diff --git a/Android.mk b/Android.mk
index f12ba9626b8ce1f96e5564437e26489d3c6cb62d..3e8dfd0e583d29c7745338f115c6339f352e4805 100644
--- a/Android.mk
+++ b/Android.mk
@@ -215,6 +215,12 @@ LOCAL_REQUIRED_MODULES += \
     nonplat_file_contexts \
     plat_file_contexts \
 
+ifneq ($(TARGET_BUILD_VARIANT), user)
+LOCAL_REQUIRED_MODULES += \
+    selinux_denial_metadata \
+
+endif
+
 ifneq ($(with_asan),true)
 LOCAL_REQUIRED_MODULES += \
     sepolicy_tests \
@@ -657,6 +663,24 @@ file_contexts.device.sorted.tmp :=
 file_contexts.device.tmp :=
 file_contexts.local.tmp :=
 
+##################################
+ifneq ($(TARGET_BUILD_VARIANT), user)
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := selinux_denial_metadata
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+bug_files := $(call build_policy, bug_map, $(LOCAL_PATH) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(PLAT_PUBLIC_POLICY))
+
+$(LOCAL_BUILT_MODULE) : $(bug_files)
+	@mkdir -p $(dir $@)
+	cat $^ > $@
+
+bug_files :=
+endif
 ##################################
 include $(CLEAR_VARS)