diff --git a/public/domain.te b/public/domain.te
index ec0532d5abd44e54b535322c02b46efbd56fc66b..f9b66880ea43125881a8fae9fd41360bb5f8e8d8 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -1114,3 +1114,16 @@ neverallow ~coredomain coredomain_hwservice:hwservice_manager add;
 # be passthrough only (i.e., run in the process of their clients instead of a
 # separate server process).
 neverallow * same_process_hwservice:hwservice_manager add;
+
+# On TREBLE devices, most coredomains should not access vendor_files.
+full_treble_only(`
+  neverallow {
+    coredomain
+    -halclientdomain
+    -init
+    -ueventd
+    -crash_dump
+    -perfprofd
+    -vendor_init
+  } vendor_file:file { create_file_perms x_file_perms };
+')