diff --git a/private/shell.te b/private/shell.te
index 3e45e1f..2033f7e 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -142,7 +142,7 @@
 
 # Allow shell to call perf_event_open for profiling other shell processes, but
 # not the whole system.
-allow shell self:perf_event { open read write };
+allow shell self:perf_event { open read write kernel };
 
 # Allow shell to read microdroid vendor image
 r_dir_file(shell, vendor_microdroid_file)