diff --git a/BUILD.gn b/BUILD.gn
index eb9a8401a8004a13c6ca5a68762a5f23e3b40011..cd98b42319e671f91ec7f2426c78e4386bde3fad 100755
--- a/BUILD.gn
+++ b/BUILD.gn
@@ -33,13 +33,21 @@ config("appspawn_config") {
     "${aafwk_path}/frameworks/kits/ability/native/include",
     "${aafwk_path}/services/abilitymgr/include",
     "${distributedschedule_path}/services/dtbschedmgr/include",
+    "//base/security/access_token/interfaces/innerkits/token_setproc/include",
   ]
+
+  if (build_selinux) {
+    cflags = [ "-DWITH_SELINUX" ]
+  }
 }
 
 ohos_executable("appspawn") {
   sources = [ "${appspawn_path}/src/main.cpp" ]
   configs = [ ":appspawn_config" ]
-  deps = [ "${appspawn_path}:appspawn_server" ]
+  deps = [
+    "${appspawn_path}:appspawn_server",
+    "//base/security/access_token/interfaces/innerkits/token_setproc:libtoken_setproc",
+  ]
   external_deps = [ "hiviewdfx_hilog_native:libhilog" ]
 
   install_enable = true
@@ -73,6 +81,10 @@ ohos_static_library("appspawn_server") {
     "samgr_standard:samgr_proxy",
   ]
 
+  if (build_selinux) {
+    external_deps += [ "selinux:libhap_restorecon" ]
+  }
+
   subsystem_name = "${subsystem_name}"
   part_name = "${part_name}"
 }
diff --git a/interfaces/innerkits/include/client_socket.h b/interfaces/innerkits/include/client_socket.h
index 2706a7c31bef2a7a6b966492e579eb6ffaa405cf..7bcb0c7f774b962c13b1184395ac1e4d75e9d6b5 100644
--- a/interfaces/innerkits/include/client_socket.h
+++ b/interfaces/innerkits/include/client_socket.h
@@ -87,6 +87,7 @@ public:
     static constexpr int LEN_PROC_NAME = 256;           // process name length
     static constexpr int LEN_SO_PATH = 256;             // load so lib
     static constexpr int MAX_GIDS = 64;
+    static constexpr int APL_MAX_LEN = 32;
 
     struct AppProperty {
         uint32_t uid;                     // the UNIX uid that the child process setuid() to after fork()
@@ -95,6 +96,8 @@ public:
         uint32_t gidCount;                // the size of gidTable
         char processName[LEN_PROC_NAME];  // process name
         char soPath[LEN_SO_PATH];         // so lib path
+        uint32_t accessTokenId;
+        char apl[APL_MAX_LEN];
     };
 
 private:
diff --git a/src/appspawn_server.cpp b/src/appspawn_server.cpp
index 7950c23d74ca273df95b4e8b1a0a1953c97106c4..a49603b327c889cf7b7b68d8a3caec8291ec1367 100644
--- a/src/appspawn_server.cpp
+++ b/src/appspawn_server.cpp
@@ -35,6 +35,10 @@
 #include "if_system_ability_manager.h"
 #include "iservice_registry.h"
 #include "system_ability_definition.h"
+#include "token_setproc.h"
+#ifdef WITH_SELINUX
+#include "hap_restorecon.h"
+#endif
 
 #include <dirent.h>
 #include <dlfcn.h>
@@ -587,6 +591,21 @@ int32_t AppSpawnServer::SetAppSandboxProperty(const ClientSocket::AppProperty *a
     return ERR_OK;
 }
 
+void AppSpawnServer::SetAppAccessToken(const ClientSocket::AppProperty *appProperty)
+{
+    int32_t ret = SetSelfTokenID(appProperty->accessTokenId);
+    if (ret != 0) {
+        HiLog::Error(LABEL, "AppSpawnServer::Failed to set access token id, errno = %{public}d", errno);
+    }
+#ifdef WITH_SELINUX
+    HapContext hapContext;
+    ret = hapContext.HapDomainSetcontext(appProperty->apl, appProperty->processName);
+    if (ret != 0) {
+        HiLog::Error(LABEL, "AppSpawnServer::Failed to hap domain set context, errno = %{public}d", errno);
+    }
+#endif
+}
+
 bool AppSpawnServer::SetAppProcProperty(int connectFd, const ClientSocket::AppProperty *appProperty, char *longProcName,
     int64_t longProcNameLen, const int32_t fd[FDLEN2])
 {
@@ -617,6 +636,8 @@ bool AppSpawnServer::SetAppProcProperty(int connectFd, const ClientSocket::AppPr
         return false;
     }
 
