diff --git a/fingerprintd.te b/fingerprintd.te
index 1c0ab1c9e8fd0fcdd6c6ce4bd19edb82df7d5d34..41e1aca6bbf4d950a9a43482630bd4bbb2bbdcaf 100644
--- a/fingerprintd.te
+++ b/fingerprintd.te
@@ -21,3 +21,12 @@ allow fingerprintd keystore:keystore_key { add_auth };
 # For permissions checking
 binder_call(fingerprintd, system_server);
 allow fingerprintd permission_service:service_manager find;
+
+###
+### Neverallow rules
+###
+
+# Protect fingerprint data files from access by anything other
+# than fingerprintd and init
+neverallow { domain -fingerprintd -init } fingerprintd_data_file:file
+  { append create link relabelfrom rename setattr write open read ioctl lock };