diff --git a/private/file.te b/private/file.te
index 21c9455..f8a48cd 100644
--- a/private/file.te
+++ b/private/file.te
@@ -37,6 +37,9 @@
 # /data/misc/uprobestats-configs for uprobestats configs
 type uprobestats_configs_data_file, file_type, data_file_type, core_data_file_type;
 
+# /apex/com.android.art/bin/oatdump
+type oatdump_exec, system_file_type, exec_type, file_type;
+
 # /data/misc_{ce/de}/<user>/sdksandbox root data directory for sdk sandbox processes
 type sdk_sandbox_system_data_file, file_type, data_file_type, core_data_file_type;
 # /data/misc_{ce/de}/<user>/sdksandbox/<app-name>/* subdirectory for sdk sandbox processes
diff --git a/private/shell.te b/private/shell.te
index 9944bd1..d613a94 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -261,6 +261,9 @@
 # Allow shell to read the build properties for attestation feature
 get_prop(shell, build_attestation_prop)
 
+# Allow shell to execute oatdump.
+allow shell oatdump_exec:file rx_file_perms;
+
 # Allow shell access to socket for test
 userdebug_or_eng(`
     allow shell aconfigd_socket:sock_file write;
diff --git a/private/uprobestats.te b/private/uprobestats.te
index 2c5711f..f6dd906 100644
--- a/private/uprobestats.te
+++ b/private/uprobestats.te
@@ -16,7 +16,7 @@
 allow uprobestats sysfs_uprobe:dir { search };
 
 # Allow uprobestats to popen oatdump.
-allow uprobestats system_file:file rx_file_perms;
+allow uprobestats oatdump_exec:file rx_file_perms;
 
 # Allow uprobestats to write atoms to statsd
 unix_socket_send(uprobestats, statsdw, statsd)