diff --git a/private/priv_app.te b/private/priv_app.te
index e12cce7..192221d 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -218,3 +218,6 @@
 # upon traceur to pass a file descriptor which they can then read
 neverallow priv_app trace_data_file:dir *;
 neverallow priv_app trace_data_file:file { no_w_file_perms open };
+
+# Do not allow priv_app access to cgroups.
+neverallow priv_app cgroup:file *;