diff --git a/domain.te b/domain.te
index 6aa69add01f03268de8ea2865b2c1685ecd93bf8..9d377e50a6604b1f0d3bb3f8746e92d83412d189 100644
--- a/domain.te
+++ b/domain.te
@@ -38,8 +38,7 @@ userdebug_or_eng(`
   allow domain su:fd use;
   allow domain su:unix_stream_socket { getattr getopt read write shutdown };
 
-  allow { domain -init } su:binder { call transfer };
-  allow { domain -init } su:fd use;
+  binder_call({ domain -init }, su)
 
   # Running something like "pm dump com.android.bluetooth" requires
   # fifo writes
diff --git a/dumpstate.te b/dumpstate.te
index ce099131e5f11fd8164f1d3b32bcfab369bb70cf..f7a84f6bcb8eee2d71a1756c99d40d45eb090ad5 100644
--- a/dumpstate.te
+++ b/dumpstate.te
@@ -113,7 +113,7 @@ allow dumpstate tombstone_data_file:file r_file_perms;
 allow dumpstate cache_recovery_file:dir r_dir_perms;
 allow dumpstate cache_recovery_file:file r_file_perms;
 
-allow dumpstate { service_manager_type -gatekeeper_service -netd_service }:service_manager find;
+allow dumpstate { service_manager_type -gatekeeper_service }:service_manager find;
 allow dumpstate servicemanager:service_manager list;
 
 allow dumpstate devpts:chr_file rw_file_perms;
diff --git a/netd.te b/netd.te
index e3df2ba45986a663df23ee568efc91c59251033c..98a1a2a3c1014c34c7835392b727d75767247d00 100644
--- a/netd.te
+++ b/netd.te
@@ -57,6 +57,7 @@ set_prop(netd, ctl_mdnsd_prop)
 
 # Allow netd to publish a binder service and make binder calls.
 binder_use(netd)
+binder_service(netd)
 allow netd netd_service:service_manager add;
 
 # Allow netd to call into the system server so it can check permissions.
@@ -83,8 +84,3 @@ neverallow netd system_file:dir_file_class_set write;
 
 # Write to files in /data/data or system files on /data
 neverallow netd { app_data_file system_data_file }:dir_file_class_set write;
-
-# only system_server may interact with netd over binder
-neverallow { domain -system_server } netd_service:service_manager find;
-neverallow { domain -system_server } netd:binder call;
-neverallow netd { domain -system_server -servicemanager userdebug_or_eng(`-su') }:binder call;
diff --git a/shell.te b/shell.te
index d1c385b9462fba9e8ad97a900062a287c61e0b02..8076d460bd14b633812cdac6cc27de6844ebae2c 100644
--- a/shell.te
+++ b/shell.te
@@ -83,7 +83,7 @@ allow shell kernel:system syslog_read;
 # allow shell access to services
 allow shell servicemanager:service_manager list;
 # don't allow shell to access GateKeeper service
-allow shell { service_manager_type -gatekeeper_service -netd_service }:service_manager find;
+allow shell { service_manager_type -gatekeeper_service }:service_manager find;
 
 # allow shell to look through /proc/ for ps, top, netstat
 r_dir_file(shell, proc)
diff --git a/system_app.te b/system_app.te
index a07a9b9d8019cc9ad543a1ba1343624bb17b7bb9..5e66acd734c2ea57cd47cfb81960134e8a5be2b8 100644
--- a/system_app.te
+++ b/system_app.te
@@ -43,7 +43,7 @@ allow system_app anr_data_file:file create_file_perms;
 allow system_app asec_apk_file:file r_file_perms;
 
 allow system_app servicemanager:service_manager list;
-allow system_app { service_manager_type -netd_service }:service_manager find;
+allow system_app service_manager_type:service_manager find;
 
 allow system_app keystore:keystore_key {
 	get_state