diff --git a/target/board/generic/sepolicy/goldfish_setup.te b/target/board/generic/sepolicy/goldfish_setup.te
index bce196a7d..b8f121cda 100644
--- a/target/board/generic/sepolicy/goldfish_setup.te
+++ b/target/board/generic/sepolicy/goldfish_setup.te
@@ -5,7 +5,7 @@ type goldfish_setup_exec, exec_type, file_type;
 init_daemon_domain(goldfish_setup)
 
 # Inherit open file to shell (interpreter) for script.
-allow goldfish_setup shell_exec:file read;
+allow goldfish_setup shell_exec:file rx_file_perms;
 
 # Run ifconfig, route commands to configure interfaces and routes.
 allow goldfish_setup system_file:file execute_no_trans;