diff --git a/private/crosvm.te b/private/crosvm.te
index bd44d6f..00978f3 100644
--- a/private/crosvm.te
+++ b/private/crosvm.te
@@ -98,6 +98,11 @@
   allow crosvm virtualization_service:service_manager find;
   allow crosvm virtualizationservice:binder { call transfer };
 
+  # Allow crosvm to mount Terminal app internal storage directory
+  # to guest VM over virtiofs
+  allow crosvm privapp_data_file:dir { getattr open read search };
+  allow crosvm privapp_data_file:file { open };
+
   # Allow crosvm to play sound.
   binder_call(crosvm, audioserver)
   allow crosvm audioserver_service:service_manager find;
@@ -146,12 +151,14 @@
 # image referring by name to files which it doesn't have permission to open, trying to get crosvm to
 # open them on its behalf. By preventing crosvm from opening any other files we prevent this
 # potential privilege escalation. See http://b/192453819 for more discussion.
+#
+# crosvm requires access to terminal app internal storage; the directory
+# is passed as a mount point to guest VM over virtiofs.
 neverallow crosvm {
   virtualizationservice_data_file
   staging_data_file
   apk_data_file
   app_data_file
-  privapp_data_file
   is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file')
   userdebug_or_eng(`-shell_data_file')
 }:file open;
diff --git a/private/domain.te b/private/domain.te
index 2ffd222..046d2a3 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -1645,6 +1645,7 @@
   -runas
   -system_server
   -zygote
+  -crosvm # required to access terminal app internal storage
 } {
   privapp_data_file
   app_data_file
@@ -1710,6 +1711,7 @@
   -artd # compile secondary dex files
   -installd
   -rs # spawned by appdomain, so carryover the exception above
+  -crosvm # required to access terminal app internal storage
 } {
   privapp_data_file
   app_data_file