diff --git a/private/compat/30.0/30.0.ignore.cil b/private/compat/30.0/30.0.ignore.cil
index 8dd2d2f..183894c 100644
--- a/private/compat/30.0/30.0.ignore.cil
+++ b/private/compat/30.0/30.0.ignore.cil
@@ -80,6 +80,7 @@
     profcollectd_data_file
     profcollectd_exec
     profcollectd_service
+    qemu_hw_prop
     radio_core_data_file
     reboot_readiness_service
     remote_prov_app
diff --git a/private/platform_app.te b/private/platform_app.te
index 7bf14c8..a112081 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -90,6 +90,9 @@
 # allow platform apps to read keyguard.no_require_sim
 get_prop(platform_app, keyguard_config_prop)
 
+# allow platform apps to read qemu.hw.mainkeys
+get_prop(platform_app, qemu_hw_prop)
+
 # allow platform apps to create symbolic link
 allow platform_app app_data_file:lnk_file create_file_perms;
 
diff --git a/private/property_contexts b/private/property_contexts
index 7d99a24..42efcff 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -186,6 +186,9 @@
 dalvik.                 u:object_r:dalvik_prop:s0
 ro.dalvik.              u:object_r:dalvik_prop:s0
 
+# qemu_hw_prop is read/written by both system and vendor.
+qemu.hw.mainkeys        u:object_r:qemu_hw_prop:s0
+
 # Shared between system server and wificond
 wifi.                   u:object_r:wifi_prop:s0
 wlan.                   u:object_r:wifi_prop:s0
diff --git a/private/system_server.te b/private/system_server.te
index c143999..4796b89 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1328,3 +1328,6 @@
 # Only system server can write the font files.
 neverallow { domain -init -system_server } font_data_file:file no_w_file_perms;
 neverallow { domain -init -system_server } font_data_file:dir no_w_dir_perms;
+
+# Read qemu.hw.mainkeys property
+get_prop(system_server, qemu_hw_prop)