diff --git a/private/hal_widevine_system.te b/private/hal_widevine_system.te
new file mode 100644
index 0000000..57213b3
--- /dev/null
+++ b/private/hal_widevine_system.te
@@ -0,0 +1,7 @@
+type hal_widevine_system, domain, coredomain;
+hal_server_domain(hal_widevine_system, hal_drm)
+
+type hal_widevine_system_exec, exec_type, system_file_type, file_type;
+init_daemon_domain(hal_widevine_system)
+
+allow hal_widevine_system self:vsock_socket { create_socket_perms_no_ioctl };