diff --git a/domain.te b/domain.te
index 13ce01604..5ac6b460f 100644
--- a/domain.te
+++ b/domain.te
@@ -203,7 +203,7 @@ neverallow domain init:binder call;
 
 # Don't allow raw read/write/open access to block_device
 # Rather force a relabel to a more specific type
-neverallow { domain -unconfineddomain -vold } block_device:blk_file { open read write };
+neverallow { domain -kernel -init -recovery -vold } block_device:blk_file { open read write };
 
 # Don't allow raw read/write/open access to generic devices.
 # Rather force a relabel to a more specific type.
diff --git a/init.te b/init.te
index efce6e7d8..c05fabaa5 100644
--- a/init.te
+++ b/init.te
@@ -9,6 +9,7 @@ allow init unlabeled:filesystem mount;
 
 allow init self:capability { sys_rawio mknod };
 
+allow init dev_type:blk_file rw_file_perms;
 allow init fs_type:filesystem *;
 allow init {fs_type dev_type file_type}:dir_file_class_set relabelto;
 allow init kernel:security load_policy;
diff --git a/kernel.te b/kernel.te
index af107910f..88ebc5092 100644
--- a/kernel.te
+++ b/kernel.te
@@ -21,3 +21,5 @@ allow kernel self:security setcheckreqprot;
 ## TODO: Investigate whether it is safe to remove these
 allow kernel self:capability { sys_rawio mknod };
 auditallow kernel self:capability { sys_rawio mknod };
+allow kernel dev_type:blk_file rw_file_perms;
+auditallow kernel dev_type:blk_file rw_file_perms;
diff --git a/recovery.te b/recovery.te
index ea444c4bb..b6f82c783 100644
--- a/recovery.te
+++ b/recovery.te
@@ -10,6 +10,9 @@ allow recovery {fs_type dev_type -kmem_device file_type}:dir_file_class_set rela
 allow recovery unlabeled:filesystem mount;
 allow recovery fs_type:filesystem *;
 
+# Required to e.g. wipe userdata/cache.
+allow recovery dev_type:blk_file rw_file_perms;
+
 allow recovery self:process execmem;
 allow recovery ashmem_device:chr_file execute;
 allow recovery tmpfs:file rx_file_perms;
diff --git a/unconfined.te b/unconfined.te
index 8415ada78..80d42b3e7 100644
--- a/unconfined.te
+++ b/unconfined.te
@@ -28,7 +28,7 @@ allow unconfineddomain domain:{ fifo_file file } rw_file_perms;
 allow unconfineddomain domain:socket_class_set *;
 allow unconfineddomain domain:ipc_class_set *;
 allow unconfineddomain domain:key *;
-allow unconfineddomain {fs_type dev_type file_type}:{ dir blk_file lnk_file sock_file fifo_file } ~relabelto;
+allow unconfineddomain {fs_type dev_type file_type}:{ dir lnk_file sock_file fifo_file } ~relabelto;
 allow unconfineddomain {fs_type -usermodehelper -proc_security}:{ chr_file file } ~{entrypoint execmod execute relabelto};
 allow unconfineddomain {dev_type -kmem_device}:{ chr_file file } ~{entrypoint execmod execute relabelto};
 allow unconfineddomain file_type:{ chr_file file } ~{entrypoint execmod execute relabelto};