diff --git a/private/runas_app.te b/private/runas_app.te
index 63ce178..9142a19 100644
--- a/private/runas_app.te
+++ b/private/runas_app.te
@@ -28,8 +28,8 @@
 
 # Allow runas_app to call perf_event_open for profiling debuggable app
 # processes, but not the whole system.
-allow runas_app self:perf_event { open read write };
-neverallow runas_app self:perf_event ~{ open read write };
+allow runas_app self:perf_event { open read write kernel };
+neverallow runas_app self:perf_event ~{ open read write kernel };
 
 # Suppress bionic loader denial /data/local/tests directories.
 dontaudit runas_app shell_test_data_file:dir search;