diff --git a/sepolicy/private/update_engine.te b/sepolicy/private/update_engine.te
index b1ca5d1..70c37ec 100644
--- a/sepolicy/private/update_engine.te
+++ b/sepolicy/private/update_engine.te
@@ -23,6 +23,7 @@
 allow update_engine sepolicy_file:file { append };
 
 allow update_engine gsi_metadata_file:dir search;
+allow update_engine metadata_file:dir search;
 allow update_engine rootfs:file { create write };
 #####
 allow update_engine proc_filesystems:file { getattr open read };