diff --git a/private/app.te b/private/app.te
index b0b5dbb..07e0be0 100644
--- a/private/app.te
+++ b/private/app.te
@@ -407,7 +407,13 @@
 # hence no sock_file or connectto permission. This appears to be how
 # Chrome works, may need to be updated as more apps using isolated services
 # are examined.
-allow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdown };
+allow {
+  appdomain
+  -sdk_sandbox_all
+} {
+  appdomain
+  -sdk_sandbox_all
+}:unix_stream_socket { getopt getattr read write shutdown };
 
 # Backup ability for every app. BMS opens and passes the fd
 # to any app that has backup ability. Hence, no open permissions here.