diff --git a/attributes b/attributes
index 485b3e9a91ba9b2a14436ed534526e0ddd5473e3..30220297a1de3a85cdb043435d85d6f52be6f1d4 100644
--- a/attributes
+++ b/attributes
@@ -67,6 +67,9 @@ attribute property_type;
 # used by device specific properties
 attribute core_property_type;
 
+# All properties used to configure log filtering.
+attribute log_property_type;
+
 # All service_manager types created by system_server
 attribute system_server_service;
 
diff --git a/domain.te b/domain.te
index 9001773b58155ccafbd9b07e5fef8a0b9408642f..294f26e1df562210f49bde42d9a117cf3fd944a1 100644
--- a/domain.te
+++ b/domain.te
@@ -83,6 +83,9 @@ allow domain properties_serial:file r_file_perms;
 # For now, everyone can access core property files
 # Device specific properties are not granted by default
 get_prop(domain, core_property_type)
+# Let everyone read log properties, so that liblog can avoid sending unloggable
+# messages to logd.
+get_prop(domain, log_property_type)
 dontaudit domain property_type:file audit_access;
 allow domain property_contexts:file r_file_perms;
 
diff --git a/property.te b/property.te
index 16802457012922e9a0ba34aec75ed2247d163d1c..a7370aec612edebb573e5905553a66505de3bfe1 100644
--- a/property.te
+++ b/property.te
@@ -21,6 +21,7 @@ type ctl_rildaemon_prop, property_type;
 type ctl_bugreport_prop, property_type;
 type ctl_console_prop, property_type;
 type audio_prop, property_type, core_property_type;
+type log_prop, property_type, log_property_type;
 type logd_prop, property_type, core_property_type;
 type mmc_prop, property_type;
 type restorecon_prop, property_type, core_property_type;
diff --git a/property_contexts b/property_contexts
index 1329854b4fc59ea8e0a81d41588ba9a169b85626..e634165540f3782c44496cc720c21199158633ce 100644
--- a/property_contexts
+++ b/property_contexts
@@ -32,7 +32,7 @@ bluetooth.              u:object_r:bluetooth_prop:s0
 debug.                  u:object_r:debug_prop:s0
 debug.db.               u:object_r:debuggerd_prop:s0
 dumpstate.              u:object_r:dumpstate_prop:s0
-log.                    u:object_r:shell_prop:s0
+log.                    u:object_r:log_prop:s0
 service.adb.root        u:object_r:shell_prop:s0
 service.adb.tcp.port    u:object_r:shell_prop:s0
 
@@ -40,7 +40,7 @@ persist.audio.          u:object_r:audio_prop:s0
 persist.debug.          u:object_r:persist_debug_prop:s0
 persist.logd.           u:object_r:logd_prop:s0
 persist.logd.security   u:object_r:device_logging_prop:s0
-persist.log.tag         u:object_r:logd_prop:s0
+persist.log.tag         u:object_r:log_prop:s0
 persist.mmc.            u:object_r:mmc_prop:s0
 persist.sys.            u:object_r:system_prop:s0
 persist.sys.safemode    u:object_r:safemode_prop:s0
diff --git a/shell.te b/shell.te
index a314c612694e990af04d1a0db84c5a4dce32d414..ad610b42c9491b4a1f05370163b2b0caea948e85 100644
--- a/shell.te
+++ b/shell.te
@@ -63,6 +63,7 @@ set_prop(shell, ctl_dumpstate_prop)
 set_prop(shell, dumpstate_prop)
 set_prop(shell, debug_prop)
 set_prop(shell, powerctl_prop)
+userdebug_or_eng(`set_prop(shell, log_prop)')
 
 # systrace support - allow atrace to run
 allow shell debugfs_tracing:dir r_dir_perms;
diff --git a/system_app.te b/system_app.te
index afc2be5f5bc4ab0d956aafc52a8daac804bb5df4..b3f4b301903519095eb15d7aa89e75f902a5d69e 100644
--- a/system_app.te
+++ b/system_app.te
@@ -31,6 +31,7 @@ set_prop(system_app, system_prop)
 set_prop(system_app, logd_prop)
 set_prop(system_app, net_radio_prop)
 set_prop(system_app, system_radio_prop)
+set_prop(system_app, log_prop)
 auditallow system_app net_radio_prop:property_service set;
 auditallow system_app system_radio_prop:property_service set;