diff --git a/private/netutils_wrapper.te b/private/netutils_wrapper.te
index a26181f..37a2c47 100644
--- a/private/netutils_wrapper.te
+++ b/private/netutils_wrapper.te
@@ -39,9 +39,15 @@
     -appdomain
 }, netutils_wrapper_exec, netutils_wrapper)
 
+###
+### Neverallow rules
+###
+
 # suppress spurious denials
 dontaudit netutils_wrapper self:global_capability_class_set sys_resource;
 dontaudit netutils_wrapper sysfs_type:file read;
 
 # netutils wrapper may only use the following capabilities.
 neverallow netutils_wrapper self:global_capability_class_set ~{ net_admin net_raw };
+
+neverallow domain netutils_wrapper_exec:file execute_no_trans;