diff --git a/private/compat/26.0/26.0.cil b/private/compat/26.0/26.0.cil
index 4ad2d8443a41448427c92dc31e5b23f0c0460a73..5a6ad3a5454f7e4b54954ef5e2fcf7e43bc447e3 100644
--- a/private/compat/26.0/26.0.cil
+++ b/private/compat/26.0/26.0.cil
@@ -447,7 +447,7 @@
 (typeattributeset preopt2cachename_exec_26_0 (preopt2cachename_exec))
 (typeattributeset print_service_26_0 (print_service))
 (typeattributeset priv_app_26_0 (mediaprovider priv_app))
-(typeattributeset proc_26_0 (proc proc_asound_cards proc_filesystems proc_kmsg proc_loadavg proc_mounts proc_pagetypeinfo proc_swaps proc_uid_time_in_state proc_version proc_vmallocinfo))
+(typeattributeset proc_26_0 (proc proc_asound_cards proc_cmdline proc_filesystems proc_kmsg proc_loadavg proc_mounts proc_pagetypeinfo proc_swaps proc_uid_time_in_state proc_version proc_vmallocinfo))
 (typeattributeset proc_bluetooth_writable_26_0 (proc_bluetooth_writable))
 (typeattributeset proc_cpuinfo_26_0 (proc_cpuinfo))
 (typeattributeset proc_drop_caches_26_0 (proc_drop_caches))
diff --git a/private/genfs_contexts b/private/genfs_contexts
index cfe7b92c8ad97aca19ee8c88709c415bfdbc9326..b5827c80337a5adf6ecbc32bb0a4303c6cc5fe85 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -3,6 +3,7 @@ genfscon rootfs / u:object_r:rootfs:s0
 # proc labeling can be further refined (longest matching prefix).
 genfscon proc / u:object_r:proc:s0
 genfscon proc /asound/cards u:object_r:proc_asound_cards:s0
+genfscon proc /cmdline u:object_r:proc_cmdline:s0
 genfscon proc /config.gz u:object_r:config_gz:s0
 genfscon proc /filesystems u:object_r:proc_filesystems:s0
 genfscon proc /interrupts u:object_r:proc_interrupts:s0
diff --git a/public/file.te b/public/file.te
index 62cad466b6aea4ca3a94be59ab578fcee0b7da61..840fd2eebea0ff03f3f82d8b0f96bfd870763318 100644
--- a/public/file.te
+++ b/public/file.te
@@ -14,6 +14,7 @@ type sysfs_usermodehelper, fs_type, sysfs_type;
 type qtaguid_proc, fs_type, mlstrustedobject;
 type proc_bluetooth_writable, fs_type;
 type proc_asound_cards, fs_type;
+type proc_cmdline, fs_type;
 type proc_cpuinfo, fs_type;
 type proc_filesystems, fs_type;
 type proc_interrupts, fs_type;
diff --git a/public/init.te b/public/init.te
index 51b07e27ac4430703a47880f15f2677ffa58d626..46e4ee6ce9051b9fdd01b41414853bfa3d335de2 100644
--- a/public/init.te
+++ b/public/init.te
@@ -274,6 +274,9 @@ allow init proc_stat:file r_file_perms;
 # Read /proc/version.
 allow init proc_version:file r_file_perms;
 
+# Read /proc/cmdline
+allow init proc_cmdline:file r_file_perms;
+
 # Reboot.
 allow init self:capability sys_boot;
 
diff --git a/public/kernel.te b/public/kernel.te
index 7f5d2244319d4ff13633572846ce9667745127e9..64111b0fa889db57ce67de3f75bdf5fc89c2f915 100644
--- a/public/kernel.te
+++ b/public/kernel.te
@@ -6,6 +6,7 @@ allow kernel self:capability sys_nice;
 # Root fs.
 r_dir_file(kernel, rootfs)
 r_dir_file(kernel, proc)
+allow kernel proc_cmdline:file r_file_perms;
 
 # Get SELinux enforcing status.
 allow kernel selinuxfs:dir r_dir_perms;
diff --git a/public/vold.te b/public/vold.te
index e86caac3f0fbcd2a691540b1168ede7539aeb4f9..a8537154a5762ab0d860478e1c7a4f34715ae10f 100644
--- a/public/vold.te
+++ b/public/vold.te
@@ -8,7 +8,6 @@ allow vold cache_file:file { getattr read };
 allow vold cache_file:lnk_file r_file_perms;
 
 # Read access to pseudo filesystems.
-r_dir_file(vold, proc)
 r_dir_file(vold, proc_net)
 r_dir_file(vold, sysfs_type)
 # XXX Label sysfs files with a specific type?
@@ -18,6 +17,8 @@ allow vold sysfs_zram_uevent:file w_file_perms;
 
 r_dir_file(vold, rootfs)
 allow vold {
+  proc_cmdline
+  proc_drop_caches
   proc_filesystems
   proc_meminfo
   proc_mounts