diff --git a/whitechapel_pro/file_contexts b/whitechapel_pro/file_contexts
index f439a185..1d2dd7b3 100644
--- a/whitechapel_pro/file_contexts
+++ b/whitechapel_pro/file_contexts
@@ -213,3 +213,6 @@
 /mnt/vendor/efs(/.*)?                                                       u:object_r:modem_efs_file:s0
 /mnt/vendor/efs_backup(/.*)?                                                u:object_r:modem_efs_file:s0
 /mnt/vendor/modem_userdata(/.*)?                                            u:object_r:modem_userdata_file:s0
+
+# USB
+/vendor/bin/hw/set_usb_irq\.sh  u:object_r:set-usb-irq-sh_exec:s0
diff --git a/whitechapel_pro/set-usb-irq-sh.te b/whitechapel_pro/set-usb-irq-sh.te
new file mode 100644
index 00000000..a00fe3bb
--- /dev/null
+++ b/whitechapel_pro/set-usb-irq-sh.te
@@ -0,0 +1,13 @@
+type set-usb-irq-sh, domain;
+type set-usb-irq-sh_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(set-usb-irq-sh)
+
+allow set-usb-irq-sh vendor_toolbox_exec:file execute_no_trans;
+
+allow set-usb-irq-sh proc_irq:dir r_dir_perms;
+allow set-usb-irq-sh proc_irq:file w_file_perms;
+
+# AFAICT this happens if /proc/irq updates as we're running
+# and we end up trying to write into non-existing file,
+# which implies creation...
+dontaudit set-usb-irq-sh self:capability dac_override;