diff --git a/public/domain.te b/public/domain.te
index 4f026232a93c79c994a5ebf8c2b1b671946a3e97..31345be8f979068fb2a7a4a0caa5d19ad4b8be9d 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -600,6 +600,7 @@ neverallow {
   -init
   -uncrypt
   -update_engine
+  -vendor_init
   -vold
   -recovery
   -ueventd
diff --git a/public/vendor_init.te b/public/vendor_init.te
index 027392509796b8cb44075b3bacd3bd498a1b0781..362244ee756c349aa1f18ae94fea497f53585a5a 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -146,6 +146,9 @@ allow vendor_init serialno_prop:file { getattr open read };
 # Vendor init can perform operations on trusted and security Extended Attributes
 allow vendor_init self:global_capability_class_set sys_admin;
 
+# Raw writes to misc block device
+allow vendor_init misc_block_device:blk_file w_file_perms;
+
 not_compatible_property(`
     set_prop(vendor_init, {
       property_type