diff --git a/private/property.te b/private/property.te
index def39f0..90cfad2 100644
--- a/private/property.te
+++ b/private/property.te
@@ -53,8 +53,9 @@
 system_internal_prop(virtualizationservice_prop)
 system_internal_prop(ctl_apex_load_prop)
 system_internal_prop(enable_16k_pages_prop)
-
 system_internal_prop(sensors_config_prop)
+system_internal_prop(hypervisor_pvmfw_prop)
+system_internal_prop(hypervisor_virtualizationmanager_prop)
 
 # Properties which can't be written outside system
 system_restricted_prop(device_config_virtualization_framework_native_prop)
diff --git a/private/property_contexts b/private/property_contexts
index 1f4e95f..39dd3b5 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -700,6 +700,9 @@
 ro.fuse.bpf.enabled u:object_r:storage_config_prop:s0 exact bool
 ro.fuse.bpf.is_running u:object_r:vold_status_prop:s0 exact bool
 
+hypervisor.pvmfw.path                              u:object_r:hypervisor_pvmfw_prop:s0 exact string
+hypervisor.virtualizationmanager.debug_policy.path u:object_r:hypervisor_virtualizationmanager_prop:s0 exact string
+
 # hypervisor.*: configured by the vendor to advertise capabilities of their
 # hypervisor to virtualizationservice.
 hypervisor.memory_reclaim.supported u:object_r:hypervisor_restricted_prop:s0 exact bool
diff --git a/private/virtualizationmanager.te b/private/virtualizationmanager.te
index b6bcd98..095a27d 100644
--- a/private/virtualizationmanager.te
+++ b/private/virtualizationmanager.te
@@ -65,6 +65,14 @@
 get_prop(virtualizationmanager, hypervisor_prop)
 get_prop(virtualizationmanager, hypervisor_restricted_prop)
 
+# Allow virtualizationmanager to be read custom pvmfw.img configuration
+userdebug_or_eng(`get_prop(virtualizationmanager, hypervisor_pvmfw_prop)')
+dontaudit virtualizationmanager hypervisor_pvmfw_prop:file read;
+
+# Allow virtualizationmanager to be read custom virtualizationmanager configuration
+userdebug_or_eng(`get_prop(virtualizationmanager, hypervisor_virtualizationmanager_prop)')
+dontaudit virtualizationmanager hypervisor_virtualizationmanager_prop:file read;
+
 # Allow virtualizationmanager service to talk to tombstoned to push guest ramdumps
 unix_socket_connect(virtualizationmanager, tombstoned_crash, tombstoned)