diff --git a/prebuilts/api/28.0/private/mediaprovider.te b/prebuilts/api/28.0/private/mediaprovider.te
index fc6ec5a1c..f5c9f690e 100644
--- a/prebuilts/api/28.0/private/mediaprovider.te
+++ b/prebuilts/api/28.0/private/mediaprovider.te
@@ -19,6 +19,8 @@ allow mediaprovider cache_file:lnk_file r_file_perms;
 dontaudit mediaprovider cache_private_backup_file:dir getattr;
 dontaudit mediaprovider cache_recovery_file:dir getattr;
 
+# Access external sdcards through /mnt/media_rw
+allow mediaprovider { mnt_media_rw_file }:dir search;
 
 allow mediaprovider app_api_service:service_manager find;
 allow mediaprovider audioserver_service:service_manager find;
diff --git a/private/mediaprovider.te b/private/mediaprovider.te
index fc6ec5a1c..f5c9f690e 100644
--- a/private/mediaprovider.te
+++ b/private/mediaprovider.te
@@ -19,6 +19,8 @@ allow mediaprovider cache_file:lnk_file r_file_perms;
 dontaudit mediaprovider cache_private_backup_file:dir getattr;
 dontaudit mediaprovider cache_recovery_file:dir getattr;
 
+# Access external sdcards through /mnt/media_rw
+allow mediaprovider { mnt_media_rw_file }:dir search;
 
 allow mediaprovider app_api_service:service_manager find;
 allow mediaprovider audioserver_service:service_manager find;