diff --git a/private/audioserver.te b/private/audioserver.te
index 2d0b46d..feda8d4 100644
--- a/private/audioserver.te
+++ b/private/audioserver.te
@@ -95,7 +95,8 @@
 # permissions and be isolated from the rest of the system and network.
 # Lengthier explanation here:
 # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
-neverallow audioserver domain:{ tcp_socket udp_socket rawip_socket } *;
+neverallow audioserver domain:{ udp_socket rawip_socket } *;
+neverallow audioserver { domain userdebug_or_eng(`-su') }:tcp_socket *;
 
 # Allow using wake locks
 wakelock_use(audioserver)
diff --git a/private/mediatranscoding.te b/private/mediatranscoding.te
index 2a43cf9..d812525 100644
--- a/private/mediatranscoding.te
+++ b/private/mediatranscoding.te
@@ -61,4 +61,5 @@
 # permissions and be isolated from the rest of the system and network.
 # Lengthier explanation here:
 # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
-neverallow mediatranscoding domain:{ tcp_socket udp_socket rawip_socket } *;
+neverallow mediatranscoding domain:{ udp_socket rawip_socket } *;
+neverallow mediatranscoding { domain userdebug_or_eng(`-su') }:tcp_socket *;