diff --git a/core/product.mk b/core/product.mk
index 4f780f9..8f3fcb8 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -121,6 +121,10 @@
     PRODUCT_DEX_PREOPT_DEFAULT_FLAGS \
     PRODUCT_DEX_PREOPT_BOOT_FLAGS \
     PRODUCT_SHIPPING_API_LEVEL \
+    VENDOR_PRODUCT_RESTRICT_VENDOR_FILES \
+    VENDOR_EXCEPTION_MODULES \
+    VENDOR_EXCEPTION_PATHS \
+
 
 define dump-product
 $(info ==== $(1) ====)\
diff --git a/core/tasks/vendor_module_check.mk b/core/tasks/vendor_module_check.mk
index 910c8b7..2a9c3d8 100644
--- a/core/tasks/vendor_module_check.mk
+++ b/core/tasks/vendor_module_check.mk
@@ -46,19 +46,43 @@
         widevine
 
 
-ifneq (,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_RESTRICT_VENDOR_FILES))
+_restrictions := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_RESTRICT_VENDOR_FILES))
 
-_vendor_check_modules := $(product_MODULES)
+ifneq (,$(_restrictions))
+ifneq (,$(PRODUCTS.$(INTERNAL_PRODUCT).VENDOR_PRODUCT_RESTRICT_VENDOR_FILES))
+$(error Error: cannot set both PRODUCT_RESTRICT_VENDOR_FILES and VENDOR_PRODUCT_RESTRICT_VENDOR_FILES)
+endif
+_vendor_exception_path_prefix :=
+_vendor_exception_modules :=
+else
+_restrictions := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).VENDOR_PRODUCT_RESTRICT_VENDOR_FILES))
+_vendor_exception_path_prefix := $(patsubst %, vendor/%/%, $(PRODUCTS.$(INTERNAL_PRODUCT).VENDOR_EXCEPTION_PATHS))
+_vendor_exception_modules := $(PRODUCTS.$(INTERNAL_PRODUCT).VENDOR_EXCEPTION_MODULES)
+endif
+
+
+ifneq (,$(_restrictions))
+
+_vendor_check_modules := \
+$(foreach m, $(filter-out $(_vendor_exception_modules), $(product_MODULES)), \
+  $(if $(filter-out FAKE, $(ALL_MODULES.$(m).CLASS)),\
+    $(if $(filter vendor/%, $(ALL_MODULES.$(m).PATH)),\
+      $(if $(filter-out $(_vendor_exception_path_prefix), $(ALL_MODULES.$(m).PATH)),\
+        $(m)))))
 
 _vendor_module_owner_info :=
 # Restrict owners
-ifneq (,$(filter true owner all, $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_RESTRICT_VENDOR_FILES)))
+ifneq (,$(filter true owner all, $(_restrictions)))
 
-ifneq (,$(filter vendor/%, $(PRODUCT_PACKAGE_OVERLAYS) $(DEVICE_PACKAGE_OVERLAYS)))
-$(error Error: Product "$(TARGET_PRODUCT)" cannot have overlay in vendor tree: \
+_vendor_package_overlays := $(filter-out $(_vendor_exception_path_prefix),\
     $(filter vendor/%, $(PRODUCT_PACKAGE_OVERLAYS) $(DEVICE_PACKAGE_OVERLAYS)))
+ifneq (,$(_vendor_package_overlays))
+$(error Error: Product "$(TARGET_PRODUCT)" cannot have overlay in vendor tree: $(_vendor_package_overlays))
 endif
-_vendor_check_copy_files := $(filter vendor/%, $(PRODUCT_COPY_FILES))
+_vendor_package_overlays :=
+
+_vendor_check_copy_files := $(filter-out $(_vendor_exception_path_prefix),\
+    $(filter vendor/%, $(PRODUCT_COPY_FILES)))
 ifneq (,$(_vendor_check_copy_files))
 $(foreach c, $(_vendor_check_copy_files), \
   $(if $(filter $(_vendor_owner_whitelist), $(call word-colon,3,$(c))),,\
@@ -68,28 +92,24 @@
 _vendor_check_copy_files :=
 
 $(foreach m, $(_vendor_check_modules), \
-  $(if $(filter vendor/%, $(ALL_MODULES.$(m).PATH)),\
-    $(if $(filter-out FAKE, $(ALL_MODULES.$(m).CLASS)),\
-      $(if $(filter $(_vendor_owner_whitelist), $(ALL_MODULES.$(m).OWNER)),,\
-        $(error Error: vendor module "$(m)" in $(ALL_MODULES.$(m).PATH) with unknown owner \
-          "$(ALL_MODULES.$(m).OWNER)" in product "$(TARGET_PRODUCT)"))\
-      $(if $(ALL_MODULES.$(m).INSTALLED),\
-        $(eval _vendor_module_owner_info += $(patsubst $(PRODUCT_OUT)/%,%,$(ALL_MODULES.$(m).INSTALLED)):$(ALL_MODULES.$(m).OWNER))))))
+  $(if $(filter $(_vendor_owner_whitelist), $(ALL_MODULES.$(m).OWNER)),,\
+    $(error Error: vendor module "$(m)" in $(ALL_MODULES.$(m).PATH) with unknown owner \
+      "$(ALL_MODULES.$(m).OWNER)" in product "$(TARGET_PRODUCT)"))\
+  $(if $(ALL_MODULES.$(m).INSTALLED),\
+    $(eval _vendor_module_owner_info += $(patsubst $(PRODUCT_OUT)/%,%,$(ALL_MODULES.$(m).INSTALLED)):$(ALL_MODULES.$(m).OWNER))))
 
 endif
 
 
 # Restrict paths
-ifneq (,$(filter path all, $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_RESTRICT_VENDOR_FILES)))
+ifneq (,$(filter path all, $(_restrictions)))
 
 $(foreach m, $(_vendor_check_modules), \
-  $(if $(filter vendor/%, $(ALL_MODULES.$(m).PATH)),\
-    $(if $(filter-out FAKE, $(ALL_MODULES.$(m).CLASS)),\
-      $(if $(filter-out ,$(ALL_MODULES.$(m).INSTALLED)),\
-        $(if $(filter $(TARGET_OUT_VENDOR)/% $(HOST_OUT)/%, $(ALL_MODULES.$(m).INSTALLED)),,\
-          $(error Error: vendor module "$(m)" in $(ALL_MODULES.$(m).PATH) \
-            in product "$(TARGET_PRODUCT)" being installed to \
-            $(ALL_MODULES.$(m).INSTALLED) which is not in the vendor tree))))))
+  $(if $(filter-out ,$(ALL_MODULES.$(m).INSTALLED)),\
+    $(if $(filter $(TARGET_OUT_VENDOR)/% $(TARGET_OUT_ODM)/% $(HOST_OUT)/%, $(ALL_MODULES.$(m).INSTALLED)),,\
+      $(error Error: vendor module "$(m)" in $(ALL_MODULES.$(m).PATH) \
+        in product "$(TARGET_PRODUCT)" being installed to \
+        $(ALL_MODULES.$(m).INSTALLED) which is not in the vendor tree or odm tree))))
 
 endif
 
@@ -112,4 +132,7 @@
 _vendor_module_owner_info_txt :=
 _vendor_module_owner_info :=
 _vendor_check_modules :=
+_vendor_exception_path_prefix :=
+_vendor_exception_modules :=
+_restrictions :=
 endif