diff --git a/dex2oat.te b/dex2oat.te
index 83a7c8af54ee2401df4d5cc87b3c8c4d28a88858..42abb55d795d2d2ce79259857db0b896f3951e3a 100644
--- a/dex2oat.te
+++ b/dex2oat.te
@@ -1,5 +1,5 @@
 # dex2oat
-type dex2oat, domain, domain_deprecated;
+type dex2oat, domain, mlstrustedsubject, domain_deprecated;
 type dex2oat_exec, exec_type, file_type;
 
 allow dex2oat dalvikcache_data_file:file write;
@@ -14,3 +14,6 @@ allow dex2oat asec_apk_file:file read;
 allow dex2oat unlabeled:file read;
 allow dex2oat oemfs:file read;
 allow dex2oat apk_tmp_file:file read;
+allow dex2oat app_data_file:file {read write lock};
+
+neverallow dex2oat app_data_file:notdevfile_class_set open;