diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index d496e90..a2223b2 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -250,6 +250,11 @@
   -untrusted_app_visible_hwservice_violators
 }:hwservice_manager find;
 
+neverallow all_untrusted_apps {
+  vendor_service
+  vintf_service
+}:service_manager find;
+
 # SELinux is not an API for untrusted apps to use
 neverallow all_untrusted_apps selinuxfs:file no_rw_file_perms;