diff --git a/app.te b/app.te
index b31fce09fee72f89b1ddc9a80e54378e4119ab0c..b05089bb9314ebf146658ed8ee469c7d6d94ac94 100644
--- a/app.te
+++ b/app.te
@@ -225,6 +225,10 @@ selinux_check_context(appdomain)
 auditallow { appdomain userdebug_or_eng(`-su') } sysfs:dir { open getattr read ioctl };
 auditallow { appdomain userdebug_or_eng(`-su') } sysfs:file r_file_perms;
 
+# Apps receive an open tun fd from the framework for
+# device traffic. Do not allow untrusted app to directly open tun_device
+allow { appdomain -isolated_app } tun_device:chr_file { read write getattr ioctl append };
+
 ###
 ### Neverallow rules
 ###
diff --git a/untrusted_app.te b/untrusted_app.te
index b5a00d6e9422a8e7ccb8de3457837213fd2ea174..86263256b70ac6ad57a4b8f59350bcd6a552343f 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -29,10 +29,6 @@ bluetooth_domain(untrusted_app)
 # to their sandbox directory and then execute.
 allow untrusted_app app_data_file:file { rx_file_perms execmod };
 
-# Third party vpn apps receive an open tun fd from the framework for
-# device traffic. Do not allow untrusted app to directly open tun_device
-allow untrusted_app tun_device:chr_file { read write getattr ioctl append };
-
 # ASEC
 allow untrusted_app asec_apk_file:file r_file_perms;
 # Execute libs in asec containers.