diff --git a/selinux/recovery.te b/selinux/recovery.te
new file mode 100644
index 0000000..3a41f0c
--- /dev/null
+++ b/selinux/recovery.te
@@ -0,0 +1,5 @@
+recovery_only(`
+
+# mfc firmware
+allow recovery firmware_mfc:file { create write open setattr relabelto relabelfrom };
+')