diff --git a/private/domain.te b/private/domain.te
index 9db19f1..8b502f3 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -204,3 +204,26 @@
   -init
   -vendor_init
 } cgroup_rc_file:file no_w_file_perms;
+
+# Only authorized processes should be writing to files in /data/dalvik-cache
+neverallow {
+  domain
+  -init # TODO: limit init to relabelfrom for files
+  -zygote
+  -installd
+  -postinstall_dexopt
+  -cppreopts
+  -dex2oat
+  -otapreopt_slot
+} dalvikcache_data_file:file no_w_file_perms;
+
+neverallow {
+  domain
+  -init
+  -installd
+  -postinstall_dexopt
+  -cppreopts
+  -dex2oat
+  -zygote
+  -otapreopt_slot
+} dalvikcache_data_file:dir no_w_dir_perms;
diff --git a/public/domain.te b/public/domain.te
index 2621d81..9a66a62 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -1071,29 +1071,6 @@
   }:file *;
 ')
 
-# Only authorized processes should be writing to files in /data/dalvik-cache
-neverallow {
-  domain
-  -init # TODO: limit init to relabelfrom for files
-  -zygote
-  -installd
-  -postinstall_dexopt
-  -cppreopts
-  -dex2oat
-  -otapreopt_slot
-} dalvikcache_data_file:file no_w_file_perms;
-
-neverallow {
-  domain
-  -init
-  -installd
-  -postinstall_dexopt
-  -cppreopts
-  -dex2oat
-  -zygote
-  -otapreopt_slot
-} dalvikcache_data_file:dir no_w_dir_perms;
-
 # Only system_server should be able to send commands via the zygote socket
 neverallow { domain -zygote -system_server } zygote:unix_stream_socket connectto;
 neverallow { domain -system_server } zygote_socket:sock_file write;