diff --git a/private/shell.te b/private/shell.te
index c0b4ee5..fbd9676 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -7,6 +7,9 @@
 allow shell debugfs_trace_marker:file getattr;
 allow shell atrace_exec:file rx_file_perms;
 
+# read config.gz for CTS purposes
+allow shell config_gz:file r_file_perms;
+
 userdebug_or_eng(`
   allow shell tracing_shell_writable_debug:file rw_file_perms;
 ')