diff --git a/file_contexts b/file_contexts
index 358c0bc803160539e66d16ac36c5a91a4358fea2..81caa35d6d38fa75e5917b596957077dfc4756a5 100644
--- a/file_contexts
+++ b/file_contexts
@@ -183,6 +183,8 @@
 /data/misc/systemkeys(/.*)?     u:object_r:systemkeys_data_file:s0
 /data/misc/vpn(/.*)?            u:object_r:vpn_data_file:s0
 /data/misc/wifi(/.*)?           u:object_r:wifi_data_file:s0
+/data/misc/wifi/sockets(/.*)?   u:object_r:wpa_socket:s0
+/data/misc/wifi/sockets/wpa_ctrl.*   u:object_r:system_wpa_socket:s0
 /data/misc/zoneinfo(/.*)?       u:object_r:zoneinfo_data_file:s0
 
 # App sandboxes
diff --git a/system_server.te b/system_server.te
index 19719124fe8c5b77fe18eb92339ce63b4e97911a..6ec3af4a2b2b99f1edd6b028647c8caa93c64825 100644
--- a/system_server.te
+++ b/system_server.te
@@ -173,6 +173,8 @@ allow system_server ctl_default_prop:property_service set;
 
 # Create a socket for receiving info from wpa.
 type_transition system_server wifi_data_file:sock_file system_wpa_socket;
+type_transition system_server wpa_socket:sock_file system_wpa_socket;
+allow system_server wpa_socket:dir rw_dir_perms;
 allow system_server system_wpa_socket:sock_file create_file_perms;
 
 # Remove sockets created by wpa_supplicant
diff --git a/wpa_supplicant.te b/wpa_supplicant.te
index 38c0fb06b3939e69ec9f01cfba8ea2a67bfd6c37..1ebf5560201ceb4d22b1a2831b8fd59443682754 100644
--- a/wpa_supplicant.te
+++ b/wpa_supplicant.te
@@ -17,4 +17,11 @@ allow wpa random_device:chr_file r_file_perms;
 
 # Create a socket for receiving info from wpa
 type_transition wpa wifi_data_file:sock_file wpa_socket;
+allow wpa wpa_socket:dir { rw_dir_perms setattr };
 allow wpa wpa_socket:sock_file create_file_perms;
+
+# Allow wpa_cli to work. wpa_cli creates a socket in
+# /data/misc/wifi/sockets which wpa supplicant communicates with.
+userdebug_or_eng(`
+  unix_socket_send(wpa, wpa, su)
+')