diff --git a/prebuilts/api/34.0/private/adbd.te b/prebuilts/api/34.0/private/adbd.te
index 4360541..dccdd60 100644
--- a/prebuilts/api/34.0/private/adbd.te
+++ b/prebuilts/api/34.0/private/adbd.te
@@ -7,10 +7,8 @@
 
 domain_auto_trans(adbd, shell_exec, shell)
 
-userdebug_or_eng(`
-  allow adbd self:process setcurrent;
-  allow adbd su:process dyntransition;
-')
+allow adbd self:process setcurrent;
+allow adbd su:process dyntransition;
 
 # When 'adb shell' is executed in recovery mode, adbd explicitly
 # switches into shell domain using setcon() because the shell executable
@@ -232,7 +230,6 @@
 ###
 
 # No transitions from adbd to non-shell, non-crash_dump domains. adbd only ever
-# transitions to the shell domain (except when it crashes). In particular, we
-# never want to see a transition from adbd to su (aka "adb root")
+# transitions to the shell domain (except when it crashes).
 neverallow adbd { domain -crash_dump -shell }:process transition;
-neverallow adbd { domain userdebug_or_eng(`-su') recovery_only(`-shell') }:process dyntransition;
+neverallow adbd { domain -su recovery_only(`-shell') }:process dyntransition;
diff --git a/private/adbd.te b/private/adbd.te
index 4360541..dccdd60 100644
--- a/private/adbd.te
+++ b/private/adbd.te
@@ -7,10 +7,8 @@
 
 domain_auto_trans(adbd, shell_exec, shell)
 
-userdebug_or_eng(`
-  allow adbd self:process setcurrent;
-  allow adbd su:process dyntransition;
-')
+allow adbd self:process setcurrent;
+allow adbd su:process dyntransition;
 
 # When 'adb shell' is executed in recovery mode, adbd explicitly
 # switches into shell domain using setcon() because the shell executable
@@ -232,7 +230,6 @@
 ###
 
 # No transitions from adbd to non-shell, non-crash_dump domains. adbd only ever
-# transitions to the shell domain (except when it crashes). In particular, we
-# never want to see a transition from adbd to su (aka "adb root")
+# transitions to the shell domain (except when it crashes).
 neverallow adbd { domain -crash_dump -shell }:process transition;
-neverallow adbd { domain userdebug_or_eng(`-su') recovery_only(`-shell') }:process dyntransition;
+neverallow adbd { domain -su recovery_only(`-shell') }:process dyntransition;