diff --git a/sepolicy/vendor/bug_map b/sepolicy/vendor/bug_map
new file mode 100644
index 00000000..8e72b519
--- /dev/null
+++ b/sepolicy/vendor/bug_map
@@ -0,0 +1 @@
+surfaceflinger vendor_firmware_file dir 68213100
diff --git a/sepolicy/vendor/file.te b/sepolicy/vendor/file.te
index 3d916968..d954c007 100644
--- a/sepolicy/vendor/file.te
+++ b/sepolicy/vendor/file.te
@@ -71,6 +71,8 @@ type sensors_vendor_data_file, file_type, data_file_type;
 type audio_vendor_data_file, file_type, data_file_type;
 type mediadrm_vendor_data_file, file_type, data_file_type;
 
+type vendor_firmware_file, vendor_file_type, file_type;
+
 #data sysfs files
 type sysfs_data, fs_type, sysfs_type;
 
diff --git a/sepolicy/vendor/file_contexts b/sepolicy/vendor/file_contexts
index e213942c..d9290d61 100644
--- a/sepolicy/vendor/file_contexts
+++ b/sepolicy/vendor/file_contexts
@@ -120,6 +120,7 @@
 /system/bin/move_widevine_data\.sh              u:object_r:move-widevine-data-sh_exec:s0
 
 # files in /vendor
+/vendor/firmware(/.*)?          u:object_r:vendor_firmware_file:s0
 /vendor/bin/hw/android\.hardware\.dumpstate@1\.0-service.wahoo      u:object_r:hal_dumpstate_impl_exec:s0
 /vendor/bin/hw/android\.hardware\.vr@1\.0-service.wahoo      u:object_r:hal_vr_default_exec:s0
 /vendor/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service.wahoo u:object_r:hal_fingerprint_default_exec:s0
diff --git a/sepolicy/vendor/kernel.te b/sepolicy/vendor/kernel.te
index 758eb697..d2bf9c0f 100644
--- a/sepolicy/vendor/kernel.te
+++ b/sepolicy/vendor/kernel.te
@@ -3,10 +3,11 @@ userdebug_or_eng(`
   allow kernel self:socket create;
 ')
 
-dontaudit kernel kernel:system module_request;
+allow kernel vendor_firmware_file:dir search;
+allow kernel vendor_firmware_file:file r_file_perms;
+allow kernel vendor_firmware_file:lnk_file read;
 
-# Read FDs from /vendor/firmware
-allow kernel vendor_file:file r_file_perms;
+dontaudit kernel kernel:system module_request;
 
 allow kernel debugfs_ipc:dir search;
 allow kernel persist_file:dir search;