diff --git a/seapp_contexts b/seapp_contexts
index 0050cc2..25d7316 100644
--- a/seapp_contexts
+++ b/seapp_contexts
@@ -8,6 +8,8 @@
 # An unspecified isSystemServer defaults to false.
 # An unspecified string selector will match any value.
 # A user string selector that ends in * will perform a prefix match.
+# user=_app will match any regular app UID.
+# user=_isolated will match any isolated service UID.
 # All specified input selectors in an entry must match (i.e. logical AND).
 # Matching is case-insensitive.
 # Precedence rules:
@@ -33,10 +35,10 @@
 user=system domain=system_app type=system_data_file
 user=nfc domain=nfc type=nfc_data_file
 user=radio domain=radio type=radio_data_file
-user=app_* domain=untrusted_app type=app_data_file levelFromUid=true
-user=app_* seinfo=platform domain=platform_app type=platform_app_data_file
-user=app_* seinfo=shared domain=shared_app type=platform_app_data_file
-user=app_* seinfo=media domain=media_app type=platform_app_data_file
-user=app_* seinfo=release domain=release_app type=platform_app_data_file
-user=app_* seinfo=release name=com.android.browser domain=browser_app type=platform_app_data_file
-user=isolated domain=isolated_app levelFromUid=true
+user=_app domain=untrusted_app type=app_data_file levelFromUid=true
+user=_app seinfo=platform domain=platform_app type=platform_app_data_file
+user=_app seinfo=shared domain=shared_app type=platform_app_data_file
+user=_app seinfo=media domain=media_app type=platform_app_data_file
+user=_app seinfo=release domain=release_app type=platform_app_data_file
+user=_app seinfo=release name=com.android.browser domain=browser_app type=platform_app_data_file
+user=_isolated domain=isolated_app levelFromUid=true