diff --git a/private/hal_drm_default.te b/private/hal_drm_default.te
index 6e4df5b8ba2fb964c703f7695eff08e29fab691a..74875af44e7d06c092b614c4889967a3c5d45747 100644
--- a/private/hal_drm_default.te
+++ b/private/hal_drm_default.te
@@ -3,3 +3,6 @@ hal_impl_domain(hal_drm_default, hal_drm)
 
 type hal_drm_default_exec, exec_type, file_type;
 init_daemon_domain(hal_drm_default)
+
+allow hal_drm_default mediacodec:fd use;
+allow hal_drm_default { appdomain -isolated_app }:fd use;
diff --git a/public/mediadrmserver.te b/public/mediadrmserver.te
index f93cf4545e728e0d93e324f022c5b73c3ec86980..8835585f6f92dc2077489a84a4d047ea4099fe9c 100644
--- a/public/mediadrmserver.te
+++ b/public/mediadrmserver.te
@@ -9,6 +9,7 @@ binder_use(mediadrmserver)
 binder_call(mediadrmserver, binderservicedomain)
 binder_call(mediadrmserver, appdomain)
 binder_service(mediadrmserver)
+binder_call(mediadrmserver, hal_drm)
 
 add_service(mediadrmserver, mediadrmserver_service)
 allow mediadrmserver mediaserver_service:service_manager find;