diff --git a/app.te b/app.te
index c670c9dd818a8ddbad8c55da64bf9421a8e7a239..c8009dc52fbb4eb5b714e90d2c764d3157a94556 100644
--- a/app.te
+++ b/app.te
@@ -344,6 +344,10 @@ neverallow appdomain
     dhcp_data_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
 
+# access tmp apk files
+neverallow { appdomain -platform_app -priv_app }
+    { apk_tmp_file apk_private_tmp_file }:dir_file_class_set *;
+
 # Access to factory files.
 neverallow appdomain efs_file:dir_file_class_set write;
 neverallow { appdomain -shell } efs_file:dir_file_class_set read;
diff --git a/untrusted_app.te b/untrusted_app.te
index 1778c22324b2a6a8a80cb49a38d1628316b95d14..ecf85a22da6c95b5843eac11bda34a8424c11592 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -77,10 +77,6 @@ allow untrusted_app radio_service:service_manager find;
 allow untrusted_app surfaceflinger_service:service_manager find;
 allow untrusted_app app_api_service:service_manager find;
 
-# Allow verifier to access staged apks.
-allow untrusted_app { apk_tmp_file apk_private_tmp_file }:dir r_dir_perms;
-allow untrusted_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
-
 # only allow unprivileged socket ioctl commands
 allow untrusted_app self:{ rawip_socket tcp_socket udp_socket } unpriv_sock_ioctls;