diff --git a/private/file_contexts b/private/file_contexts
index 4d2464a32ae1896fb70a4e49dbc58da04870eec7..4d35a177b5a0411370df51c69a0777e654102348 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -83,6 +83,7 @@
 /dev/input(/.*)		u:object_r:input_device:s0
 /dev/iio:device[0-9]+   u:object_r:iio_device:s0
 /dev/ion		u:object_r:ion_device:s0
+/dev/keychord   u:object_r:keychord_device:s0
 /dev/kmem		u:object_r:kmem_device:s0
 /dev/log(/.*)?		u:object_r:log_device:s0
 /dev/mem		u:object_r:kmem_device:s0
diff --git a/public/device.te b/public/device.te
index 6866330c169a243ca51bb4a6f778b779e6d8c8a4..633515fe9908190de44a413ccc442c713ea3bdc3 100644
--- a/public/device.te
+++ b/public/device.te
@@ -10,6 +10,7 @@ type hwbinder_device, dev_type, mlstrustedobject;
 type block_device, dev_type;
 type camera_device, dev_type;
 type dm_device, dev_type;
+type keychord_device, dev_type;
 type loop_device, dev_type;
 type pmsg_device, dev_type, mlstrustedobject;
 type radio_device, dev_type;
diff --git a/public/init.te b/public/init.te
index 528c6b8f08f4672e3f648e04d874fe2e6ad2cab6..c858f8f0af2f0a98083d17bb361773adc93378bd 100644
--- a/public/init.te
+++ b/public/init.te
@@ -308,13 +308,13 @@ allow init hw_random_device:chr_file r_file_perms;
 allow init device:file create_file_perms;
 
 # Access character devices without a specific type,
-# e.g. /dev/keychord.
-# TODO: Move these devices into their own type unless they
-# are only ever accessed by init.
+# TODO: Remove this access and auditallow (b/33347297)
 allow init device:chr_file { rw_file_perms setattr };
+auditallow init device:chr_file { rw_file_perms setattr };
 
 # keychord configuration
 allow init self:capability sys_tty_config;
+allow init keychord_device:chr_file rw_file_perms;
 
 # Access device mapper for setting up dm-verity
 allow init dm_device:chr_file rw_file_perms;
diff --git a/public/ueventd.te b/public/ueventd.te
index 3f1dcd4733afcbe0c70d9c77ba0b3dd12c436a69..11235ed35ad34591154f7b0b2725cd0a1dbbce53 100644
--- a/public/ueventd.te
+++ b/public/ueventd.te
@@ -8,6 +8,8 @@ allow ueventd kmsg_device:chr_file rw_file_perms;
 allow ueventd self:capability { chown mknod net_admin setgid fsetid sys_rawio dac_override fowner };
 allow ueventd device:file create_file_perms;
 allow ueventd device:chr_file rw_file_perms;
+auditallow ueventd device:chr_file rw_file_perms;
+
 r_dir_file(ueventd, sysfs_type)
 r_dir_file(ueventd, rootfs)
 allow ueventd sysfs:file w_file_perms;