diff --git a/private/vold_prepare_subdirs.te b/private/vold_prepare_subdirs.te
index badbb71f34c5a837b650fd5e13d6fa95be51f138..89b152803c5141d8a3f6f87c0ee198c35bf1e23e 100644
--- a/private/vold_prepare_subdirs.te
+++ b/private/vold_prepare_subdirs.te
@@ -12,8 +12,8 @@ allow vold_prepare_subdirs self:process setfscreate;
 allow vold_prepare_subdirs {
   system_data_file
   vendor_data_file
-}:dir { open read write add_name remove_name relabelfrom };
-allow vold_prepare_subdirs system_data_file:file getattr;
+}:dir { open read write add_name remove_name rmdir relabelfrom };
+allow vold_prepare_subdirs system_data_file:file { getattr unlink };
 allow vold_prepare_subdirs vold_data_file:dir { create open read write search getattr setattr remove_name rmdir relabelto };
 allow vold_prepare_subdirs vold_data_file:file { getattr unlink };
 allow vold_prepare_subdirs storaged_data_file:dir { create_dir_perms relabelto };
diff --git a/public/domain.te b/public/domain.te
index 41e090331ddf3911c878daa74fcdf94c89d47502..2856f2c6a10fcbae08a7ef17cfffd0365f1361f5 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -1120,6 +1120,7 @@ neverallow {
   -system_app
   -init
   -installd # for relabelfrom and unlink, check for this in explicit neverallow
+  -vold_prepare_subdirs # For unlink
   with_asan(`-asan_extract')
 } system_data_file:file no_w_file_perms;
 # do not grant anything greater than r_file_perms and relabelfrom unlink