diff --git a/hostapd.te b/hostapd.te
index 0b58fcbbb4371b5774414a7c6ad16ff8f2694bf2..41f429aeb22002af2a4ff94f9e92f070febd5c75 100644
--- a/hostapd.te
+++ b/hostapd.te
@@ -25,8 +25,7 @@ allow hostapd self:netlink_route_socket nlmsg_write;
 allow hostapd wifi_data_file:file rw_file_perms;
 r_dir_file(hostapd, wifi_data_file)
 
-# hostapd needs to bind to (and possibly create) its control interface socket.
-allow hostapd hostapd_socket:dir rw_dir_perms;
-# hostapd likes to chmod its socket directory.
-allow hostapd hostapd_socket:dir setattr;
+# hostapd wants to create the directory holding its control socket.
+allow hostapd hostapd_socket:dir create_dir_perms;
+# hostapd needs to create, bind to, read, and write its control socket.
 allow hostapd hostapd_socket:sock_file create_file_perms;