diff --git a/public/domain.te b/public/domain.te
index 66029f8120c20343df76efa550bc4175e19ecad7..2a27ad96545fe04d334e27c5b15910db3d42c113 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -686,6 +686,7 @@ full_treble_only(`
         -idmap
         -init
         -installd
+        -postinstall_dexopt
         -system_server
     } vendor_app_file:dir { open read getattr search };
 
@@ -696,6 +697,7 @@ full_treble_only(`
         -idmap
         -init
         -installd
+        -postinstall_dexopt
         -system_server
     } vendor_app_file:{ file lnk_file } r_file_perms;
 
diff --git a/public/postinstall_dexopt.te b/public/postinstall_dexopt.te
index 76001f7bbd0b5e2578113dcc60d9abbc8adc0d76..b66c9274b0171e822cc4e1bc06dc1f751419aa63 100644
--- a/public/postinstall_dexopt.te
+++ b/public/postinstall_dexopt.te
@@ -17,6 +17,8 @@ allow postinstall_dexopt tmpfs:file read;
 
 # Read app data (APKs) as input to dex2oat.
 r_dir_file(postinstall_dexopt, apk_data_file)
+# Read vendor app data (APKs) as input to dex2oat.
+r_dir_file(postinstall_dexopt, vendor_app_file)
 # Access to app oat directory.
 r_dir_file(postinstall_dexopt, dalvikcache_data_file)