diff --git a/bluetooth.te b/bluetooth.te
index ff664ab..4b20a58 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -57,7 +57,8 @@
 # Access to /data/media.
 # This should be removed if sdcardfs is modified to alter the secontext for its
 # accesses to the underlying FS.
-allow bluetooth media_rw_data_file:dir search;
+allow bluetooth media_rw_data_file:dir create_dir_perms;
+allow bluetooth media_rw_data_file:file create_file_perms;
 
 ###
 ### Neverallow rules
diff --git a/platform_app.te b/platform_app.te
index 3e6cd1a..8ac7932 100644
--- a/platform_app.te
+++ b/platform_app.te
@@ -50,3 +50,4 @@
 allow platform_app surfaceflinger_service:service_manager find;
 allow platform_app app_api_service:service_manager find;
 allow platform_app system_api_service:service_manager find;
+allow platform_app vr_manager_service:service_manager find;
diff --git a/service.te b/service.te
index 71f8f3b..bd6ab38 100644
--- a/service.te
+++ b/service.te
@@ -110,6 +110,7 @@
 type user_service, app_api_service, system_server_service, service_manager_type;
 type vibrator_service, app_api_service, system_server_service, service_manager_type;
 type voiceinteraction_service, app_api_service, system_server_service, service_manager_type;
+type vr_manager_service, system_server_service, service_manager_type;
 type wallpaper_service, app_api_service, system_server_service, service_manager_type;
 type webviewupdate_service, app_api_service, system_server_service, service_manager_type;
 type wifip2p_service, app_api_service, system_server_service, service_manager_type;
diff --git a/service_contexts b/service_contexts
index c1fe961..288ff90 100644
--- a/service_contexts
+++ b/service_contexts
@@ -135,6 +135,7 @@
 user                                      u:object_r:user_service:s0
 vibrator                                  u:object_r:vibrator_service:s0
 voiceinteraction                          u:object_r:voiceinteraction_service:s0
+vrmanager                                 u:object_r:vr_manager_service:s0
 wallpaper                                 u:object_r:wallpaper_service:s0
 webviewupdate                             u:object_r:webviewupdate_service:s0
 wifip2p                                   u:object_r:wifip2p_service:s0
diff --git a/system_server.te b/system_server.te
index 8d8c303..ac27256 100644
--- a/system_server.te
+++ b/system_server.te
@@ -497,6 +497,9 @@
 # accesses to the underlying FS.
 allow system_server media_rw_data_file:dir search;
 
+# Allow invoking tools like "timeout"
+allow system_server toolbox_exec:file rx_file_perms;
+
 ###
 ### Neverallow rules
 ###