diff --git a/domain.te b/domain.te
index 13ce01604a31d16d10538d5ed313c1f64dba5843..5ac6b460f6d2e338944cab11a0da64b2e01ce837 100644
--- a/domain.te
+++ b/domain.te
@@ -203,7 +203,7 @@ neverallow domain init:binder call;
 
 # Don't allow raw read/write/open access to block_device
 # Rather force a relabel to a more specific type
-neverallow { domain -unconfineddomain -vold } block_device:blk_file { open read write };
+neverallow { domain -kernel -init -recovery -vold } block_device:blk_file { open read write };
 
 # Don't allow raw read/write/open access to generic devices.
 # Rather force a relabel to a more specific type.
diff --git a/init.te b/init.te
index efce6e7d8b18cbeaebf077b449d48cca986aba5f..c05fabaa564ae7529cc3502e3d340c0ce79c8ebd 100644
--- a/init.te
+++ b/init.te
@@ -9,6 +9,7 @@ allow init unlabeled:filesystem mount;
 
 allow init self:capability { sys_rawio mknod };
 
+allow init dev_type:blk_file rw_file_perms;
 allow init fs_type:filesystem *;
 allow init {fs_type dev_type file_type}:dir_file_class_set relabelto;
 allow init kernel:security load_policy;
diff --git a/kernel.te b/kernel.te
index af107910f430cd17f3d3efdf12d83044ff44df0b..88ebc50924d0f7e6eb52ef8b6a4d327293f09b47 100644
--- a/kernel.te
+++ b/kernel.te
@@ -21,3 +21,5 @@ allow kernel self:security setcheckreqprot;
 ## TODO: Investigate whether it is safe to remove these
 allow kernel self:capability { sys_rawio mknod };
 auditallow kernel self:capability { sys_rawio mknod };
+allow kernel dev_type:blk_file rw_file_perms;
+auditallow kernel dev_type:blk_file rw_file_perms;
diff --git a/recovery.te b/recovery.te
index ea444c4bb5aab5a40fb8c4cfc70de4cbf416bea1..b6f82c7834d1323a897f294ed730a4eb374c2960 100644
--- a/recovery.te
+++ b/recovery.te
@@ -10,6 +10,9 @@ allow recovery {fs_type dev_type -kmem_device file_type}:dir_file_class_set rela
 allow recovery unlabeled:filesystem mount;
 allow recovery fs_type:filesystem *;
 
+# Required to e.g. wipe userdata/cache.
+allow recovery dev_type:blk_file rw_file_perms;
+
 allow recovery self:process execmem;
 allow recovery ashmem_device:chr_file execute;
 allow recovery tmpfs:file rx_file_perms;
diff --git a/unconfined.te b/unconfined.te
index 8415ada78ef4a525541d838cdef8025f87c6f227..80d42b3e70caadf7217b61c5ac004bd369bc420e 100644
--- a/unconfined.te
+++ b/unconfined.te
@@ -28,7 +28,7 @@ allow unconfineddomain domain:{ fifo_file file } rw_file_perms;
 allow unconfineddomain domain:socket_class_set *;
 allow unconfineddomain domain:ipc_class_set *;
 allow unconfineddomain domain:key *;
-allow unconfineddomain {fs_type dev_type file_type}:{ dir blk_file lnk_file sock_file fifo_file } ~relabelto;
+allow unconfineddomain {fs_type dev_type file_type}:{ dir lnk_file sock_file fifo_file } ~relabelto;
 allow unconfineddomain {fs_type -usermodehelper -proc_security}:{ chr_file file } ~{entrypoint execmod execute relabelto};
 allow unconfineddomain {dev_type -kmem_device}:{ chr_file file } ~{entrypoint execmod execute relabelto};
 allow unconfineddomain file_type:{ chr_file file } ~{entrypoint execmod execute relabelto};