diff --git a/private/access_vectors b/private/access_vectors
index dcd86c28e34db23dfa4982aa9deb1c9c27b4e37d..6b08d9efce4fd28b4032f324637532252bff465b 100644
--- a/private/access_vectors
+++ b/private/access_vectors
@@ -702,6 +702,7 @@ class keystore_key
 	clear_uid
 	add_auth
 	user_changed
+	gen_unique_id
 }
 
 class drmservice {
diff --git a/private/domain.te b/private/domain.te
index 6f8814e40ae9ba20eff0e9a107047a3c79191b42..d37a0bd2656f0bcca2abf6e41b22aee93158c20f 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -13,3 +13,6 @@ neverallow {
   -system_server
   userdebug_or_eng(`-perfprofd')
 } self:capability sys_ptrace;
+
+# Limit ability to generate hardware unique device ID attestations to priv_apps
+neverallow { domain -priv_app } *:keystore_key gen_unique_id;
diff --git a/private/priv_app.te b/private/priv_app.te
index 38ce673a1efa7ee8410fbcf2852dc1a460dc2435..a703ba8d436c12e395dfdf7e204d176d074b013a 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -114,6 +114,9 @@ allow priv_app functionfs:file rw_file_perms;
 # TODO: narrow this to just MediaProvider
 allow priv_app mnt_media_rw_file:dir search;
 
+# Allow privileged apps (e.g. GMS core) to generate unique hardware IDs
+allow priv_app keystore:keystore_key gen_unique_id;
+
 read_runtime_log_tags(priv_app)
 
 ###