diff --git a/public/attributes b/public/attributes
index c25f1ebc899ebfedbef86c0cb14ebed4624e4c9e..2a8a40ada20732b34e48382c4e6efa427e14486d 100644
--- a/public/attributes
+++ b/public/attributes
@@ -154,6 +154,12 @@ expandattribute vendor_executes_system_violators false;
 attribute data_between_core_and_vendor_violators;
 expandattribute data_between_core_and_vendor_violators false;
 
+# All system domains which violate the requirement of not executing vendor
+# binaries/libraries.
+# TODO(b/62041836)
+attribute system_executes_vendor_violators;
+expandattribute system_executes_vendor_violators false;
+
 # hwservices that are accessible from untrusted applications
 # WARNING: Use of this attribute should be avoided unless
 # absolutely necessary.  It is a temporary allowance to aid the
diff --git a/public/domain.te b/public/domain.te
index 70d8ae20fd3c551c54026ef63de7e5a7120108fa..fb468e0db803e5b761f8272d540cfe8ae02bca91 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -829,6 +829,20 @@ full_treble_only(`
         -crash_dump_exec
         -netutils_wrapper_exec
     }:file { entrypoint execute execute_no_trans };
+
+    # Do not allow system components to execute files from vendor
+    # except for the ones whitelist here.
+    neverallow {
+      coredomain
+      -init
+      -system_executes_vendor_violators
+      -vendor_init
+    } {
+      vendor_file_type
+      -same_process_hal_file
+      -vndk_sp_file
+      -vendor_app_file
+    }:file { execute execute_no_trans };
 ')
 
 # Only authorized processes should be writing to files in /data/dalvik-cache