diff --git a/init/init.cpp b/init/init.cpp
index 60fcf6463..250098536 100644
--- a/init/init.cpp
+++ b/init/init.cpp
@@ -380,7 +380,8 @@ void service_start(struct service *svc, const char *dynamic_args)
 
     if ((svc->flags & SVC_EXEC) != 0) {
         INFO("SVC_EXEC pid %d (uid %d gid %d+%zu context %s) started; waiting...\n",
-             svc->pid, svc->uid, svc->gid, svc->nr_supp_gids, svc->seclabel);
+             svc->pid, svc->uid, svc->gid, svc->nr_supp_gids,
+             svc->seclabel ? : "default");
         waiting_for_exec = true;
     }
 
diff --git a/init/init_parser.cpp b/init/init_parser.cpp
index df049edeb..f975b6c0b 100644
--- a/init/init_parser.cpp
+++ b/init/init_parser.cpp
@@ -664,6 +664,7 @@ int action_queue_empty()
 
 service* make_exec_oneshot_service(int nargs, char** args) {
     // Parse the arguments: exec [SECLABEL [UID [GID]*] --] COMMAND ARGS...
+    // SECLABEL can be a - to denote default
     int command_arg = 1;
     for (int i = 1; i < nargs; ++i) {
         if (strcmp(args[i], "--") == 0) {
@@ -689,7 +690,7 @@ service* make_exec_oneshot_service(int nargs, char** args) {
         return NULL;
     }
 
-    if (command_arg > 2) {
+    if ((command_arg > 2) && strcmp(args[1], "-")) {
         svc->seclabel = args[1];
     }
     if (command_arg > 3) {
diff --git a/init/readme.txt b/init/readme.txt
index 6b9c42d3f..c2130416d 100644
--- a/init/readme.txt
+++ b/init/readme.txt
@@ -180,7 +180,7 @@ exec [ <seclabel> [ <user> [ <group> ]* ] ] -- <command> [ <argument> ]*
    Fork and execute command with the given arguments. The command starts
    after "--" so that an optional security context, user, and supplementary
    groups can be provided. No other commands will be run until this one
-   finishes.
+   finishes. <seclabel> can be a - to denote default.
 
 export <name> <value>
    Set the environment variable <name> equal to <value> in the