diff --git a/Android.mk b/Android.mk
index 9dc31a542f..47c4aa1d0b 100644
--- a/Android.mk
+++ b/Android.mk
@@ -17,7 +17,7 @@ LOCAL_PATH := $(call my-dir)
 ifdef project-path-for
     ifeq ($(LOCAL_PATH),$(call project-path-for,recovery))
         PROJECT_PATH_AGREES := true
-        BOARD_SEPOLICY_DIRS += bootable/recovery-twrp/sepolicy
+        BOARD_SEPOLICY_DIRS += $(call project-path-for,recovery)/sepolicy
     endif
 else
     ifeq ($(LOCAL_PATH),bootable/recovery)
diff --git a/sepolicy/twrp.te b/sepolicy/twrp.te
index 3ebdc4b3b5..d81b9e191d 100644
--- a/sepolicy/twrp.te
+++ b/sepolicy/twrp.te
@@ -1 +1,4 @@
-permissive recovery;
+recovery_only(`
+  # Allow recovery to set permissive mode
+  permissive recovery;
+')