diff --git a/device.te b/device.te
index 880212cd474e051be3d36745b309d1ab02945a8e..06006b26dde849471af13933d84178a4ce6972a3 100644
--- a/device.te
+++ b/device.te
@@ -41,7 +41,7 @@ type urandom_device, dev_type, mlstrustedobject;
 type video_device, dev_type;
 type vcs_device, dev_type;
 type zero_device, dev_type, mlstrustedobject;
-type fuse_device, dev_type;
+type fuse_device, dev_type, mlstrustedobject;
 type iio_device, dev_type;
 type ion_device, dev_type, mlstrustedobject;
 type gps_device, dev_type;
diff --git a/domain.te b/domain.te
index 79fb9c6be575cc4fe4f3984e4395c8869337cd9e..7b44fb5b19042316e45c3aff9fb9de077e1878a7 100644
--- a/domain.te
+++ b/domain.te
@@ -517,3 +517,22 @@ neverallow domain domain:file { execute execute_no_trans entrypoint };
 # more specific label.
 # TODO: fix system_server and dumpstate
 neverallow { domain -init -system_server -dumpstate } debugfs:file no_rw_file_perms;
+
+neverallow {
+  domain
+  -init
+  -recovery
+  -sdcardd
+  -vold
+} fuse_device:chr_file open;
+neverallow {
+  domain
+  -dumpstate
+  -init
+  -priv_app
+  -recovery
+  -sdcardd
+  -system_server
+  -ueventd
+  -vold
+} fuse_device:chr_file *;
diff --git a/priv_app.te b/priv_app.te
index 2ff9a37f3ff85f474be58151c8161fb193d64472..6617feb0195105a0540bfa020e9def2db3c4b5a8 100644
--- a/priv_app.te
+++ b/priv_app.te
@@ -64,6 +64,10 @@ userdebug_or_eng(`
 # the system partition
 allow priv_app exec_type:file getattr;
 
+# For AppFuse.
+allow priv_app vold:fd use;
+allow priv_app fuse_device:chr_file { read write };
+
 ###
 ### neverallow rules
 ###
diff --git a/system_server.te b/system_server.te
index 2616c46bae1aeffa338bf0041f228aeb068b13f4..2a1d761c56baaa131ae17ba5a9da000226a1a4e9 100644
--- a/system_server.te
+++ b/system_server.te
@@ -434,6 +434,10 @@ userdebug_or_eng(`
   allow system_server method_trace_data_file:file { create w_file_perms };
 ')
 
+# For AppFuse.
+allow system_server vold:fd use;
+allow system_server fuse_device:chr_file { read write ioctl };
+
 ###
 ### Neverallow rules
 ###
diff --git a/vold.te b/vold.te
index c8952af02cd09dc3e2c63b17dcced412b521924d..35e502f3d679784718dc97b255757a10df275215 100644
--- a/vold.te
+++ b/vold.te
@@ -164,6 +164,9 @@ allow vold self:capability sys_nice;
 allow vold self:capability sys_chroot;
 allow vold storage_file:dir mounton;
 
+# For AppFuse.
+allow vold fuse_device:chr_file rw_file_perms;
+
 neverallow { domain -vold } vold_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
 neverallow { domain -vold } vold_data_file:notdevfile_class_set ~{ relabelto getattr };
 neverallow { domain -vold -init } vold_data_file:dir *;