diff --git a/property.te b/property.te
index cfa3ec9687b2a089492ee7121dc34cc301775291..aff073a72fb5cf0e7016f0aa257a57161854df2a 100644
--- a/property.te
+++ b/property.te
@@ -3,6 +3,7 @@ type shell_prop, property_type;
 type debug_prop, property_type;
 type debuggerd_prop, property_type;
 type dhcp_prop, property_type;
+type fingerprint_prop, property_type;
 type radio_prop, property_type;
 type net_radio_prop, property_type;
 type system_radio_prop, property_type;
diff --git a/property_contexts b/property_contexts
index f89c43282271bd428151fa48b3a3f63b8afbec10..91ab594df5b44377c1c10b9cce326c976718bc20 100644
--- a/property_contexts
+++ b/property_contexts
@@ -49,6 +49,10 @@ selinux.                u:object_r:security_prop:s0
 vold.                   u:object_r:vold_prop:s0
 crypto.                 u:object_r:vold_prop:s0
 
+# ro.build.fingerprint is either set in /system/build.prop, or is
+# set at runtime by system_server.
+build.fingerprint       u:object_r:fingerprint_prop:s0
+
 # ctl properties
 ctl.bootanim            u:object_r:ctl_bootanim_prop:s0
 ctl.dumpstate           u:object_r:ctl_dumpstate_prop:s0
diff --git a/system_server.te b/system_server.te
index 5786c2ee098b2f6010120f4694bd374d16505660..d45d5de1844a1d90f1943efb33d321a7d300eab1 100644
--- a/system_server.te
+++ b/system_server.te
@@ -278,6 +278,7 @@ allow system_server net_radio_prop:property_service set;
 allow system_server system_radio_prop:property_service set;
 allow system_server debug_prop:property_service set;
 allow system_server powerctl_prop:property_service set;
+allow system_server fingerprint_prop:property_service set;
 
 # ctl interface
 allow system_server ctl_default_prop:property_service set;