diff --git a/private/platform_app.te b/private/platform_app.te
index ee0590c..2596a8e 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -67,6 +67,10 @@
 
 read_runtime_log_tags(platform_app)
 
+# allow platform apps to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow platform_app system_server:udp_socket { connect getattr read recvfrom sendto write };
+
 ###
 ### Neverallow rules
 ###