diff --git a/sepolicy/su.te b/sepolicy/su.te
index 473386b..1a2a2b3 100644
--- a/sepolicy/su.te
+++ b/sepolicy/su.te
@@ -66,4 +66,7 @@
   allow system_app superuser_device:dir { create rw_dir_perms setattr unlink };
 
   allow kernel sudaemon:fd { use };
+
 ')
+
+neverallow { domain userdebug_or_eng(`-dumpstate -shell -su -untrusted_app -init -sudaemon') } su_exec:file no_x_file_perms;