diff --git a/domain.te b/domain.te
index 78f1dea741f80373983f1eaa281bbf07128bf400..5ed9dc9de9ca87d13e95333d162014d73a969725 100644
--- a/domain.te
+++ b/domain.te
@@ -278,7 +278,7 @@ neverallow { domain -init -ueventd } device:chr_file { open read write };
 # Limit what domains can mount filesystems or change their mount flags.
 # sdcard_type / vfat is exempt as a larger set of domains need
 # this capability, including device-specific domains.
-neverallow { domain -kernel -init -recovery -vold -zygote -update_engine } { fs_type -sdcard_type }:filesystem { mount remount relabelfrom relabelto };
+neverallow { domain -kernel -init -recovery -vold -zygote -update_engine -otapreopt_chroot } { fs_type -sdcard_type }:filesystem { mount remount relabelfrom relabelto };
 
 #
 # Assert that, to the extent possible, we're not loading executable content from
diff --git a/otapreopt_chroot.te b/otapreopt_chroot.te
index 3f426709c86ca5ccdf91f733bfe189103ec8dfc2..fcba7b145163b30bba2490d8f6f21d5631b38955 100644
--- a/otapreopt_chroot.te
+++ b/otapreopt_chroot.te
@@ -7,6 +7,10 @@ type otapreopt_chroot_exec, exec_type, file_type;
 allow otapreopt_chroot postinstall_file:dir { search mounton };
 allow otapreopt_chroot self:capability { sys_admin sys_chroot };
 
+# This is required to mount /vendor.
+allow otapreopt_chroot block_device:dir search;
+allow otapreopt_chroot labeledfs:filesystem mount;
+
 # Allow to transition to postinstall_ota, to run otapreopt in its own sandbox.
 domain_auto_trans(otapreopt_chroot, postinstall_file, postinstall_dexopt)