diff --git a/Android.mk b/Android.mk
index 085a3625e1dfd4a0dc8efeb6560ab28e23c64126..3af7591d832903369ae2c8d7a157dd3b56f4139d 100644
--- a/Android.mk
+++ b/Android.mk
@@ -10,6 +10,12 @@ POLICYVERS ?= 24
 MLS_SENS=1
 MLS_CATS=1024
 
+ifeq ($(TARGET_BUILD_VARIANT),user)
+	BOARD_SEPOLICY_IGNORE+=external/sepolicy/su.te
+else
+	BOARD_SEPOLICY_IGNORE+=external/sepolicy/su_user.te
+endif
+
 # Quick edge case error detection for BOARD_SEPOLICY_REPLACE.
 # Builds the singular path for each replace file.
 sepolicy_replace_paths :=
diff --git a/su_user.te b/su_user.te
new file mode 100644
index 0000000000000000000000000000000000000000..77fc535c9a342230b5fec13cbb335d1382c7fc02
--- /dev/null
+++ b/su_user.te
@@ -0,0 +1,4 @@
+# File types must be defined for file_contexts.
+type su_exec, file_type;
+
+# No allow rules