diff --git a/private/domain.te b/private/domain.te
index 5fcc1fd685fb30e141cb264cc3d93752325ce960..7945d89c05c5a99b9b5d9b13b79e000463f3a18b 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -142,12 +142,10 @@ neverallow {
   -dexoptanalyzer
   -init
   -installd
-  -mediaserver # b/80300620
   userdebug_or_eng(`-perfprofd')
   -profman
   -runas
   -system_server
-  -vold
 } { privapp_data_file app_data_file }:dir *;
 
 # Only apps should be modifying app data. init and installd are exempted for
@@ -163,9 +161,7 @@ neverallow {
   domain
   -appdomain
   -installd
-  -mediaserver # b/80300620
   userdebug_or_eng(`-perfprofd')
-  -vold # b/80418809
 } { privapp_data_file app_data_file }:file_class_set open;
 
 neverallow {
diff --git a/public/domain.te b/public/domain.te
index 2396d4aa21333cfc24f447122b15f47002afafa1..032c27c2c594c726b624bd52c93a3bc024cbb013 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -1280,7 +1280,6 @@ neverallow {
   domain
   -appdomain
   -installd
-  -uncrypt  # TODO: see if we can remove
 } { app_data_file privapp_data_file }:lnk_file read;
 
 neverallow {
diff --git a/public/mediaserver.te b/public/mediaserver.te
index c0d4e701cbeb281a7bb70dad9c4895d87dae28cb..a197a4482bf1eb16b431f24e8b219e781ad70c3e 100644
--- a/public/mediaserver.te
+++ b/public/mediaserver.te
@@ -27,11 +27,7 @@ binder_service(mediaserver)
 
 allow mediaserver media_data_file:dir create_dir_perms;
 allow mediaserver media_data_file:file create_file_perms;
-# TODO(b/80190017, b/80300620): remove direct access to private app data
-userdebug_or_eng(`auditallow mediaserver { app_data_file privapp_data_file }:dir search;')
-allow mediaserver { app_data_file privapp_data_file }:dir search;
-userdebug_or_eng(`auditallow mediaserver { app_data_file privapp_data_file }:file open;')
-allow mediaserver { app_data_file privapp_data_file }:file rw_file_perms;
+allow mediaserver { app_data_file privapp_data_file }:file { append getattr ioctl lock map read write };
 allow mediaserver sdcard_type:file write;
 allow mediaserver gpu_device:chr_file rw_file_perms;
 allow mediaserver video_device:dir r_dir_perms;
diff --git a/public/vold.te b/public/vold.te
index 2097392046f3ef9393d590ec98525fb05df23627..73d3b6d6be09f5422d512813e046119fb819c93c 100644
--- a/public/vold.te
+++ b/public/vold.te
@@ -81,11 +81,6 @@ allow vold tmpfs:dir create_dir_perms;
 allow vold tmpfs:dir mounton;
 allow vold self:global_capability_class_set { net_admin dac_override dac_read_search mknod sys_admin chown fowner fsetid };
 allow vold self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
-# TODO(b/80418809): remove direct access to private app data
-userdebug_or_eng(`auditallow vold { app_data_file privapp_data_file }:dir search;')
-allow vold { app_data_file privapp_data_file }:dir search;
-userdebug_or_eng(`auditallow vold { app_data_file privapp_data_file }:file rw_file_perms;')
-allow vold { app_data_file privapp_data_file }:file rw_file_perms;
 allow vold loop_control_device:chr_file rw_file_perms;
 allow vold loop_device:blk_file { create setattr unlink rw_file_perms };
 allow vold vold_device:blk_file { create setattr unlink rw_file_perms };