diff --git a/app.te b/app.te
index 8288ea0..e242152 100644
--- a/app.te
+++ b/app.te
@@ -255,7 +255,7 @@
 
 # Transition to a non-app domain.
 # Exception for the shell domain, can transition to runas, etc.
-neverallow { appdomain -shell } ~appdomain:process
+neverallow { appdomain -shell } { domain -appdomain }:process
     { transition dyntransition };
 
 # Write to rootfs.
diff --git a/file.te b/file.te
index 99c3839..7df06d3 100644
--- a/file.te
+++ b/file.te
@@ -167,4 +167,4 @@
 #   type apk_data_file, file_type, data_file_type, fs_type;
 # Should be:
 #   type apk_data_file, file_type, data_file_type;
-neverallow fs_type file_type:filesystem *;
+neverallow fs_type file_type:filesystem associate;