+    SetAppAccessToken(appProperty);
+
     ret = SetProcessName(longProcName, longProcNameLen, appProperty->processName, strlen(appProperty->processName) + 1);
     if (FAILED(ret)) {
         NotifyResToParentProc(fd[1], ret);
diff --git a/src/include/appspawn_server.h b/src/include/appspawn_server.h
index bb61bb830b2e29f8bddee8f21770f8da50c81637..7edb20287b7460d58a3ff40e3e8b09156a5fc932 100644
--- a/src/include/appspawn_server.h
+++ b/src/include/appspawn_server.h
@@ -165,6 +165,7 @@ private:
 
     void LoadAceLib();
 
+    void SetAppAccessToken(const ClientSocket::AppProperty *appProperty);
 private:
     const std::string deviceNull_ = "/dev/null";
     std::string socketName_ {};
diff --git a/test/unittest/app_spawn_server_test/BUILD.gn b/test/unittest/app_spawn_server_test/BUILD.gn
index 5b7d3223aa10458cb66b3a9d21779b0a25fb6ded..6bdeb3291f7efe7c8aefb33bdfb5aaeceab10367 100755
--- a/test/unittest/app_spawn_server_test/BUILD.gn
+++ b/test/unittest/app_spawn_server_test/BUILD.gn
@@ -17,7 +17,9 @@ import("//build/test.gni")
 ohos_unittest("AppSpawnServerOverrideTest") {
   module_out_path = "${module_output_path}"
 
-  include_dirs = []
+  include_dirs = [
+    "//base/security/access_token/interfaces/innerkits/token_setproc/include",
+  ]
 
   sources = [
     "${appspawn_path}/src/appspawn_server.cpp",
@@ -31,7 +33,10 @@ ohos_unittest("AppSpawnServerOverrideTest") {
     "app_spawn_server_override_test.cpp",
   ]
 
-  deps = [ "${appspawn_path}/test:appspawn_test_source" ]
+  deps = [
+    "${appspawn_path}/test:appspawn_test_source",
+    "//base/security/access_token/interfaces/innerkits/token_setproc:libtoken_setproc",
+  ]
 
   external_deps = [
     "ability_runtime:app_manager",
@@ -44,12 +49,19 @@ ohos_unittest("AppSpawnServerOverrideTest") {
     "safwk:system_ability_fwk",
     "samgr_standard:samgr_proxy",
   ]
+
+  if (build_selinux) {
+    external_deps += [ "selinux:libhap_restorecon" ]
+    cflags = [ "-DWITH_SELINUX" ]
+  }
 }
 
 ohos_unittest("AppSpawnServerMockTest") {
   module_out_path = "${module_output_path}"
 
-  include_dirs = []
+  include_dirs = [
+    "//base/security/access_token/interfaces/innerkits/token_setproc/include",
+  ]
 
   sources = [
     "${appspawn_path}/src/appspawn_msg_peer.cpp",
@@ -63,7 +75,10 @@ ohos_unittest("AppSpawnServerMockTest") {
     "app_spawn_server_mock_test.cpp",
   ]
 
-  deps = [ "${appspawn_path}/test:appspawn_test_source" ]
+  deps = [
+    "${appspawn_path}/test:appspawn_test_source",
+    "//base/security/access_token/interfaces/innerkits/token_setproc:libtoken_setproc",
+  ]
 
   external_deps = [
     "ability_runtime:app_manager",
@@ -76,6 +91,11 @@ ohos_unittest("AppSpawnServerMockTest") {
     "safwk:system_ability_fwk",
     "samgr_standard:samgr_proxy",
   ]
+
+  if (build_selinux) {
+    external_deps += [ "selinux:libhap_restorecon" ]
+    cflags = [ "-DWITH_SELINUX" ]
+  }
 }
 
 group("unittest") {