diff --git a/public/domain.te b/public/domain.te
index 20ae4a9f127026291f1e8cf082b6ab1837f984f2..b788f0d72916f771c2b1a283df064cd3c17d171a 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -328,7 +328,7 @@ with_asan(`allow domain system_data_file:dir getattr;')
 with_asan(`allow domain system_asan_options_file:file r_file_perms;')
 
 # read APEX dir and stat any symlink pointing to APEXs.
-allow domain apex_mnt_dir:dir search;
+allow domain apex_mnt_dir:dir { getattr search };
 allow domain apex_mnt_dir:lnk_file r_file_perms;
 
 ###