diff --git a/non_plat/file_contexts b/non_plat/file_contexts
index a564935..db775c7 100644
--- a/non_plat/file_contexts
+++ b/non_plat/file_contexts
@@ -615,3 +615,5 @@
 
 /vendor/bin/hw/vendor\.mediatek\.hardware\.dumpstate@1\.0-service      u:object_r:hal_dumpstate_impl_exec:s0
 /vendor/bin/aeev  u:object_r:aee_aedv_exec:s0
+
+/vendor/bin/hw/android\.hardware\.drm@1\.1-service\.clearkey          u:object_r:hal_drm_clearkey_exec:s0
diff --git a/non_plat/hal_drm_clearkey.te b/non_plat/hal_drm_clearkey.te
new file mode 100644
index 0000000..976b9fa
--- /dev/null
+++ b/non_plat/hal_drm_clearkey.te
@@ -0,0 +1,11 @@
+# policy for /vendor/bin/hw/android.hardware.drm@1.1-service.clearkey
+type hal_drm_clearkey, domain;
+type hal_drm_clearkey_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(hal_drm_clearkey)
+
+hal_server_domain(hal_drm_clearkey, hal_drm)
+
+vndbinder_use(hal_drm_clearkey);
+
+allow hal_drm_clearkey { appdomain -isolated_app }:fd use;
diff --git a/non_plat/hal_drm_widevine.te b/non_plat/hal_drm_widevine.te
index 261b156..83c6825 100644
--- a/non_plat/hal_drm_widevine.te
+++ b/non_plat/hal_drm_widevine.te
@@ -12,6 +12,6 @@ vndbinder_use(hal_drm_widevine);
 allow hal_drm_widevine debugfs_tracing:file write;
 allow hal_drm_widevine debugfs_ion:dir search;
 
-allow hal_drm_default hal_allocator_server:fd use;
+allow hal_drm_widevine hal_allocator_server:fd use;
 allow hal_drm_widevine mediadrm_vendor_data_file:dir create_dir_perms;
 allow hal_drm_widevine mediadrm_vendor_data_file:file create_file_perms;