diff --git a/private/ephemeral_app.te b/private/ephemeral_app.te
index 4935f33..92fd325 100644
--- a/private/ephemeral_app.te
+++ b/private/ephemeral_app.te
@@ -22,7 +22,7 @@
 # Some apps ship with shared libraries and binaries that they write out
 # to their sandbox directory and then execute.
 allow ephemeral_app privapp_data_file:file { r_file_perms execute };
-allow ephemeral_app app_data_file:file     { r_file_perms execute };
+allow ephemeral_app app_data_file:file r_file_perms;
 
 # Allow the renderscript compiler to be run.
 domain_auto_trans(ephemeral_app, rs_exec, rs)