diff --git a/access_vectors b/access_vectors
index 320a1c8976880bd0a1c9374d06651fa7c0c68d30..43b81e9f42d682950d0a12fe2fdbaccba04e39e9 100644
--- a/access_vectors
+++ b/access_vectors
@@ -876,14 +876,6 @@ class binder
 	transfer
 }
 
-class zygote
-{
-	specifyids
-	specifyrlimits
-	specifyinvokewith
-	specifyseinfo
-}
-
 class property_service
 {
 	set
diff --git a/domain.te b/domain.te
index 005b2b34f73f6898698dda5ddcb3894e879b5125..4fc6f7324bab91f0b2d240c8407d6fb58ae1bd7c 100644
--- a/domain.te
+++ b/domain.te
@@ -344,6 +344,10 @@ neverallow {
   -dex2oat
 } dalvikcache_data_file:file no_w_file_perms;
 
+# Only system_server should be able to send commands via the zygote socket
+neverallow { domain -zygote -system_server } zygote:unix_stream_socket connectto;
+neverallow { domain -system_server } zygote_socket:sock_file write;
+
 # Android does not support System V IPCs.
 #
 # The reason for this is due to the fact that, by design, they lead to global
diff --git a/system_server.te b/system_server.te
index 015f80115b43959ea93137448e800b250cbd331d..cceec96dc513925bdc4ef5b9ff90b01792feedf8 100644
--- a/system_server.te
+++ b/system_server.te
@@ -302,9 +302,6 @@ allow system_server wpa_socket:sock_file unlink;
 type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";
 allow system_server system_ndebug_socket:sock_file create_file_perms;
 
-# Specify any arguments to zygote.
-allow system_server self:zygote { specifyids specifyrlimits specifyseinfo };
-
 # Manage cache files.
 allow system_server cache_file:dir { relabelfrom create_dir_perms };
 allow system_server cache_file:file { relabelfrom create_file_perms };