diff --git a/domain.te b/domain.te
index 2b7c0a676f3d626578ecd973a455b8e601f502cf..4297badcbf16e5416dc4ece9e5b2e1ce290c62d5 100644
--- a/domain.te
+++ b/domain.te
@@ -130,17 +130,8 @@ neverallow { domain -relabeltodomain } *:dir_file_class_set relabelto;
 ### neverallow rules
 ###
 
-# Only init should be able to load SELinux policies.
-# The first load technically occurs while still in the kernel domain,
-# but this does not trigger a denial since there is no policy yet.
-# Policy reload requires allowing this to the init domain.
-neverallow { domain -init } kernel:security load_policy;
-
-# Only init prior to switching context should be able to set enforcing mode.
-# init starts in kernel domain and switches to init domain via setcon in
-# the init.rc, so the setenforce occurs while still in kernel. After
-# switching domains, there is never any need to setenforce again by init.
-neverallow { domain -kernel } kernel:security setenforce;
+# Only init should be able to load SELinux policies and set enforcing mode.
+neverallow { domain -init } kernel:security { load_policy setenforce };
 
 # Only init, ueventd and system_server should be able to access HW RNG
 neverallow { domain -init -system_server -ueventd -unconfineddomain } hw_random_device:chr_file *;
diff --git a/init.te b/init.te
index 1c76e72cd27ca66f770934b85adfbe52a10021b0..b2d99fbcef58d0b6c0cba8fd19e71dadb239f88f 100644
--- a/init.te
+++ b/init.te
@@ -11,4 +11,3 @@ allow init {fs_type dev_type file_type}:dir_file_class_set relabelto;
 allow init kernel:security { load_policy setenforce };
 allow init usermodehelper:file rw_file_perms;
 allow init proc_security:file rw_file_perms;
-allow init kernel:security load_policy;
diff --git a/kernel.te b/kernel.te
index 089786bff834cdd689e5f997c5fdbf451ef164bb..d1c1b7f823ba3ef645fbeaea412dfe516a7eb52b 100644
--- a/kernel.te
+++ b/kernel.te
@@ -6,6 +6,3 @@ relabelto_domain(kernel)
 
 allow kernel {fs_type dev_type file_type}:dir_file_class_set relabelto;
 allow kernel unlabeled:filesystem mount;
-
-# Initial setenforce by init prior to switching to init domain.
-allow kernel self:security setenforce;