diff --git a/private/bpfloader.te b/private/bpfloader.te
index de7e8a4..33d3783 100644
--- a/private/bpfloader.te
+++ b/private/bpfloader.te
@@ -47,8 +47,8 @@
 neverallow { domain -bpfloader } bpffs_type:lnk_file ~read;
 neverallow { domain -bpfdomain } bpffs_type:lnk_file read;
 
-neverallow { domain -bpfloader } *:bpf { map_create prog_load };
-neverallow { domain -bpfdomain } *:bpf { map_read map_write prog_run };
+neverallow { domain -bpfloader } *:bpf prog_load;
+neverallow { domain -bpfdomain } *:bpf { map_create map_read map_write prog_run };
 
 # 'fs_bpf_loader' is for internal use of the BpfLoader oneshot boot time process.
 neverallow { domain -bpfloader } fs_bpf_loader:bpf *;