diff --git a/private/vfio_handler.te b/private/vfio_handler.te
index 3bed3c6..1b553e9 100644
--- a/private/vfio_handler.te
+++ b/private/vfio_handler.te
@@ -20,11 +20,11 @@
 allow vfio_handler sysfs:dir r_dir_perms;
 allow vfio_handler sysfs:file rw_file_perms;
 
-# Allow vfio_handler to write to VM DTBO via a file created by virtualizationmanager.
-allow vfio_handler virtualizationmanager:fd use;
+# Allow vfio_handler to write to VM DTBO via a file created by virtualizationservice.
+allow vfio_handler virtualizationservice:fd use;
 allow vfio_handler virtualizationservice_data_file:file write;
 
-# vfio_handler can only use fd from virtualizationmanager, and can't open files itself
+# vfio_handler can only use fd from virtualizationservice, and can't open files itself
 neverallow vfio_handler virtualizationservice_data_file:file { open create };
 
 # Allow vfio_handler to search /dev/block for accessing dtbo.img
diff --git a/private/virtualizationservice.te b/private/virtualizationservice.te
index 2d20195..93cd04c 100644
--- a/private/virtualizationservice.te
+++ b/private/virtualizationservice.te
@@ -34,8 +34,8 @@
 # Let virtualizationservice create and delete temporary directories of VMs. To remove old
 # directories, it needs the permission to unlink the files created by virtualizationmanager.
 allow virtualizationservice virtualizationservice_data_file:dir create_dir_perms;
-allow virtualizationservice virtualizationservice_data_file:{ file sock_file } unlink;
-allow virtualizationservice virtualizationservice_data_file:file write;
+allow virtualizationservice virtualizationservice_data_file:sock_file unlink;
+allow virtualizationservice virtualizationservice_data_file:file create_file_perms;
 
 # Allow to use fd (e.g. /dev/pts/0) inherited from adbd so that we can redirect output from
 # crosvm to the console