diff --git a/domain.te b/domain.te
index 4fc6f7324bab91f0b2d240c8407d6fb58ae1bd7c..06959a5d2f3bd8cf5242b10b506e06c6d0890f62 100644
--- a/domain.te
+++ b/domain.te
@@ -92,6 +92,7 @@ allow domain alarm_device:chr_file r_file_perms;
 allow domain urandom_device:chr_file rw_file_perms;
 allow domain random_device:chr_file rw_file_perms;
 allow domain properties_device:file r_file_perms;
+allow domain init:key search;
 
 # logd access
 write_logd(domain)
diff --git a/file.te b/file.te
index 5ac2b66b5bc75f85f88ce83a4c3918bef652e870..ca717fd70caf6ced2102e1da9811698c12eab03f 100644
--- a/file.te
+++ b/file.te
@@ -49,6 +49,8 @@ type logcat_exec, exec_type, file_type;
 type coredump_file, file_type;
 # Default type for anything under /data.
 type system_data_file, file_type, data_file_type;
+# Unencrypted data
+type unencrypted_data_file, file_type, data_file_type;
 # /data/.layout_version or other installd-created files that
 # are created in a system_data_file directory.
 type install_data_file, file_type, data_file_type;
diff --git a/file_contexts b/file_contexts
index d51047686954be165abd302f7234b2a3540baef2..ed12d870270cf456408fee3454e0a4dcf62f8a0d 100644
--- a/file_contexts
+++ b/file_contexts
@@ -182,6 +182,7 @@
 #
 /data(/.*)?		u:object_r:system_data_file:s0
 /data/.layout_version		u:object_r:install_data_file:s0
+/data/unencrypted(/.*)?         u:object_r:unencrypted_data_file:s0
 /data/backup(/.*)?		u:object_r:backup_data_file:s0
 /data/secure/backup(/.*)?	u:object_r:backup_data_file:s0
 /data/security(/.*)?	u:object_r:security_file:s0
diff --git a/init.te b/init.te
index da9a72278a3bc9b1340790517a92a7fee449da69..909490d300b84189962dec4fded70f4f72a97dab 100644
--- a/init.te
+++ b/init.te
@@ -234,6 +234,18 @@ allow init metadata_block_device:blk_file rw_file_perms;
 allow init pstorefs:dir search;
 allow init pstorefs:file r_file_perms;
 
+# linux keyring configuration
+allow init init:key { write search setattr };
+
+# Allow init to link temp fs to unencrypted data on userdata
+allow init tmpfs:lnk_file { create read getattr relabelfrom };
+
+# Allow init to manipulate /data/unencrypted
+allow init unencrypted_data_file:{ file lnk_file } create_file_perms;
+allow init unencrypted_data_file:dir create_dir_perms;
+
+unix_socket_connect(init, vold, vold)
+
 ###
 ### neverallow rules
 ###
diff --git a/vold.te b/vold.te
index f605f8a77710343a8fce8a34bce03ca2480d8690..17ddd61f2448ec9f87ed6aa79b40a3148b48d6e3 100644
--- a/vold.te
+++ b/vold.te
@@ -101,3 +101,7 @@ allow vold userdata_block_device:blk_file rw_file_perms;
 
 # Access metadata block device used for encryption meta-data.
 allow vold metadata_block_device:blk_file rw_file_perms;
+
+# Allow init to manipulate /data/unencrypted
+allow vold unencrypted_data_file:{ file lnk_file } create_file_perms;
+allow vold unencrypted_data_file:dir create_dir_perms;