allow tee drm_block_device:blk_file rw_file_perms;

# tee starts as root, and drops privileges
allow tee self:capability { setuid setgid };

# Need to directly minipulate certain block devices
# for anti-rollback protection
allow tee block_device:dir search;
allow tee self:capability sys_rawio;
allow tee drm_block_device:blk_file rw_file_perms;