diff --git a/domain.te b/domain.te
index 7df8e6fb94db5dd199a835eff23e3d1790277704..a67e77abe60d7584edd1b65b4f3e045c628e86fa 100644
--- a/domain.te
+++ b/domain.te
@@ -356,10 +356,6 @@ neverallow {
   -zygote
   -installd
   -dex2oat
-  -system_server # TODO: The system server needs to create directories
-                 # and link files for split APK installs. This could perhaps be
-                 # removed if we made installd responsible for manipulating the
-                 # staging directory.
 } dalvikcache_data_file:file no_w_file_perms;
 
 # Only system_server should be able to send commands via the zygote socket
diff --git a/installd.te b/installd.te
index a47853f80547a9c3d20e638c7c5a7a4bc8fdcf08..18d6c6d1fb2e40690829f2f3ef5014ef3ed30b9c 100644
--- a/installd.te
+++ b/installd.te
@@ -8,11 +8,11 @@ allow installd self:capability { chown dac_override fowner fsetid setgid setuid
 
 # Allow labeling of files under /data/app/com.example/oat/
 allow installd dalvikcache_data_file:dir relabelto;
-allow installd dalvikcache_data_file:file relabelto;
+allow installd dalvikcache_data_file:file { relabelto link };
 
 # Allow movement of APK files between volumes
 allow installd apk_data_file:dir { create_dir_perms relabelfrom };
-allow installd apk_data_file:file { create_file_perms relabelfrom };
+allow installd apk_data_file:file { create_file_perms relabelfrom link };
 allow installd apk_data_file:lnk_file { create read unlink };
 
 allow installd asec_apk_file:file r_file_perms;
diff --git a/system_server.te b/system_server.te
index 5d1398ab1af960916e65c50c7a102d684bfc96f6..0b18eb4b6db1d5dfcd3f2367c9c83b88307ccc25 100644
--- a/system_server.te
+++ b/system_server.te
@@ -16,25 +16,6 @@ allow system_server system_server_tmpfs:file execute;
 allow system_server dalvikcache_data_file:file execute;
 allow system_server dalvikcache_data_file:dir r_dir_perms;
 
-# For PackageInstallerSession.
-#
-# All of these rules relate to the installation and compilation of split
-# APKs. Roughly, the process is as follows. The rules below only pertain
-# to step (3) of the process
-#
-# (1) Create a staging directory.
-# (2) Link existing APKs from the split
-#
-# (3) Link existing compiled oat files : This requires "create_dir_perms"
-# to create oat directories (foo/oat and foo/oat/x86), "relabelto" to
-# make sure they have the right label, and "link" to link files.
-#
-# (3) Invoke dex2oat to compile the updated / new split
-# (4) Rename the staging directory back to the final path.
-allow system_server dalvikcache_data_file:file link;
-allow system_server dalvikcache_data_file:dir relabelto;
-allow system_server dalvikcache_data_file:dir create_dir_perms;
-
 # /data/resource-cache
 allow system_server resourcecache_data_file:file r_file_perms;
 allow system_server resourcecache_data_file:dir r_dir_perms;