diff --git a/private/llkd.te b/private/llkd.te
index 900d403..3f84eb6 100644
--- a/private/llkd.te
+++ b/private/llkd.te
@@ -8,7 +8,7 @@
 allow llkd self:global_capability_class_set kill;
 userdebug_or_eng(`
   allow llkd self:global_capability_class_set sys_ptrace;
-  allow llkd self:global_capability_class_set dac_override;
+  allow llkd self:global_capability_class_set { dac_override dac_read_search };
 ')
 
 # llkd optionally locks itself in memory, to prevent it from being
diff --git a/private/storaged.te b/private/storaged.te
index b7321fd..8f70531 100644
--- a/private/storaged.te
+++ b/private/storaged.te
@@ -48,7 +48,7 @@
 
 # Kernel does extra check on CAP_DAC_OVERRIDE for libbinder when storaged is
 # running as root. See b/35323867 #3.
-dontaudit storaged self:global_capability_class_set dac_override;
+dontaudit storaged self:global_capability_class_set { dac_override dac_read_search };
 
 # For collecting bugreports.
 allow storaged dumpstate:fifo_file write;
diff --git a/private/vold_prepare_subdirs.te b/private/vold_prepare_subdirs.te
index 0a11558..0d062e9 100644
--- a/private/vold_prepare_subdirs.te
+++ b/private/vold_prepare_subdirs.te
@@ -7,7 +7,7 @@
 allow vold_prepare_subdirs vold:fd use;
 allow vold_prepare_subdirs vold:fifo_file { read write };
 allow vold_prepare_subdirs file_contexts_file:file r_file_perms;
-allow vold_prepare_subdirs self:global_capability_class_set { chown dac_override fowner };
+allow vold_prepare_subdirs self:global_capability_class_set { chown dac_override dac_read_search fowner };
 allow vold_prepare_subdirs self:process setfscreate;
 allow vold_prepare_subdirs {
   system_data_file
diff --git a/private/zygote.te b/private/zygote.te
index 610916e..91c9230 100644
--- a/private/zygote.te
+++ b/private/zygote.te
@@ -7,7 +7,7 @@
 read_runtime_log_tags(zygote)
 
 # Override DAC on files and switch uid/gid.
-allow zygote self:global_capability_class_set { dac_override setgid setuid fowner chown };
+allow zygote self:global_capability_class_set { dac_override dac_read_search setgid setuid fowner chown };
 
 # Drop capabilities from bounding set.
 allow zygote self:global_capability_class_set setpcap;