diff --git a/cppreopts.te b/cppreopts.te
new file mode 100644
index 0000000000000000000000000000000000000000..66df7eea4148c577faf580547d08f35f4eded281
--- /dev/null
+++ b/cppreopts.te
@@ -0,0 +1,28 @@
+# cppreopts
+#
+# This command copies preopted files from the system_b partition to the data
+# partition. This domain ensures that we are only copying into specific
+# directories.
+
+type cppreopts, domain, mlstrustedsubject;
+type cppreopts_exec, exec_type, file_type;
+
+# Technically not a daemon but we do want the transition from init domain to
+# cppreopts to occur.
+init_daemon_domain(cppreopts)
+
+domain_auto_trans(cppreopts, preopt2cachename_exec, preopt2cachename);
+
+# Allow cppreopts copy files into the dalvik-cache
+allow cppreopts dalvikcache_data_file:dir { add_name remove_name search write };
+allow cppreopts dalvikcache_data_file:file { create getattr open read rename write };
+
+# Allow cppreopts to execute itself using #!/system/bin/sh
+allow cppreopts shell_exec:file rx_file_perms;
+
+# Allow us to run find on /postinstall
+allow cppreopts system_file:dir { open read };
+
+# Allow running the cp command using cppreopts permissions. Needed so we can
+# write into dalvik-cache
+allow cppreopts toolbox_exec:file rx_file_perms;
diff --git a/domain.te b/domain.te
index 7da234092a9e3685bde4cf6964b7eaaa582f4702..78f1dea741f80373983f1eaa281bbf07128bf400 100644
--- a/domain.te
+++ b/domain.te
@@ -396,6 +396,7 @@ neverallow {
   -zygote
   -installd
   -postinstall_dexopt
+  -cppreopts
   -dex2oat
 } dalvikcache_data_file:file no_w_file_perms;
 
@@ -404,6 +405,7 @@ neverallow {
   -init
   -installd
   -postinstall_dexopt
+  -cppreopts
   -dex2oat
   -zygote
 } dalvikcache_data_file:dir no_w_dir_perms;
diff --git a/file_contexts b/file_contexts
index 8106bd263512736af7534b4f4a8bedc1eab25b05..e92aec8bc66e6e923c2f7e4c758c26f813aeabe5 100644
--- a/file_contexts
+++ b/file_contexts
@@ -199,6 +199,8 @@
 /system/bin/update_verifier u:object_r:update_verifier_exec:s0
 /system/bin/logwrapper  u:object_r:system_file:s0
 /system/bin/vdc         u:object_r:vdc_exec:s0
+/system/bin/cppreopts.sh   u:object_r:cppreopts_exec:s0
+/system/bin/preopt2cachename u:object_r:preopt2cachename_exec:s0
 /system/bin/install-recovery.sh u:object_r:install_recovery_exec:s0
 /system/bin/dex2oat(d)?     u:object_r:dex2oat_exec:s0
 # patchoat executable has (essentially) the same requirements as dex2oat.
diff --git a/init.te b/init.te
index 0a96314b05d388955595f8104b526deecd6e3a65..1512d0b4c52e3ffe5e4bf3d980b086528e455011 100644
--- a/init.te
+++ b/init.te
@@ -56,7 +56,7 @@ allow init self:capability sys_admin;
 
 # Create and mount on directories in /.
 allow init rootfs:dir create_dir_perms;
-allow init { rootfs cache_file cgroup storage_file system_data_file system_file }:dir mounton;
+allow init { rootfs cache_file cgroup storage_file system_data_file system_file postinstall_mnt_dir }:dir mounton;
 
 # Mount on /dev/usb-ffs/adb.
 allow init device:dir mounton;
diff --git a/preopt2cachename.te b/preopt2cachename.te
new file mode 100644
index 0000000000000000000000000000000000000000..49df647250f0f26cfd7b26052b0effc88f67c0c2
--- /dev/null
+++ b/preopt2cachename.te
@@ -0,0 +1,13 @@
+# preopt2cachename executable
+#
+# This executable translates names from the preopted versions the build system
+# creates to the names the runtime expects in the data directory.
+type preopt2cachename, domain;
+type preopt2cachename_exec, exec_type, file_type;
+
+# Allow write to stdout.
+allow preopt2cachename cppreopts:fd use;
+allow preopt2cachename cppreopts:fifo_file { getattr read write };
+
+# Allow write to logcat.
+allow preopt2cachename proc_net:file r_file_perms;
diff --git a/property.te b/property.te
index 90c2912083d05272ec5d161bb8aa9af5061a41b0..2802c0d33a462f91be97ad2d9159ca02a26a6898 100644
--- a/property.te
+++ b/property.te
@@ -33,6 +33,7 @@ type security_prop, property_type, core_property_type;
 type bluetooth_prop, property_type, core_property_type;
 type pan_result_prop, property_type, core_property_type;
 type powerctl_prop, property_type, core_property_type;
+type cppreopt_prop, property_type, core_property_type;
 type nfc_prop, property_type, core_property_type;
 type dalvik_prop, property_type, core_property_type;
 type config_prop, property_type, core_property_type;
diff --git a/property_contexts b/property_contexts
index 91908312b59a76a56cc71e416e79657ec3c59860..2ae1bb0f3d779152e87ce9eec36f49ab0433492f 100644
--- a/property_contexts
+++ b/property_contexts
@@ -21,6 +21,7 @@ ro.runtime.             u:object_r:system_prop:s0
 hw.                     u:object_r:system_prop:s0
 ro.hw.                  u:object_r:system_prop:s0
 sys.                    u:object_r:system_prop:s0
+sys.cppreopt            u:object_r:cppreopt_prop:s0
 sys.powerctl            u:object_r:powerctl_prop:s0
 sys.usb.ffs.            u:object_r:ffs_prop:s0
 service.                u:object_r:system_prop:s0
diff --git a/system_server.te b/system_server.te
index 05e929e7c782e7e040842dc66f9d7a4d516ab2bd..4b7067b54f4b7a0b634eb18ffcdd2928caa7c836 100644
--- a/system_server.te
+++ b/system_server.te
@@ -354,6 +354,9 @@ userdebug_or_eng(`set_prop(system_server, wifi_log_prop)')
 set_prop(system_server, ctl_default_prop)
 set_prop(system_server, ctl_bugreport_prop)
 
+# cppreopt property
+set_prop(system_server, cppreopt_prop)
+
 # Create a socket for receiving info from wpa.
 type_transition system_server wifi_data_file:sock_file system_wpa_socket;
 type_transition system_server wpa_socket:sock_file system_wpa_socket;