diff --git a/app.te b/app.te
index 19f9b61518b0d2d267af357a86c2f95fc9acd097..37f2bc2ee00f6c685b361184dc0c85b15f27a7ca 100644
--- a/app.te
+++ b/app.te
@@ -408,6 +408,3 @@ neverallow appdomain {
   security_file
   tmpfs
 }:lnk_file no_w_file_perms;
-
-# Do not allow Apps to directly open tun_device
-neverallow appdomain tun_device:chr_file open;
diff --git a/bluetooth.te b/bluetooth.te
index ab85a9616824f8ec288961d3de60fcb2b2c6b521..f249e9b7077234473f21be60df676fb3c5f65364 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -25,6 +25,7 @@ allow bluetooth self:capability2 wake_alarm;
 
 # tethering
 allow bluetooth self:tun_socket create_socket_perms;
+allow bluetooth tun_device:chr_file rw_file_perms;
 allow bluetooth efs_file:dir search;
 
 # proc access.
diff --git a/isolated_app.te b/isolated_app.te
index 9bcb018cad4198fcac2e90d32284cfda589f1ff4..862592e2ba3249124b9359526c8102e0a1ea8e60 100644
--- a/isolated_app.te
+++ b/isolated_app.te
@@ -29,6 +29,9 @@ allow isolated_app self:process ptrace;
 ##### Neverallow
 #####
 
+# Do not allow isolated_app to directly open tun_device
+neverallow isolated_app tun_device:chr_file open;
+
 # Do not allow isolated_app to set system properties.
 neverallow isolated_app property_socket:sock_file write;
 neverallow isolated_app property_type:property_service set;
diff --git a/untrusted_app.te b/untrusted_app.te
index fd55653677e4a3857c3c1ec0a4d7a0ef6893ff33..a61c595a1a1aea6336aa86555a21bdf915061919 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -170,3 +170,6 @@ neverallow untrusted_app {
     -coredump_file          # userdebug/eng only
   ')
 }:dir_file_class_set { create unlink };
+
+# Do not allow untrusted_app to directly open tun_device
+neverallow untrusted_app tun_device:chr_file open;