diff --git a/public/domain.te b/public/domain.te
index 565e5e4132531df2feb8200bfea51881a23395b5..f76ce6ba9f793210060c4a2c6c454945f311474f 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -1118,3 +1118,16 @@ neverallow ~coredomain coredomain_hwservice:hwservice_manager add;
 # be passthrough only (i.e., run in the process of their clients instead of a
 # separate server process).
 neverallow * same_process_hwservice:hwservice_manager add;
+
+# On TREBLE devices, most coredomains should not access vendor_files.
+full_treble_only(`
+  neverallow {
+    coredomain
+    -halclientdomain
+    -init
+    -ueventd
+    -crash_dump
+    -perfprofd
+    -vendor_init
+  } vendor_file:file { create_file_perms x_file_perms };
+')