diff --git a/private/app.te b/private/app.te
index b5bb474..1ef6ceb 100644
--- a/private/app.te
+++ b/private/app.te
@@ -146,6 +146,9 @@
 r_dir_file({ appdomain -ephemeral_app -sdk_sandbox_all }, vendor_app_file)
 allow { appdomain -ephemeral_app -sdk_sandbox_all } vendor_app_file:file execute;
 
+# Allow apps to read microdroid related files in vendor partition for CTS purpose.
+r_dir_file({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }, vendor_microdroid_file)
+
 # Perform binder IPC to sdk sandbox.
 binder_call(appdomain, sdk_sandbox_all)