diff --git a/app.te b/app.te
index 967a32f7a0182d27451988bdc5b1bf2843717284..e8d272d27563da7189e6249a0bd89d2e4d4a2653 100644
--- a/app.te
+++ b/app.te
@@ -20,8 +20,10 @@ allow platform_app cache_file:file create_file_perms;
 allow platform_app shell_data_file:dir search;
 allow platform_app shell_data_file:file { open getattr read };
 allow platform_app shell_data_file:lnk_file read;
-# Populate /data/app/vmdl*.tmp file created by system server.
-allow platform_app apk_tmp_file:file rw_file_perms;
+# Populate /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files
+# created by system server.
+allow platform_app { apk_tmp_file apk_private_tmp_file }:file rw_file_perms;
+allow platform_app apk_private_data_file:dir search;
 # ASEC
 allow platform_app asec_apk_file:dir create_dir_perms;
 allow platform_app asec_apk_file:file create_file_perms;
diff --git a/file.te b/file.te
index a82945a5f4e15076b7800140370bb1c33f0903f0..5ec92cc8cbba0a8014b82e654d618ae80f57434f 100644
--- a/file.te
+++ b/file.te
@@ -36,6 +36,9 @@ type tombstone_data_file, file_type, data_file_type;
 # /data/app - user-installed apps
 type apk_data_file, file_type, data_file_type;
 type apk_tmp_file, file_type, data_file_type, mlstrustedobject;
+# /data/app-private - forward-locked apps
+type apk_private_data_file, file_type, data_file_type;
+type apk_private_tmp_file, file_type, data_file_type, mlstrustedobject;
 # /data/dalvik-cache
 type dalvikcache_data_file, file_type, data_file_type;
 # /data/local - writable by shell
diff --git a/file_contexts b/file_contexts
index 26a1863dc2ccc65aa0f91504ad6717381c981891..1e34bd94e5acfd57b4f54f6cee6a28316bb0a0a0 100644
--- a/file_contexts
+++ b/file_contexts
@@ -165,6 +165,8 @@
 /data/anr(/.*)?		u:object_r:anr_data_file:s0
 /data/app(/.*)?		u:object_r:apk_data_file:s0
 /data/app/vmdl.*\.tmp	u:object_r:apk_tmp_file:s0
+/data/app-private(/.*)?		u:object_r:apk_private_data_file:s0
+/data/app-private/vmdl.*\.tmp	u:object_r:apk_private_tmp_file:s0
 /data/tombstones(/.*)?	u:object_r:tombstone_data_file:s0
 /data/local/tmp(/.*)?	u:object_r:shell_data_file:s0
 # Misc data
diff --git a/system.te b/system.te
index db699aa2743e6c2ec29abd888404b49315af7c2e..1c543e7c3f3f72aaeb1c25fc49b07a1100b2acd7 100644
--- a/system.te
+++ b/system.te
@@ -152,8 +152,8 @@ allow system data_file_type:notdevfile_class_set create_file_perms;
 allow system rootfs:file r_file_perms;
 
 # Relabel apk files.
-allow system apk_tmp_file:file { relabelfrom relabelto };
-allow system apk_data_file:file { relabelfrom relabelto };
+allow system { apk_tmp_file apk_private_tmp_file }:file { relabelfrom relabelto };
+allow system { apk_data_file apk_private_data_file }:file { relabelfrom relabelto };
 
 # Relabel wallpaper.
 allow system system_data_file:file relabelfrom;