diff --git a/public/domain.te b/public/domain.te
index 41da133a866fcc312645a32af9ea83ccd50a9e71..f2b9f0c70a388fa9ea9b5dd17cb446b4c04fea9e 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -1286,11 +1286,12 @@ full_treble_only(`
     coredomain
     -appdomain
     -bootanim
-    -init
-    -ueventd
     -crash_dump
+    -init
+    -kernel
     -perfprofd
-  } vendor_file:file { create_file_perms x_file_perms };
+    -ueventd
+  } vendor_file:file { no_w_file_perms no_x_file_perms open };
 ')
 
 # Minimize dac_override and dac_read_search.