diff --git a/Android.mk b/Android.mk
index 085a3625e..3af7591d8 100644
--- a/Android.mk
+++ b/Android.mk
@@ -10,6 +10,12 @@ POLICYVERS ?= 24
 MLS_SENS=1
 MLS_CATS=1024
 
+ifeq ($(TARGET_BUILD_VARIANT),user)
+	BOARD_SEPOLICY_IGNORE+=external/sepolicy/su.te
+else
+	BOARD_SEPOLICY_IGNORE+=external/sepolicy/su_user.te
+endif
+
 # Quick edge case error detection for BOARD_SEPOLICY_REPLACE.
 # Builds the singular path for each replace file.
 sepolicy_replace_paths :=
diff --git a/su_user.te b/su_user.te
new file mode 100644
index 000000000..77fc535c9
--- /dev/null
+++ b/su_user.te
@@ -0,0 +1,4 @@
+# File types must be defined for file_contexts.
+type su_exec, file_type;
+
+# No allow rules