diff --git a/public/su.te b/public/su.te
index 346b1fe..a2f435e 100644
--- a/public/su.te
+++ b/public/su.te
@@ -51,6 +51,7 @@
   dontaudit su unlabeled:filesystem *;
   dontaudit su postinstall_file:filesystem *;
   dontaudit su domain:bpf *;
+  dontaudit su unlabeled:vsock_socket *;
 
   # VTS tests run in the permissive su domain on debug builds, but the HALs
   # being tested run in enforcing mode. Because hal_foo_server is enforcing