diff --git a/untrusted_app.te b/untrusted_app.te
index cc56ac5bd977e7e8a1c9273f15a134279c2cf99e..5b573a723d80c3f153858755a93314e47b515aaf 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -174,6 +174,7 @@ neverallow untrusted_app {
   fs_type
   -fuse                     # sdcard
   -sdcardfs                 # sdcard
+  -vfat
   file_type
   -app_data_file            # The apps sandbox itself
   -media_rw_data_file       # Internal storage. Known that apps can