diff --git a/private/app.te b/private/app.te
index 710b94d..2ade955 100644
--- a/private/app.te
+++ b/private/app.te
@@ -74,6 +74,11 @@
 # Allow APFE device info to read Virtual A/B props.
 get_prop(appdomain, virtual_ab_prop)
 
+# Allow access to tombstones if an fd to one is given to you.
+# This is restricted by unix permissions, so an app must go through system_server to get one.
+allow appdomain tombstone_data_file:file { getattr read };
+neverallow appdomain tombstone_data_file:file ~{ getattr read };
+
 # Sensitive app domains are not allowed to execute from /data
 # to prevent persistence attacks and ensure all code is executed
 # from read-only locations.