diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index 5b30be0706656fab2ff5af5e89399a407edab3ec..aad4bee7f88224bb5225b6891e330231ab107933 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -34,6 +34,7 @@
     hal_lowpan_hwservice
     hal_neuralnetworks_hwservice
     hal_tetheroffload_hwservice
+    hal_wifi_hostapd_hwservice
     hal_wifi_offload_hwservice
     kmsg_debug_device
     last_boot_reason_prop
diff --git a/private/hwservice_contexts b/private/hwservice_contexts
index a98c68a02a1a70cde6e73b9d6dd59b9142912cda..316c34c6308c058d279ee14a76c0603b1d6476c7 100644
--- a/private/hwservice_contexts
+++ b/private/hwservice_contexts
@@ -47,6 +47,7 @@ android.hardware.vibrator::IVibrator                            u:object_r:hal_v
 android.hardware.vr::IVr                                        u:object_r:hal_vr_hwservice:s0
 android.hardware.weaver::IWeaver                                u:object_r:hal_weaver_hwservice:s0
 android.hardware.wifi::IWifi                                    u:object_r:hal_wifi_hwservice:s0
+android.hardware.wifi.hostapd::IHostapd                         u:object_r:hal_wifi_hostapd_hwservice:s0
 android.hardware.wifi.offload::IOffload                         u:object_r:hal_wifi_offload_hwservice:s0
 android.hardware.wifi.supplicant::ISupplicant                   u:object_r:hal_wifi_supplicant_hwservice:s0
 android.hidl.allocator::IAllocator                              u:object_r:hidl_allocator_hwservice:s0
diff --git a/private/system_server.te b/private/system_server.te
index 973b017ed2f74feefd5a69c9740fd5ac66377b1a..48ae95d58c163d9b4d5567fc421aa3361892f8d6 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -202,6 +202,7 @@ hal_client_domain(system_server, hal_vibrator)
 hal_client_domain(system_server, hal_vr)
 hal_client_domain(system_server, hal_weaver)
 hal_client_domain(system_server, hal_wifi)
+hal_client_domain(system_server, hal_wifi_hostapd)
 hal_client_domain(system_server, hal_wifi_offload)
 hal_client_domain(system_server, hal_wifi_supplicant)
 
diff --git a/public/attributes b/public/attributes
index c25f1ebc899ebfedbef86c0cb14ebed4624e4c9e..3c3af3c9aecbd46dff2bcd4473e40671cd1f0b32 100644
--- a/public/attributes
+++ b/public/attributes
@@ -233,6 +233,7 @@ hal_attribute(vibrator);
 hal_attribute(vr);
 hal_attribute(weaver);
 hal_attribute(wifi);
+hal_attribute(wifi_hostapd);
 hal_attribute(wifi_offload);
 hal_attribute(wifi_supplicant);
 
