diff --git a/public/debuggerd.te b/public/debuggerd.te
index da1314a04e56b415deb7f6453e0a41531300013a..33f88784f7c6f69a2090dc9048d8e715b22c3df3 100644
--- a/public/debuggerd.te
+++ b/public/debuggerd.te
@@ -23,7 +23,7 @@ allow debuggerd tombstone_data_file:file create_file_perms;
 allow debuggerd shared_relro_file:dir r_dir_perms;
 allow debuggerd shared_relro_file:file r_file_perms;
 allow debuggerd domain:process { sigstop sigkill signal };
-allow debuggerd exec_type:file r_file_perms;
+allow debuggerd { exec_type libart_file }:file r_file_perms;
 # Access app library
 allow debuggerd system_data_file:file open;
 # Allow debuggerd to redirect a dump_backtrace request to itself.
diff --git a/public/domain.te b/public/domain.te
index 68e81ed7de224fe0ccebe715557b1ce1d349e8f9..88abff39726bca0b2d37c765ab397c1f505081ea 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -107,8 +107,10 @@ allow domain libart_file:file { execute read open getattr };
 auditallow {
   domain
   -appdomain
+  -debuggerd
   -dex2oat
   -dumpstate
+  -profman
   -recovery
   -zygote
 } libart_file:file { execute read open getattr };
diff --git a/public/profman.te b/public/profman.te
index fa3df94a6526d52e6174959b41d7f94a9de15cd3..6afd417f939ef9611f93c01761119c57b6540db4 100644
--- a/public/profman.te
+++ b/public/profman.te
@@ -2,6 +2,8 @@
 type profman, domain;
 type profman_exec, exec_type, file_type;
 
+allow profman libart_file:file r_file_perms;
+
 allow profman user_profile_data_file:file { getattr read write lock };
 
 # Dumping profile info opens the application APK file for pretty printing.
@@ -14,4 +16,8 @@ allow profman profman_dump_data_file:file { write };
 
 allow profman installd:fd use;
 
+###
+### neverallow rules
+###
+
 neverallow profman app_data_file:notdevfile_class_set open;