diff --git a/private/virtualizationservice.te b/private/virtualizationservice.te
index 3e057fe..f41e7cc 100644
--- a/private/virtualizationservice.te
+++ b/private/virtualizationservice.te
@@ -22,6 +22,9 @@
 # When virtualizationservice execs a file with the crosvm_exec label, run it in the crosvm domain.
 domain_auto_trans(virtualizationservice, crosvm_exec, crosvm)
 
+# Let virtualizationservice (and specifically its children) mlock VM memory and page tables.
+allow virtualizationservice self:capability sys_resource;
+
 # Let virtualizationservice kill crosvm.
 allow virtualizationservice crosvm:process sigkill;