diff --git a/device-common.mk b/device-common.mk
index b015079..9bb31b9 100644
--- a/device-common.mk
+++ b/device-common.mk
@@ -156,7 +156,8 @@
 
 PRODUCT_COPY_FILES += \
     $(LOCAL_PATH)/seccomp_policy/mediaswcodec.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/mediacodec.policy \
-    $(LOCAL_PATH)/seccomp_policy/mediaswcodec.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/mediaswcodec.policy
+    $(LOCAL_PATH)/seccomp_policy/mediaswcodec.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/mediaswcodec.policy \
+    $(LOCAL_PATH)/seccomp_policy/mediaextractor.policy:$(TARGET_COPY_OUT_VENDOR)/etc/seccomp_policy/mediaextractor.policy \
 
 # Copy hardware config file(s)
 PRODUCT_COPY_FILES +=  \
diff --git a/seccomp_policy/mediaextractor.policy b/seccomp_policy/mediaextractor.policy
new file mode 100644
index 0000000..cf7e427
--- /dev/null
+++ b/seccomp_policy/mediaextractor.policy
@@ -0,0 +1,5 @@
+# device specific syscalls
+# extension of frameworks/av/services/mediaextractor/seccomp_policy/mediaextractor-arm64.policy
+uname: 1
+memfd_create: 1
+ftruncate: 1
diff --git a/seccomp_policy/mediaswcodec.policy b/seccomp_policy/mediaswcodec.policy
index 4c148fb..8b1f97b 100644
--- a/seccomp_policy/mediaswcodec.policy
+++ b/seccomp_policy/mediaswcodec.policy
@@ -1,3 +1,4 @@
 # device specific syscalls
 # extension of frameworks/av/services/mediacodec/seccomp_policy/mediaswcodec-arm64.policy
 sysinfo: 1
+uname: 1
diff --git a/sepolicy/memfd.te b/sepolicy/memfd.te
new file mode 100644
index 0000000..be64644
--- /dev/null
+++ b/sepolicy/memfd.te
@@ -0,0 +1,28 @@
+# audit2allow
+
+#============= audioserver ==============
+allow audioserver system_server_tmpfs:file { map read write };
+allow audioserver tmpfs:file { map read write };
+
+#============= hal_audio_default ==============
+allow hal_audio_default tmpfs:file { getattr map read write };
+
+#============= mediaextractor ==============
+allow mediaextractor logd:unix_stream_socket connectto;
+allow mediaextractor logdr_socket:sock_file write;
+
+#============= mediaserver ==============
+allow mediaserver audioserver_tmpfs:file { map read write };
+allow mediaserver tmpfs:file { map read write };
+
+#============= mediaswcodec ==============
+allow mediaswcodec appdomain_tmpfs:file { map read write };
+allow mediaswcodec logd:unix_stream_socket connectto;
+allow mediaswcodec logdr_socket:sock_file write;
+allow mediaswcodec mediaserver_tmpfs:file { map read write };
+allow mediaswcodec system_server_tmpfs:file { map read write };
+allow mediaswcodec tmpfs:file { getattr map read write };
+
+#============= system_server ==============
+allow system_server audioserver_tmpfs:file { map read write };
+allow system_server tmpfs:file { map read write };