sepolicy/tee.te

allow tee drm_block_device:blk_file rw_file_perms;

# tee starts as root, and drops privileges
allow tee self:capability { setuid setgid };