diff --git a/debuggerd.te b/debuggerd.te
index 31453c9ceb79a2e906e28f22cb6ef4010844351f..690e695484afe080ecef15566ad96c4216fb3efa 100644
--- a/debuggerd.te
+++ b/debuggerd.te
@@ -7,3 +7,6 @@ init_daemon_domain(debuggerd)
 unconfined_domain(debuggerd)
 relabelto_domain(debuggerd)
 allow debuggerd tombstone_data_file:dir relabelto;
+
+# Connect to system_server via /data/system/ndebugsocket.
+unix_socket_connect(debuggerd, system_ndebug, system_server)
diff --git a/file.te b/file.te
index aeea030b2ab654309fc5296a045de1fe86bb2b1a..44b7516212bc045fe12f640593e95242f8aa2489 100644
--- a/file.te
+++ b/file.te
@@ -98,6 +98,7 @@ type racoon_socket, file_type;
 type rild_socket, file_type;
 type rild_debug_socket, file_type;
 type system_wpa_socket, file_type;
+type system_ndebug_socket, file_type;
 type vold_socket, file_type;
 type wpa_socket, file_type;
 type zygote_socket, file_type;
diff --git a/system_server.te b/system_server.te
index d4930ab27abf2249f4f4ce3703fa28e3b75a6dbe..35df21c6642adb780d8cb562660cc7217246d8c5 100644
--- a/system_server.te
+++ b/system_server.te
@@ -25,6 +25,12 @@ allow system_server self:capability {
 
 # Create a socket for receiving info from wpa.
 type_transition system_server wifi_data_file:sock_file system_wpa_socket;
+allow system_server system_wpa_socket:sock_file create_file_perms;
+
+# Create a socket for connections from debuggerd.
+type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";
+allow system_server system_ndebug_socket:sock_file create_file_perms;
+
 allow system_server self:zygote { specifyids specifyrlimits specifyseinfo };
 
 allow system_server backup_data_file:dir relabelto;