diff --git a/private/init.te b/private/init.te
index f84d87ebb32d0682feb087d30d7afc070d245ed0..b6c49b952819f0fa9264a5a37a13793ae2768f09 100644
--- a/private/init.te
+++ b/private/init.te
@@ -13,8 +13,7 @@ recovery_only(`
 domain_trans(init, shell_exec, shell)
 domain_trans(init, init_exec, ueventd)
 domain_trans(init, init_exec, watchdogd)
-domain_trans(init, rootfs, modprobe)
-domain_trans(init, toolbox_exec, modprobe)
+domain_trans(init, { rootfs toolbox_exec vendor_toolbox_exec }, modprobe)
 # case where logpersistd is actually logcat -f in logd context (nee: logcatd)
 userdebug_or_eng(`
   domain_auto_trans(init, logcat_exec, logpersist)
diff --git a/public/vendor_toolbox.te b/public/vendor_toolbox.te
index 39462f8e776de512fb6b5ea6dc7e075b8bed8579..eb292cafb3645847e5f04afe78f198c9eb019e11 100644
--- a/public/vendor_toolbox.te
+++ b/public/vendor_toolbox.te
@@ -7,6 +7,10 @@ type vendor_toolbox_exec, exec_type, vendor_file_type, file_type;
 # or read, execute the vendor_toolbox file.
 full_treble_only(`
     # Do not allow non-vendor domains to transition
-    # to vendor toolbox
-    neverallow coredomain vendor_toolbox_exec:file { entrypoint execute execute_no_trans };
+    # to vendor toolbox except for the whitelisted domains.
+    neverallow {
+        coredomain
+        -init
+        -modprobe
+    } vendor_toolbox_exec:file { entrypoint execute execute_no_trans };
 ')