diff --git a/file.te b/file.te
index 62ad733d2b85e36ccdcceaeade061d6e6c862172..e6ad9e21b51b0e071c7b449df6d4a42c45e9fae7 100644
--- a/file.te
+++ b/file.te
@@ -101,6 +101,7 @@ type adb_keys_file, file_type, data_file_type;
 type audio_data_file, file_type, data_file_type;
 type bluetooth_data_file, file_type, data_file_type;
 type camera_data_file, file_type, data_file_type;
+type gatekeeper_data_file, file_type, data_file_type;
 type keychain_data_file, file_type, data_file_type;
 type keystore_data_file, file_type, data_file_type;
 type media_data_file, file_type, data_file_type;
diff --git a/file_contexts b/file_contexts
index 7c48b024e80b99d40b52951d439259c4c8f731be..3099ed0bc119e088180b1eb8f3cb7606ba8c2251 100644
--- a/file_contexts
+++ b/file_contexts
@@ -230,6 +230,7 @@
 /data/misc/bluedroid/\.a2dp_data u:object_r:bluetooth_socket:s0
 /data/misc/camera(/.*)?         u:object_r:camera_data_file:s0
 /data/misc/dhcp(/.*)?           u:object_r:dhcp_data_file:s0
+/data/misc/gatekeeper(/.*)?     u:object_r:gatekeeper_data_file:s0
 /data/misc/keychain(/.*)?       u:object_r:keychain_data_file:s0
 /data/misc/keystore(/.*)?       u:object_r:keystore_data_file:s0
 /data/misc/media(/.*)?          u:object_r:media_data_file:s0
diff --git a/gatekeeperd.te b/gatekeeperd.te
index 5f27aa92ac96e416f5ca04215bf9b312b05b536d..39d9d210c21727b0b38f4a472f05914b64276e54 100644
--- a/gatekeeperd.te
+++ b/gatekeeperd.te
@@ -18,11 +18,7 @@ allow gatekeeperd system_server:binder call;
 allow gatekeeperd permission_service:service_manager find;
 
 # for SID file access
-allow gatekeeperd system_data_file:dir { add_name write};
-allow gatekeeperd system_data_file:file { write create open };
-
-# Apps using KeyStore API will request the SID from GateKeeper
-allow untrusted_app gatekeeper_service:service_manager find;
-binder_call(untrusted_app, gatekeeperd)
+allow gatekeeperd gatekeeper_data_file:dir rw_dir_perms;
+allow gatekeeperd gatekeeper_data_file:file create_file_perms;
 
 neverallow { domain -gatekeeperd } gatekeeper_service:service_manager add;
diff --git a/untrusted_app.te b/untrusted_app.te
index 5ad8c79bd1395571f4ce22fba8b158e8f7681ea2..1b7aaeefd0d8289b3c8db118428f5511c7164a48 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -93,6 +93,10 @@ allow untrusted_app persistent_data_block_service:service_manager find;
 allow untrusted_app { apk_tmp_file apk_private_tmp_file }:dir r_dir_perms;
 allow untrusted_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
 
+# Apps using KeyStore API will request the SID from GateKeeper
+allow untrusted_app gatekeeper_service:service_manager find;
+binder_call(untrusted_app, gatekeeperd)
+
 ###
 ### neverallow rules
 ###