diff --git a/private/priv_app.te b/private/priv_app.te
index 9d7a0f6..4dcd1fb 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -201,6 +201,11 @@
 # created by things like renderscript or via other mechanisms.
 allow priv_app app_exec_data_file:file { r_file_perms execute unlink };
 
+# Allow privileged apps to create a VM. Note that access is still
+# guarded with the `android.permission.MANAGE_VIRTUAL_MACHINE`
+# permission.
+virtualizationservice_use(priv_app)
+
 ###
 ### neverallow rules
 ###