diff --git a/access_vectors b/access_vectors
index 5e7834140f28997ac66bb988aba6c2c45a8cc0ba..1b26bce963052d660b498361431800437c16723a 100644
--- a/access_vectors
+++ b/access_vectors
@@ -915,3 +915,9 @@ class keystore_key
 	duplicate
 	clear_uid
 }
+
+class debuggerd
+{
+	dump_tombstone
+	dump_backtrace
+}
diff --git a/debuggerd.te b/debuggerd.te
index 6bbeac4a6dfe4a9af38a2155930edd13c31b35a4..22afe63ac12a2809cfff1f3aff193b1afd623544 100644
--- a/debuggerd.te
+++ b/debuggerd.te
@@ -9,7 +9,7 @@ allow debuggerd self:capability2 { syslog };
 allow debuggerd domain:dir r_dir_perms;
 allow debuggerd domain:file r_file_perms;
 allow debuggerd domain:lnk_file read;
-allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd -keystore }:process ptrace;
+allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd -keystore }:process { ptrace getattr };
 security_access_policy(debuggerd)
 allow debuggerd system_data_file:dir create_dir_perms;
 allow debuggerd system_data_file:dir relabelfrom;
@@ -31,3 +31,6 @@ userdebug_or_eng(`
 
 # logd access
 read_logd(debuggerd)
+
+# Check SELinux permissions.
+selinux_check_access(debuggerd)
diff --git a/security_classes b/security_classes
index fcee928e7d5993b5cd3d6aa40f4cfa13ab76d80a..ca8f4689b3eb3fa91d8185abb58dc39e9f38f646 100644
--- a/security_classes
+++ b/security_classes
@@ -143,4 +143,7 @@ class service_manager           # userspace
 # Keystore Key
 class keystore_key              # userspace
 
+# debuggerd service
+class debuggerd                 # userspace
+
 # FLASK
diff --git a/system_server.te b/system_server.te
index 9d973dbbcd956f59d07770879351ff3495863db3..9d3dfa14331d1c69f765398d3b8d9b77787f3ae9 100644
--- a/system_server.te
+++ b/system_server.te
@@ -127,6 +127,9 @@ binder_call(system_server, appdomain)
 binder_call(system_server, dumpstate)
 binder_service(system_server)
 
+# Ask debuggerd to dump backtraces for native stacks of interest.
+allow system_server { mediaserver sdcardd surfaceflinger inputflinger }:debuggerd dump_backtrace;
+
 # Read /proc/pid files for dumping stack traces of native processes.
 r_dir_file(system_server, mediaserver)
 r_dir_file(system_server, sdcardd)