diff --git a/system_server.te b/system_server.te
index 0b18eb4b6db1d5dfcd3f2367c9c83b88307ccc25..c9d8f3b49d3e043b829825c896f3c50fdeda730a 100644
--- a/system_server.te
+++ b/system_server.te
@@ -101,9 +101,13 @@ allow system_server proc_sysrq:file rw_file_perms;
 # Read /sys/kernel/debug/wakeup_sources.
 allow system_server debugfs:file r_file_perms;
 
-# WifiWatchdog uses a packet_socket
+# The DhcpClient and WifiWatchdog use packet_sockets
 allow system_server self:packet_socket create_socket_perms;
 
+# NetworkDiagnostics requires explicit bind() calls to ping sockets. These aren't actually the same
+# as raw sockets, but the kernel doesn't yet distinguish between the two.
+allow system_server node:rawip_socket node_bind;
+
 # 3rd party VPN clients require a tun_socket to be created
 allow system_server self:tun_socket create_socket_perms;