diff --git a/private/app.te b/private/app.te
index 4c5cb380d05afdd600abc1c2861380cbec0b3688..c0fdff2aa676c5f8635fdd4ed190c694e62d2353 100644
--- a/private/app.te
+++ b/private/app.te
@@ -273,9 +273,6 @@ get_prop({ appdomain -isolated_app }, hwservicemanager_prop);
 # Allow app access to mediacodec (IOMX HAL)
 binder_call({ appdomain -isolated_app }, mediacodec)
 
-# App can access configstore HAL which is read only
-binder_call({ appdomain -isolated_app }, hal_configstore)
-
 # Allow app to access shared memory created by camera HAL1
 allow { appdomain -isolated_app } hal_camera:fd use;
 
diff --git a/private/surfaceflinger.te b/private/surfaceflinger.te
index 9f5e4fa694b06acbf9e0ec618f3ec5c574898a8d..eeea1852db1e463e111b46e073a3a5b009624679 100644
--- a/private/surfaceflinger.te
+++ b/private/surfaceflinger.te
@@ -14,7 +14,6 @@ hwbinder_use(surfaceflinger)
 hal_client_domain(surfaceflinger, hal_graphics_allocator)
 binder_call(surfaceflinger, hal_graphics_composer)
 hal_client_domain(surfaceflinger, hal_graphics_composer)
-binder_call(surfaceflinger, hal_configstore)
 hal_client_domain(surfaceflinger, hal_configstore)
 
 # Perform Binder IPC.
diff --git a/private/technical_debt.cil b/private/technical_debt.cil
index e95e555a6ccdc7a11e3fc051a9d4290f5c8e6eee..ccbae108881effbbdae7a1291a0064c5d3e26f92 100644
--- a/private/technical_debt.cil
+++ b/private/technical_debt.cil
@@ -12,6 +12,11 @@
 (typeattributeset hal_allocator_client ((and (appdomain) ((not (isolated_app))))))
 (typeattributeset halclientdomain (hal_allocator_client))
 
+; Apps, except isolated apps, are clients of Configstore HAL
+; Unfortunately, we can't currently express this in module policy language:
+;     typeattribute { appdomain -isolated_app } hal_configstore_client;
+(typeattributeset hal_configstore_client ((and (appdomain) ((not (isolated_app))))))
+
 ; Apps, except isolated apps, are clients of Graphics Allocator HAL
 ; Unfortunately, we can't currently express this in module policy language:
 ;     typeattribute { appdomain -isolated_app } hal_graphics_allocator_client;
diff --git a/public/hal_configstore.te b/public/hal_configstore.te
new file mode 100644
index 0000000000000000000000000000000000000000..1a8b88b3ba215950d1c2a9cc2043324b973ef9a9
--- /dev/null
+++ b/public/hal_configstore.te
@@ -0,0 +1,2 @@
+# HwBinder IPC from client to server
+binder_call(hal_configstore_client, hal_configstore_server)