diff --git a/public/vdc.te b/public/vdc.te
index 67fb7a3a0e221bd928a7b775ef667aab89898da4..53d7bbe2cf7a099955b962e6a4d1728eee87418d 100644
--- a/public/vdc.te
+++ b/public/vdc.te
@@ -22,3 +22,6 @@ allow vdc dumpstate:unix_dgram_socket { read write };
 
 # vdc can be invoked with logwrapper, so let it write to pty
 allow vdc devpts:chr_file rw_file_perms;
+
+# vdc writes directly to kmsg during the boot process
+allow vdc kmsg_device:chr_file w_file_perms;