diff --git a/private/ephemeral_app.te b/private/ephemeral_app.te
index 9289027..2d4b1f1 100644
--- a/private/ephemeral_app.te
+++ b/private/ephemeral_app.te
@@ -20,6 +20,13 @@
 allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr ioctl lock append};
 
 # services
+allow ephemeral_app audioserver_service:service_manager find;
+allow ephemeral_app cameraserver_service:service_manager find;
+allow ephemeral_app mediaserver_service:service_manager find;
+allow ephemeral_app mediaextractor_service:service_manager find;
+allow ephemeral_app mediacodec_service:service_manager find;
+allow ephemeral_app mediametrics_service:service_manager find;
+allow ephemeral_app mediacasserver_service:service_manager find;
 allow ephemeral_app surfaceflinger_service:service_manager find;
 allow ephemeral_app radio_service:service_manager find;
 allow ephemeral_app ephemeral_app_api_service:service_manager find;
diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index 993b3d0..73aa79e 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -1,7 +1,8 @@
 ###
 ### Untrusted_app_all.
 ###
-### This file defines the rules shared by all untrusted app domains.
+### This file defines the rules shared by all untrusted app domains except
+### ephemeral apps.
 ### Apps are labeled based on mac_permissions.xml (maps signer and
 ### optionally package name to seinfo value) and seapp_contexts (maps UID
 ### and optionally seinfo value to domain for process and type for data