diff --git a/gpsd.te b/gpsd.te
index 33b1df6ccb8e75354646613ea408214d4b3e15f7..2e050920d9363123bbf698814b0dd1e1610aee4a 100644
--- a/gpsd.te
+++ b/gpsd.te
@@ -18,3 +18,11 @@ allow gpsd gps_device:chr_file rw_file_perms;
 # Execute the shell or system commands.
 allow gpsd shell_exec:file rx_file_perms;
 allow gpsd system_file:file rx_file_perms;
+
+###
+### neverallow
+###
+
+# gpsd can never have capabilities other than block_suspend
+neverallow gpsd self:capability *;
+neverallow gpsd self:capability2 ~block_suspend;