diff --git a/private/boringssl_self_test.te b/private/boringssl_self_test.te
index 0ef4b53..4e2d848 100644
--- a/private/boringssl_self_test.te
+++ b/private/boringssl_self_test.te
@@ -10,6 +10,9 @@
 allow boringssl_self_test boringssl_self_test_marker:file create_file_perms;
 allow boringssl_self_test boringssl_self_test_marker:dir ra_dir_perms;
 
+# Allow boringsself_self_test to write its stdout/stderr messages to kmsg_debug.
+allow boringssl_self_test kmsg_debug_device:chr_file { w_file_perms getattr ioctl };
+
 # No other process should be able to create these files because their existence causes the
 # boringssl self test to be skipped.
 neverallow {
diff --git a/public/init.te b/public/init.te
index de6d4d4..3a59641 100644
--- a/public/init.te
+++ b/public/init.te
@@ -14,7 +14,7 @@
 allow init kmsg_device:chr_file { getattr write relabelto };
 # /dev/kmsg_debug
 userdebug_or_eng(`
-  allow init kmsg_debug_device:chr_file { write relabelto };
+  allow init kmsg_debug_device:chr_file { open write relabelto };
 ')
 # /dev/__properties__
 allow init properties_device:dir relabelto;