diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index 32eec26dfdbb50e7994eb02f9600bf6fb1c1dbe2..54d278e2c961662e3ef21ee3414ceae57fb7679f 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -108,7 +108,7 @@ allow untrusted_app_all preloads_data_file:dir search;
 # TODO (b/37784178) Consider creating  a special type for /vendor/app installed
 # apps.
 allow untrusted_app_all vendor_app_file:dir { open getattr read search };
-allow untrusted_app_all vendor_app_file:file { open getattr read execute };
+allow untrusted_app_all vendor_app_file:file { r_file_perms execute };
 allow untrusted_app_all vendor_app_file:lnk_file { open getattr read };
 
 # Write app-specific trace data to the Perfetto traced damon. This requires