diff --git a/public/hal_neverallows.te b/public/hal_neverallows.te
index c866baeff9a8bff9821bb5a36be6ae0cefa6468a..1ab28c5d78511b4ffb990206c9af679792097ccd 100644
--- a/public/hal_neverallows.te
+++ b/public/hal_neverallows.te
@@ -4,6 +4,7 @@ neverallow {
   halserverdomain
   -hal_bluetooth_server
   -hal_wifi_server
+  -hal_wifi_hostapd_server
   -hal_wifi_supplicant_server
   -rild
 } self:global_capability_class_set { net_admin net_raw };
@@ -14,6 +15,7 @@ neverallow {
   halserverdomain
   -hal_tetheroffload_server
   -hal_wifi_server
+  -hal_wifi_hostapd_server
   -hal_wifi_supplicant_server
   -rild
 } domain:{ tcp_socket udp_socket rawip_socket } *;
diff --git a/public/hal_wifi_hostapd.te b/public/hal_wifi_hostapd.te
new file mode 100644
index 0000000000000000000000000000000000000000..03a554674d4c9277a54ba5f554c3969e70dcaa85
--- /dev/null
+++ b/public/hal_wifi_hostapd.te
@@ -0,0 +1,28 @@
+# HwBinder IPC from client to server
+binder_call(hal_wifi_hostapd_client, hal_wifi_hostapd_server)
+binder_call(hal_wifi_hostapd_server, hal_wifi_hostapd_client)
+
+add_hwservice(hal_wifi_hostapd_server, hal_wifi_hostapd_hwservice)
+allow hal_wifi_hostapd_client hal_wifi_hostapd_hwservice:hwservice_manager find;
+
+allow hal_wifi_hostapd_server self:global_capability_class_set { net_admin net_raw };
+
+allow hal_wifi_hostapd_server sysfs_net:dir search;
+
+# Allow hal_wifi_hostapd to access /proc/net/psched
+allow hal_wifi_hostapd_server proc_net:file { getattr open read };
+
+# Various socket permissions.
+allowxperm hal_wifi_hostapd_server self:udp_socket ioctl priv_sock_ioctls;
+allow hal_wifi_hostapd_server self:netlink_socket create_socket_perms_no_ioctl;
+allow hal_wifi_hostapd_server self:netlink_generic_socket create_socket_perms_no_ioctl;
+allow hal_wifi_hostapd_server self:packet_socket create_socket_perms_no_ioctl;
+allow hal_wifi_hostapd_server self:netlink_route_socket nlmsg_write;
+
+###
+### neverallow rules
+###
+
+# hal_wifi_hostapd should not trust any data from sdcards
+neverallow hal_wifi_hostapd_server sdcard_type:dir ~getattr;
+neverallow hal_wifi_hostapd_server sdcard_type:file *;
diff --git a/public/hwservice.te b/public/hwservice.te
index 19a72051b0cf5529f2903801532994795db826b6..6eb816e9d9c358f7ee3545bc561aa892fc9faf3d 100644
--- a/public/hwservice.te
+++ b/public/hwservice.te
@@ -41,6 +41,7 @@ type hal_vibrator_hwservice, hwservice_manager_type;
 type hal_vr_hwservice, hwservice_manager_type;
 type hal_weaver_hwservice, hwservice_manager_type;
 type hal_wifi_hwservice, hwservice_manager_type;
+type hal_wifi_hostapd_hwservice, hwservice_manager_type;
 type hal_wifi_offload_hwservice, hwservice_manager_type;
 type hal_wifi_supplicant_hwservice, hwservice_manager_type;
 type hidl_allocator_hwservice, hwservice_manager_type, coredomain_hwservice;
diff --git a/public/su.te b/public/su.te
index 88065f626485958e8dc73f5253b835cb1fbb377d..a893026b75139e72b88aa7bd1addf5265a68181b 100644
--- a/public/su.te
+++ b/public/su.te
@@ -91,6 +91,7 @@ userdebug_or_eng(`
   typeattribute su hal_vr_client;
   typeattribute su hal_weaver_client;
   typeattribute su hal_wifi_client;
+  typeattribute su hal_wifi_hostapd_client;
   typeattribute su hal_wifi_offload_client;
   typeattribute su hal_wifi_supplicant_client;
 ')
diff --git a/vendor/file.te b/vendor/file.te
index 3350b1e0b6badfdd70c716d39eb40acb1fb4fad8..50238acb0c9193b5046b794c65822405b8e6b829 100644
--- a/vendor/file.te
+++ b/vendor/file.te
@@ -1,2 +1,2 @@
-# Socket types
-type hostapd_socket, file_type, data_file_type;
+# Hostapd conf files
+type hostapd_data_file, file_type, data_file_type;
diff --git a/vendor/file_contexts b/vendor/file_contexts
index b6028f4054d202eed31ca819c14ebfd268ebde99..712e1d453acaa764a903a0b0258523baa6d7268a 100644
--- a/vendor/file_contexts
+++ b/vendor/file_contexts
@@ -38,8 +38,8 @@
 /(vendor|system/vendor)/bin/hw/android\.hardware\.vr@1\.0-service             u:object_r:hal_vr_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.wifi\.offload@1\.0-service  u:object_r:hal_wifi_offload_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.wifi@1\.0-service           u:object_r:hal_wifi_default_exec:s0
+/(vendor|system/vendor)/bin/hw/hostapd                                        u:object_r:hal_wifi_hostapd_default_exec:s0
 /(vendor|system/vendor)/bin/hw/wpa_supplicant                                 u:object_r:hal_wifi_supplicant_default_exec:s0
-/(vendor|system/vendor)/bin/hostapd                                           u:object_r:hostapd_exec:s0
 /(vendor|system/vendor)/bin/vndservicemanager                                 u:object_r:vndservicemanager_exec:s0
 
 #############################
@@ -52,4 +52,4 @@
 #############################
 # Data files
 #
-/data/misc/wifi/hostapd(/.*)?   u:object_r:hostapd_socket:s0
+/data/vendor/wifi/hostapd(/.*)?                                               u:object_r:hostapd_data_file:s0
diff --git a/vendor/hal_wifi_hostapd_default.te b/vendor/hal_wifi_hostapd_default.te
new file mode 100644
index 0000000000000000000000000000000000000000..5a3bbb6eed013b4f8fb5c5b2e897bac055eaa294
--- /dev/null
+++ b/vendor/hal_wifi_hostapd_default.te
@@ -0,0 +1,11 @@
+# hostapd or equivalent
+type hal_wifi_hostapd_default, domain;
+hal_server_domain(hal_wifi_hostapd_default, hal_wifi_hostapd)
+type hal_wifi_hostapd_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_wifi_hostapd_default)
+
+net_domain(hal_wifi_hostapd_default)
+
+# Allow hostapd to access it's data folder
+allow hal_wifi_hostapd_default hostapd_data_file:dir rw_dir_perms;
+allow hal_wifi_hostapd_default hostapd_data_file:file create_file_perms;
diff --git a/vendor/hostapd.te b/vendor/hostapd.te
deleted file mode 100644
index 9f99378219d04ac712193a86f8a616f6aa54fb62..0000000000000000000000000000000000000000
--- a/vendor/hostapd.te
+++ /dev/null
@@ -1,23 +0,0 @@
-# userspace wifi access points
-type hostapd, domain;
-type hostapd_exec, exec_type, vendor_file_type, file_type;
-
-init_daemon_domain(hostapd)
-
-net_domain(hostapd)
-allow hostapd self:global_capability_class_set { net_admin net_raw };
-
-# hostapd learns about its network interface via sysfs.
-allow hostapd sysfs:file r_file_perms;
-# hostapd follows the /sys/class/net/wlan0 link to the PCI device.
-allow hostapd sysfs:lnk_file r_file_perms;
-
-# Allow hostapd to access /proc/net/psched
-allow hostapd proc_net:file { getattr open read };
-
-# Various socket permissions.
-allowxperm hostapd self:udp_socket ioctl priv_sock_ioctls;
-allow hostapd self:netlink_socket create_socket_perms_no_ioctl;
-allow hostapd self:netlink_generic_socket create_socket_perms_no_ioctl;
-allow hostapd self:packet_socket create_socket_perms_no_ioctl;
-allow hostapd self:netlink_route_socket nlmsg_write;