diff --git a/app.te b/app.te
index 7364d24513c09bd29c187530c065a1dd10ae51f9..dc99f1fc6d685fddfb82502b0b880e644d302d9e 100644
--- a/app.te
+++ b/app.te
@@ -205,6 +205,9 @@ use_keystore({ appdomain -isolated_app })
 
 allow appdomain console_device:chr_file { read write };
 
+# only allow unprivileged socket ioctl commands
+allowxperm { appdomain -bluetooth } self:{ rawip_socket tcp_socket udp_socket } ioctl unpriv_sock_ioctls;
+
 ###
 ### CTS-specific rules
 ###
diff --git a/isolated_app.te b/isolated_app.te
index c155b12b741cd0fd5a1b47215bb05f434957fd99..ff9b525d63bae60b55c598f50afdd71a5844f79f 100644
--- a/isolated_app.te
+++ b/isolated_app.te
@@ -18,9 +18,6 @@ allow isolated_app app_data_file:file { read write getattr lock };
 allow isolated_app activity_service:service_manager find;
 allow isolated_app display_service:service_manager find;
 
-# only allow unprivileged socket ioctl commands
-allowxperm isolated_app self:{ rawip_socket tcp_socket udp_socket } ioctl unpriv_sock_ioctls;
-
 # Google Breakpad (crash reporter for Chrome) relies on ptrace
 # functionality. Without the ability to ptrace, the crash reporter
 # tool is broken.
diff --git a/priv_app.te b/priv_app.te
index 4a25787ab3f7163baec048c75d7da12555ef82e6..27551d0dc513494c9736d9aa89eddf34ac7339af 100644
--- a/priv_app.te
+++ b/priv_app.te
@@ -77,6 +77,9 @@ allow priv_app fuse_device:chr_file { read write };
 allow priv_app sysfs_zram:dir search;
 allow priv_app sysfs_zram:file r_file_perms;
 
+# access the mac address
+allowxperm priv_app self:udp_socket ioctl SIOCGIFHWADDR;
+
 ###
 ### neverallow rules
 ###
diff --git a/untrusted_app.te b/untrusted_app.te
index 21da4ef616808b2fbb906b698847344fd50f1bf3..0aca8b0f8474c57194ea46d712666f69f1fc0d2a 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -80,9 +80,6 @@ allow untrusted_app radio_service:service_manager find;
 allow untrusted_app surfaceflinger_service:service_manager find;
 allow untrusted_app app_api_service:service_manager find;
 
-# only allow unprivileged socket ioctl commands
-allowxperm untrusted_app self:{ rawip_socket tcp_socket udp_socket } ioctl unpriv_sock_ioctls;
-
 # Allow GMS core to access perfprofd output, which is stored
 # in /data/misc/perfprofd/. GMS core will need to list all
 # data stored in that directory to process them one by one.