diff --git a/domain.te b/domain.te
index 0a819c2650889a7562e5d9e6824fcce4d85ea61c..a312acbabe93f86b5705101446afa4e635afb168 100644
--- a/domain.te
+++ b/domain.te
@@ -122,6 +122,9 @@ allow domain proc:lnk_file { getattr read };
 # /proc/cpuinfo
 allow domain proc_cpuinfo:file r_file_perms;
 
+# jemalloc needs to read /proc/sys/vm/overcommit_memory
+allow domain proc_overcommit_memory:file r_file_perms;
+
 # toybox loads libselinux which stats /sys/fs/selinux/
 allow domain selinuxfs:dir search;
 allow domain selinuxfs:file getattr;
diff --git a/file.te b/file.te
index 95415d31f19a06ecbd267566da979eba56809ab9..3a4ca03831ea3e13e145e2dc1b1f4949edd3de86 100644
--- a/file.te
+++ b/file.te
@@ -6,8 +6,8 @@ type rootfs, fs_type;
 type proc, fs_type;
 # Security-sensitive proc nodes that should not be writable to most.
 type proc_security, fs_type;
-# Type for /proc/sys/vm/drop_caches
 type proc_drop_caches, fs_type;
+type proc_overcommit_memory, fs_type;
 # proc, sysfs, or other nodes that permit configuration of kernel usermodehelpers.
 type usermodehelper, fs_type, sysfs_type;
 type qtaguid_proc, fs_type, mlstrustedobject;
diff --git a/genfs_contexts b/genfs_contexts
index 31794a1e834096abc55a76c71a647ba187a826e3..81749fd1c89e5ca44e48e45fd90a60ca22ac4eeb 100644
--- a/genfs_contexts
+++ b/genfs_contexts
@@ -23,6 +23,7 @@ genfscon proc /sys/kernel/usermodehelper u:object_r:usermodehelper:s0
 genfscon proc /sys/net u:object_r:proc_net:s0
 genfscon proc /sys/vm/mmap_min_addr u:object_r:proc_security:s0
 genfscon proc /sys/vm/drop_caches u:object_r:proc_drop_caches:s0
+genfscon proc /sys/vm/overcommit_memory u:object_r:proc_overcommit_memory:s0
 genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0
 genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0