Move slider-sepolicy into gs101-sepolicy
from: 71e609c24c97fc8d44843af30527cbeb90d5dcdf
Bug: 167996145
Change-Id: Ie00e7e0983a3ca695bbd5140c929d07a80144301
diff --git a/OWNERS b/OWNERS
index 33a2925..a24d5fb 100644
--- a/OWNERS
+++ b/OWNERS
@@ -1,3 +1,11 @@
-aaronding@google.com
-robinpeng@google.com
-lucaswei@google.com
+adamshih@google.com
+alanstokes@google.com
+bowgotsai@google.com
+jbires@google.com
+jeffv@google.com
+jgalenson@google.com
+jiyong@google.com
+rurumihong@google.com
+sspatil@google.com
+smoreland@google.com
+trong@google.com
diff --git a/ambient/exo_app.te b/ambient/exo_app.te
new file mode 100644
index 0000000..a66e941
--- /dev/null
+++ b/ambient/exo_app.te
@@ -0,0 +1,11 @@
+type exo_app, domain;
+
+app_domain(exo_app)
+
+allow exo_app app_api_service:service_manager find;
+allow exo_app audioserver_service:service_manager find;
+allow exo_app cameraserver_service:service_manager find;
+allow exo_app mediaserver_service:service_manager find;
+allow exo_app radio_service:service_manager find;
+allow exo_app fwk_stats_hwservice:hwservice_manager find;
+binder_call(exo_app, statsd)
diff --git a/ambient/exo_wirecutter_app.te b/ambient/exo_wirecutter_app.te
new file mode 100644
index 0000000..c8b63b8
--- /dev/null
+++ b/ambient/exo_wirecutter_app.te
@@ -0,0 +1,7 @@
+type exo_wirecutter_app, domain;
+
+app_domain(exo_wirecutter_app)
+
+allow exo_wirecutter_app app_api_service:service_manager find;
+allow exo_wirecutter_app fwk_stats_hwservice:hwservice_manager find;
+binder_call(exo_wirecutter_app, statsd)
diff --git a/ambient/keys.conf b/ambient/keys.conf
new file mode 100644
index 0000000..9be4f7f
--- /dev/null
+++ b/ambient/keys.conf
@@ -0,0 +1,2 @@
+[@EXO_WIRECUTTER]
+ALL : vendor/google/dev-keystore/certs/com_google_pixel_wirecutter/com_google_pixel_wirecutter.x509.pem
diff --git a/ambient/mac_permissions.xml b/ambient/mac_permissions.xml
new file mode 100644
index 0000000..d1ba106
--- /dev/null
+++ b/ambient/mac_permissions.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<policy>
+
+<!--
+
+ * A signature is a hex encoded X.509 certificate or a tag defined in
+ keys.conf and is required for each signer tag.
+ * A signer tag may contain a seinfo tag and multiple package stanzas.
+ * A default tag is allowed that can contain policy for all apps not signed with a
+ previously listed cert. It may not contain any inner package stanzas.
+ * Each signer/default/package tag is allowed to contain one seinfo tag. This tag
+ represents additional info that each app can use in setting a SELinux security
+ context on the eventual process.
+ * When a package is installed the following logic is used to determine what seinfo
+ value, if any, is assigned.
+ - All signatures used to sign the app are checked first.
+ - If a signer stanza has inner package stanzas, those stanza will be checked
+ to try and match the package name of the app. If the package name matches
+ then that seinfo tag is used. If no inner package matches then the outer
+ seinfo tag is assigned.
+ - The default tag is consulted last if needed.
