diff --git a/domain.te b/domain.te
index 45569de..06b9dc2 100644
--- a/domain.te
+++ b/domain.te
@@ -62,7 +62,7 @@
 
 # Root fs.
 allow domain rootfs:dir search;
-allow domain rootfs:lnk_file read;
+allow domain rootfs:lnk_file { read getattr };
 
 # Device accesses.
 allow domain device:dir search;