diff --git a/private/kernel.te b/private/kernel.te
index 5341163..6775b3b 100644
--- a/private/kernel.te
+++ b/private/kernel.te
@@ -31,3 +31,19 @@
 
 allow kernel kmsg_device:chr_file write;
 allow kernel gsid:fd use;
+
+# Some contexts are changed before the device is flipped into enforcing mode
+# during the setup of Apex sepolicy. These denials can be suppressed since
+# the permissions should not be allowed after the device is flipped into
+# enforcing mode.
+dontaudit kernel device:dir { open read relabelto };
+dontaudit kernel tmpfs:file { getattr open read relabelfrom };
+dontaudit kernel {
+  file_contexts_file
+  hwservice_contexts_file
+  mac_perms_file
+  property_contexts_file
+  seapp_contexts_file
+  sepolicy_test_file
+  service_contexts_file
+}:file relabelto;