diff --git a/private/platform_app.te b/private/platform_app.te
index 42534bd60a34f12604bf213555888861f6fbc11e..047cca45fdd361c34c75bd8bb65e9ff00daa2de9 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -38,6 +38,9 @@ allow platform_app mnt_media_rw_file:dir r_dir_perms;
 allow platform_app vfat:dir create_dir_perms;
 allow platform_app vfat:file create_file_perms;
 
+# com.android.systemui
+allow platform_app rootfs:dir getattr;
+
 allow platform_app audioserver_service:service_manager find;
 allow platform_app cameraserver_service:service_manager find;
 allow platform_app drmserver_service:service_manager find;
diff --git a/private/system_app.te b/private/system_app.te
index 606c4a07d6d3f23f8d50aad1c10770d50901528c..80afcb946d87307d27e81cc3b5ea8f27016969db 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -11,6 +11,9 @@ app_domain(system_app)
 net_domain(system_app)
 binder_service(system_app)
 
+# android.ui and system.ui
+allow system_app rootfs:dir getattr;
+
 # Read and write /data/data subdirectory.
 allow system_app system_app_data_file:dir create_dir_perms;
 allow system_app system_app_data_file:{ file lnk_file } create_file_perms;
diff --git a/public/update_engine_common.te b/public/update_engine_common.te
index fb0284f0eab9752f9e038262fde0d387a87b63ed..775bb1eda46cd859c785473ce071d06399848dfe 100644
--- a/public/update_engine_common.te
+++ b/public/update_engine_common.te
@@ -13,6 +13,10 @@ allow update_engine_common system_block_device:blk_file rw_file_perms;
 # requires it.
 allow update_engine_common misc_block_device:blk_file rw_file_perms;
 
+# read fstab
+allow update_engine_common rootfs:dir getattr;
+allow update_engine_common rootfs:file r_file_perms;
+
 # Allow update_engine_common to mount on the /postinstall directory and reset the
 # labels on the mounted filesystem to postinstall_file.
 allow update_engine_common postinstall_mnt_dir:dir mounton;