diff --git a/UpdateEngine.conf b/UpdateEngine.conf
new file mode 100644
index 0000000..88d6dc4
--- /dev/null
+++ b/UpdateEngine.conf
@@ -0,0 +1,23 @@
+<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+  "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+  <policy user="root">
+    <allow own="org.chromium.UpdateEngine" />
+    <allow send_destination="org.chromium.UpdateEngine" />
+  </policy>
+  <policy user="chronos">
+    <!-- introspection is denied -->
+    <deny send_destination="org.chromium.UpdateEngine"
+          send_interface="org.freedesktop.DBus.Introspectable" />
+    <!-- properties denied -->
+    <deny send_destination="org.chromium.UpdateEngine"
+          send_interface="org.freedesktop.DBus.Properties" />
+    <!-- allow explicit methods -->
+    <allow send_destination="org.chromium.UpdateEngine"
+           send_interface="org.chromium.UpdateEngineInterface"
+           send_member="GetStatus"/>
+  </policy>
+  <policy context="default">
+    <deny send_destination="org.chromium.UpdateEngine" />
+  </policy>
+</busconfig>