diff --git a/attributes b/attributes
index 485b3e9..3022029 100644
--- a/attributes
+++ b/attributes
@@ -67,6 +67,9 @@
 # used by device specific properties
 attribute core_property_type;
 
+# All properties used to configure log filtering.
+attribute log_property_type;
+
 # All service_manager types created by system_server
 attribute system_server_service;
 
diff --git a/domain.te b/domain.te
index 9001773..294f26e 100644
--- a/domain.te
+++ b/domain.te
@@ -83,6 +83,9 @@
 # For now, everyone can access core property files
 # Device specific properties are not granted by default
 get_prop(domain, core_property_type)
+# Let everyone read log properties, so that liblog can avoid sending unloggable
+# messages to logd.
+get_prop(domain, log_property_type)
 dontaudit domain property_type:file audit_access;
 allow domain property_contexts:file r_file_perms;
 
diff --git a/property.te b/property.te
index 1680245..a7370ae 100644
--- a/property.te
+++ b/property.te
@@ -21,6 +21,7 @@
 type ctl_bugreport_prop, property_type;
 type ctl_console_prop, property_type;
 type audio_prop, property_type, core_property_type;
+type log_prop, property_type, log_property_type;
 type logd_prop, property_type, core_property_type;
 type mmc_prop, property_type;
 type restorecon_prop, property_type, core_property_type;
diff --git a/property_contexts b/property_contexts
index 1329854..e634165 100644
--- a/property_contexts
+++ b/property_contexts
@@ -32,7 +32,7 @@
 debug.                  u:object_r:debug_prop:s0
 debug.db.               u:object_r:debuggerd_prop:s0
 dumpstate.              u:object_r:dumpstate_prop:s0
-log.                    u:object_r:shell_prop:s0
+log.                    u:object_r:log_prop:s0
 service.adb.root        u:object_r:shell_prop:s0
 service.adb.tcp.port    u:object_r:shell_prop:s0
 
@@ -40,7 +40,7 @@
 persist.debug.          u:object_r:persist_debug_prop:s0
 persist.logd.           u:object_r:logd_prop:s0
 persist.logd.security   u:object_r:device_logging_prop:s0
-persist.log.tag         u:object_r:logd_prop:s0
+persist.log.tag         u:object_r:log_prop:s0
 persist.mmc.            u:object_r:mmc_prop:s0
 persist.sys.            u:object_r:system_prop:s0
 persist.sys.safemode    u:object_r:safemode_prop:s0
diff --git a/shell.te b/shell.te
index a314c61..ad610b4 100644
--- a/shell.te
+++ b/shell.te
@@ -63,6 +63,7 @@
 set_prop(shell, dumpstate_prop)
 set_prop(shell, debug_prop)
 set_prop(shell, powerctl_prop)
+userdebug_or_eng(`set_prop(shell, log_prop)')
 
 # systrace support - allow atrace to run
 allow shell debugfs_tracing:dir r_dir_perms;
diff --git a/system_app.te b/system_app.te
index afc2be5..b3f4b30 100644
--- a/system_app.te
+++ b/system_app.te
@@ -31,6 +31,7 @@
 set_prop(system_app, logd_prop)
 set_prop(system_app, net_radio_prop)
 set_prop(system_app, system_radio_prop)
+set_prop(system_app, log_prop)
 auditallow system_app net_radio_prop:property_service set;
 auditallow system_app system_radio_prop:property_service set;