diff --git a/public/hal_bootctl.te b/public/hal_bootctl.te
index 8b240b1ce3013649202b0908dddf63b5e905e630..181de4a9cf5e4f261cf6fc8ba1f236a44424994c 100644
--- a/public/hal_bootctl.te
+++ b/public/hal_bootctl.te
@@ -4,3 +4,5 @@ binder_call(hal_bootctl_server, hal_bootctl_client)
 
 add_hwservice(hal_bootctl_server, hal_bootctl_hwservice)
 allow hal_bootctl_client hal_bootctl_hwservice:hwservice_manager find;
+
+dontaudit hal_bootctl self:capability sys_rawio;
diff --git a/public/update_engine.te b/public/update_engine.te
index 00f70bc4a8eb288cfd3250aaf044145ae67ae94a..2075985d3b662a0a440b05664ce6cd3e107c8188 100644
--- a/public/update_engine.te
+++ b/public/update_engine.te
@@ -19,6 +19,7 @@ wakelock_use(update_engine);
 
 # Ignore these denials.
 dontaudit update_engine kernel:process setsched;
+dontaudit update_engine self:capability sys_rawio;
 
 # Allow using persistent storage in /data/misc/update_engine.
 allow update_engine update_engine_data_file:dir create_dir_perms;