diff --git a/private/system_server.te b/private/system_server.te
index 9eea9c1..4d44736 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1075,6 +1075,10 @@
   FS_IOC_ENABLE_VERITY FS_IOC_MEASURE_VERITY
 };
 
+allowxperm system_server system_file:file ioctl {
+  FS_IOC_MEASURE_VERITY
+};
+
 # Postinstall
 #
 # For OTA dexopt, allow calls coming from postinstall.