diff --git a/assert.te b/assert.te
index 1f12c5eede72fd4d4e85adea7922ef02cbce615a..85cb48be87f219869af3f1f79676698ba83ef72f 100644
--- a/assert.te
+++ b/assert.te
@@ -16,7 +16,7 @@ neverallow appdomain kmem_device:chr_file { read write };
 
 # Setting SELinux enforcing status or booleans.
 # Conditionally allowed to system_app for SEAndroidManager.
-neverallow { appdomain -system_app } kernel:security { setenforce setbool };
+neverallow { domain -unconfineddomain -system -system_app } kernel:security { setenforce setbool };
 
 # Load security policy.
 neverallow appdomain kernel:security load_policy;