diff --git a/private/android_hardware_vr.te b/private/android_hardware_vr.te
new file mode 100644
index 0000000000000000000000000000000000000000..65ab4eec7f558548c69188599cda6349e6cfa645
--- /dev/null
+++ b/private/android_hardware_vr.te
@@ -0,0 +1,2 @@
+# may be started by init
+init_daemon_domain(android_hardware_vr)
diff --git a/private/file_contexts b/private/file_contexts
index 5290c2c8df5ad86ef1d563e198072f57e91dc038..c24d2f991b23b685712650e09895b2308fea806e 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -223,6 +223,7 @@
 /system/lib(64)?/libart.*        u:object_r:libart_file:s0
 /system/bin/hw/android.hardware.nfc@1.0-service   u:object_r:android_hardware_nfc_1_0_service_exec:s0
 /system/bin/hw/android.hardware.vibrator@1.0-service   u:object_r:android_hardware_vibrator_service_exec:s0
+/system/bin/hw/android.hardware.vr@1.0-service   u:object_r:android_hardware_vr_exec:s0
 
 #############################
 # Vendor files
diff --git a/public/android_hardware_vr.te b/public/android_hardware_vr.te
new file mode 100644
index 0000000000000000000000000000000000000000..f6651c5c9969b44fbb2281449d86d8830a1db687
--- /dev/null
+++ b/public/android_hardware_vr.te
@@ -0,0 +1,9 @@
+# vr subsystem
+type android_hardware_vr, domain;
+type android_hardware_vr_exec, exec_type, file_type;
+
+# hwbinder access
+hwbinder_use(android_hardware_vr)
+
+# call into system_server process
+binder_call(android_hardware_vr, system_server)
diff --git a/public/system_server.te b/public/system_server.te
index f61bcabaaf85830c5cee80eb47b1f0173ad9b22c..249a3d348f22b1aa3ca81c75153e73bfe5b290f1 100644
--- a/public/system_server.te
+++ b/public/system_server.te
@@ -148,6 +148,7 @@ allow system_server surfaceflinger:unix_stream_socket { read write setopt };
 # Perform Binder IPC.
 binder_use(system_server)
 binder_call(system_server, android_hardware_vibrator_service)
+binder_call(system_server, android_hardware_vr)
 binder_call(system_server, binderservicedomain)
 binder_call(system_server, gatekeeperd)
 binder_call(system_server, fingerprintd)