diff --git a/private/system_app.te b/private/system_app.te
index 5a2a561..a052f1d 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -136,6 +136,16 @@
     user_changed
 };
 
+allow system_app keystore:keystore2_key {
+    delete
+    get_info
+    grant
+    list
+    rebind
+    update
+    use
+};
+
 # settings app reads /proc/version
 allow system_app {
   proc_version