diff --git a/private/property_contexts b/private/property_contexts
index a27b7566fc7493924efeb848979dd1f0eaf8e65e..39e8a8db894aa4e2826e7527e592fcde38bb6723 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -18,6 +18,7 @@ persist.radio           u:object_r:radio_prop:s0
 net.                    u:object_r:system_prop:s0
 dev.                    u:object_r:system_prop:s0
 ro.runtime.             u:object_r:system_prop:s0
+ro.runtime.firstboot    u:object_r:firstboot_prop:s0
 hw.                     u:object_r:system_prop:s0
 ro.hw.                  u:object_r:system_prop:s0
 sys.                    u:object_r:system_prop:s0
diff --git a/public/domain.te b/public/domain.te
index 47b3e5a4632485f46c8bbe1f136bf69cfc928eff..2bf0be312312b8657467815f0700c7b7eb1b38d7 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -386,6 +386,9 @@ neverallow {
   -system_server
 } serialno_prop:file r_file_perms;
 
+# Do not allow reading the last boot timestamp from system properties
+neverallow { domain -init -system_server } firstboot_prop:file r_file_perms;
+
 neverallow {
   domain
   -init
diff --git a/public/property.te b/public/property.te
index 0bba50d3a91f1e34178367855301fd852e4f9a5c..ce5ce2f9b711c241c123009e903db88b7a9b91c1 100644
--- a/public/property.te
+++ b/public/property.te
@@ -21,6 +21,7 @@ type dumpstate_options_prop, property_type;
 type dumpstate_prop, property_type, core_property_type;
 type ffs_prop, property_type, core_property_type;
 type fingerprint_prop, property_type, core_property_type;
+type firstboot_prop, property_type;
 type hwservicemanager_prop, property_type;
 type logd_prop, property_type, core_property_type;
 type logpersistd_logging_prop, property_type;
diff --git a/public/system_server.te b/public/system_server.te
index bc1dd9f34489956df99dc7739ebf061c24adc52e..99ff1d8168b15701eccf29938a9c2e8da562ed6a 100644
--- a/public/system_server.te
+++ b/public/system_server.te
@@ -391,6 +391,9 @@ get_prop(system_server, boottime_prop)
 # Read device's serial number from system properties
 get_prop(system_server, serialno_prop)
 
+# Read/write the property which keeps track of whether this is the first start of system_server
+set_prop(system_server, firstboot_prop)
+
 # Create a socket for receiving info from wpa.
 allow system_server wpa_socket:dir rw_dir_perms;
 allow system_server system_wpa_socket:sock_file create_file_perms;