diff --git a/app.te b/app.te
index 9101c9bdf5fe159447abc12273d3249d6c5d2004..5ba0e74adcc3d7b01f95a50cdc4e72234f2a5bc9 100644
--- a/app.te
+++ b/app.te
@@ -419,6 +419,3 @@ neverallow appdomain {
   security_file
   tmpfs
 }:lnk_file no_w_file_perms;
-
-# Do not allow Apps to directly open tun_device
-neverallow appdomain tun_device:chr_file open;
diff --git a/bluetooth.te b/bluetooth.te
index 18178202a19a28165eb0270033949e4ceb3bea85..e74d38d11b2f11d30140137e0a44ccb5a3c95d63 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -27,6 +27,7 @@ allow bluetooth self:capability2 wake_alarm;
 allow bluetooth self:packet_socket create_socket_perms;
 allow bluetooth self:capability { net_admin net_raw net_bind_service };
 allow bluetooth self:tun_socket create_socket_perms;
+allow bluetooth tun_device:chr_file rw_file_perms;
 allow bluetooth efs_file:dir search;
 
 # proc access.
diff --git a/isolated_app.te b/isolated_app.te
index 4d37b51094d48982a3c4d98eaca694326d6ebd3c..c27b5474d0297ad3aabd5152ebd67a48e4400d05 100644
--- a/isolated_app.te
+++ b/isolated_app.te
@@ -29,6 +29,9 @@ allow isolated_app self:process ptrace;
 ##### Neverallow
 #####
 
+# Do not allow isolated_app to directly open tun_device
+neverallow isolated_app tun_device:chr_file open;
+
 # Do not allow isolated_app to set system properties.
 neverallow isolated_app property_socket:sock_file write;
 neverallow isolated_app property_type:property_service set;
diff --git a/untrusted_app.te b/untrusted_app.te
index 24ad996b47b4be8a1d3a99b488b8f48b5ca05ed9..9e638a6d87905a1d66019ea0211045dce45368c9 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -179,3 +179,6 @@ neverallow untrusted_app {
     -coredump_file          # userdebug/eng only
   ')
 }:dir_file_class_set { create unlink };
+
+# Do not allow untrusted_app to directly open tun_device
+neverallow untrusted_app tun_device:chr_file open;