diff --git a/sepolicy/private/netd.te b/sepolicy/private/netd.te
new file mode 100644
index 000000000..f5ebe20cd
--- /dev/null
+++ b/sepolicy/private/netd.te
@@ -0,0 +1,10 @@
+# TODO: delete this once it's in common sepolicy.
+set_prop(netd, netd_stable_secret_prop)
+
+# persist.netd.stable_secret contains RFC 7217 secret key which should never be
+# leaked to other processes. Make sure it never leaks.
+neverallow { domain -netd -init } netd_stable_secret_prop:file r_file_perms;
+
+# We want to ensure that no other process ever tries tampering with persist.netd.stable_secret,
+# the RFC 7217 secret key managed by netd. Doing so could compromise user privacy.
+neverallow { domain -netd -init } netd_stable_secret_prop:property_service set;
diff --git a/sepolicy/private/property.te b/sepolicy/private/property.te
new file mode 100644
index 000000000..a9519ecd4
--- /dev/null
+++ b/sepolicy/private/property.te
@@ -0,0 +1,2 @@
+# TODO: delete this once it's in common sepolicy.
+type netd_stable_secret_prop, property_type;
diff --git a/sepolicy/private/property_contexts b/sepolicy/private/property_contexts
new file mode 100644
index 000000000..901beedcd
--- /dev/null
+++ b/sepolicy/private/property_contexts
@@ -0,0 +1,2 @@
+# TODO: delete this once it's in common sepolicy.
+persist.netd.stable_secret    u:object_r:netd_stable_secret_prop:s0