diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index 7d4737d..6534412 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -17,15 +17,18 @@
 ### seapp_contexts.
 ###
 
+# Legacy text relocations
+allow untrusted_app_all apk_data_file:file execmod;
+
 # Some apps ship with shared libraries and binaries that they write out
 # to their sandbox directory and then execute.
-allow untrusted_app_all app_data_file:file rx_file_perms;
+allow untrusted_app_all app_data_file:file { rx_file_perms execmod };
 
 # ASEC
 allow untrusted_app_all asec_apk_file:file r_file_perms;
 allow untrusted_app_all asec_apk_file:dir r_dir_perms;
 # Execute libs in asec containers.
-allow untrusted_app_all asec_public_file:file execute;
+allow untrusted_app_all asec_public_file:file { execute execmod };
 
 # Used by Finsky / Android "Verify Apps" functionality when
 # running "adb install foo.apk".