diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 9f1750a2daa8275a3db87e7faa991e2db75f7476..5c09ea6554389ba36abbad94e963be250b69b0e2 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -181,6 +181,7 @@ neverallow all_untrusted_apps {
 neverallow all_untrusted_apps {
   default_android_hwservice
   hal_audio_hwservice
+  hal_authsecret_hwservice
   hal_bluetooth_hwservice
   hal_bootctl_hwservice
   hal_camera_hwservice
diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index 8db5d34551223ee08a15207a81e4a5cb25cdcb00..757689ad761789717ac6a6170dc21b58114ba86a 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -35,6 +35,7 @@
     exported3_default_prop
     exported3_system_prop
     fs_bpf
+    hal_authsecret_hwservice
     hal_broadcastradio_hwservice
     hal_cas_hwservice
     hal_lowpan_hwservice
diff --git a/private/hwservice_contexts b/private/hwservice_contexts
index 76781db7247450a9a5b6090b3dcac184cce38c59..809f53bf241ce8c2929f7ca2f2d26d677da47e89 100644
--- a/private/hwservice_contexts
+++ b/private/hwservice_contexts
@@ -3,6 +3,7 @@ android.frameworks.schedulerservice::ISchedulingPolicyService   u:object_r:fwk_s
 android.frameworks.sensorservice::ISensorManager                u:object_r:fwk_sensor_hwservice:s0
 android.hardware.audio.effect::IEffectsFactory                  u:object_r:hal_audio_hwservice:s0
 android.hardware.audio::IDevicesFactory                         u:object_r:hal_audio_hwservice:s0
+android.hardware.authsecret::IAuthSecret                        u:object_r:hal_authsecret_hwservice:s0
 android.hardware.biometrics.fingerprint::IBiometricsFingerprint u:object_r:hal_fingerprint_hwservice:s0
 android.hardware.bluetooth::IBluetoothHci                       u:object_r:hal_bluetooth_hwservice:s0
 android.hardware.boot::IBootControl                             u:object_r:hal_bootctl_hwservice:s0
diff --git a/private/system_server.te b/private/system_server.te
index 0589659642e146404c630474c099ba6864c8bcf2..14b8ca4f42ad9d3f84839d7d5a037c2a0e41d081 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -177,6 +177,7 @@ binder_service(system_server)
 
 # Use HALs
 hal_client_domain(system_server, hal_allocator)
+hal_client_domain(system_server, hal_authsecret)
 hal_client_domain(system_server, hal_broadcastradio)
 hal_client_domain(system_server, hal_configstore)
 hal_client_domain(system_server, hal_contexthub)
diff --git a/public/attributes b/public/attributes
index ebc302ae60c9acefdb2eebf1bcc8a37f1f7dd021..eebb1e02972d0ac3b7f9ad7e2fcb3ff854566824 100644
--- a/public/attributes
+++ b/public/attributes
@@ -204,6 +204,7 @@ expandattribute halclientdomain true;
 # HALs
 hal_attribute(allocator);
 hal_attribute(audio);
+hal_attribute(authsecret);
 hal_attribute(bluetooth);
 hal_attribute(bootctl);
 hal_attribute(broadcastradio);
diff --git a/public/hal_authsecret.te b/public/hal_authsecret.te
new file mode 100644
index 0000000000000000000000000000000000000000..81b0c04451b03c12ad1453f9635a8e04b589b9ca
--- /dev/null
+++ b/public/hal_authsecret.te
@@ -0,0 +1,5 @@
+# HwBinder IPC from client to server
+binder_call(hal_authsecret_client, hal_authsecret_server)
+
+add_hwservice(hal_authsecret_server, hal_authsecret_hwservice)
+allow hal_authsecret_client hal_authsecret_hwservice:hwservice_manager find;
diff --git a/public/hwservice.te b/public/hwservice.te
index 8f634ca6896ed251791d2bace81a1c5d4f93d0e8..ee8929dfcd93c194a310fc53dc7160b7655c4722 100644
--- a/public/hwservice.te
+++ b/public/hwservice.te
@@ -3,6 +3,7 @@ type fwk_display_hwservice, hwservice_manager_type, coredomain_hwservice;
 type fwk_scheduler_hwservice, hwservice_manager_type, coredomain_hwservice;
 type fwk_sensor_hwservice, hwservice_manager_type, coredomain_hwservice;
 type hal_audio_hwservice, hwservice_manager_type;
+type hal_authsecret_hwservice, hwservice_manager_type;
 type hal_bluetooth_hwservice, hwservice_manager_type;
 type hal_bootctl_hwservice, hwservice_manager_type;
 type hal_broadcastradio_hwservice, hwservice_manager_type;
diff --git a/public/su.te b/public/su.te
index a893026b75139e72b88aa7bd1addf5265a68181b..06586925cdb1a95a5582509db17980ec743f1c7d 100644
--- a/public/su.te
+++ b/public/su.te
@@ -58,6 +58,7 @@ userdebug_or_eng(`
   typeattribute su halclientdomain;
   typeattribute su hal_allocator_client;
   typeattribute su hal_audio_client;
+  typeattribute su hal_authsecret_client;
   typeattribute su hal_bluetooth_client;
   typeattribute su hal_bootctl_client;
   typeattribute su hal_camera_client;
diff --git a/vendor/hal_authsecret_default.te b/vendor/hal_authsecret_default.te
new file mode 100644
index 0000000000000000000000000000000000000000..46f5291cf1c4fc6df962a6d3fc202c647d8abefa
--- /dev/null
+++ b/vendor/hal_authsecret_default.te
@@ -0,0 +1,5 @@
+type hal_authsecret_default, domain;
+hal_server_domain(hal_authsecret_default, hal_authsecret)
+
+type hal_authsecret_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_authsecret_default)