diff --git a/public/dumpstate.te b/public/dumpstate.te
index d0204a50b4458c1a2048ec81703c220104e4ead1..42d929049a87a727a3aa55833821f4ecfdb1733e 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -250,6 +250,9 @@ binder_call(dumpstate, installd);
 # Allow dumpstate to run ip xfrm policy
 allow dumpstate self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_read };
 
+# Allow dumpstate to run iotop
+allow dumpstate self:netlink_socket create_socket_perms_no_ioctl;
+
 ###
 ### neverallow rules
 ###