diff --git a/app.te b/app.te
index 3c0a88b945ee93c9e289eb82df2d41b586c8f03a..29f0eeb3b2637d29758e49d708b90122ec777b30 100644
--- a/app.te
+++ b/app.te
@@ -107,6 +107,9 @@ allow appdomain ringtone_file:file { getattr read write };
 # Read ShortcutManager icon files (opened by system).
 allow appdomain shortcut_manager_icons:file { getattr read };
 
+# Read icon file (opened by system).
+allow appdomain icon_file:file { getattr read };
+
 # Write to /data/anr/traces.txt.
 allow appdomain anr_data_file:dir search;
 allow appdomain anr_data_file:file { open append };
diff --git a/file.te b/file.te
index 6f32aeb50b32a9b314afe551da15d28726715dbe..644490e85a738d9dac5acb893b56c9e72517bf83 100644
--- a/file.te
+++ b/file.te
@@ -170,6 +170,8 @@ type efs_file, file_type;
 type wallpaper_file, file_type, data_file_type, mlstrustedobject;
 # Type for shortcut manager icon file.
 type shortcut_manager_icons, file_type, data_file_type, mlstrustedobject;
+# Type for user icon file.
+type icon_file, file_type, data_file_type;
 # /mnt/asec
 type asec_apk_file, file_type, data_file_type, mlstrustedobject;
 # Elements of asec files (/mnt/asec) that are world readable
diff --git a/file_contexts b/file_contexts
index a3cebbf476c3e3c9c05b0d888b97c3677b82c61c..200bfb3111aead193c502138717b28912c987a99 100644
--- a/file_contexts
+++ b/file_contexts
@@ -334,6 +334,9 @@
 #   /data/system_ce/0/shortcut_service/bitmaps/com.example.app/1457472879282.png
 /data/system_ce/[0-9]+/shortcut_service/bitmaps(/.*)? u:object_r:shortcut_manager_icons:s0
 
+# User icon files
+/data/system/users/[0-9]+/photo.png             u:object_r:icon_file:s0
+
 #############################
 # efs files
 #
diff --git a/platform_app.te b/platform_app.te
index 3d46f7f87871b9a663b7d42c1e97e7aeb24edd04..3e6cd1aac158609030cbd09c89985a1a4a94773c 100644
--- a/platform_app.te
+++ b/platform_app.te
@@ -11,6 +11,7 @@ bluetooth_domain(platform_app)
 # Read from /data/local/tmp or /data/data/com.android.shell.
 allow platform_app shell_data_file:dir search;
 allow platform_app shell_data_file:file { open getattr read };
+allow platform_app icon_file:file { open getattr read };
 # Populate /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files
 # created by system server.
 allow platform_app { apk_tmp_file apk_private_tmp_file }:dir rw_dir_perms;
diff --git a/system_app.te b/system_app.te
index a07a9b9d8019cc9ad543a1ba1343624bb17b7bb9..afc2be5f5bc4ab0d956aafc52a8daac804bb5df4 100644
--- a/system_app.te
+++ b/system_app.te
@@ -22,6 +22,9 @@ allow system_app mnt_media_rw_file:dir search;
 # Read wallpaper file.
 allow system_app wallpaper_file:file r_file_perms;
 
+# Read icon file.
+allow system_app icon_file:file r_file_perms;
+
 # Write to properties
 set_prop(system_app, debug_prop)
 set_prop(system_app, system_prop)
diff --git a/system_server.te b/system_server.te
index c8364e25d84325a7ebe2231f4fa88f7eb3028063..757591f566b428e6deefc737989e9ee05cbc3d71 100644
--- a/system_server.te
+++ b/system_server.te
@@ -310,6 +310,10 @@ allow system_server shortcut_manager_icons:file create_file_perms;
 allow system_server ringtone_file:dir { create_dir_perms relabelto };
 allow system_server ringtone_file:file create_file_perms;
 
+# Relabel icon file.
+allow system_server icon_file:file relabelto;
+allow system_server icon_file:file { rw_file_perms unlink };
+
 # FingerprintService.java does a restorecon of the directory /data/system/users/[0-9]+/fpdata(/.*)?
 allow system_server system_data_file:dir relabelfrom;