diff --git a/bootctrl/bootctrl_aidl.mk b/bootctrl/bootctrl_aidl.mk
index ca136ba..e9d7051 100644
--- a/bootctrl/bootctrl_aidl.mk
+++ b/bootctrl/bootctrl_aidl.mk
@@ -3,3 +3,4 @@
 	android.hardware.boot-service.default_recovery-pixel
 
 PRODUCT_SOONG_NAMESPACES += device/google/gs-common/bootctrl/aidl
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/bootctrl/sepolicy/aidl
diff --git a/bootctrl/sepolicy/aidl/device.te b/bootctrl/sepolicy/aidl/device.te
new file mode 100644
index 0000000..4fd0240
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/device.te
@@ -0,0 +1,5 @@
+# devinfo block device
+type devinfo_block_device, dev_type;
+
+# OTA
+type sda_block_device, dev_type;
diff --git a/bootctrl/sepolicy/aidl/file.te b/bootctrl/sepolicy/aidl/file.te
new file mode 100644
index 0000000..5357fa9
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/file.te
@@ -0,0 +1,2 @@
+# sysfs
+type sysfs_ota, sysfs_type, fs_type;
diff --git a/bootctrl/sepolicy/aidl/file_contexts b/bootctrl/sepolicy/aidl/file_contexts
new file mode 100644
index 0000000..339896f
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/hw/android\.hardware\.boot-service\.default-pixel                u:object_r:hal_bootctl_default_exec:s0
diff --git a/bootctrl/sepolicy/aidl/hal_bootctl_default.te b/bootctrl/sepolicy/aidl/hal_bootctl_default.te
new file mode 100644
index 0000000..2ffeb27
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/hal_bootctl_default.te
@@ -0,0 +1,8 @@
+allow hal_bootctl_default devinfo_block_device:blk_file rw_file_perms;
+allow hal_bootctl_default sda_block_device:blk_file rw_file_perms;
+allow hal_bootctl_default sysfs_ota:file rw_file_perms;
+allow hal_bootctl_default tee_device:chr_file rw_file_perms;
+
+recovery_only(`
+  allow hal_bootctl_default rootfs:dir r_dir_perms;
+')