diff --git a/private/incident.te b/private/incident.te
index b910dde..2038816 100644
--- a/private/incident.te
+++ b/private/incident.te
@@ -23,3 +23,5 @@
 binder_call(incident, incidentd)
 allow incident incidentd:fifo_file write;
 
+# only allow incident being called by shell
+neverallow { domain -su -shell -incident } incident_exec:file { execute execute_no_trans };