diff --git a/app.te b/app.te
index 1aee3ac5d1fb615bbf09314bcbd68b67ac8853c5..c4b33314ac19427641cc228f13407ff9ab0c1c7c 100644
--- a/app.te
+++ b/app.te
@@ -201,9 +201,6 @@ neverallow { appdomain -unconfineddomain } self:capability2 *;
 # Block device access.
 neverallow { appdomain -unconfineddomain } dev_type:blk_file { read write };
 
-# Access to any character device that is not specifically typed.
-neverallow { appdomain -unconfineddomain } device:chr_file { read write };
-
 # Access to any of the following character devices.
 neverallow { appdomain -unconfineddomain } {
     audio_device
diff --git a/domain.te b/domain.te
index 13b977a9a55ec79ac6a9725d78459ebcb9fec36f..6f0ee1331e45ecd5373737175b2870930edd242f 100644
--- a/domain.te
+++ b/domain.te
@@ -187,3 +187,8 @@ neverallow domain init:binder call;
 # Don't allow raw read/write/open access to block_device
 # Rather force a relabel to a more specific type
 neverallow { domain -unconfineddomain -vold } block_device:blk_file { open read write };
+
+# Don't allow raw read/write/open access to generic devices.
+# Rather force a relabel to a more specific type.
+# ueventd is exempt from this, as its managing these devices.
+neverallow { domain -unconfineddomain -ueventd } device:chr_file { open read write };