diff --git a/device.te b/device.te
index 7818ce870313fdda7c33afd0bd35cddc25cbae9c..ecb7c10c39ad0b0e1fcb1fae9d50d05f92920b4e 100644
--- a/device.te
+++ b/device.te
@@ -41,6 +41,7 @@ type fuse_device, dev_type;
 type ion_device, dev_type;
 type gps_device, dev_type;
 type qtaguid_device, dev_type;
+type watchdog_device, dev_type;
 
 # All devices have a uart for the hci
 # attach service. The uart dev node
diff --git a/file_contexts b/file_contexts
index 3b207c9f03c7f8e789e2e1f5d92c28cbdc9fda0c..c47b44b5c2ec18586d2f12de2a86d8a692a2c0b7 100644
--- a/file_contexts
+++ b/file_contexts
@@ -104,6 +104,7 @@
 /dev/urandom		u:object_r:urandom_device:s0
 /dev/vcs[0-9a-z]*	u:object_r:vcs_device:s0
 /dev/video[0-9]*	u:object_r:video_device:s0
+/dev/watchdog		u:object_r:watchdog_device:s0
 /dev/xt_qtaguid	u:object_r:qtaguid_device:s0
 /dev/zero		u:object_r:zero_device:s0
 #############################
diff --git a/watchdogd.te b/watchdogd.te
new file mode 100644
index 0000000000000000000000000000000000000000..18824ccf204c85fb3497511059be3615db7a155b
--- /dev/null
+++ b/watchdogd.te
@@ -0,0 +1,8 @@
+# watchdogd seclabel is specified in init.<board>.rc
+type watchdogd, domain;
+allow watchdogd rootfs:file { entrypoint r_file_perms };
+allow watchdogd self:capability mknod;
+allow watchdogd device:dir { add_name write remove_name };
+allow watchdogd watchdog_device:chr_file rw_file_perms;
+# because of /dev/__kmsg__ and /dev/__null__
+allow watchdogd device:chr_file create_file_perms;