diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index ea10df5..5ea924a 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -295,3 +295,6 @@
 # anon_inode usages like userfaultfd and io_uring. This prevents us from
 # creating a more fine-grained neverallow policy for each anon_inode usage.
 neverallow all_untrusted_apps domain:anon_inode *;
+
+# Do not allow untrusted app access to hidraw devices.
+neverallow all_untrusted_apps hidraw_device:chr_file *;
diff --git a/private/compat/34.0/34.0.ignore.cil b/private/compat/34.0/34.0.ignore.cil
index 5bbfecc..3364462 100644
--- a/private/compat/34.0/34.0.ignore.cil
+++ b/private/compat/34.0/34.0.ignore.cil
@@ -16,6 +16,7 @@
     hal_macsec_service
     hal_remotelyprovisionedcomponent_avf_service
     hal_threadnetwork_service
+    hidraw_device
     virtual_camera_service
     ot_daemon_service
     remote_auth_service
diff --git a/private/file_contexts b/private/file_contexts
index 32092da..3cfbaf0 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -127,6 +127,7 @@
 /dev/fuse		u:object_r:fuse_device:s0
 /dev/gnss[0-9]+		u:object_r:gnss_device:s0
 /dev/graphics(/.*)?	u:object_r:graphics_device:s0
+/dev/hidraw[0-9]+	u:object_r:hidraw_device:s0
 /dev/hw_random		u:object_r:hw_random_device:s0
 /dev/hwbinder		u:object_r:hwbinder_device:s0
 /dev/input(/.*)?	u:object_r:input_device:s0
diff --git a/private/system_server.te b/private/system_server.te
index 8c26cc7..bab31ae 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -480,6 +480,8 @@
 allow system_server rtc_device:chr_file rw_file_perms;
 allow system_server audio_device:dir r_dir_perms;
 allow system_server uhid_device:chr_file rw_file_perms;
+allow system_server hidraw_device:dir r_dir_perms;
+allow system_server hidraw_device:chr_file rw_file_perms;
 
 # write access to ALSA interfaces (/dev/snd/*) needed for MIDI
 allow system_server audio_device:chr_file rw_file_perms;