diff --git a/domain.te b/domain.te
index 6be7ddd..47ad05a 100644
--- a/domain.te
+++ b/domain.te
@@ -83,6 +83,9 @@
 allow domain cgroup:dir { search write };
 allow domain cgroup:file w_file_perms;
 
+#Allow access to ion memory allocation device
+allow domain ion_device:chr_file rw_file_perms;
+
 # For /sys/qemu_trace files in the emulator.
 bool in_qemu false;
 if (in_qemu) {
diff --git a/mediaserver.te b/mediaserver.te
index e124db0..4b299a0 100644
--- a/mediaserver.te
+++ b/mediaserver.te
@@ -25,7 +25,6 @@
 allow mediaserver sysfs:file rw_file_perms;
 # XXX Why?
 allow mediaserver apk_data_file:file { read getattr };
-allow mediaserver ion_device:chr_file rw_file_perms;
 
 # To use remote processor
 allow mediaserver rpmsg_device:chr_file rw_file_perms;