diff --git a/domain.te b/domain.te
index 1e3b2fb2b0ae62b18886d67ba696f87a8e962d36..1c0a598d7c4a5c466bc6a4b58cd48de705bd98f2 100644
--- a/domain.te
+++ b/domain.te
@@ -257,7 +257,7 @@ neverallow domain init:binder *;
 
 # Don't allow raw read/write/open access to block_device
 # Rather force a relabel to a more specific type
-neverallow { domain -kernel -init -recovery -vold -uncrypt -install_recovery } block_device:blk_file { open read write };
+neverallow { domain -kernel -init -recovery -vold -uncrypt } block_device:blk_file { open read write };
 
 # Don't allow raw read/write/open access to generic devices.
 # Rather force a relabel to a more specific type.
diff --git a/install_recovery.te b/install_recovery.te
index 52326859a2396ae3c3f5bfacf4031285ff31c8d0..9155a2d4179059e993b0de2d4b70cca17dd78905 100644
--- a/install_recovery.te
+++ b/install_recovery.te
@@ -14,11 +14,7 @@ allow install_recovery shell_exec:file rx_file_perms;
 allow install_recovery system_file:file rx_file_perms;
 
 # Update the recovery block device
-# TODO: Limit this to only recovery block device when we
-# create an appropriate label for it.
 allow install_recovery block_device:dir search;
-allow install_recovery block_device:blk_file rw_file_perms;
-auditallow install_recovery block_device:blk_file rw_file_perms;
 allow install_recovery recovery_block_device:blk_file rw_file_perms;
 
 # Create and delete /cache/saved.file