diff --git a/recovery.te b/recovery.te
index 282ed3e4d0a3ad327c7fce14be5f2756c8ea4443..9c5900381c3dfacc3ef5192a2a10d56f174d014e 100644
--- a/recovery.te
+++ b/recovery.te
@@ -8,7 +8,6 @@ type recovery, domain;
 # Otherwise recovery is only allowed the domain rules.
 recovery_only(`
   allow recovery rootfs:file { entrypoint execute };
-  permissive_or_unconfined(recovery)
 
   allow recovery self:capability { chown dac_override fowner fsetid setfcap setuid setgid sys_admin sys_tty_config };