diff --git a/private/netutils_wrapper.te b/private/netutils_wrapper.te
index 9a5697e..f56e8d8 100644
--- a/private/netutils_wrapper.te
+++ b/private/netutils_wrapper.te
@@ -18,6 +18,13 @@
 allow netutils_wrapper netd_socket:sock_file { open getattr read write append };
 allow netutils_wrapper netd:unix_stream_socket { read getattr connectto };
 
+# For vendor code that update the iptables rules at runtime. They need to reload
+# the whole chain including the xt_bpf rules. They need to access to the pinned
+# program when reloading the rule.
+allow netutils_wrapper fs_bpf:dir search;
+allow netutils_wrapper fs_bpf:file { read write };
+allow netutils_wrapper bpfloader:bpf prog_run;
+
 # For /data/misc/net access to ndc and ip
 r_dir_file(netutils_wrapper, net_data_file)