diff --git a/bootanim.te b/bootanim.te
index ee5bcae75de38b4859882869a840d3dd762ddda7..159fd9ea45ce59c4866e55d9c726b427e0d5df64 100644
--- a/bootanim.te
+++ b/bootanim.te
@@ -22,10 +22,6 @@ allow bootanim surfaceflinger_service:service_manager find;
 allow bootanim cgroup:dir { search write };
 allow bootanim cgroup:file w_file_perms;
 
-# debugfs access
-allow bootanim debugfs:dir r_dir_perms;
-allow bootanim debugfs:file w_file_perms;
-
 # Allow access to ion memory allocation device
 allow bootanim ion_device:chr_file rw_file_perms;
 
diff --git a/domain.te b/domain.te
index c910c7069855f403d9c203399cff900e6273061a..b60e5e0483141269c1ca3438f82a6f3e36802e77 100644
--- a/domain.te
+++ b/domain.te
@@ -118,6 +118,7 @@ allow domain selinuxfs:filesystem getattr;
 # /sys/kernel/debug/tracing/trace_marker
 # The reason behind this is documented in b/6513400
 allow domain debugfs:dir search;
+allow domain debugfs_tracing:dir search;
 allow domain debugfs_trace_marker:file w_file_perms;
 
 ###
diff --git a/domain_deprecated.te b/domain_deprecated.te
index 269fe5bbdbdde9bc3d9e2090729ac3d061e3ad40..cd1a08c3b20072829b96e107a452e67aa8bc477a 100644
--- a/domain_deprecated.te
+++ b/domain_deprecated.te
@@ -68,15 +68,6 @@ r_dir_file(domain_deprecated, cgroup)
 r_dir_file(domain_deprecated, proc_net)
 allow domain_deprecated proc_cpuinfo:file r_file_perms;
 
-# debugfs access
-allow domain_deprecated debugfs:dir r_dir_perms;
-# TODO: The following line can likely be deleted. The only reason
-# it was exposed was to allow /sys/kernel/debug/tracing/trace_marker
-# write access. This was in the days before labels could be assigned
-# to individual files on debugfs
-# (b/18935184, https://android-review.googlesource.com/122130)
-allow domain_deprecated debugfs:file w_file_perms;
-
 # Get SELinux enforcing status.
 allow domain_deprecated selinuxfs:dir r_dir_perms;
 allow domain_deprecated selinuxfs:file r_file_perms;
diff --git a/file.te b/file.te
index bab302b5566e954a691a527b7e562a3554062af8..a2f2811ce41429a7aba9278d587459dc87a6a600 100644
--- a/file.te
+++ b/file.te
@@ -39,8 +39,9 @@ type fuse, sdcard_type, fs_type, mlstrustedobject;
 type vfat, sdcard_type, fs_type, mlstrustedobject;
 typealias fuse alias sdcard_internal;
 typealias vfat alias sdcard_external;
-type debugfs, fs_type, mlstrustedobject;
+type debugfs, fs_type;
 type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject;
+type debugfs_tracing, fs_type, debugfs_type;
 type pstorefs, fs_type;
 type functionfs, fs_type;
 type oemfs, fs_type, contextmount_type;
diff --git a/file_contexts b/file_contexts
index a54876727b54f75ddc60e2482e0fb29a40ee3d2c..76d514558a4801002556b85545e6b5bab7f08b6f 100644
--- a/file_contexts
+++ b/file_contexts
@@ -330,6 +330,7 @@
 #############################
 # debugfs files
 #
+/sys/kernel/debug/tracing(/.*)?          u:object_r:debugfs_tracing:s0
 /sys/kernel/debug/tracing/trace_marker   u:object_r:debugfs_trace_marker:s0
 
 #############################
diff --git a/perfprofd.te b/perfprofd.te
index f76d9919a1605c2861164178b13c2073ad539e27..0122c559022652bef6e9611fb3632c646e2b0e8b 100644
--- a/perfprofd.te
+++ b/perfprofd.te
@@ -48,7 +48,7 @@ userdebug_or_eng(`
   allow perfprofd exec_type:file r_file_perms;
 
   # simpleperf examines debugfs on startup to collect tracepoint event types
-  allow perfprofd debugfs:file r_file_perms;
+  allow perfprofd debugfs_tracing:file r_file_perms;
 
   # simpleperf is going to execute "sleep"
   allow perfprofd toolbox_exec:file rx_file_perms;
diff --git a/shell.te b/shell.te
index 4b6acbc25f6de43cd85c2cac588591e14b09ee62..ebd702bf6ea5d8ac7a43dc496c9db6bf352bc627 100644
--- a/shell.te
+++ b/shell.te
@@ -69,13 +69,8 @@ set_prop(shell, debug_prop)
 set_prop(shell, powerctl_prop)
 
 # systrace support - allow atrace to run
-# debugfs did not support labeling individual files, so we have
-# to grant read access to all of /sys/kernel/debug.
-# Directory read access and file write access is already granted
-# in domain.te.
-# TODO: Fix this now that we support labeling individual debugfs files
-# (b/18935184, https://android-review.googlesource.com/122130)
-allow shell debugfs:file r_file_perms;
+allow shell debugfs_tracing:dir r_dir_perms;
+allow shell debugfs_tracing:file rw_file_perms;
 allow shell atrace_exec:file rx_file_perms;
 
 userdebug_or_eng(`