diff --git a/private/system_server.te b/private/system_server.te
index 287503c..b48c9e7 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -177,6 +177,9 @@
 # Set and get routes directly via netlink.
 allow system_server self:netlink_route_socket nlmsg_write;
 
+# Use XFRM (IPsec) netlink sockets
+allow system_server self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read };
+
 # Kill apps.
 allow system_server appdomain:process { getpgid sigkill signal };
 # signull allowed for kill(pid, 0) existence test.