diff --git a/dumpstate.te b/dumpstate.te
index fbf9ce923764fa00d9cf75c64471440c73ad523f..5977422814dd0baf7746b16abc7b9351538f21c1 100644
--- a/dumpstate.te
+++ b/dumpstate.te
@@ -73,3 +73,16 @@ allow dumpstate self:capability sys_ptrace;
 # /data/data/com.android.shell/files/bugreports/bugreport
 allow dumpstate shell_data_file:dir create_dir_perms;
 allow dumpstate shell_data_file:file create_file_perms;
+
+# Run a shell.
+allow dumpstate shell_exec:file rx_file_perms;
+
+# For running am and similar framework commands.
+# Run /system/bin/app_process.
+allow dumpstate zygote_exec:file rx_file_perms;
+# Dalvik Compiler JIT.
+allow dumpstate ashmem_device:chr_file execute;
+allow dumpstate dumpstate_tmpfs:file execute;
+allow dumpstate self:process execmem;
+# For art.
+allow dumpstate dalvikcache_data_file:file execute;
diff --git a/system_server.te b/system_server.te
index 06bca76a6fc4174b4504ef06ba18f99ffa671e80..19719124fe8c5b77fe18eb92339ce63b4e97911a 100644
--- a/system_server.te
+++ b/system_server.te
@@ -104,6 +104,7 @@ binder_use(system_server)
 binder_call(system_server, binderservicedomain)
 binder_call(system_server, appdomain)
 binder_call(system_server, healthd)
+binder_call(system_server, dumpstate)
 binder_service(system_server)
 
 # Read /proc/pid files for Binder clients.