diff --git a/domain.te b/domain.te
index 46e0ad2e4a8e0e18848d043c8095bd2037217540..0af215d1b49b1c6a1dd780ebc67fc6ede1826adf 100644
--- a/domain.te
+++ b/domain.te
@@ -425,7 +425,7 @@ neverallow {
   -system_app # its own sandbox
   -system_server #populate com.android.providers.settings/databases/settings.db.
   -installd # creation of app sandbox
-} system_app_data_file:dir_file_class_set { create unlink };
+} system_app_data_file:dir_file_class_set { create unlink open };
 
 #
 # Only these domains should transition to shell domain. This domain is