diff --git a/app.te b/app.te
index b2bd817506c56d1b8c695d2b23a6ae05d33196b4..976b6bcf42e9c9779b59f9bc6353aa334bb5ea81 100644
--- a/app.te
+++ b/app.te
@@ -14,6 +14,9 @@ net_domain(trusted_app)
 bluetooth_domain(trusted_app)
 # Read logs.
 allow trusted_app log_device:chr_file read;
+# Access /dev/mtp_usb.
+# XXX Split android.process.media into a separate domain?
+allow trusted_app mtp_device:chr_file rw_file_perms;
 # Write to /cache.
 allow trusted_app cache_file:dir rw_dir_perms;
 allow trusted_app cache_file:file create_file_perms;
diff --git a/device.te b/device.te
index 1b9df4f546abd0c8be96f4a56e0b0a921ae52050..6424db6476504cdbf0e0bad5fbf353c8ee155e11 100644
--- a/device.te
+++ b/device.te
@@ -21,6 +21,7 @@ type input_device, dev_type;
 type kmem_device, dev_type;
 type log_device, dev_type, mlstrustedobject;
 type mtd_device, dev_type;
+type mtp_device, dev_type, mlstrustedobject;
 type nfc_device, dev_type;
 type nv_device, dev_type, mlstrustedobject;
 type powervr_device, dev_type, mlstrustedobject;
diff --git a/file_contexts b/file_contexts
index 332017d70f2e88e4fa3836be57c43566a93ff106..92c6bb0f4f137c973932ee103cbd352cc2126524 100644
--- a/file_contexts
+++ b/file_contexts
@@ -33,6 +33,7 @@
 /dev/mtd(/.*)?		u:object_r:mtd_device:s0
 /dev/mtd/mtd5		u:object_r:radio_device:s0
 /dev/mtd/mtd5ro		u:object_r:radio_device:s0
+/dev/mtp_usb		u:object_r:mtp_device:s0
 /dev/pn544		u:object_r:nfc_device:s0
 /dev/ptmx		u:object_r:ptmx_device:s0
 /dev/pvrsrvkm		u:object_r:powervr_device:s0
diff --git a/netd.te b/netd.te
index 94c9604126f292429278667f8de77df1b1b73b96..47687dc7d9ce0f53e35e9fe8a3abf1932e43a199 100644
--- a/netd.te
+++ b/netd.te
@@ -21,10 +21,10 @@ allow netd devpts:chr_file rw_file_perms;
 # XXX Split /proc/sys/net into its own type.
 allow netd proc:file write;
 
-# For firmware_path
+# For /sys/modules/bcmdhd/parameters/firmware_path
 # XXX Split into its own type.
 allow netd sysfs:file write;
 
-# Load network drivers.
+# Network driver loading.
 allow netd kernel:system module_request;
 
diff --git a/system.te b/system.te
index eff7386702100779b68a7a4bf172d50bdd7e5691..970aed8f48931c269b6483cde5a7131686738e82 100644
--- a/system.te
+++ b/system.te
@@ -100,6 +100,7 @@ selinux_check_access(system)
 allow system sysfs:file rw_file_perms;
 
 # Access devices.
+allow system device:dir r_dir_perms;
 allow system device:chr_file rw_file_perms;
 allow system akm_device:chr_file rw_file_perms;
 allow system accelerometer_device:chr_file rw_file_perms;