diff --git a/domain.te b/domain.te
index 0f6c6dac39a8fb6517ac289a3c20e0e5a0c26982..c6898ba9a0371c0c5d7db5028fdee3f1ce133138 100644
--- a/domain.te
+++ b/domain.te
@@ -312,7 +312,8 @@ neverallow { domain -recovery } { system_file exec_type }:dir_file_class_set
 neverallow { domain -recovery -kernel } { system_file exec_type }:dir_file_class_set relabelto;
 
 # Don't allow mounting on top of /system files or directories
-neverallow domain { system_file exec_type }:dir_file_class_set mounton;
+neverallow domain exec_type:dir_file_class_set mounton;
+neverallow { domain -init } system_file:dir_file_class_set mounton;
 
 # Nothing should be writing to files in the rootfs.
 neverallow domain rootfs:file { create write setattr relabelto append unlink link rename };
diff --git a/init.te b/init.te
index 41eafe26253429eaf1b6b4f1dd879d543a60a0a2..1a60e2746757315cb33a4c682fc6d4d20fcacfc1 100644
--- a/init.te
+++ b/init.te
@@ -43,7 +43,7 @@ allow init self:capability sys_admin;
 
 # Create and mount on directories in /.
 allow init rootfs:dir create_dir_perms;
-allow init rootfs:dir mounton;
+allow init { rootfs cache_file cgroup storage_file system_data_file system_file }:dir mounton;
 
 # Mount on /dev/usb-ffs/adb.
 allow init device:dir mounton;