diff --git a/microdroid/system/private/servicemanager.te b/microdroid/system/private/servicemanager.te
index 91a8ad20e..a9d025c88 100644
--- a/microdroid/system/private/servicemanager.te
+++ b/microdroid/system/private/servicemanager.te
@@ -28,3 +28,6 @@ set_prop(servicemanager, servicemanager_prop)
 
 # servicemanager is using bootstrap bionic
 use_bootstrap_libs(servicemanager)
+
+# servicemanager is using apex_info via libvintf
+use_apex_info(servicemanager)
diff --git a/microdroid/system/public/te_macros b/microdroid/system/public/te_macros
index 60332bdfc..b27441755 100644
--- a/microdroid/system/public/te_macros
+++ b/microdroid/system/public/te_macros
@@ -960,3 +960,11 @@ define(`use_bootstrap_libs', `
   allow $1 system_bootstrap_lib_file:dir r_dir_perms;
   allow $1 system_bootstrap_lib_file:file { execute read open getattr map };
 ')
+
+######################################
+# use_apex_info(domain)
+# Allow access to apex information
+define(`use_apex_info', `
+  allow $1 apex_mnt_dir:dir r_dir_perms;
+  allow $1 apex_info_file:file r_file_perms;
+')
diff --git a/private/binderservicedomain.te b/private/binderservicedomain.te
index 7275954b2..fa9dd7d1c 100644
--- a/private/binderservicedomain.te
+++ b/private/binderservicedomain.te
@@ -22,3 +22,5 @@ allow binderservicedomain keystore:keystore2 { get_state };
 allow binderservicedomain keystore:keystore2_key { delete get_info rebind use };
 
 use_keystore(binderservicedomain)
+# binderservicedomain is using apex_info via libvintf
+use_apex_info(binderservicedomain)
diff --git a/private/hwservicemanager.te b/private/hwservicemanager.te
index 5982ecfde..ecc8a40c6 100644
--- a/private/hwservicemanager.te
+++ b/private/hwservicemanager.te
@@ -10,3 +10,6 @@ set_prop(hwservicemanager, hwservicemanager_prop)
 
 # hwservicemanager is using bootstrap bionic
 use_bootstrap_libs(hwservicemanager)
+
+# hwservicemanager is using apex_info via libvintf
+use_apex_info(hwservicemanager)
diff --git a/private/keystore.te b/private/keystore.te
index b69477cf5..cd2ef76d5 100644
--- a/private/keystore.te
+++ b/private/keystore.te
@@ -40,3 +40,6 @@ allow keystore vold:binder transfer;
 # system property, an exception is added for init as well.
 set_prop(keystore, keystore_crash_prop)
 neverallow { domain -keystore -init } keystore_crash_prop:property_service set;
+
+# keystore is using apex_info via libvintf
+use_apex_info(keystore)
diff --git a/private/servicemanager.te b/private/servicemanager.te
index 95a949661..5a69a43a3 100644
--- a/private/servicemanager.te
+++ b/private/servicemanager.te
@@ -9,3 +9,6 @@ set_prop(servicemanager, servicemanager_prop)
 
 # servicemanager is using bootstrap bionic
 use_bootstrap_libs(servicemanager)
+
+# servicemanager is using apex_info via libvintf
+use_apex_info(servicemanager)
diff --git a/public/te_macros b/public/te_macros
index 551f4f321..8a8b47356 100644
--- a/public/te_macros
+++ b/public/te_macros
@@ -1036,3 +1036,11 @@ define(`use_bootstrap_libs', `
   allow $1 system_bootstrap_lib_file:dir r_dir_perms;
   allow $1 system_bootstrap_lib_file:file { execute read open getattr map };
 ')
+
+######################################
+# use_apex_info(domain)
+# Allow access to apex information
+define(`use_apex_info', `
+  allow $1 apex_mnt_dir:dir r_dir_perms;
+  allow $1 apex_info_file:file r_file_perms;
+')