diff --git a/app.te b/app.te
index 9101c9bdf5fe159447abc12273d3249d6c5d2004..5ba0e74adcc3d7b01f95a50cdc4e72234f2a5bc9 100644
--- a/app.te
+++ b/app.te
@@ -419,6 +419,3 @@ neverallow appdomain {
   security_file
   tmpfs
 }:lnk_file no_w_file_perms;
-
-# Do not allow Apps to directly open tun_device
-neverallow appdomain tun_device:chr_file open;
diff --git a/bluetooth.te b/bluetooth.te
index 18178202a19a28165eb0270033949e4ceb3bea85..e74d38d11b2f11d30140137e0a44ccb5a3c95d63 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -27,6 +27,7 @@ allow bluetooth self:capability2 wake_alarm;
 allow bluetooth self:packet_socket create_socket_perms;
 allow bluetooth self:capability { net_admin net_raw net_bind_service };
 allow bluetooth self:tun_socket create_socket_perms;
+allow bluetooth tun_device:chr_file rw_file_perms;
 allow bluetooth efs_file:dir search;
 
 # proc access.
diff --git a/isolated_app.te b/isolated_app.te
index 4d37b51094d48982a3c4d98eaca694326d6ebd3c..c27b5474d0297ad3aabd5152ebd67a48e4400d05 100644
--- a/isolated_app.te
+++ b/isolated_app.te
@@ -29,6 +29,9 @@ allow isolated_app self:process ptrace;
 ##### Neverallow
 #####
 
+# Do not allow isolated_app to directly open tun_device
+neverallow isolated_app tun_device:chr_file open;
+
 # Do not allow isolated_app to set system properties.
 neverallow isolated_app property_socket:sock_file write;
 neverallow isolated_app property_type:property_service set;
diff --git a/untrusted_app.te b/untrusted_app.te
index d5abe17e509e8d8f803850e2529215b5c2e20e84..8672f585de6fa2eb81c27335a67c41a7620bb910 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -178,3 +178,6 @@ neverallow untrusted_app {
     -coredump_file          # userdebug/eng only
   ')
 }:dir_file_class_set { create unlink };
+
+# Do not allow untrusted_app to directly open tun_device
+neverallow untrusted_app tun_device:chr_file open;