diff --git a/prebuilts/api/26.0/26.0.cil b/prebuilts/api/26.0/26.0.cil
index 1b010dec9ad46c34b0ee97ff452eb2f1bbad056b..903dbdb9c90910af31d1a7ef459ef35152451f11 100644
--- a/prebuilts/api/26.0/26.0.cil
+++ b/prebuilts/api/26.0/26.0.cil
@@ -535,7 +535,7 @@
 (typeattributeset serial_device_26_0 (serial_device))
 (typeattributeset serialno_prop_26_0 (serialno_prop))
 (typeattributeset serial_service_26_0 (serial_service))
-(typeattributeset service_contexts_file_26_0 (service_contexts_file))
+(typeattributeset service_contexts_file_26_0 (service_contexts_file nonplat_service_contexts_file))
 (typeattributeset servicediscovery_service_26_0 (servicediscovery_service))
 (typeattributeset servicemanager_26_0 (servicemanager))
 (typeattributeset servicemanager_exec_26_0 (servicemanager_exec))
diff --git a/private/file_contexts b/private/file_contexts
index d655b435daaafd22ba4122abf1f9d5d2be9afb6c..17378eeffc04cf9ae038a8b2fbe8c792bc6cb7a8 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -51,7 +51,7 @@
 /sepolicy           u:object_r:sepolicy_file:s0
 /plat_service_contexts   u:object_r:service_contexts_file:s0
 /plat_hwservice_contexts   u:object_r:hwservice_contexts_file:s0
-/nonplat_service_contexts   u:object_r:service_contexts_file:s0
+/nonplat_service_contexts   u:object_r:nonplat_service_contexts_file:s0
 /nonplat_hwservice_contexts   u:object_r:hwservice_contexts_file:s0
 /vndservice_contexts   u:object_r:vndservice_contexts_file:s0
 
@@ -298,7 +298,7 @@
 
 /vendor/etc/selinux/nonplat_mac_permissions.xml u:object_r:mac_perms_file:s0
 /vendor/etc/selinux/nonplat_property_contexts   u:object_r:property_contexts_file:s0
-/vendor/etc/selinux/nonplat_service_contexts    u:object_r:service_contexts_file:s0
+/vendor/etc/selinux/nonplat_service_contexts    u:object_r:nonplat_service_contexts_file:s0
 /vendor/etc/selinux/nonplat_hwservice_contexts    u:object_r:hwservice_contexts_file:s0
 /vendor/etc/selinux/nonplat_file_contexts   u:object_r:file_contexts_file:s0
 /vendor/etc/selinux/nonplat_seapp_contexts    u:object_r:seapp_contexts_file:s0
diff --git a/public/file.te b/public/file.te
index 4d19e213b4bbaf316f946a1f4617d75d7f834eff..bcdc4612b46f032120565a95263948a36d24e999 100644
--- a/public/file.te
+++ b/public/file.te
@@ -313,6 +313,9 @@ type sepolicy_file, file_type;
 # service_contexts file
 type service_contexts_file, file_type;
 
+# nonplat service_contexts file (only accessible on non full-treble devices)
+type nonplat_service_contexts_file, file_type;
+
 # hwservice_contexts file
 type hwservice_contexts_file, file_type;
 
diff --git a/public/servicemanager.te b/public/servicemanager.te
index 3cf5a464d7445f1e616f77b6a12bdf1b436bd861..7fa56f8027d263834469b9fa192bfb73e8205f0f 100644
--- a/public/servicemanager.te
+++ b/public/servicemanager.te
@@ -16,10 +16,9 @@ allow servicemanager {
   -vndservicemanager
 }:binder transfer;
 
-# Access to all (system and vendor) service_contexts
-# TODO(b/36866029) access to nonplat_service_contexts
-#                  should not be allowed on full treble devices
 allow servicemanager service_contexts_file:file r_file_perms;
+# nonplat_service_contexts only accessible on non full-treble devices
+not_full_treble('allow servicemanager nonplat_service_contexts_file:file r_file_perms;')
 
 # Check SELinux permissions.
 selinux_check_access(servicemanager)