diff --git a/Android.mk b/Android.mk
index 91d6303019dd5d7d692e4da0ab892cffd27cdc18..102b2b18840d99f78ff49415bb166c857bf736f9 100644
--- a/Android.mk
+++ b/Android.mk
@@ -5,7 +5,7 @@ include $(CLEAR_VARS)
 # SELinux policy version.
 # Must be <= /sys/fs/selinux/policyvers reported by the Android kernel.
 # Must be within the compatibility range reported by checkpolicy -V.
-POLICYVERS ?= 30
+POLICYVERS ?= 29
 
 MLS_SENS=1
 MLS_CATS=1024
diff --git a/ioctl_macros b/ioctl_macros
index c1af6b4cd331ca2eded6681773433776d0d4d574..e71e0ce5a764520820c4e67723dd1164ad45a137 100644
--- a/ioctl_macros
+++ b/ioctl_macros
@@ -5,16 +5,7 @@ define(`unpriv_sock_ioctls', `
 0x8900-0x8926 0x8928-0x89ff
 # all wireless extensions ioctls except get/set essid
 # IOCSIWESSID 0x8B1A SIOCGIWESSID 0x8B1B
-0x8B00-0x8B19 0x8B1C-0x8BFF
+0x8B00-0x8B09 0x8B1C-0x8BFF
 # commonly used TTY ioctls
 0x5411 0x5451
 }')
-
-# socket ioctls never allowed to unprivileged appss
-define(`priv_sock_ioctls', `
-{
-# Mac address SIOCGIFHWADDR
-0x8927
-# get/set essid IOCSIWESSID 0x8B1A SIOCGIWESSID 0x8B1B
-0x8B1A-0x8B1B
-}')
diff --git a/isolated_app.te b/isolated_app.te
index 1e40a7f57911a2f8f3f32d0fd712f1466f3d3438..2cf5578953386ce4f59dff4dfe4a568d2a742730 100644
--- a/isolated_app.te
+++ b/isolated_app.te
@@ -18,9 +18,6 @@ allow isolated_app app_data_file:file { read write getattr lock };
 allow isolated_app activity_service:service_manager find;
 allow isolated_app display_service:service_manager find;
 
-# only allow unprivileged socket ioctl commands
-allowxperm isolated_app self:{ rawip_socket tcp_socket udp_socket } ioctl unpriv_sock_ioctls;
-
 # Google Breakpad (crash reporter for Chrome) relies on ptrace
 # functionality. Without the ability to ptrace, the crash reporter
 # tool is broken.
@@ -50,7 +47,3 @@ neverallow isolated_app gpu_device:chr_file { rw_file_perms execute };
 # Do not allow isolated_app access to /cache
 neverallow isolated_app cache_file:dir ~{ r_dir_perms };
 neverallow isolated_app cache_file:file ~{ read getattr };
-
-# do not allow privileged socket ioctl commands
-neverallowxperm isolated_app self:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
-
diff --git a/untrusted_app.te b/untrusted_app.te
index 889658dd8e3b280bc2fc96a0d7cb3e256af078a3..9d80bd8eaca52c51de43008711434f62539dfb3f 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -85,9 +85,6 @@ allow untrusted_app radio_service:service_manager find;
 allow untrusted_app surfaceflinger_service:service_manager find;
 allow untrusted_app app_api_service:service_manager find;
 
-# only allow unprivileged socket ioctl commands
-allowxperm untrusted_app self:{ rawip_socket tcp_socket udp_socket } ioctl unpriv_sock_ioctls;
-
 # Allow GMS core to access perfprofd output, which is stored
 # in /data/misc/perfprofd/. GMS core will need to list all
 # data stored in that directory to process them one by one.
@@ -149,9 +146,6 @@ neverallow untrusted_app file_type:file link;
 # Do not allow untrusted_app to access network MAC address file
 neverallow untrusted_app sysfs_mac_address:file no_rw_file_perms;
 
-# do not allow privileged socket ioctl commands
-neverallowxperm untrusted_app self:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
-
 # Do not allow untrusted_app access to /cache
 neverallow untrusted_app cache_file:dir ~{ r_dir_perms };
 neverallow untrusted_app cache_file:file ~{ read getattr };