diff --git a/property.te b/property.te
index 1a209e9a485bb3844cbb1c70098d43938a9041db..6fedfa7a53a47cad3b439b24b546123022724ef4 100644
--- a/property.te
+++ b/property.te
@@ -3,6 +3,7 @@ type shell_prop, property_type;
 type debug_prop, property_type;
 type debuggerd_prop, property_type;
 type dhcp_prop, property_type;
+type fingerprint_prop, property_type;
 type radio_prop, property_type;
 type net_radio_prop, property_type;
 type system_radio_prop, property_type;
diff --git a/property_contexts b/property_contexts
index 8403d382d6e7d96f0c0cc9647cbc025860277653..06f6c174b986a2a0d83b9cecb703364f34cc0486 100644
--- a/property_contexts
+++ b/property_contexts
@@ -49,6 +49,10 @@ selinux.                u:object_r:security_prop:s0
 vold.                   u:object_r:vold_prop:s0
 crypto.                 u:object_r:vold_prop:s0
 
+# ro.build.fingerprint is either set in /system/build.prop, or is
+# set at runtime by system_server.
+build.fingerprint       u:object_r:fingerprint_prop:s0
+
 # ctl properties
 ctl.bootanim            u:object_r:ctl_bootanim_prop:s0
 ctl.dumpstate           u:object_r:ctl_dumpstate_prop:s0
diff --git a/system_server.te b/system_server.te
index ae14ab36b512ed39761206518dd049f0084f7a36..a8348e7202ef2d001a79519bae11474e6a7d9913 100644
--- a/system_server.te
+++ b/system_server.te
@@ -277,6 +277,7 @@ allow system_server net_radio_prop:property_service set;
 allow system_server system_radio_prop:property_service set;
 allow system_server debug_prop:property_service set;
 allow system_server powerctl_prop:property_service set;
+allow system_server fingerprint_prop:property_service set;
 
 # ctl interface
 allow system_server ctl_default_prop:property_service set;