diff --git a/private/virtualizationmanager.te b/private/virtualizationmanager.te
index 871d3f2..40d95c6 100644
--- a/private/virtualizationmanager.te
+++ b/private/virtualizationmanager.te
@@ -97,6 +97,10 @@
 # Allow virtualizationmanager to read microdroid related files in vendor partition
 r_dir_file(virtualizationmanager, vendor_microdroid_file)
 
+# Do not allow writing vendor_microdroid_file from any process.
+neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } vendor_microdroid_file:dir no_w_dir_perms;
+neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } vendor_microdroid_file:file no_w_file_perms;
+
 # Allow reading files under /proc/[crosvm pid]/, for collecting CPU & memory usage inside VM.
 r_dir_file(virtualizationmanager, crosvm);
 
diff --git a/public/file.te b/public/file.te
index 142e167..01143f7 100644
--- a/public/file.te
+++ b/public/file.te
@@ -256,6 +256,7 @@
 # system. ABI stability of these libs is vendor's responsibility.
 type vendor_public_framework_file, vendor_file_type, file_type;
 # Type for all microdroid related files in the vendor partition.
+# Files having this type should be read-only.
 type vendor_microdroid_file, vendor_file_type, file_type;
 
 # Input configuration