diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 6ebbd436a51976d9b19a8507f44bdfa0bda80b6b..10b0b3bd014232cb5984d05a5c53e8956c3bb383 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -47,7 +47,7 @@ neverallow { all_untrusted_apps -untrusted_app_25 } net_dns_prop:file read;
 neverallow all_untrusted_apps rs_data_file:file
   { append create link relabelfrom relabelto rename setattr write };
 
-# Block calling execve() on files in an apps home directory.
+# Block calling execve() in app /data/data files.
 # This is a W^X violation (loading executable code from a writable
 # home directory). For compatibility, allow for targetApi <= 28.
 # b/112357170
@@ -58,6 +58,17 @@ neverallow {
   -runas_app
 } { app_data_file privapp_data_file }:file execute_no_trans;
 
+# Block calling dlopen() in app /data/data files.
+# This is a W^X violation (loading executable code from a writable
+# home directory). For compatibility, allow for targetApi <= 28.
+# b/112357170
+neverallow {
+  all_untrusted_apps
+  -untrusted_app_25
+  -untrusted_app_27
+  -runas_app
+} app_data_file:file execute;
+
 # Do not allow untrusted apps to invoke dex2oat. This was historically required
 # by ART for compiling secondary dex files but has been removed in Q.
 # Exempt legacy apps (targetApi<=28) for compatibility.
diff --git a/private/ephemeral_app.te b/private/ephemeral_app.te
index 4935f3340fe53f9f57d577e098252ff6f45bd129..92fd325465630217722ca1e26795d1be9e0e1e2c 100644
--- a/private/ephemeral_app.te
+++ b/private/ephemeral_app.te
@@ -22,7 +22,7 @@ allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr
 # Some apps ship with shared libraries and binaries that they write out
 # to their sandbox directory and then execute.
 allow ephemeral_app privapp_data_file:file { r_file_perms execute };
-allow ephemeral_app app_data_file:file     { r_file_perms execute };
+allow ephemeral_app app_data_file:file r_file_perms;
 
 # Allow the renderscript compiler to be run.
 domain_auto_trans(ephemeral_app, rs_exec, rs)
diff --git a/private/runas_app.te b/private/runas_app.te
index b976b91879ed85a34e98e032c07ce622e1f76537..00baa83fa2b5e9ccd6d2acdd4d7143540d3bc31a 100644
--- a/private/runas_app.te
+++ b/private/runas_app.te
@@ -6,6 +6,7 @@ untrusted_app_domain(runas_app)
 net_domain(runas_app)
 bluetooth_domain(runas_app)
 
-# The ability to call exec() on files in the apps home directories
-# when using run-as on a debuggable app. Needed by simpleperf.
-allow runas_app app_data_file:file execute_no_trans;
+# The ability to call exec() or dlopen() on app /data/data
+# files when using run-as on a debuggable app.
+# Needed by simpleperf.
+allow runas_app app_data_file:file { execute_no_trans execute };
diff --git a/private/untrusted_app_25.te b/private/untrusted_app_25.te
index 7c266a524fef6870400a2c1d1070b87d7a43e194..8825e2e784e05a04c54f4a552eeeabcc2cbe7766 100644
--- a/private/untrusted_app_25.te
+++ b/private/untrusted_app_25.te
@@ -45,10 +45,10 @@ allow untrusted_app_25 proc_tty_drivers:file r_file_perms;
 # https://android.googlesource.com/platform/bionic/+/master/android-changes-for-ndk-developers.md#text-relocations-enforced-for-api-level-23
 allow untrusted_app_25 { apk_data_file app_data_file asec_public_file }:file execmod;
 
-# The ability to call exec() on files in the apps home directories
-# for targetApi<=25. This is also allowed for targetAPIs 26, 27,
-# and 28 in untrusted_app_27.te.
-allow untrusted_app_25 app_data_file:file execute_no_trans;
+# The ability to call exec() or dlopen() on files in the apps home
+# directories for targetApi<=25. This is also allowed for targetAPIs 26,
+# 27, and 28 in untrusted_app_27.te.
+allow untrusted_app_25 app_data_file:file { execute execute_no_trans };
 
 # The ability to invoke dex2oat. Historically required by ART, now only
 # allowed for targetApi<=28 for compat reasons.
diff --git a/private/untrusted_app_27.te b/private/untrusted_app_27.te
index b8fd22eb49e06077712a579feab41fe362abada4..fab6acc36ebecdb891e7f1bc0f3c3775226072a2 100644
--- a/private/untrusted_app_27.te
+++ b/private/untrusted_app_27.te
@@ -27,9 +27,9 @@ untrusted_app_domain(untrusted_app_27)
 net_domain(untrusted_app_27)
 bluetooth_domain(untrusted_app_27)
 
-# The ability to call exec() on files in the apps home directories
-# for targetApi 26, 27, and 28.
-allow untrusted_app_27 app_data_file:file execute_no_trans;
+# The ability to call exec() or dlopen() on files in the apps home
+# directories for targetApi 26, 27, and 28.
+allow untrusted_app_27 app_data_file:file { execute execute_no_trans };
 
 # The ability to invoke dex2oat. Historically required by ART, now only
 # allowed for targetApi<=28 for compat reasons.
diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index aebb7118aee60acc06342225acf4b76ca00987c9..2c81ebdae2a5a4888174c27ccff6ab97f601936d 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -23,7 +23,7 @@
 # Some apps ship with shared libraries and binaries that they write out
 # to their sandbox directory and then execute.
 allow untrusted_app_all privapp_data_file:file { r_file_perms execute };
-allow untrusted_app_all app_data_file:file     { r_file_perms execute };
+allow untrusted_app_all app_data_file:file r_file_perms;
 
 # Allow loading and deleting renderscript created shared libraries
 # within an application home directory.