diff --git a/public/domain.te b/public/domain.te
index d2b370a..acbae69 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -691,6 +691,7 @@
         -installd
         -postinstall_dexopt
         -system_server
+        -mediaserver
     } vendor_app_file:{ file lnk_file } r_file_perms;
 
     # Limit access to /vendor/overlay
diff --git a/public/mediaserver.te b/public/mediaserver.te
index 6efaf0f..93783fb 100644
--- a/public/mediaserver.te
+++ b/public/mediaserver.te
@@ -102,6 +102,9 @@
 allow mediaserver oemfs:dir search;
 allow mediaserver oemfs:file r_file_perms;
 
+# /vendor apk access
+allow mediaserver vendor_app_file:file r_file_perms;
+
 use_drmservice(mediaserver)
 allow mediaserver drmserver:drmservice {
     consumeRights