diff --git a/untrusted_app.te b/untrusted_app.te
index d864424b97eae5a6d616feb57c63e85782a03204..89dbfdda2b901ea806a22fcb4b254a76d2943da3 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -154,3 +154,21 @@ neverallow untrusted_app { cache_file cache_recovery_file }:file ~{ read getattr
 # Do not allow untrusted_app to set system properties.
 neverallow untrusted_app property_socket:sock_file write;
 neverallow untrusted_app property_type:property_service set;
+
+# Do not allow untrusted_app to create/unlink files outside of its sandbox,
+# internal storage or sdcard.
+# World accessible data locations allow application to fill the device
+# with unaccounted for data. This data will not get removed during
+# application un-installation.
+neverallow untrusted_app {
+  fs_type
+  -fuse                     # sdcard
+  file_type
+  -app_data_file            # The apps sandbox itself
+  -media_rw_data_file       # Internal storage. Known that apps can
+                            # leave artfacts here after uninstall.
+  userdebug_or_eng(`
+    -method_trace_data_file # only on ro.debuggable=1
+    -coredump_file          # userdebug/eng only
+  ')
+}:dir_file_class_set { create unlink };