diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 0d6d42c..1a1ed62 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -123,7 +123,7 @@
 # Apps can read/write an already open vsock (e.g. created by
 # virtualizationservice) but nothing more than that (e.g. creating a
 # new vsock, etc.)
-neverallow all_untrusted_apps *:vsock_socket ~{ getattr read write };
+neverallow all_untrusted_apps *:vsock_socket ~{ getattr getopt read write };
 
 # Disallow sending RTM_GETLINK messages on netlink sockets.
 neverallow all_untrusted_apps domain:netlink_route_socket { bind nlmsg_readpriv };