diff --git a/BoardConfigCommon.mk b/BoardConfigCommon.mk
index 57c0607..fdbb195 100644
--- a/BoardConfigCommon.mk
+++ b/BoardConfigCommon.mk
@@ -88,6 +88,7 @@
         genfs_contexts \
         bluetooth.te \
         device.te \
+        domain.te \
         drmserver.te \
         init_shell.te \
         file.te \
diff --git a/sepolicy/domain.te b/sepolicy/domain.te
new file mode 100644
index 0000000..07223d1
--- /dev/null
+++ b/sepolicy/domain.te
@@ -0,0 +1,3 @@
+userdebug_or_eng(`
+  allow domain diag_device:chr_file rw_file_perms;
+')
diff --git a/sepolicy/rild.te b/sepolicy/rild.te
index 7718e27..8654560 100644
--- a/sepolicy/rild.te
+++ b/sepolicy/rild.te
@@ -1,5 +1,3 @@
-allow rild diag_device:chr_file rw_file_perms;
-
 # Kernel bug for Linux < 3.3: sysfs inodes can lose their security context
 # and revert to the base sysfs type.
 allow rild sysfs:file write;
diff --git a/sepolicy/system_server.te b/sepolicy/system_server.te
index c3eda54..1fba21e 100644
--- a/sepolicy/system_server.te
+++ b/sepolicy/system_server.te
@@ -1,4 +1,3 @@
 allow system_server { knv_device }:chr_file rw_file_perms;
 allow system_server sysfs_devices_system_cpu:file w_file_perms;
 allow system_server elan_ip_device:chr_file rw_file_perms;
-allow system_server diag_device:chr_file rw_file_perms;