diff --git a/file.te b/file.te
index ac4220fd49ead70dff0f53f15c176d6c7f00cf5d..00f158936ea15a6a07f18c5721e18063d5f9a62e 100644
--- a/file.te
+++ b/file.te
@@ -118,6 +118,7 @@ type adbd_socket, file_type;
 type bluetooth_socket, file_type;
 type dnsproxyd_socket, file_type, mlstrustedobject;
 type dumpstate_socket, file_type;
+type fwmarkd_socket, file_type, mlstrustedobject;
 type gps_socket, file_type;
 type installd_socket, file_type;
 type lmkd_socket, file_type;
diff --git a/file_contexts b/file_contexts
index 0926d745f7c73ceb40d6c2a0c02ae0706bb72536..74c6db3e042c4405efcd392faf6d0a32d823063e 100644
--- a/file_contexts
+++ b/file_contexts
@@ -79,6 +79,7 @@
 /dev/socket/adbd	u:object_r:adbd_socket:s0
 /dev/socket/dnsproxyd	u:object_r:dnsproxyd_socket:s0
 /dev/socket/dumpstate	u:object_r:dumpstate_socket:s0
+/dev/socket/fwmarkd	u:object_r:fwmarkd_socket:s0
 /dev/socket/gps		u:object_r:gps_socket:s0
 /dev/socket/installd	u:object_r:installd_socket:s0
 /dev/socket/lmkd        u:object_r:lmkd_socket:s0
diff --git a/net.te b/net.te
index 9942efe4a5b12f710f86cadf9a62fe1b5eace375..6aa12f23a5a5695906a3bb15c504e9f67874f74b 100644
--- a/net.te
+++ b/net.te
@@ -18,5 +18,8 @@ allow netdomain self:netlink_route_socket { create_socket_perms nlmsg_read };
 # Talks to netd via dnsproxyd socket.
 unix_socket_connect(netdomain, dnsproxyd, netd)
 
+# Talks to netd via fwmarkd socket.
+unix_socket_connect(netdomain, fwmarkd, netd)
+
 # Connect to mdnsd via mdnsd socket.
 unix_socket_connect(netdomain, mdnsd, mdnsd)
diff --git a/netd.te b/netd.te
index 46cc43631813bcfd6fcde171b609beca21b32418..6fe1ad313ce38d8133ed5502d064846133961a28 100644
--- a/netd.te
+++ b/netd.te
@@ -58,6 +58,10 @@ allow netd clatd:process signal;
 
 allow netd ctl_mdnsd_prop:property_service set;
 
+# Allow netd to operate on sockets that are passed to it.
+allow netd netdomain:{tcp_socket udp_socket rawip_socket dccp_socket tun_socket} {read write getattr setattr getopt setopt};
+allow netd netdomain:fd use;
+
 ###
 ### Neverallow rules
 ###