diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index 0064bc02651087be3135325447bc267d470ccd6f..a2142852c38415dae49ded45de0947cad38830e1 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -65,6 +65,7 @@
     lowpan_service
     mediaextractor_update_service
     mediaprovider_tmpfs
+    metadata_file
     mnt_vendor_file
     netd_stable_secret_prop
     network_watchlist_data_file
diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil
index 11bd8b58da5d7f40aa91c4b26ab349a89fac3c79..557f93b30237c08c0eee170c1c3957fd609fdd17 100644
--- a/private/compat/27.0/27.0.ignore.cil
+++ b/private/compat/27.0/27.0.ignore.cil
@@ -54,6 +54,7 @@
     lowpan_prop
     lowpan_service
     mediaextractor_update_service
+    metadata_file
     mnt_vendor_file
     network_watchlist_data_file
     network_watchlist_service
diff --git a/public/file.te b/public/file.te
index 1451dc4501bfb8f4d6f2a9ef26f8cef9bb3f6529..ccfec1529b3e43a70e37b88a79b643b22b1a2c20 100644
--- a/public/file.te
+++ b/public/file.te
@@ -150,7 +150,9 @@ type vendor_framework_file, vendor_file_type, file_type;
 # Default type for everything in /vendor/overlay
 type vendor_overlay_file, vendor_file_type, file_type;
 
-# /metadata subdirectories
+# /metadata partition itself
+type metadata_file, file_type;
+# Vold files within /metadata
 type vold_metadata_file, file_type;
 
 # Speedup access for trusted applications to the runtime event tags
diff --git a/public/init.te b/public/init.te
index c34e02842d367d7d4b1b94772c35b73bfe4f7a59..735524e0c327097648a9bebf50eb6e36b8f38f72 100644
--- a/public/init.te
+++ b/public/init.te
@@ -98,6 +98,9 @@ allow init configfs:dir mounton;
 allow init configfs:dir create_dir_perms;
 allow init configfs:{ file lnk_file } create_file_perms;
 
+# /metadata
+allow init metadata_file:dir mounton;
+
 # Use tmpfs as /data, used for booting when /data is encrypted
 allow init tmpfs:dir relabelfrom;
 
diff --git a/public/vold.te b/public/vold.te
index 95847cf648c8ad64d7f3537884a71431f4f7eb13..0b0c7663b641ed10a44c26226f22e3c5476c1dd4 100644
--- a/public/vold.te
+++ b/public/vold.te
@@ -17,6 +17,7 @@ allow vold sysfs_usb:file w_file_perms;
 allow vold sysfs_zram_uevent:file w_file_perms;
 
 r_dir_file(vold, rootfs)
+r_dir_file(vold, metadata_file)
 allow vold {
   proc # b/67049235 processes /proc/<pid>/* files are mislabeled.
   proc_cmdline