl lock }; # read open getattr in domain
-auditallow { domain_deprecated -appdomain -init -rild -surfaceflinger -system_server -zygote } system_file:lnk_file { getattr open ioctl lock }; # read in domain
+auditallow {
+  domain_deprecated
+  -appdomain
+  -init
+  -installd
+  -rild
+  -surfaceflinger
+  -system_server
+  -zygote
+} system_file:dir { open read ioctl lock }; # search getattr in domain
+auditallow {
+  domain_deprecated
+  -appdomain
+  -init
+  -rild
+  -surfaceflinger
+  -system_server
+  -zygote
+} system_file:file { ioctl lock }; # read open getattr in domain
+auditallow {
+  domain_deprecated
+  -appdomain
+  -init
+  -installd
+  -rild
+  -surfaceflinger
+  -system_server
+  -zygote
+} system_file:lnk_file { getattr open ioctl lock }; # read in domain
 
 # Read files already opened under /data.
 allow domain_deprecated system_data_file:file { getattr read };
diff --git a/public/installd.te b/public/installd.te
index a544d5be7149f11b855a2a0b13d507d9bc7d12b3..4396ea46a0231bc8f245f4691e1e0273a8faccc5 100644
--- a/public/installd.te
+++ b/public/installd.te
@@ -25,6 +25,8 @@ allow installd mnt_expand_file:dir { search getattr };
 selinux_check_context(installd)
 
 r_dir_file(installd, rootfs)
+# Scan through APKs in /system/app and /system/priv-app
+r_dir_file(installd, system_file)
 
 # Search /data/app-asec and stat files in it.
 allow installd asec_image_file:dir search;