diff --git a/kernel/selinux/rules.c b/kernel/selinux/rules.c
index 94599792..c60159c0 100644
--- a/kernel/selinux/rules.c
+++ b/kernel/selinux/rules.c
@@ -128,7 +128,7 @@ void apply_kernelsu_rules()
     ksu_allow(db, "system_server", KERNEL_SU_DOMAIN, "process", "sigkill");
 
 	// https://android-review.googlesource.com/c/platform/system/logging/+/3725346
-	ksu_dontaudit(db, ALL, KERNEL_SU_DOMAIN, "dir", "getattr");
+	ksu_dontaudit(db, "untrusted_app", KERNEL_SU_DOMAIN, "dir", "getattr");
 
 	mutex_unlock(&ksu_rules);
 }