diff --git a/private/shell.te b/private/shell.te
index 8a933a5..53a6a7a 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -79,3 +79,9 @@
 userdebug_or_eng(`
   set_prop(shell, linker_prop)
 ')
+
+# Allow shell to get encryption policy of /data/local/tmp/, for CTS
+allowxperm shell shell_data_file:dir ioctl {
+  FS_IOC_GET_ENCRYPTION_POLICY
+  FS_IOC_GET_ENCRYPTION_POLICY_EX
+};
diff --git a/public/ioctl_defines b/public/ioctl_defines
index c5b412b..48fed86 100644
--- a/public/ioctl_defines
+++ b/public/ioctl_defines
@@ -804,6 +804,7 @@
 define(`FS_IOC_ENABLE_VERITY', `0x6685')
 define(`FS_IOC_FIEMAP', `0xc020660b')
 define(`FS_IOC_GET_ENCRYPTION_POLICY', `0x400c6615')
+define(`FS_IOC_GET_ENCRYPTION_POLICY_EX', `0xc0096616')
 define(`FS_IOC_GET_ENCRYPTION_PWSALT', `0x40106614')
 define(`FS_IOC_GETFLAGS', `0x80086601')
 define(`FS_IOC_GETVERSION', `0x80087601')