diff --git a/device.te b/device.te
index b2f4f1d..a120ba3 100644
--- a/device.te
+++ b/device.te
@@ -93,3 +93,6 @@
 # Assign this type to the partition specified by the encryptable=
 # mount option in your fstab file in the entry for userdata.
 type metadata_block_device, dev_type;
+
+# The 'misc' partition used by recovery and A/B.
+type misc_block_device, dev_type;
diff --git a/domain.te b/domain.te
index c6898ba..5634c17 100644
--- a/domain.te
+++ b/domain.te
@@ -341,8 +341,8 @@
 
 neverallow { domain -init -recovery -system_server } frp_block_device:blk_file rw_file_perms;
 
-# No domain other than recovery can write to system.
-neverallow { domain -recovery } system_block_device:blk_file write;
+# No domain other than recovery and update_engine can write to system partition(s).
+neverallow { domain -recovery -update_engine } system_block_device:blk_file write;
 
 # No domains other than install_recovery or recovery can write to recovery.
 neverallow { domain -install_recovery -recovery } recovery_block_device:blk_file write;
diff --git a/file_contexts b/file_contexts
index 4b6198a..7a8d0ea 100644
--- a/file_contexts
+++ b/file_contexts
@@ -196,6 +196,7 @@
 /system/bin/sgdisk      u:object_r:sgdisk_exec:s0
 /system/bin/blkid       u:object_r:blkid_exec:s0
 /system/bin/tzdatacheck u:object_r:tzdatacheck_exec:s0
+/system/bin/update_engine        u:object_r:update_engine_exec:s0
 
 #############################
 # Vendor files
@@ -269,6 +270,7 @@
 /data/misc/zoneinfo(/.*)?       u:object_r:zoneinfo_data_file:s0
 /data/misc/vold(/.*)?           u:object_r:vold_data_file:s0
 /data/misc/perfprofd(/.*)?      u:object_r:perfprofd_data_file:s0
+/data/misc/update_engine(/.*)?  u:object_r:update_engine_data_file:s0
 /data/system/heapdump(/.*)?     u:object_r:heapdump_data_file:s0
 
 # Fingerprint data
diff --git a/uncrypt.te b/uncrypt.te
index 752124d..93f5a27 100644
--- a/uncrypt.te
+++ b/uncrypt.te
@@ -27,6 +27,8 @@
 # Raw writes to block device
 allow uncrypt self:capability sys_rawio;
 allow uncrypt block_device:blk_file w_file_perms;
+auditallow uncrypt block_device:blk_file w_file_perms;
+allow uncrypt misc_block_device:blk_file w_file_perms;
 allow uncrypt block_device:dir r_dir_perms;
 
 # Access userdata block device.
diff --git a/update_engine.te b/update_engine.te
new file mode 100644
index 0000000..88b0b72
--- /dev/null
+++ b/update_engine.te
@@ -0,0 +1,27 @@
+# Domain for update_engine daemon.
+type update_engine, domain;
+type update_engine_exec, exec_type, file_type;
+type update_engine_data_file, file_type, data_file_type;
+
+init_daemon_domain(update_engine);
+net_domain(update_engine);
+
+# Following permissions are needed for update_engine.
+allow update_engine self:process { setsched };
+allow update_engine self:capability { fowner sys_admin };
+allow update_engine kmsg_device:chr_file w_file_perms;
+wakelock_use(update_engine);
+
+# Allow using persistent storage in /data/misc/update_engine.
+allow update_engine update_engine_data_file:dir { create_dir_perms };
+allow update_engine update_engine_data_file:file { create_file_perms };
+
+# Allow update_engine to reach block devices in /dev/block.
+allow update_engine block_device:dir search;
+
+# Allow read/write on system and boot partitions.
+allow update_engine boot_block_device:blk_file rw_file_perms;
+allow update_engine system_block_device:blk_file rw_file_perms;
+
+# Don't allow kernel module loading, just silence the logs.
+dontaudit update_engine kernel:system module_request;