diff --git a/public/app.te b/public/app.te
index 96f77e471cf71a94156582bf5c80e1b3429d2179..cf9890562f29d51030f740668a4df8f24dcf9e7a 100644
--- a/public/app.te
+++ b/public/app.te
@@ -201,6 +201,7 @@ userdebug_or_eng(`
     -platform_app
     -priv_app
     -shell
+    -su
     -system_app
     -untrusted_app_all
   } proc_net_type:{ dir file lnk_file } { getattr open read };