hook up traditional dbus activation On systems using systemd dbus will use the SystemdServices= directive, but on non-systemd systems the so called "traditional dbus activation" method involves reading the Exec= directive. Setting that to /bin/false means this service is not relevant on non-systemd systems, but apparently there's an interest from users of such systems to use iwd (and possibly ead). Thus hook up the expansion of the paths in the Exec= directive of the dbus service files to allow the traditional dbus activation to start respective daemon.
Switch wheel to netdev group in dbus policy In Debian there's a specific dedicated group that is supposed to give permission to manage the network, called netdev. Thus replace the generic, and in debian not very widely used, wheel group in the default policy.
ap: only accept ptk 4/4 after receiving ptk 2/4 When operating as an AP, drop message 4 of the 4-way handshake if the AP has not yet received message 2. Otherwise an attacker can skip message 2 and immediately send message 4 to bypass authentication (the AP would be using an all-zero ptk to verify the authenticity of message 4).
