diff --git a/diagnosticstool/diagnosticstool.mk b/diagnosticstool/diagnosticstool.mk
new file mode 100644
index 0000000..67fbd88
--- /dev/null
+++ b/diagnosticstool/diagnosticstool.mk
@@ -0,0 +1 @@
+PRODUCT_PRIVATE_SEPOLICY_DIRS += device/google/gs-common/diagnosticstool/sepolicy
diff --git a/diagnosticstool/sepolicy/diagnosticstool_app.te b/diagnosticstool/sepolicy/diagnosticstool_app.te
new file mode 100644
index 0000000..d1874e6
--- /dev/null
+++ b/diagnosticstool/sepolicy/diagnosticstool_app.te
@@ -0,0 +1,4 @@
+type diagnosticstool_app, domain;
+app_domain(diagnosticstool_app)
+
+allow diagnosticstool_app app_api_service:service_manager find;
diff --git a/diagnosticstool/sepolicy/seapp_contexts b/diagnosticstool/sepolicy/seapp_contexts
new file mode 100644
index 0000000..3c601cd
--- /dev/null
+++ b/diagnosticstool/sepolicy/seapp_contexts
@@ -0,0 +1,2 @@
+# Diagnostics Tool
+user=_app seinfo=platform name=com.google.android.apps.diagnosticstool domain=diagnosticstool_app isPrivApp=true levelFrom=user
diff --git a/modem/radio_ext/compatibility_matrix.xml b/modem/radio_ext/compatibility_matrix.xml
new file mode 100644
index 0000000..1e4def5
--- /dev/null
+++ b/modem/radio_ext/compatibility_matrix.xml
@@ -0,0 +1,10 @@
+<compatibility-matrix version="1.0" type="framework">
+    <hal format="aidl" optional="true">
+        <name>vendor.google.radio_ext</name>
+        <version>1</version>
+        <interface>
+            <name>IRadioExt</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</compatibility-matrix>
diff --git a/modem/radio_ext/radio_ext.mk b/modem/radio_ext/radio_ext.mk
new file mode 100644
index 0000000..6750fdd
--- /dev/null
+++ b/modem/radio_ext/radio_ext.mk
@@ -0,0 +1,5 @@
+PRODUCT_SOONG_NAMESPACES += vendor/google/interfaces
+PRODUCT_PACKAGES += vendor.google.radio_ext-service
+DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += device/google/gs-common/modem/radio_ext/compatibility_matrix.xml
+
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/modem/radio_ext/sepolicy
diff --git a/modem/radio_ext/sepolicy/file_contexts b/modem/radio_ext/sepolicy/file_contexts
new file mode 100644
index 0000000..cd4172c
--- /dev/null
+++ b/modem/radio_ext/sepolicy/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/hw/vendor\.google\.radio_ext-service              u:object_r:hal_radio_ext_exec:s0
diff --git a/modem/radio_ext/sepolicy/hal_radio_ext.te b/modem/radio_ext/sepolicy/hal_radio_ext.te
new file mode 100644
index 0000000..203ae3b
--- /dev/null
+++ b/modem/radio_ext/sepolicy/hal_radio_ext.te
@@ -0,0 +1,11 @@
+type hal_radio_ext, domain;
+type hal_radio_ext_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(hal_radio_ext)
+
+binder_call(hal_radio_ext, servicemanager)
+add_service(hal_radio_ext, hal_radio_ext_service)
+
+# Allow access to the backlight driver to set ssc_mode
+allow hal_radio_ext sysfs_leds:dir search;
+allow hal_radio_ext sysfs_leds:file rw_file_perms;
diff --git a/modem/radio_ext/sepolicy/service.te b/modem/radio_ext/sepolicy/service.te
new file mode 100644
index 0000000..7288ef1
--- /dev/null
+++ b/modem/radio_ext/sepolicy/service.te
@@ -0,0 +1,2 @@
+# Radio Ext AIDL service
+type hal_radio_ext_service, hal_service_type, protected_service, service_manager_type;
diff --git a/modem/radio_ext/sepolicy/service_contexts b/modem/radio_ext/sepolicy/service_contexts
new file mode 100644
index 0000000..7e50c2e
--- /dev/null
+++ b/modem/radio_ext/sepolicy/service_contexts
@@ -0,0 +1 @@
+vendor.google.radio_ext.IRadioExt/default                 u:object_r:hal_radio_ext_service:s0