diff --git a/private/init.te b/private/init.te
index 7a2e0b3..49a98e0 100644
--- a/private/init.te
+++ b/private/init.te
@@ -59,3 +59,7 @@
 # SELinux hooks were detected.
 set_prop(init, init_perf_lsm_hooks_prop)
 neverallow { domain -init } init_perf_lsm_hooks_prop:property_service set;
+
+# Only init can write vts.native_server.on
+set_prop(init, vts_status_prop)
+neverallow { -init } vts_status_prop:property_service set;