diff --git a/drmserver.te b/drmserver.te
index f30033a2f5265e3806ba25c00cc3465158a8a70d..63286d55822f284c5379aa07d8374a8f9fafe9c1 100644
--- a/drmserver.te
+++ b/drmserver.te
@@ -18,3 +18,4 @@ allow drmserver sdcard:dir search;
 allow drmserver drm_data_file:dir create_dir_perms;
 allow drmserver drm_data_file:file create_file_perms;
 allow drmserver self:{ tcp_socket udp_socket } *;
+allow drmserver tee_device:chr_file rw_file_perms;
diff --git a/gpsd.te b/gpsd.te
index bc2893d1ef59989f6c08d1768b4617a9c04e2d08..8010efa0d5d41b5c66d13ea0a430a4465095e7d1 100644
--- a/gpsd.te
+++ b/gpsd.te
@@ -12,3 +12,5 @@ type_transition gpsd gps_data_file:sock_file gps_socket;
 allow gpsd gps_socket:sock_file create_file_perms;
 # XXX Label sysfs files with a specific type?
 allow gpsd sysfs:file rw_file_perms;
+
+allow gpsd gps_device:chr_file rw_file_perms;
diff --git a/keystore.te b/keystore.te
index 6c4d61026fbb0955696d350dab10174a6965f756..20e7222f758dc4dd941e09475f6f5f2b63c19ead 100644
--- a/keystore.te
+++ b/keystore.te
@@ -6,3 +6,4 @@ init_daemon_domain(keystore)
 allow keystore keystore_data_file:dir create_dir_perms;
 allow keystore keystore_data_file:notdevfile_class_set create_file_perms;
 allow keystore keystore_exec:file { getattr };
+allow keystore tee_device:chr_file rw_file_perms;
diff --git a/mediaserver.te b/mediaserver.te
index c8adf3ac185bfd9c734bb59648360de81a615601..e124db052b9147bd74131251a13823d0f4771b64 100644
--- a/mediaserver.te
+++ b/mediaserver.te
@@ -42,3 +42,5 @@ allow mediaserver qtaguid_proc:file rw_file_perms;
 allow mediaserver qtaguid_device:chr_file r_file_perms;
 # Allow abstract socket connection
 allow mediaserver rild:unix_stream_socket connectto;
+
+allow mediaserver tee_device:chr_file rw_file_perms;
diff --git a/tee.te b/tee.te
new file mode 100644
index 0000000000000000000000000000000000000000..ce4e2b6f7b68b04b3ce54920cc61be52060fbda6
--- /dev/null
+++ b/tee.te
@@ -0,0 +1,13 @@
+##
+# trusted execution environment (tee) daemon
+#
+type tee, domain;
+type tee_exec, exec_type, file_type;
+type tee_device, dev_type;
+type tee_data_file, file_type, data_file_type;
+
+init_daemon_domain(tee)
+allow tee self:capability { dac_override };
+allow tee tee_device:chr_file rw_file_perms;
+allow tee tee_data_file:dir { getattr write add_name };
+allow tee tee_data_file:file create_file_perms;