diff --git a/private/priv_app.te b/private/priv_app.te
index 9f8ef7946de51e1228aa30032e3dcf288af0c835..ea1ce5b1668e525703535f17c4649fd1ab3afa10 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -21,22 +21,23 @@ allow priv_app self:process ptrace;
 # to their sandbox directory and then dlopen().
 allow priv_app app_data_file:file execute;
 
+allow priv_app app_api_service:service_manager find;
 allow priv_app audioserver_service:service_manager find;
 allow priv_app cameraserver_service:service_manager find;
 allow priv_app drmserver_service:service_manager find;
 allow priv_app mediacodec_service:service_manager find;
-allow priv_app mediametrics_service:service_manager find;
 allow priv_app mediadrmserver_service:service_manager find;
 allow priv_app mediaextractor_service:service_manager find;
+allow priv_app mediametrics_service:service_manager find;
 allow priv_app mediaserver_service:service_manager find;
 allow priv_app network_watchlist_service:service_manager find;
 allow priv_app nfc_service:service_manager find;
 allow priv_app oem_lock_service:service_manager find;
-allow priv_app radio_service:service_manager find;
-allow priv_app app_api_service:service_manager find;
-allow priv_app system_api_service:service_manager find;
 allow priv_app persistent_data_block_service:service_manager find;
+allow priv_app radio_service:service_manager find;
 allow priv_app recovery_service:service_manager find;
+allow priv_app stats_service:service_manager find;
+allow priv_app system_api_service:service_manager find;
 
 # Write to /cache.
 allow priv_app { cache_file cache_recovery_file }:dir create_dir_perms;
@@ -95,6 +96,9 @@ allow priv_app update_engine_service:service_manager find;
 binder_call(priv_app, storaged)
 allow priv_app storaged_service:service_manager find;
 
+# Allow GMS core to communicate with statsd.
+binder_call(priv_app, statsd)
+
 # Allow Phone to read/write cached ringtones (opened by system).
 allow priv_app ringtone_file:file { getattr read write };
 
diff --git a/private/statsd.te b/private/statsd.te
index 617021af7d847c362f82e26cee8f5b6e3ecc0fe9..9d78ebb40c3b885d588cb699f2e143461a81451d 100644
--- a/private/statsd.te
+++ b/private/statsd.te
@@ -55,6 +55,7 @@ binder_call(statsd, stats)
 neverallow {
   domain
   -dumpstate
+  -priv_app
   -shell
   -stats
   -statsd