diff --git a/private/app.te b/private/app.te
index ae8b206..a7939b0 100644
--- a/private/app.te
+++ b/private/app.te
@@ -95,8 +95,9 @@
 # Exception for crash_dump to allow for app crash reporting.
 # Exception for renderscript binaries (/system/bin/bcc, /system/bin/ld.mc)
 # to allow renderscript to create privileged executable files.
+# Exception for virtmgr to allow running VMs as child processes.
 neverallow { appdomain -shell userdebug_or_eng(`-su') }
-    { domain -appdomain -crash_dump -rs }:process { transition };
+    { domain -appdomain -crash_dump -rs -virtmgr }:process { transition };
 neverallow { appdomain -shell userdebug_or_eng(`-su') }
     { domain -appdomain }:process { dyntransition };
 
diff --git a/private/virtmgr.te b/private/virtmgr.te
new file mode 100644
index 0000000..225b6cb
--- /dev/null
+++ b/private/virtmgr.te
@@ -0,0 +1,8 @@
+# Domain for a child process that manages virtual machines on behalf of its parent.
+
+type virtmgr, domain, coredomain;
+type virtmgr_exec, system_file_type, exec_type, file_type;
+
+# Allow virtmgr to communicate use, read and write over the adb connection.
+allow virtmgr adbd:fd use;
+allow virtmgr adbd:unix_stream_socket { read write };