diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index b2c4f40..c9bf65f 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -150,3 +150,9 @@
     -proc_net_vpn
   }:{ dir file lnk_file } { getattr open read };
 ')
+
+# Attempts to write to system_data_file is generally a sign
+# that apps are attempting to access encrypted storage before
+# the ACTION_USER_UNLOCKED intent is delivered. Suppress this
+# denial to prevent third party apps from spamming the logs.
+dontaudit untrusted_app_all system_data_file:dir write;