diff --git a/microdroid/init.rc b/microdroid/init.rc
index f304d00..15f9a47 100644
--- a/microdroid/init.rc
+++ b/microdroid/init.rc
@@ -128,6 +128,11 @@
 
     start tombstoned
 
+    # For security reasons, /data/local/tmp should always be empty.
+    # Do not place files or directories in /data/local/tmp
+    mkdir /data/local 0751 root root encryption=Require
+    mkdir /data/local/tmp 0771 shell shell
+
 service ueventd /system/bin/ueventd
     class core
     critical
diff --git a/tests/hostside/java/android/virt/test/MicrodroidTestCase.java b/tests/hostside/java/android/virt/test/MicrodroidTestCase.java
index a7cc06c..6dedb49 100644
--- a/tests/hostside/java/android/virt/test/MicrodroidTestCase.java
+++ b/tests/hostside/java/android/virt/test/MicrodroidTestCase.java
@@ -23,6 +23,7 @@
 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
 import com.android.tradefed.testtype.junit4.BaseHostJUnit4Test;
 import com.android.tradefed.util.CommandResult;
+import com.android.tradefed.util.FileUtil;
 import com.android.tradefed.util.RunUtil;
 
 import org.junit.After;
@@ -30,6 +31,8 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
+import java.io.File;
+import java.io.FileWriter;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
@@ -146,6 +149,24 @@
         String prop = executeCommand("adb -s " + MICRODROID_SERIAL + " shell getprop ro.hardware");
         assertThat(prop, is("microdroid"));
 
+        // Test writing to /data partition
+        File tmpFile = FileUtil.createTempFile("test", ".txt");
+        tmpFile.deleteOnExit();
+        FileWriter writer = new FileWriter(tmpFile);
+        writer.write("MicrodroidTest");
+        writer.close();
+
+        executeCommand(
+                "adb -s "
+                        + MICRODROID_SERIAL
+                        + " push "
+                        + tmpFile.getPath()
+                        + " /data/local/tmp/test.txt");
+        String catResult =
+                executeCommand(
+                        "adb -s " + MICRODROID_SERIAL + " shell cat /data/local/tmp/test.txt");
+        assertThat(catResult, is("MicrodroidTest"));
+
         // Shutdown microdroid
         executeCommand("adb -s localhost:" + TEST_VM_ADB_PORT + " shell reboot");
     }