diff --git a/system_server.te b/system_server.te
index 8d8c30350c32b8b8c0da836c83cc73449a772649..ac27256612a5a9a1ca50b030c0de7f259d4ba3f3 100644
--- a/system_server.te
+++ b/system_server.te
@@ -497,6 +497,9 @@ allow system_server adbd:unix_stream_socket { getattr getopt ioctl read write sh
 # accesses to the underlying FS.
 allow system_server media_rw_data_file:dir search;
 
+# Allow invoking tools like "timeout"
+allow system_server toolbox_exec:file rx_file_perms;
+
 ###
 ### Neverallow rules
 ###