diff --git a/private/genfs_contexts b/private/genfs_contexts
index 0c50675..d1e1b91 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -26,6 +26,8 @@
 genfscon proc /sys/kernel/usermodehelper u:object_r:usermodehelper:s0
 genfscon proc /sys/net u:object_r:proc_net:s0
 genfscon proc /sys/vm/mmap_min_addr u:object_r:proc_security:s0
+genfscon proc /sys/vm/mmap_rnd_bits u:object_r:proc_security:s0
+genfscon proc /sys/vm/mmap_rnd_compat_bits u:object_r:proc_security:s0
 genfscon proc /sys/vm/drop_caches u:object_r:proc_drop_caches:s0
 genfscon proc /sys/vm/overcommit_memory u:object_r:proc_overcommit_memory:s0
 genfscon proc /timer_list u:object_r:proc_timer:s0
diff --git a/public/domain.te b/public/domain.te
index e2c71da..10e62b8 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -251,7 +251,7 @@
 # Only init should be able to configure kernel usermodehelpers or
 # security-sensitive proc settings.
 neverallow { domain -init } usermodehelper:file { append write };
-neverallow { domain -init } proc_security:file { append write };
+neverallow { domain -init } proc_security:file { append open read write };
 
 # No domain should be allowed to ptrace init.
 neverallow * init:process ptrace;