diff --git a/prebuilts/api/28.0/public/mediaextractor.te b/prebuilts/api/28.0/public/mediaextractor.te
index 44387fd475330e02451f44f6452006ac2797ee62..b0554626fa9b7d76333e961f4983465d5d808e65 100644
--- a/prebuilts/api/28.0/public/mediaextractor.te
+++ b/prebuilts/api/28.0/public/mediaextractor.te
@@ -22,10 +22,8 @@ allow mediaextractor proc_meminfo:file r_file_perms;
 
 crash_dump_fallback(mediaextractor)
 
-# Suppress denials from sdcardfs (b/67454004)
-dontaudit mediaextractor sdcardfs:file read;
-
 # allow mediaextractor read permissions for file sources
+allow mediaextractor sdcardfs:file { getattr read };
 allow mediaextractor media_rw_data_file:file { getattr read };
 allow mediaextractor app_data_file:file { getattr read };
 
diff --git a/public/mediaextractor.te b/public/mediaextractor.te
index 44387fd475330e02451f44f6452006ac2797ee62..b0554626fa9b7d76333e961f4983465d5d808e65 100644
--- a/public/mediaextractor.te
+++ b/public/mediaextractor.te
@@ -22,10 +22,8 @@ allow mediaextractor proc_meminfo:file r_file_perms;
 
 crash_dump_fallback(mediaextractor)
 
-# Suppress denials from sdcardfs (b/67454004)
-dontaudit mediaextractor sdcardfs:file read;
-
 # allow mediaextractor read permissions for file sources
+allow mediaextractor sdcardfs:file { getattr read };
 allow mediaextractor media_rw_data_file:file { getattr read };
 allow mediaextractor app_data_file:file { getattr read };