diff --git a/sepolicy/netmgrd.te b/sepolicy/netmgrd.te
index 90f68f2..7bec8bd 100644
--- a/sepolicy/netmgrd.te
+++ b/sepolicy/netmgrd.te
@@ -20,8 +20,12 @@
 # Talk to qmuxd (qmux_radio)
 qmux_socket(netmgrd)
 
+# Runs commands via sh.
+# TODO:  Convert to direct exec of /system/bin/ip and any other helpers.
+allow netmgrd shell_exec:file rx_file_perms;
+
 # Runs /system/bin/ip addr flush dev <device> commands.
-allow netmgrd system_file:file execute_no_trans;
+allow netmgrd system_file:file rx_file_perms;
 
 # set net.rmnet* properties.
 unix_socket_connect(netmgrd, property, init)