common/kernel.te

allow kernel block_device:blk_file rw_file_perms;

userdebug_or_eng(`
  allow kernel self:capability { dac_read_search dac_override };
  allow kernel self:socket create_socket_perms;
')

# Access firmware_file
r_dir_file(kernel, firmware_file)