diff --git a/contexts/plat_file_contexts_test b/contexts/plat_file_contexts_test
index e002b15..c799171 100644
--- a/contexts/plat_file_contexts_test
+++ b/contexts/plat_file_contexts_test
@@ -405,6 +405,7 @@
 /system/bin/lpdumpd                                               lpdumpd_exec
 /system/bin/rss_hwm_reset                                         rss_hwm_reset_exec
 /system/bin/perfetto                                              perfetto_exec
+/system/bin/misctrl                                               misctrl_exec
 /system/bin/mtectrl                                               mtectrl_exec
 /system/bin/traced                                                traced_exec
 /system/bin/traced_perf                                           traced_perf_exec
diff --git a/private/domain.te b/private/domain.te
index 3454fd1..59e30c8 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -226,6 +226,7 @@
   -recovery
   -ueventd
   -mtectrl
+  -misctrl
 } misc_block_device:blk_file { append link relabelfrom rename write open read ioctl lock };
 
 # Limit ability to ptrace or read sensitive /proc/pid files of processes
diff --git a/private/dumpstate.te b/private/dumpstate.te
index 6798667..29cd454 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -68,6 +68,8 @@
 # Collect metrics on boot time created by init
 get_prop(dumpstate, boottime_prop)
 
+get_prop(dumpstate, misctrl_prop)
+
 # Signal native processes to dump their stack.
 allow dumpstate {
   mediatranscoding
diff --git a/private/file_contexts b/private/file_contexts
index 5e234f7..b9d661a 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -332,6 +332,7 @@
 /system/bin/rss_hwm_reset	u:object_r:rss_hwm_reset_exec:s0
 /system/bin/perfetto        u:object_r:perfetto_exec:s0
 /system/bin/mtectrl         u:object_r:mtectrl_exec:s0
+/system/bin/misctrl         u:object_r:misctrl_exec:s0
 /system/bin/traced        u:object_r:traced_exec:s0
 /system/bin/traced_perf        u:object_r:traced_perf_exec:s0
 /system/bin/traced_probes        u:object_r:traced_probes_exec:s0
diff --git a/private/misctrl.te b/private/misctrl.te
new file mode 100644
index 0000000..2352067
--- /dev/null
+++ b/private/misctrl.te
@@ -0,0 +1,17 @@
+# binary for generic misc partition management
+type misctrl, domain, coredomain;
+type misctrl_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(misctrl)
+
+allow misctrl misc_block_device:blk_file rw_file_perms;
+allow misctrl block_device:dir r_dir_perms;
+read_fstab(misctrl)
+
+set_prop(misctrl, misctrl_prop)
+
+# bootloader_message tries to find the fstab in the device config path first,
+# but because we've already booted up we can use the ro.boot properties instead,
+# so we can just ignore the SELinux denial.
+dontaudit misctrl sysfs_dt_firmware_android:dir search;
+dontaudit misctrl vendor_property_type:file read;
diff --git a/private/property.te b/private/property.te
index d21df55..2d030ab 100644
--- a/private/property.te
+++ b/private/property.te
@@ -35,6 +35,7 @@
 system_internal_prop(netd_stable_secret_prop)
 system_internal_prop(next_boot_prop)
 system_internal_prop(odsign_prop)
+system_internal_prop(misctrl_prop)
 system_internal_prop(perf_drop_caches_prop)
 system_internal_prop(pm_prop)
 system_internal_prop(profcollectd_node_id_prop)
@@ -185,6 +186,21 @@
   userdebug_or_eng(`-su')
 } init_svc_debug_prop:file no_rw_file_perms;
 
+# DO NOT ADD: compat risk
+neverallow {
+  domain
+  -init
+  -dumpstate
+  -misctrl
+  userdebug_or_eng(`-su')
+} misctrl_prop:file no_rw_file_perms;
+neverallow {
+  domain
+  -init
+  -misctrl
+  userdebug_or_eng(`-su')
+} misctrl_prop:property_service set;
+
 compatible_property_only(`
 # Prevent properties from being set
   neverallow {
diff --git a/private/property_contexts b/private/property_contexts
index 568bdc1..fe12202 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -98,6 +98,7 @@
 ro.boot.serialno        u:object_r:serialno_prop:s0
 ro.bt.                  u:object_r:bluetooth_prop:s0
 ro.boot.bootreason      u:object_r:bootloader_boot_reason_prop:s0
+ro.misctrl.             u:object_r:misctrl_prop:s0
 persist.sys.boot.reason u:object_r:last_boot_reason_prop:s0
 sys.boot.reason         u:object_r:system_boot_reason_prop:s0
 sys.boot.reason.last    u:object_r:last_boot_reason_prop:s0