diff --git a/domain.te b/domain.te
index 4d115fd29..60f2baae1 100644
--- a/domain.te
+++ b/domain.te
@@ -183,6 +183,7 @@ neverallow {
   -dumpstate
   -system_server
   userdebug_or_eng(`-procrank')
+  userdebug_or_eng(`-perfprofd')
 } self:capability sys_ptrace;
 
 # Limit device node creation to these whitelisted domains.
diff --git a/file.te b/file.te
index 7bd38434a..28076f57c 100644
--- a/file.te
+++ b/file.te
@@ -116,6 +116,7 @@ type vpn_data_file, file_type, data_file_type;
 type wifi_data_file, file_type, data_file_type;
 type zoneinfo_data_file, file_type, data_file_type;
 type vold_data_file, file_type, data_file_type;
+type perfprofd_data_file, file_type, data_file_type, mlstrustedobject;
 
 # Compatibility with type names used in vanilla Android 4.3 and 4.4.
 typealias audio_data_file alias audio_firmware_file;
diff --git a/file_contexts b/file_contexts
index e4b6b157e..f7a2c3593 100644
--- a/file_contexts
+++ b/file_contexts
@@ -247,6 +247,7 @@
 /data/misc/wifi/hostapd(/.*)?   u:object_r:wpa_socket:s0
 /data/misc/zoneinfo(/.*)?       u:object_r:zoneinfo_data_file:s0
 /data/misc/vold(/.*)?           u:object_r:vold_data_file:s0
+/data/misc/perfprofd(/.*)?      u:object_r:perfprofd_data_file:s0
 /data/system/heapdump(/.*)?     u:object_r:heapdump_data_file:s0
 
 # Bootchart data
diff --git a/perfprofd.te b/perfprofd.te
index 30b438b30..c9f7f35ed 100644
--- a/perfprofd.te
+++ b/perfprofd.te
@@ -18,19 +18,13 @@ userdebug_or_eng(`
   allow perfprofd system_file:file rx_file_perms;
 
   # perfprofd reads a config file from /data/data/com.google.android.gms/files
-  # opens a file for writing in the same directory
-  allow perfprofd app_data_file:file rw_file_perms;
-  allow perfprofd app_data_file:dir rw_dir_perms;
-
-  # perfprofd looks for the existence of a semaphore file to determine
-  # whether collection is enabled/disabled (where the semphore file is
-  # created by some other entity, e.g. gms)
+  allow perfprofd app_data_file:file r_file_perms;
   allow perfprofd app_data_file:dir search;
   allow perfprofd self:capability { dac_override };
 
-  # perfprofd reads profiles from /data/data/..., encodes them,
-  # and then dumps the encoded profiles back to /data/data/....
-  allow perfprofd app_data_file:dir_file_class_set create_file_perms;
+  # perfprofd opens a file for writing in /data/misc/perfprofd
+  allow perfprofd perfprofd_data_file:file create_file_perms;
+  allow perfprofd perfprofd_data_file:dir rw_dir_perms;
 
   # perfprofd uses the system log
   read_logd(perfprofd);
@@ -39,6 +33,17 @@ userdebug_or_eng(`
   # simpleperf uses ioctl() to turn on kernel perf events measurements
   allow perfprofd self:capability sys_admin;
 
+  # simpleperf needs to examine /proc to collect task/thread info
+  r_dir_file(perfprofd, domain)
+
+  # simpleperf needs to access /proc/<pid>/exec
+  allow perfprofd self:capability { sys_resource sys_ptrace };
+  neverallow perfprofd domain:process ptrace;
+
+  # simpleperf needs open/read any file that turns up in a profile
+  # to see whether it has a build ID
+  allow perfprofd exec_type:file r_file_perms;
+
   # simpleperf is going to execute "sleep"
   allow perfprofd toolbox_exec:file x_file_perms;
 
diff --git a/untrusted_app.te b/untrusted_app.te
index 5ad8c79bd..72d0a1bbf 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -93,6 +93,13 @@ allow untrusted_app persistent_data_block_service:service_manager find;
 allow untrusted_app { apk_tmp_file apk_private_tmp_file }:dir r_dir_perms;
 allow untrusted_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
 
+# Allow GMS core to access perfprofd output, which is stored
+# in /data/misc/perfprofd/. GMS core will need to list all
+# data stored in that directory to process them one by one.
+userdebug_or_eng(`
+  allow untrusted_app perfprofd_data_file:file r_file_perms;
+  allow untrusted_app perfprofd_data_file:dir r_dir_perms;
+')
 ###
 ### neverallow rules
 ###