diff --git a/private/system_server.te b/private/system_server.te
index dce1aa9..c0c1c4b 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -284,6 +284,10 @@
 # Communicate over a socket created by app_zygote.
 allow system_server app_zygote:unix_stream_socket { read write connectto setopt };
 
+# Communicate with a virtual machine (b/396144272)
+allow system_server virtualizationmanager:fd use;
+allow system_server virtualizationmanager:vsock_socket { getopt read write };
+
 # Perform Binder IPC.
 binder_use(system_server)
 binder_call(system_server, appdomain)