diff --git a/cmds/installd/commands.c b/cmds/installd/commands.c
index 3e2d9535c..fc3972e68 100644
--- a/cmds/installd/commands.c
+++ b/cmds/installd/commands.c
@@ -313,10 +313,16 @@ int delete_cache(const char *pkgname, userid_t userid)
 int delete_code_cache(const char *pkgname, userid_t userid)
 {
     char codecachedir[PKG_PATH_MAX];
+    struct stat s;
 
     if (create_pkg_path(codecachedir, pkgname, CODE_CACHE_DIR_POSTFIX, userid))
         return -1;
 
+    /* it's okay if code cache is missing */
+    if (lstat(codecachedir, &s) == -1 && errno == ENOENT) {
+        return 0;
+    }
+
     /* delete contents, not the directory, no exceptions */
     return delete_dir_contents(codecachedir, 0, NULL);
 }
@@ -416,8 +422,14 @@ int move_dex(const char *src, const char *dst, const char *instruction_set)
     char src_dex[PKG_PATH_MAX];
     char dst_dex[PKG_PATH_MAX];
 
-    if (validate_apk_path(src)) return -1;
-    if (validate_apk_path(dst)) return -1;
+    if (validate_apk_path(src)) {
+        ALOGE("invalid apk path '%s' (bad prefix)\n", src);
+        return -1;
+    }
+    if (validate_apk_path(dst)) {
+        ALOGE("invalid apk path '%s' (bad prefix)\n", dst);
+        return -1;
+    }
 
     if (create_cache_path(src_dex, src, instruction_set)) return -1;
     if (create_cache_path(dst_dex, dst, instruction_set)) return -1;
@@ -435,12 +447,18 @@ int rm_dex(const char *path, const char *instruction_set)
 {
     char dex_path[PKG_PATH_MAX];
 
-    if (validate_apk_path(path)) return -1;
+    if (validate_apk_path(path) && validate_system_app_path(path)) {
+        ALOGE("invalid apk path '%s' (bad prefix)\n", path);
+        return -1;
+    }
+
     if (create_cache_path(dex_path, path, instruction_set)) return -1;
 
     ALOGV("unlink %s\n", dex_path);
     if (unlink(dex_path) < 0) {
-        ALOGE("Couldn't unlink %s: %s\n", dex_path, strerror(errno));
+        if (errno != ENOENT) {
+            ALOGE("Couldn't unlink %s: %s\n", dex_path, strerror(errno));
+        }
         return -1;
     } else {
         return 0;
diff --git a/cmds/installd/installd.c b/cmds/installd/installd.c
index c7fdf7af9..3078f202a 100644
--- a/cmds/installd/installd.c
+++ b/cmds/installd/installd.c
@@ -328,7 +328,7 @@ int initialize_globals() {
     }
 
     // Take note of the system and vendor directories.
-    android_system_dirs.count = 2;
+    android_system_dirs.count = 4;
 
     android_system_dirs.dirs = calloc(android_system_dirs.count, sizeof(dir_rec_t));
     if (android_system_dirs.dirs == NULL) {
@@ -336,22 +336,24 @@ int initialize_globals() {
         return -1;
     }
 
-    // system
-    if (get_path_from_env(&android_system_dirs.dirs[0], "ANDROID_ROOT") < 0) {
-        free_globals();
+    dir_rec_t android_root_dir;
+    if (get_path_from_env(&android_root_dir, "ANDROID_ROOT") < 0) {
+        ALOGE("Missing ANDROID_ROOT; aborting\n");
         return -1;
     }
 
-    // append "app/" to dirs[0]
-    char *system_app_path = build_string2(android_system_dirs.dirs[0].path, APP_SUBDIR);
-    android_system_dirs.dirs[0].path = system_app_path;
-    android_system_dirs.dirs[0].len = strlen(system_app_path);
+    android_system_dirs.dirs[0].path = build_string2(android_root_dir.path, APP_SUBDIR);
+    android_system_dirs.dirs[0].len = strlen(android_system_dirs.dirs[0].path);
 
-    // vendor
-    // TODO replace this with an environment variable (doesn't exist yet)
-    android_system_dirs.dirs[1].path = "/vendor/app/";
+    android_system_dirs.dirs[1].path = build_string2(android_root_dir.path, PRIV_APP_SUBDIR);
     android_system_dirs.dirs[1].len = strlen(android_system_dirs.dirs[1].path);
 
+    android_system_dirs.dirs[2].path = "/vendor/app/";
+    android_system_dirs.dirs[2].len = strlen(android_system_dirs.dirs[2].path);
+
+    android_system_dirs.dirs[3].path = "/oem/app/";
+    android_system_dirs.dirs[3].len = strlen(android_system_dirs.dirs[3].path);
+
     return 0;
 }
 
diff --git a/cmds/installd/installd.h b/cmds/installd/installd.h
index 99f037c34..a5cad45fd 100644
--- a/cmds/installd/installd.h
+++ b/cmds/installd/installd.h
@@ -62,6 +62,7 @@
 #define CODE_CACHE_DIR_POSTFIX "/code_cache"
 
 #define APP_SUBDIR             "app/" // sub-directory under ANDROID_DATA
+#define PRIV_APP_SUBDIR        "priv-app/" // sub-directory under ANDROID_DATA
 
 #define APP_LIB_SUBDIR         "app-lib/" // sub-directory under ANDROID_DATA
 
diff --git a/cmds/installd/utils.c b/cmds/installd/utils.c
index 8cd116874..60d20de5b 100644
--- a/cmds/installd/utils.c
+++ b/cmds/installd/utils.c
@@ -952,7 +952,6 @@ int validate_apk_path(const char *path)
     } else if (!strncmp(path, android_asec_dir.path, android_asec_dir.len)) {
         dir = &android_asec_dir;
     } else {
-        ALOGE("invalid apk path '%s' (bad prefix)\n", path);
         return -1;
     }