diff --git a/public/netd.te b/public/netd.te
index 2d72eeb33d6b187ee8e1dea30cf465401661b0d3..9854f63bfaf1063f189549e4d0184200d1c5fda0 100644
--- a/public/netd.te
+++ b/public/netd.te
@@ -104,10 +104,12 @@ neverallow netd system_file:dir_file_class_set write;
 # Write to files in /data/data or system files on /data
 neverallow netd { app_data_file system_data_file }:dir_file_class_set write;
 
-# only system_server, dumpstate and netd  may interact with netd over binder
+# only system_server and dumpstate may find netd service
 neverallow { domain -system_server -dumpstate -netd } netd_service:service_manager find;
-neverallow { domain -system_server -dumpstate } netd:binder call;
-neverallow netd { domain -system_server -servicemanager userdebug_or_eng(`-su') }:binder call;
+
+# apps may not interact with netd over binder.
+neverallow appdomain netd:binder call;
+neverallow netd { appdomain userdebug_or_eng(`-su') }:binder call;
 
 # persist.netd.stable_secret contains RFC 7217 secret key which should never be
 # leaked to other processes. Make sure it never leaks.