diff --git a/whitechapel/vendor/google/file.te b/whitechapel/vendor/google/file.te
index 37fa6efb..7c1dae90 100644
--- a/whitechapel/vendor/google/file.te
+++ b/whitechapel/vendor/google/file.te
@@ -40,6 +40,7 @@ type vendor_battery_debugfs, fs_type, debugfs_type, sysfs_type;
 # Exynos sysfs
 type sysfs_exynos_bts, sysfs_type, fs_type;
 type sysfs_exynos_bts_stats, sysfs_type, fs_type;
+type sysfs_ota, sysfs_type, fs_type;
 
 # Exynos Firmware
 type vendor_fw_file, vendor_file_type, file_type;
diff --git a/whitechapel/vendor/google/genfs_contexts b/whitechapel/vendor/google/genfs_contexts
index dee5a5ac..4659e1d2 100644
--- a/whitechapel/vendor/google/genfs_contexts
+++ b/whitechapel/vendor/google/genfs_contexts
@@ -181,6 +181,9 @@ genfscon sysfs /devices/platform/10960000.hsi2c/i2c-4/4-0008/wakeup/wakeup
 genfscon sysfs /devices/platform/10970000.hsi2c/i2c-5/5-0043/wakeup/wakeup                                               u:object_r:sysfs_wakeup:s0
 genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-6/6-0069/power_supply/main-charger/wakeup                            u:object_r:sysfs_wakeup:s0
 
+# OTA
+genfscon sysfs /devices/platform/14700000.ufs/pixel/boot_lun_enabled                                                     u:object_r:sysfs_ota:s0
+
 # subsystem-coredump
 genfscon sysfs /class/sscoredump/level                                                                  u:object_r:sscoredump_sysfs_level:s0
 
diff --git a/whitechapel/vendor/google/hal_bootctl_default.te b/whitechapel/vendor/google/hal_bootctl_default.te
index fd5063f9..0e0c3c24 100644
--- a/whitechapel/vendor/google/hal_bootctl_default.te
+++ b/whitechapel/vendor/google/hal_bootctl_default.te
@@ -1,2 +1,3 @@
 allow hal_bootctl_default sda_block_device:blk_file rw_file_perms;
 allow hal_bootctl_default devinfo_block_device:blk_file r_file_perms;
+allow hal_bootctl_default sysfs_ota:file rw_file_perms;
diff --git a/whitechapel/vendor/google/update_engine.te b/whitechapel/vendor/google/update_engine.te
new file mode 100644
index 00000000..a403d9e4
--- /dev/null
+++ b/whitechapel/vendor/google/update_engine.te
@@ -0,0 +1,3 @@
+allow update_engine custom_ab_block_device:blk_file rw_file_perms;
+allow update_engine modem_block_device:blk_file rw_file_perms;
+allow update_engine proc_bootconfig:file r_file_perms;