diff --git a/app.te b/app.te
index 29f0eeb3b2637d29758e49d708b90122ec777b30..c9c5ca201fbce88329e5d5a1d34dde06fcbc5abc 100644
--- a/app.te
+++ b/app.te
@@ -182,6 +182,8 @@ allow appdomain mnt_user_file:lnk_file r_file_perms;
 # Read/write visible storage
 allow appdomain fuse:dir create_dir_perms;
 allow appdomain fuse:file create_file_perms;
+allow appdomain sdcardfs:dir create_dir_perms;
+allow appdomain sdcardfs:file create_file_perms;
 
 # Access OBBs (vfat images) mounted by vold (b/17633509)
 # File write access allowed for FDs returned through Storage Access Framework
diff --git a/file.te b/file.te
index 43cacbb7508423269666e7d36b2a5b80a55d4014..53fac044e162b00607773b37933c66162b947ef1 100644
--- a/file.te
+++ b/file.te
@@ -29,6 +29,7 @@ type sysfs_hwrandom, fs_type, sysfs_type;
 type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject;
 type sysfs_wake_lock, fs_type, sysfs_type;
 type sysfs_mac_address, fs_type, sysfs_type;
+type configfs, fs_type;
 # /sys/devices/system/cpu
 type sysfs_devices_system_cpu, fs_type, sysfs_type;
 # /sys/module/lowmemorykiller
@@ -41,6 +42,7 @@ type tmpfs, fs_type;
 type shm, fs_type;
 type mqueue, fs_type;
 type fuse, sdcard_type, fs_type, mlstrustedobject;
+type sdcardfs, sdcard_type, fs_type, mlstrustedobject;
 type vfat, sdcard_type, fs_type, mlstrustedobject;
 type debugfs, fs_type;
 type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject;
diff --git a/genfs_contexts b/genfs_contexts
index 2700a945895ef4526fcc2a458732205e6ff66b41..d3d8bfb7ec3b8082754ee95731d27d5dfd134002 100644
--- a/genfs_contexts
+++ b/genfs_contexts
@@ -35,6 +35,8 @@ genfscon inotifyfs / u:object_r:inotify:s0
 genfscon vfat / u:object_r:vfat:s0
 genfscon debugfs / u:object_r:debugfs:s0
 genfscon fuse / u:object_r:fuse:s0
+genfscon configfs / u:object_r:configfs:s0
+genfscon sdcardfs / u:object_r:sdcardfs:s0
 genfscon pstore / u:object_r:pstorefs:s0
 genfscon functionfs / u:object_r:functionfs:s0
 genfscon usbfs / u:object_r:usbfs:s0
diff --git a/init.te b/init.te
index 047ea73d8ea8fa7bde1109d71122e9eaf0a909e7..efe3911d78b053e1e90684e607fd64bdf17aae58 100644
--- a/init.te
+++ b/init.te
@@ -61,6 +61,10 @@ allow init tmpfs:dir mounton;
 allow init cgroup:dir create_dir_perms;
 allow init cpuctl_device:dir { create mounton };
 
+# /config
+allow init configfs:dir mounton;
+allow init configfs:dir create_dir_perms;
+
 # Use tmpfs as /data, used for booting when /data is encrypted
 allow init tmpfs:dir relabelfrom;
 
diff --git a/system_server.te b/system_server.te
index 11c40eddaaa1087acf6769a90b1e7cdcd42f1bff..0e4ac39612055fad3443c8b13e7657da17124cff 100644
--- a/system_server.te
+++ b/system_server.te
@@ -481,6 +481,10 @@ userdebug_or_eng(`
 allow system_server vold:fd use;
 allow system_server fuse_device:chr_file { read write ioctl getattr };
 
+# For configuring sdcardfs
+allow system_server configfs:dir { create_dir_perms };
+allow system_server configfs:file { getattr open unlink write };
+
 # Connect to adbd and use a socket transferred from it.
 # Used for e.g. jdwp.
 allow system_server adbd:unix_stream_socket connectto;
diff --git a/untrusted_app.te b/untrusted_app.te
index 07b754f91a0c8efa588f2130e9cc8de96994c38f..d4d90ccf6a8970849a546030ff7aae95aadcc663 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -170,6 +170,7 @@ neverallow untrusted_app property_type:property_service set;
 neverallow untrusted_app {
   fs_type
   -fuse                     # sdcard
+  -sdcardfs                 # sdcard
   file_type
   -app_data_file            # The apps sandbox itself
   -media_rw_data_file       # Internal storage. Known that apps can
diff --git a/zygote.te b/zygote.te
index 013d8c6aa96873368cdfd5e2bd178cdea88de8cb..89dccfcf7bac6d4e68556ba0a22a46f2d73abb92 100644
--- a/zygote.te
+++ b/zygote.te
@@ -54,6 +54,7 @@ allow zygote proc_cpuinfo:file mounton;
 allow zygote rootfs:dir mounton;
 allow zygote tmpfs:filesystem { mount unmount };
 allow zygote fuse:filesystem { unmount };
+allow zygote sdcardfs:filesystem { unmount };
 
 # Allowed to create user-specific storage source if started before vold
 allow zygote mnt_user_file:dir create_dir_perms;