diff --git a/private/dumpstate.te b/private/dumpstate.te
index 293998d98f050a52bfdecd7c2d5e80c773f4be16..5cba2cdf9cc67d51f33a676c84bc36813f66337e 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -22,6 +22,9 @@ userdebug_or_eng(`
   allow dumpstate wm_trace_data_file:file r_file_perms;
 ')
 
+# Allow dumpstate to make binder calls to incidentd
+binder_call(dumpstate, incidentd)
+
 # Allow dumpstate to make binder calls to storaged service
 binder_call(dumpstate, storaged)
 
diff --git a/private/incident_helper.te b/private/incident_helper.te
index 078aa246be0b545e1457f9b22f4afde3e57a5766..b45385568345b9c85c622bff8b4ecb386140ac09 100644
--- a/private/incident_helper.te
+++ b/private/incident_helper.te
@@ -6,8 +6,8 @@ type incident_helper_exec, system_file_type, exec_type, file_type;
 domain_auto_trans(incidentd, incident_helper_exec, incident_helper)
 
 # use pipe to transmit data from/to incidentd/incident_helper for parsing
-allow incident_helper { shell incident incidentd }:fd use;
-allow incident_helper { shell incident incidentd }:fifo_file { getattr read write };
+allow incident_helper { shell incident incidentd dumpstate }:fd use;
+allow incident_helper { shell incident incidentd dumpstate }:fifo_file { getattr read write };
 allow incident_helper incidentd:unix_stream_socket { read write };
 
 # only allow incidentd and shell to call incident_helper
diff --git a/private/incidentd.te b/private/incidentd.te
index 4e80bdd9d7debde02f22b4fd46b5f57ce9f2cc22..ad6fbf3b3491987945101b766b8cbaa0992eeac9 100644
--- a/private/incidentd.te
+++ b/private/incidentd.te
@@ -134,9 +134,9 @@ allow incidentd {
 # Only incidentd can publish the binder service
 add_service(incidentd, incident_service)
 
-# Allow pipes from (and only from) incident
-allow incidentd incident:fd use;
-allow incidentd incident:fifo_file write;
+# Allow pipes only from dumpstate and incident
+allow incidentd { dumpstate incident }:fd use;
+allow incidentd { dumpstate incident }:fifo_file write;
 
 # Allow incident to call back to incident with status updates.
 binder_call(incidentd, incident)
@@ -145,9 +145,10 @@ binder_call(incidentd, incident)
 ### neverallow rules
 ###
 
-# only system_server, system_app and incident command can find the incident service
+# only dumpstate, system_server, system_app and incident command can find the incident service
 neverallow {
   domain
+  -dumpstate
   -incident
   -incidentd
   -statsd
diff --git a/public/dumpstate.te b/public/dumpstate.te
index af6956ef38afbd0b6ff11afd75b51c8ab034161b..cd3310aee2fc1374b979497143cbf185560df812 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -209,7 +209,6 @@ allow dumpstate {
   -apex_service
   -dumpstate_service
   -gatekeeper_service
-  -incident_service
   -iorapd_service
   -virtual_touchpad_service
   -vold_service
@@ -220,7 +219,6 @@ dontaudit dumpstate {
   apex_service
   dumpstate_service
   gatekeeper_service
-  incident_service
   iorapd_service
   virtual_touchpad_service
   vold_service