diff --git a/app.te b/app.te
index 2d6416f3e71ba5d349413201d38ae0594ae04717..8288ea054bbeb5d7abcf6749725de07c35648876 100644
--- a/app.te
+++ b/app.te
@@ -61,6 +61,9 @@ allow appdomain oemfs:file rx_file_perms;
 allow appdomain shell_exec:file rx_file_perms;
 allow appdomain system_file:file rx_file_perms;
 
+# Execute dex2oat when apps call dexclassloader
+allow appdomain dex2oat_exec:file rx_file_perms;
+
 # Read/write wallpaper file (opened by system).
 allow appdomain wallpaper_file:file { getattr read write };
 
diff --git a/dex2oat.te b/dex2oat.te
new file mode 100644
index 0000000000000000000000000000000000000000..51acc86bfb402a35188f90f968763508741d711f
--- /dev/null
+++ b/dex2oat.te
@@ -0,0 +1,6 @@
+# dex2oat
+type dex2oat, domain;
+type dex2oat_exec, exec_type, file_type;
+
+allow dex2oat dalvikcache_data_file:file write;
+allow dex2oat installd:fd use;
diff --git a/file_contexts b/file_contexts
index 57fc1f2f91b58c94d5826f1a808e58a344c6bfcd..def1e5349ce6359a619825708d1f823315625cf0 100644
--- a/file_contexts
+++ b/file_contexts
@@ -160,6 +160,7 @@
 /system/bin/logwrapper  u:object_r:system_file:s0
 /system/bin/vdc         u:object_r:vdc_exec:s0
 /system/bin/install-recovery.sh u:object_r:install_recovery_exec:s0
+/system/bin/dex2oat     u:object_r:dex2oat_exec:s0
 
 #############################
 # Vendor files
diff --git a/installd.te b/installd.te
index 5faa1ec82595bafc6415325055f700d2b44c2d44..6257edeb6fb719daa9d4c448fd5336abdd3cf1a2 100644
--- a/installd.te
+++ b/installd.te
@@ -53,6 +53,12 @@ allow installd dalvikcache_profiles_data_file:file create_file_perms;
 allow installd resourcecache_data_file:dir rw_dir_perms;
 allow installd resourcecache_data_file:file create_file_perms;
 
+# Run dex2oat in its own sandbox.
+domain_auto_trans(installd, dex2oat_exec, dex2oat)
+# dex2oat needs LD_PRELOAD, passed down from init
+# https://android-review.googlesource.com/94851
+allow installd dex2oat:process noatsecure;
+
 # Upgrade from unlabeled userdata.
 # Just need enough to remove and/or relabel it.
 allow installd unlabeled:dir { getattr search relabelfrom rw_dir_perms rmdir };
diff --git a/zygote.te b/zygote.te
index c2a325eecb1a7bad7da0fd61d536260f8061644f..c2a23959343b06056254850eb401dcad7e7f7f6d 100644
--- a/zygote.te
+++ b/zygote.te
@@ -31,6 +31,7 @@ allow zygote resourcecache_data_file:file create_file_perms;
 allow zygote dalvikcache_data_file:file execute;
 # Execute dexopt.
 allow zygote system_file:file x_file_perms;
+allow zygote dex2oat_exec:file rx_file_perms;
 # Control cgroups.
 allow zygote cgroup:dir create_dir_perms;
 allow zygote self:capability sys_admin;