diff --git a/Android.mk b/Android.mk
index 351e81a194b660472bcf5a63a8fd2c9e19ef3756..eae860b223020a29f92fd39776bc14fd5436611f 100644
--- a/Android.mk
+++ b/Android.mk
@@ -83,6 +83,7 @@ sepolicy_build_files := security_classes \
                         initial_sids \
                         access_vectors \
                         global_macros \
+                        neverallow_macros \
                         mls_macros \
                         mls \
                         policy_capabilities \
diff --git a/domain.te b/domain.te
index 5ed79c1ea8530c532cd1ae294441e36a03548141..48e2d1ac3657a1d0f581ddbacb46212251c85493 100644
--- a/domain.te
+++ b/domain.te
@@ -291,8 +291,8 @@ neverallow {
 } { fs_type -rootfs }:file execute;
 
 # Only the init property service should write to /data/property.
-neverallow { domain -init } property_data_file:dir { create setattr relabelfrom rename write add_name remove_name rmdir };
-neverallow { domain -init } property_data_file:file { create setattr relabelfrom write append unlink link rename };
+neverallow { domain -init } property_data_file:dir no_w_dir_perms;
+neverallow { domain -init } property_data_file:file no_w_file_perms;
 
 # Only recovery should be doing writes to /system
 neverallow { domain -recovery } { system_file exec_type }:dir_file_class_set
diff --git a/neverallow_macros b/neverallow_macros
new file mode 100644
index 0000000000000000000000000000000000000000..3593dd1bbce687e4d3039fb2d14cb887e4b3273d
--- /dev/null
+++ b/neverallow_macros
@@ -0,0 +1,5 @@
+#
+# Common neverallow permissions
+define(`no_w_file_perms', `{ append create link unlink relabelfrom rename setattr write }')
+define(`no_x_file_perms', `{ execute execute_no_trans }')
+define(`no_w_dir_perms',  `{ add_name create link relabelfrom remove_name rename reparent rmdir setattr write }')
diff --git a/recovery.te b/recovery.te
index 204c096a372d5ed71ba09634c4caf6c506388ab4..61c42b1380c118097562388eac9fca84539e786e 100644
--- a/recovery.te
+++ b/recovery.te
@@ -98,3 +98,20 @@ recovery_only(`
   # set scheduling parameters for a kernel domain task.
   allow recovery kernel:process setsched;
 ')
+
+###
+### neverallow rules
+###
+
+# Recovery should never touch /data.
+#
+# In particular, if /data is encrypted, it is not accessible
+# to recovery anyway.
+#
+# For now, we only enforce write/execute restrictions, as domain.te
+# contains a number of read-only rules that apply to all
+# domains, including recovery.
+#
+# TODO: tighten this up further.
+neverallow recovery data_file_type:file { no_w_file_perms no_x_file_perms };
+neverallow recovery data_file_type:dir no_w_dir_perms;