diff --git a/public/app.te b/public/app.te
index a443bbc..6cb3382 100644
--- a/public/app.te
+++ b/public/app.te
@@ -239,9 +239,9 @@
 
 allow { appdomain -isolated_app } ion_device:chr_file rw_file_perms;
 # TODO is write really necessary ?
-auditallow appdomain ion_device:chr_file { write append };
+auditallow { appdomain userdebug_or_eng(`-su') } ion_device:chr_file { write append };
 # TODO audit ion ioctl usage by apps
-auditallow appdomain ion_device:chr_file ioctl;
+auditallow { appdomain userdebug_or_eng(`-su') } ion_device:chr_file ioctl;
 
 allow { appdomain -isolated_app } hal_graphics_allocator:fd use;