diff --git a/public/mediaextractor.te b/public/mediaextractor.te
index 969c1a570e5764c829bc09047a471e75bc7dee48..e1b460d65d3c12b15ef4fbea269a6fe3898235bf 100644
--- a/public/mediaextractor.te
+++ b/public/mediaextractor.te
@@ -23,6 +23,11 @@ crash_dump_fallback(mediaextractor)
 # allow mediaextractor read permissions for file sources
 allow mediaextractor media_rw_data_file:file { getattr read };
 
+# Read resources from open apk files passed over Binder
+allow mediaextractor apk_data_file:file { read getattr };
+allow mediaextractor asec_apk_file:file { read getattr };
+allow mediaextractor ringtone_file:file { read getattr };
+
 ###
 ### neverallow rules
 ###