diff --git a/public/mediaserver.te b/public/mediaserver.te
index b9b08dd1794dccf6d6fef63e9d06c51565ca71d6..c0d4e701cbeb281a7bb70dad9c4895d87dae28cb 100644
--- a/public/mediaserver.te
+++ b/public/mediaserver.te
@@ -96,7 +96,7 @@ allow mediaserver oemfs:dir search;
 allow mediaserver oemfs:file r_file_perms;
 
 # /vendor apk access
-allow mediaserver vendor_app_file:file r_file_perms;
+allow mediaserver vendor_app_file:file { read map };
 
 use_drmservice(mediaserver)
 allow mediaserver drmserver:drmservice {