diff --git a/private/property_contexts b/private/property_contexts
index 39e8a8db894aa4e2826e7527e592fcde38bb6723..80476cc25061df0e94cecdd4218a8ecca886bb29 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -61,7 +61,9 @@ persist.vendor.overlay.  u:object_r:overlay_prop:s0
 ro.boot.vendor.overlay.  u:object_r:overlay_prop:s0
 ro.boottime.             u:object_r:boottime_prop:s0
 ro.serialno             u:object_r:serialno_prop:s0
+ro.boot.btmacaddr       u:object_r:bluetooth_prop:s0
 ro.boot.serialno        u:object_r:serialno_prop:s0
+ro.bt.                  u:object_r:bluetooth_prop:s0
 
 # Boolean property set by system server upon boot indicating
 # if device owner is provisioned.
diff --git a/public/app.te b/public/app.te
index 77af57c8cc972fdc191f6f835d270520c66de489..370f5394ba9fc9fd8da8a1ee69e5b82eece081c2 100644
--- a/public/app.te
+++ b/public/app.te
@@ -468,3 +468,11 @@ neverallow {
   appdomain
   -shell # bugreport
 } input_device:chr_file ~getattr;
+
+# Do not allow access to Bluetooth-related system properties except for a few whitelisted domains.
+# neverallow rules for access to Bluetooth-related data files are above.
+neverallow {
+  appdomain
+  -bluetooth
+  -system_app
+} bluetooth_prop:file create_file_perms;
diff --git a/public/property.te b/public/property.te
index ce5ce2f9b711c241c123009e903db88b7a9b91c1..1bde35c4d80817018cfd28718999fcd4acc08b19 100644
--- a/public/property.te
+++ b/public/property.te
@@ -1,6 +1,6 @@
 type audio_prop, property_type, core_property_type;
 type boottime_prop, property_type;
-type bluetooth_prop, property_type, core_property_type;
+type bluetooth_prop, property_type;
 type config_prop, property_type, core_property_type;
 type cppreopt_prop, property_type, core_property_type;
 type ctl_bootanim_prop, property_type;
@@ -61,7 +61,6 @@ allow property_type tmpfs:filesystem associate;
 neverallow * {
   core_property_type
   -audio_prop
-  -bluetooth_prop
   -config_prop
   -cppreopt_prop
   -dalvik_prop
diff --git a/public/webview_zygote.te b/public/webview_zygote.te
index 71f3f9a3c2515ffccb3e061c181160643b64e6cd..93bbbb1ef87c2f63ffce8aaf0c62861414723c28 100644
--- a/public/webview_zygote.te
+++ b/public/webview_zygote.te
@@ -102,3 +102,7 @@ neverallow webview_zygote domain:{
   netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket
   netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket
 } *;
+
+# Do not allow access to Bluetooth-related system properties.
+# neverallow rules for Bluetooth-related data files are listed above.
+neverallow webview_zygote bluetooth_prop:file create_file_perms;
diff --git a/public/zygote.te b/public/zygote.te
index aabf12fd484b3861bc72455ab99de1df04c71ec6..385be94a3477675804dac2d20a5e2d696a3196e7 100644
--- a/public/zygote.te
+++ b/public/zygote.te
@@ -123,3 +123,6 @@ neverallow zygote {
   data_file_type
   -dalvikcache_data_file # map PROT_EXEC
 }:file no_x_file_perms;
+
+# Do not allow access to Bluetooth-related system properties and files
+neverallow zygote bluetooth_prop:file create_file_perms;