diff --git a/public/domain.te b/public/domain.te
index b175ed436c7cc873d85ba80170b5be6af42614c8..67eafc286fcc82c9b3e1b2e1e67433770c5a06d0 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -912,6 +912,7 @@ full_treble_only(`
     neverallow {
       coredomain
       -init
+      -shell
       -system_executes_vendor_violators
     } {
       vendor_file_type
@@ -922,6 +923,7 @@ full_treble_only(`
 
     neverallow {
       coredomain
+      -shell
       -system_executes_vendor_violators
     } vendor_file_type:file execute_no_trans;
 ')
diff --git a/public/shell.te b/public/shell.te
index 32ad7701df46c3c90ef9bee19ed86c26f0c35f2e..5e2745be4fecc556cead8337fad006378e17ef75 100644
--- a/public/shell.te
+++ b/public/shell.te
@@ -190,8 +190,6 @@ allow shell service_contexts_file:file r_file_perms;
 allow shell sepolicy_file:file r_file_perms;
 
 # Allow shell to start up vendor shell
-# TODO(b/62041836): system processes should not run vendor executables.
-typeattribute shell system_executes_vendor_violators;
 allow shell vendor_shell_exec:file rx_file_perms;
 
 ###