diff --git a/access_vectors b/access_vectors
index 1b26bce963052d660b498361431800437c16723a..659fb3632ca12ab1245e6f11bdcd620826090777 100644
--- a/access_vectors
+++ b/access_vectors
@@ -921,3 +921,14 @@ class debuggerd
 	dump_tombstone
 	dump_backtrace
 }
+
+class drmservice {
+	consumeRights
+	setPlaybackStatus
+	openDecryptSession
+	closeDecryptSession
+	initializeDecryptUnit
+	decrypt
+	finalizeDecryptUnit
+	pread
+}
diff --git a/drmserver.te b/drmserver.te
index 14b2f49366fd66652c17e0b55fe3d50aaff21760..2a146b6bb78ebc3b6498217c1f95abbc779d1156 100644
--- a/drmserver.te
+++ b/drmserver.te
@@ -54,3 +54,5 @@ auditallow drmserver {
     -drmserver_service
     -system_server_service
 }:service_manager find;
+
+selinux_check_access(drmserver)
diff --git a/mediaserver.te b/mediaserver.te
index 52c593e6e2b226de7765fa1f51ffbcd6fa9e2c41..3eb078d4b0dbc9620f4e666c8d552d28fce229d8 100644
--- a/mediaserver.te
+++ b/mediaserver.te
@@ -89,3 +89,15 @@ auditallow mediaserver {
     -system_server_service
     -surfaceflinger_service
 }:service_manager find;
+
+use_drmservice(mediaserver)
+allow mediaserver drmserver:drmservice {
+    consumeRights
+    setPlaybackStatus
+    openDecryptSession
+    closeDecryptSession
+    initializeDecryptUnit
+    decrypt
+    finalizeDecryptUnit
+    pread
+};
diff --git a/security_classes b/security_classes
index ca8f4689b3eb3fa91d8185abb58dc39e9f38f646..9cd3f1c392459bec24bcc4a5fbd27e47da602e1a 100644
--- a/security_classes
+++ b/security_classes
@@ -146,4 +146,5 @@ class keystore_key              # userspace
 # debuggerd service
 class debuggerd                 # userspace
 
+class drmservice                # userspace
 # FLASK
diff --git a/te_macros b/te_macros
index b2913f3cdcf300920a7f488cd47bf90e8ee3db8d..e211a179417d3512188adcdf4bc8e1eecd26ce7d 100644
--- a/te_macros
+++ b/te_macros
@@ -367,3 +367,13 @@ define(`use_keystore', `
 define(`service_manager_local_audit_domain', `
   typeattribute $1 service_manager_local_audit;
 ')
+
+###########################################
+# use_drmservice(domain)
+# Ability to use DrmService which requires
+# DrmService to call getpidcon.
+define(`use_drmservice', `
+  allow drmserver $1:dir search;
+  allow drmserver $1:file { read open };
+  allow drmserver $1:process getattr;
+')