diff --git a/private/e2fs.te b/private/e2fs.te
new file mode 100644
index 0000000000000000000000000000000000000000..2c4c0139808e8350186321c6a4544980617f5b05
--- /dev/null
+++ b/private/e2fs.te
@@ -0,0 +1,3 @@
+allow e2fs devpts:chr_file { read write };
+allow e2fs metadata_block_device:blk_file rw_file_perms;
+
diff --git a/private/fsck.te b/private/fsck.te
index 3a36329f7cca371944b2835dee1854966a754269..f8e09b645d4165b61be2f3b7d841ce0a420d5dc6 100644
--- a/private/fsck.te
+++ b/private/fsck.te
@@ -1,3 +1,5 @@
 typeattribute fsck coredomain;
 
 init_daemon_domain(fsck)
+
+allow fsck metadata_block_device:blk_file rw_file_perms;
diff --git a/public/domain.te b/public/domain.te
index 76318ecf1aea109bdaa682b547097652430e54df..cffe5cdae1c6f7e3bea67495765d50dd80f088af 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -556,8 +556,14 @@ neverallow {
 # The metadata block device is set aside for device encryption and
 # verified boot metadata. It may be reset at will and should not
 # be used by other domains.
-neverallow { domain -init -recovery -vold } metadata_block_device:blk_file
-  { append link rename write open read ioctl lock };
+neverallow {
+  domain
+  -init
+  -recovery
+  -vold
+  -e2fs
+  -fsck
+} metadata_block_device:blk_file { append link rename write open read ioctl lock };
 
 # No domain other than recovery and update_engine can write to system partition(s).
 neverallow { domain -recovery -update_engine } system_block_device:blk_file { write append };
diff --git a/public/fsck.te b/public/fsck.te
index 7cc7e8b18f94fc49650ced01a203405f63a4b5c1..c5219d8ab6646ea3dcb0a90dfb68429def33363e 100644
--- a/public/fsck.te
+++ b/public/fsck.te
@@ -44,7 +44,6 @@ allow fsck rootfs:dir r_dir_perms;
 neverallow fsck {
   boot_block_device
   frp_block_device
-  metadata_block_device
   recovery_block_device
   root_block_device
   swap_block_device