diff --git a/private/domain.te b/private/domain.te
index 4692eda..8dd8c89 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -813,5 +813,5 @@
 neverallow { domain -gmscore_app -init -vold_prepare_subdirs } checkin_data_file:{dir file} *;
 
 # Do not allow write access to aconfig flag value files except init and aconfigd
-neverallow { domain -init -aconfigd } aconfig_storage_metadata_file:dir *;
-neverallow { domain -init -aconfigd } aconfig_storage_metadata_file:file no_w_file_perms;
+neverallow { domain -init -aconfigd -system_server } aconfig_storage_metadata_file:dir *;
+neverallow { domain -init -aconfigd -system_server } aconfig_storage_metadata_file:file no_w_file_perms;
diff --git a/private/system_server.te b/private/system_server.te
index 886499e..c2c30ae 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1470,6 +1470,7 @@
 
 allow system_server aconfig_storage_flags_metadata_file:dir rw_dir_perms;
 allow system_server aconfig_storage_flags_metadata_file:file create_file_perms;
+allow system_server aconfig_storage_metadata_file:dir search;
 
 allow system_server repair_mode_metadata_file:dir rw_dir_perms;
 allow system_server repair_mode_metadata_file:file create_file_perms;