diff --git a/private/crash_dump.te b/private/crash_dump.te
index fb73f08a994a8912746b87a257e323ae762c5931..186977f31524a333e5f4d25246ae7f1a3dc3ba14 100644
--- a/private/crash_dump.te
+++ b/private/crash_dump.te
@@ -1 +1,26 @@
 typeattribute crash_dump coredomain;
+
+allow crash_dump {
+  domain
+  -bpfloader
+  -crash_dump
+  -init
+  -kernel
+  -keystore
+  -logd
+  -ueventd
+  -vendor_init
+  -vold
+}:process { ptrace signal sigchld sigstop sigkill };
+
+neverallow crash_dump {
+  bpfloader
+  init
+  kernel
+  keystore
+  logd
+  userdebug_or_eng(`-logd')
+  ueventd
+  vendor_init
+  vold
+}:process { ptrace signal sigstop sigkill };
diff --git a/public/crash_dump.te b/public/crash_dump.te
index f778d2818eb3f0bfc6c88803a25f457f908c0608..cd1e5a8e4381ed93b7cd7d3c05c35222cc6539f4 100644
--- a/public/crash_dump.te
+++ b/public/crash_dump.te
@@ -1,14 +1,6 @@
 type crash_dump, domain;
 type crash_dump_exec, exec_type, file_type;
 
-allow crash_dump {
-  domain
-  -init
-  -crash_dump
-  -keystore
-  -logd
-}:process { ptrace signal sigchld sigstop sigkill };
-
 # crash_dump might inherit CAP_SYS_PTRACE from a privileged process,
 # which will result in an audit log even when it's allowed to trace.
 dontaudit crash_dump self:global_capability_class_set { sys_ptrace };