diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 344ecd5..1e82404 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -274,3 +274,6 @@
 # This will go away in a future Android release
 neverallow { all_untrusted_apps -untrusted_app_25 } proc_tty_drivers:file r_file_perms;
 neverallow all_untrusted_apps proc_tty_drivers:file ~r_file_perms;
+
+# Untrusted apps are not allowed to use cgroups.
+neverallow all_untrusted_apps cgroup:file *;