diff --git a/domain.te b/domain.te
index 9b2024b0347316efcb5c759dbf7ab74a216b6ebe..a66dd7eee4996ab32223284b10253d2ded84cfd4 100644
--- a/domain.te
+++ b/domain.te
@@ -165,8 +165,19 @@ neverallow {
   -vold
 } self:capability mknod;
 
-# Limit raw I/O to these whitelisted domains.
-neverallow { domain -kernel -init -recovery -ueventd -watchdogd -healthd -uncrypt -tee } self:capability sys_rawio;
+# Limit raw I/O to these whitelisted domains. Do not apply to debug builds.
+neverallow {
+  domain
+  userdebug_or_eng(`-domain')
+  -kernel
+  -init
+  -recovery
+  -ueventd
+  -watchdogd
+  -healthd
+  -uncrypt
+  -tee
+} self:capability sys_rawio;
 
 # No process can map low memory (< CONFIG_LSM_MMAP_MIN_ADDR).
 neverallow * self:memprotect mmap_zero;