diff --git a/domain.te b/domain.te
index 45569de4cb40901bc52014f01254e6d763a1a5bb..06b9dc211e90cdce4eac061a56a200803120649a 100644
--- a/domain.te
+++ b/domain.te
@@ -62,7 +62,7 @@ allow domain debuggerd:unix_stream_socket connectto;
 
 # Root fs.
 allow domain rootfs:dir search;
-allow domain rootfs:lnk_file read;
+allow domain rootfs:lnk_file { read getattr };
 
 # Device accesses.
 allow domain device:dir search;