diff --git a/private/init.te b/private/init.te
index 49a98e0..453e8a4 100644
--- a/private/init.te
+++ b/private/init.te
@@ -63,3 +63,6 @@
 # Only init can write vts.native_server.on
 set_prop(init, vts_status_prop)
 neverallow { -init } vts_status_prop:property_service set;
+
+# Only init can write normal ro.boot. properties
+neverallow { -init } bootloader_prop:property_service set;