diff --git a/private/vmnic.te b/private/vmnic.te
index da1aebb..1b7e0d8 100644
--- a/private/vmnic.te
+++ b/private/vmnic.te
@@ -13,13 +13,13 @@
     # Let the vmnic domain use Binder.
     binder_use(vmnic)
 
-    # Allow for creating TAP network interfaces.
+    # Allow for creating and deleting TAP network interfaces.
     allow vmnic self:global_capability_class_set net_admin;
     allow vmnic self:tun_socket create_socket_perms_no_ioctl;
     allow vmnic tun_device:chr_file rw_file_perms;
-    allowxperm vmnic tun_device:chr_file ioctl { TUNSETIFF TUNSETPERSIST };
+    allowxperm vmnic tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF TUNSETPERSIST };
     allow vmnic self:udp_socket create_socket_perms;
-    allowxperm vmnic self:udp_socket ioctl { SIOCGIFFLAGS SIOCSIFFLAGS };
+    allowxperm vmnic self:udp_socket ioctl SIOCSIFFLAGS;
 
     # Only virtualizationservice can communicate to vmnic
     neverallow { domain -virtualizationservice -servicemanager } vmnic:binder call;