diff --git a/autoplay_app.te b/autoplay_app.te
index c34207c..19e337b 100644
--- a/autoplay_app.te
+++ b/autoplay_app.te
@@ -11,3 +11,89 @@
 ###
 ### PackageManager flags an app as autoplay at install time.
 type autoplay_app, domain;
+
+# allow JITing
+allow autoplay_app self:process execmem;
+allow autoplay_app ashmem_device:chr_file execute;
+
+# Define and allow access to our own type for ashmem regions.
+# Label ashmem objects with our own unique type.
+tmpfs_domain(autoplay_app)
+# Map with PROT_EXEC.
+allow autoplay_app autoplay_app_tmpfs:file execute;
+
+# Send logcat messages to logd.
+write_logd(autoplay_app)
+
+# Receive and use open file descriptors inherited from zygote.
+allow autoplay_app zygote:fd use;
+
+# Notify zygote of death;
+allow autoplay_app zygote:process sigchld;
+
+# application inherit logd write socket (urge is to deprecate this long term)
+allow autoplay_app zygote:unix_dgram_socket write;
+
+# App sandbox file accesses.
+allow autoplay_app autoplay_data_file:dir create_dir_perms;
+allow autoplay_app autoplay_data_file:{ file sock_file fifo_file } create_file_perms;
+
+# For /acct/uid/*/tasks.
+allow autoplay_app cgroup:dir { search write };
+allow autoplay_app cgroup:file w_file_perms;
+
+# For art.
+allow autoplay_app dalvikcache_data_file:file { execute r_file_perms };
+allow autoplay_app dalvikcache_data_file:lnk_file r_file_perms;
+allow autoplay_app dalvikcache_data_file:dir getattr;
+
+# debugfs access
+allow autoplay_app debugfs:dir r_dir_perms;
+allow autoplay_app debugfs:file w_file_perms;
+
+# Grant GPU access. autoplay_app needs that to render the standard UI.
+allow autoplay_app gpu_device:chr_file rw_file_perms;
+
+# Use the Binder.
+binder_use(autoplay_app)
+# Perform binder IPC to binder services.
+binder_call(autoplay_app, surfaceflinger)
+binder_call(autoplay_app, system_server)
+
+# Allow read access to ion memory allocation device
+allow autoplay_app ion_device:chr_file { read open };
+
+# Use pipes and sockets provided by system_server via binder or local socket.
+allow autoplay_app system_server:fifo_file rw_file_perms;
+allow autoplay_app system_server:unix_stream_socket { read write setopt getattr getopt shutdown };
+allow autoplay_app system_server:tcp_socket { read write getattr getopt shutdown };
+
+# Inherit or receive open files from system_server.
+allow autoplay_app system_server:fd use;
+
+# Communicate with surfaceflinger.
+allow autoplay_app surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown };
+
+# Read files already opened under /data.
+allow autoplay_app system_data_file:file { getattr read };
+allow autoplay_app system_data_file:lnk_file read;
+
+# System file accesses. Check for libraries
+allow autoplay_app system_file:dir getattr;
+
+###
+### neverallow rules
+###
+
+# Receive or send uevent messages.
+neverallow autoplay_app domain:netlink_kobject_uevent_socket *;
+
+# Receive or send generic netlink messages
+neverallow autoplay_app domain:netlink_socket *;
+
+# Too much leaky information in debugfs. It's a security
+# best practice to ensure these files aren't readable.
+neverallow autoplay_app debugfs:file read;
+
+# execute gpu_device
+neverallow autoplay_app gpu_device:chr_file execute;