diff --git a/core/java/android/permission/flags.aconfig b/core/java/android/permission/flags.aconfig
index 34fb963924ae01e584c2859bb25b63ddc199fe47..e029e520f1b15a103244061fa8f4cfc093632312 100644
--- a/core/java/android/permission/flags.aconfig
+++ b/core/java/android/permission/flags.aconfig
@@ -193,7 +193,7 @@ flag {
     namespace: "permissions"
     description: "Enable getDeviceId API in OpEventProxyInfo"
     bug: "337340961"
- }
+}
 
 flag {
     name: "device_aware_app_op_new_schema_enabled"
@@ -201,4 +201,15 @@ flag {
     namespace: "permissions"
     description: "Persist device attributed AppOp accesses on the disk"
     bug: "308201969"
-}
\ No newline at end of file
+}
+
+flag {
+    name: "apex_signature_permission_allowlist_enabled"
+    is_fixed_read_only: true
+    namespace: "permissions"
+    description: "Enable reading signature permission allowlist from APEXes"
+    bug: "308573169"
+    metadata {
+        purpose: PURPOSE_BUGFIX
+    }
+}
diff --git a/services/core/java/com/android/server/SystemConfig.java b/services/core/java/com/android/server/SystemConfig.java
index 6285015d02dcd9f48c3d6b3480d007c60bfd80f3..44aea15b2bde3a8903ad65c50fe0de2fec07eec2 100644
--- a/services/core/java/com/android/server/SystemConfig.java
+++ b/services/core/java/com/android/server/SystemConfig.java
@@ -720,6 +720,9 @@ public class SystemConfig {
         }
         // Read configuration of features, libs and priv-app permissions from apex module.
         int apexPermissionFlag = ALLOW_LIBS | ALLOW_FEATURES | ALLOW_PRIVAPP_PERMISSIONS;
+        if (android.permission.flags.Flags.apexSignaturePermissionAllowlistEnabled()) {
+            apexPermissionFlag |= ALLOW_SIGNATURE_PERMISSIONS;
+        }
         // TODO: Use a solid way to filter apex module folders?
         for (File f: FileUtils.listFilesOrEmpty(Environment.getApexDirectory())) {
             if (f.isFile() || f.getPath().contains("@")) {
@@ -1322,6 +1325,8 @@ public class SystemConfig {
                                     Environment.getProductDirectory().toPath() + "/");
                             boolean systemExt = permFile.toPath().startsWith(
                                     Environment.getSystemExtDirectory().toPath() + "/");
+                            boolean apex = permFile.toPath().startsWith(
+                                    Environment.getApexDirectory().toPath() + "/");
                             if (vendor) {
                                 readSignatureAppPermissions(parser,
                                         mPermissionAllowlist.getVendorSignatureAppAllowlist());
@@ -1331,6 +1336,9 @@ public class SystemConfig {
                             } else if (systemExt) {
                                 readSignatureAppPermissions(parser,
                                         mPermissionAllowlist.getSystemExtSignatureAppAllowlist());
+                            } else if (apex) {
+                                readSignatureAppPermissions(parser,
+                                        mPermissionAllowlist.getApexSignatureAppAllowlist());
                             } else {
                                 readSignatureAppPermissions(parser,
                                         mPermissionAllowlist.getSignatureAppAllowlist());
diff --git a/services/core/java/com/android/server/pm/PackageManagerShellCommand.java b/services/core/java/com/android/server/pm/PackageManagerShellCommand.java
index 0410764e859402bfd86501b89a2e26502e818093..a8766163297bcd1ded9e88706c2f9d43b81bacf2 100644
--- a/services/core/java/com/android/server/pm/PackageManagerShellCommand.java
+++ b/services/core/java/com/android/server/pm/PackageManagerShellCommand.java
@@ -2946,6 +2946,9 @@ class PackageManagerShellCommand extends ShellCommand {
             case "system-ext":
                 allowlist = permissionAllowlist.getSystemExtSignatureAppAllowlist();
                 break;
+            case "apex":
+                allowlist = permissionAllowlist.getApexSignatureAppAllowlist();
+                break;
             default:
                 getErrPrintWriter().println("Error: unknown partition: " + partition);
                 return 1;
@@ -4923,7 +4926,7 @@ class PackageManagerShellCommand extends ShellCommand {
         pw.println("");
         pw.println("  get-signature-permission-allowlist PARTITION");
         pw.println("    Prints the signature permission allowlist for a partition.");
-        pw.println("    PARTITION is one of system, vendor, product and system-ext");
+        pw.println("    PARTITION is one of system, vendor, product, system-ext and apex");
         pw.println("");
         pw.println("  get-shared-uid-allowlist");
         pw.println("    Prints the shared UID allowlist.");
diff --git a/services/core/java/com/android/server/pm/permission/PermissionAllowlist.java b/services/core/java/com/android/server/pm/permission/PermissionAllowlist.java
index d138606369b93f2d1fc5a774a843f941dc52fd90..6b99cbb2cba97b2dd316ccb12f509c90cd5e57af 100644
--- a/services/core/java/com/android/server/pm/permission/PermissionAllowlist.java
+++ b/services/core/java/com/android/server/pm/permission/PermissionAllowlist.java
@@ -55,6 +55,9 @@ public final class PermissionAllowlist {
     @NonNull
     private final ArrayMap<String, ArrayMap<String, Boolean>> mSystemExtSignatureAppAllowlist =
             new ArrayMap<>();
+    @NonNull
+    private final ArrayMap<String, ArrayMap<String, Boolean>> mApexSignatureAppAllowlist =
+            new ArrayMap<>();
 
     @NonNull
     public ArrayMap<String, ArrayMap<String, Boolean>> getOemAppAllowlist() {
@@ -107,6 +110,11 @@ public final class PermissionAllowlist {
         return mSystemExtSignatureAppAllowlist;
     }
 
+    @NonNull
+    public ArrayMap<String, ArrayMap<String, Boolean>> getApexSignatureAppAllowlist() {
+        return mApexSignatureAppAllowlist;
+    }
+
     @Nullable
     public Boolean getOemAppAllowlistState(@NonNull String packageName,
             @NonNull String permissionName) {
@@ -211,4 +219,14 @@ public final class PermissionAllowlist {
         }
         return permissions.get(permissionName);
     }
+
+    @Nullable
+    public Boolean getApexSignatureAppAllowlistState(@NonNull String packageName,
+            @NonNull String permissionName) {
+        ArrayMap<String, Boolean> permissions = mApexSignatureAppAllowlist.get(packageName);
+        if (permissions == null) {
+            return null;
+        }
+        return permissions.get(permissionName);
+    }
 }
diff --git a/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt b/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt
index d3072000a56e9b5cdd13546d5364160edd4dcd27..bb0838db97b55c22d110645f4b87933abfb1b1a9 100644
--- a/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt
+++ b/services/permission/java/com/android/server/permission/access/permission/AppIdPermissionPolicy.kt
@@ -1277,10 +1277,11 @@ class AppIdPermissionPolicy : SchemePolicy() {
                     permissionName
                 )
             else ->
-                permissionAllowlist.getProductSignatureAppAllowlistState(
-                    packageName,
-                    permissionName
-                )
+                permissionAllowlist.getApexSignatureAppAllowlistState(packageName, permissionName)
+                    ?: permissionAllowlist.getProductSignatureAppAllowlistState(
+                        packageName,
+                        permissionName
+                    )
                     ?: permissionAllowlist.getVendorSignatureAppAllowlistState(
                         packageName,
                         permissionName