diff --git a/file.te b/file.te
index e255ae9495644b8582b64e08964aa39a12cdb282..6431c2cbc8ae96ba2699923619fd0d3d09d583b5 100644
--- a/file.te
+++ b/file.te
@@ -109,6 +109,7 @@ type installd_socket, file_type;
 type keystore_socket, file_type;
 type lmkd_socket, file_type;
 type mdns_socket, file_type;
+type mdnsd_socket, file_type;
 type netd_socket, file_type;
 type property_socket, file_type;
 type qemud_socket, file_type;
diff --git a/file_contexts b/file_contexts
index f593f6db0cbd2e63e3632317f9cccc93ae4ae410..a6b193b8ef4bab9f9ffeafd2f697baf05f5084f3 100644
--- a/file_contexts
+++ b/file_contexts
@@ -82,6 +82,7 @@
 /dev/socket/keystore	u:object_r:keystore_socket:s0
 /dev/socket/lmkd        u:object_r:lmkd_socket:s0
 /dev/socket/mdns	u:object_r:mdns_socket:s0
+/dev/socket/mdnsd	u:object_r:mdnsd_socket:s0
 /dev/socket/netd	u:object_r:netd_socket:s0
 /dev/socket/property_service	u:object_r:property_socket:s0
 /dev/socket/qemud	u:object_r:qemud_socket:s0
@@ -126,6 +127,7 @@
 /system/bin/netd	u:object_r:netd_exec:s0
 /system/bin/rild	u:object_r:rild_exec:s0
 /system/bin/mediaserver	u:object_r:mediaserver_exec:s0
+/system/bin/mdnsd	u:object_r:mdnsd_exec:s0
 /system/bin/installd	u:object_r:installd_exec:s0
 /system/bin/keystore	u:object_r:keystore_exec:s0
 /system/bin/debuggerd	u:object_r:debuggerd_exec:s0
diff --git a/mdnsd.te b/mdnsd.te
new file mode 100644
index 0000000000000000000000000000000000000000..cfcf87341035e7166b7f5e7c65de4e1fb6ec7abe
--- /dev/null
+++ b/mdnsd.te
@@ -0,0 +1,7 @@
+# mdns daemon
+type mdnsd, domain;
+permissive_or_unconfined(mdnsd)
+type mdnsd_exec, exec_type, file_type;
+
+init_daemon_domain(mdnsd)
+net_domain(mdnsd)
diff --git a/net.te b/net.te
index b10cecdaab3df2c0e5b3f6e9342e42af19967491..32b9fb7476c6c5695932ef4f212cea0501f6e26b 100644
--- a/net.te
+++ b/net.te
@@ -16,3 +16,6 @@ allow netdomain self:netlink_route_socket { create bind read nlmsg_read };
 
 # Talks to netd via dnsproxyd socket.
 unix_socket_connect(netdomain, dnsproxyd, netd)
+
+# Connect to mdnsd via mdnsd socket.
+unix_socket_connect(netdomain, mdnsd, mdnsd)
diff --git a/netd.te b/netd.te
index f8c9ffbbc7311e22e3df26669fba1444154eec53..4ab3613ccfa28a6294ce325273e42d3d8253e651 100644
--- a/netd.te
+++ b/netd.te
@@ -52,7 +52,6 @@ allow netd clatd:process signal;
 # Support netd running mdnsd
 # TODO: prune this back further
 allow netd ctl_default_prop:property_service set;
-allow netd device:sock_file write;
 
 ###
 ### Neverallow rules