diff --git a/policy/modules/services/dnsmasq.te b/policy/modules/services/dnsmasq.te
index fab57cef22..cccaa0d593 100644
--- a/policy/modules/services/dnsmasq.te
+++ b/policy/modules/services/dnsmasq.te
@@ -110,6 +110,10 @@ userdom_dontaudit_search_user_home_dirs(dnsmasq_t)
 
 files_manage_quota_aos(dnsmasq_t)
 
+init_rw_script_stream_sockets(dnsmasq_t)
+
+aos_rw_conf(dnsmasq_t)
+
 dev_rw_tee_chr_files(dnsmasq_t)
 
 kernel_use_fds(dnsmasq_t)
diff --git a/policy/modules/system/aos.if b/policy/modules/system/aos.if
index 2852cd0391..246186cb33 100644
--- a/policy/modules/system/aos.if
+++ b/policy/modules/system/aos.if
@@ -206,6 +206,25 @@ interface(`files_manage_overlay_aos',`
 ')	
 
 
+########################################
+## <summary>
+##	Read and write aos conf directories and files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`aos_rw_conf',`
+	gen_require(`
+		type aos_conf_t;
+	')
+
+	allow $1 aos_conf_t:dir rw_dir_perms;
+	allow $1 aos_conf_t:file rw_file_perms;
+')
+
 ########################################
 ## <summary>
 ##	Allow relabeled /var/aos directory.