diff --git a/domain.te b/domain.te
index 1fb2ef8b9131d75d661e4958ef68cc08bf957e20..878ac9f0519ecc73818246382ff6e53936791358 100644
--- a/domain.te
+++ b/domain.te
@@ -128,9 +128,10 @@ allow domain debugfs:file w_file_perms;
 # Get SELinux enforcing status.
 selinux_getenforce(domain)
 
-# security files
+# /data/security files
 allow domain security_file:dir { search getattr };
 allow domain security_file:file getattr;
+allow domain security_file:lnk_file r_file_perms;
 
 # World readable asec image contents
 allow domain asec_public_file:file r_file_perms;