+-->
+ <signer signature="@EXO_WIRECUTTER" >
+ <seinfo value="wirecutter" />
+ </signer>
+</policy>
diff --git a/ambient/seapp_contexts b/ambient/seapp_contexts
new file mode 100644
index 0000000..2bfdde8
--- /dev/null
+++ b/ambient/seapp_contexts
@@ -0,0 +1,5 @@
+# Domain for Exo app
+user=_app isPrivApp=true seinfo=platform name=com.google.pixel.exo domain=exo_app type=app_data_file levelFrom=all
+
+# Domain for Exo Wirecutter app
+user=_app seinfo=wirecutter name=com.google.pixel.wirecutter domain=exo_wirecutter_app type=app_data_file levelFrom=all
diff --git a/display/common/file.te b/display/common/file.te
new file mode 100644
index 0000000..3734e33
--- /dev/null
+++ b/display/common/file.te
@@ -0,0 +1 @@
+type persist_display_file, file_type, vendor_persist_type;
diff --git a/display/common/file_contexts b/display/common/file_contexts
new file mode 100644
index 0000000..bca7746
--- /dev/null
+++ b/display/common/file_contexts
@@ -0,0 +1 @@
+/mnt/vendor/persist/display(/.*)? u:object_r:persist_display_file:s0
diff --git a/display/gs101/genfs_contexts b/display/gs101/genfs_contexts
new file mode 100644
index 0000000..1bc6f30
--- /dev/null
+++ b/display/gs101/genfs_contexts
@@ -0,0 +1,11 @@
+genfscon sysfs /devices/platform/1c2c0000.drmdsim/1c2c0000.drmdsim.0/backlight u:object_r:sysfs_leds:s0
+genfscon sysfs /devices/platform/1c2c0000.drmdsim/1c2c0000.drmdsim.0/panel_name u:object_r:sysfs_display:s0
+genfscon sysfs /devices/platform/1c2c0000.drmdsim/1c2c0000.drmdsim.0/serial_number u:object_r:sysfs_display:s0
+genfscon sysfs /firmware/devicetree/base/drmdsim@0x1C2C0000/panel@0/compatible u:object_r:sysfs_display:s0
+
+genfscon sysfs /devices/platform/1c2d0000.drmdsim/1c2d0000.drmdsim.0/backlight u:object_r:sysfs_leds:s0
+genfscon sysfs /devices/platform/1c2d0000.drmdsim/1c2d0000.drmdsim.0/panel_name u:object_r:sysfs_display:s0
+genfscon sysfs /devices/platform/1c2d0000.drmdsim/1c2d0000.drmdsim.0/serial_number u:object_r:sysfs_display:s0
+genfscon sysfs /firmware/devicetree/base/drmdsim@0x1C2D0000/panel@0/compatible u:object_r:sysfs_display:s0
+
+genfscon sysfs /module/drm/parameters/vblankoffdelay u:object_r:sysfs_display:s0
diff --git a/display/gs101/hal_graphics_composer_default.te b/display/gs101/hal_graphics_composer_default.te
new file mode 100644
index 0000000..5a60781
--- /dev/null
+++ b/display/gs101/hal_graphics_composer_default.te
@@ -0,0 +1,34 @@
+allow hal_graphics_composer_default video_device:chr_file rw_file_perms;
+add_service(hal_graphics_composer_default, vendor_surfaceflinger_vndservice)
+hal_client_domain(hal_graphics_composer_default, hal_graphics_allocator)
+allow hal_graphics_composer_default self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+vndbinder_use(hal_graphics_composer_default)
+
+userdebug_or_eng(`
+ allow hal_graphics_composer_default vendor_log_file:dir create_dir_perms;
+
+ # For HWC/libdisplaycolor to generate calibration file.
+ allow hal_graphics_composer_default persist_display_file:file create_file_perms;
+ allow hal_graphics_composer_default persist_display_file:dir rw_dir_perms;
+')
+
+# allow HWC/libdisplaycolor to read calibration data
+allow hal_graphics_composer_default mnt_vendor_file:dir search;
+allow hal_graphics_composer_default persist_file:dir search;
+allow hal_graphics_composer_default persist_display_file:file r_file_perms;
+
+# allow HWC to r/w backlight
+allow hal_graphics_composer_default sysfs_leds:dir r_dir_perms;
+allow hal_graphics_composer_default sysfs_leds:file rw_file_perms;
+
+# allow HWC to get vendor_persist_sys_default_prop
+get_prop(hal_graphics_composer_default, vendor_persist_sys_default_prop)
+
+# allow HWC to get vendor_display_prop
+get_prop(hal_graphics_composer_default, vendor_display_prop)
+
+# allow HWC to access vendor_displaycolor_service
+add_service(hal_graphics_composer_default, vendor_displaycolor_service)
+
+add_service(hal_graphics_composer_default, hal_pixel_display_service)
+binder_use(hal_graphics_composer_default)
diff --git a/gs101-sepolicy.mk b/gs101-sepolicy.mk
new file mode 100644
index 0000000..c08b802
--- /dev/null
+++ b/gs101-sepolicy.mk
@@ -0,0 +1,23 @@
+# sepolicy that are shared among devices using whitechapel
+BOARD_SEPOLICY_DIRS += device/google/gs101-sepolicy/whitechapel/vendor/google
+
+# unresolved SELinux error log with bug tracking
+BOARD_SEPOLICY_DIRS += device/google/gs101-sepolicy/tracking_denials
+
+PRODUCT_PRIVATE_SEPOLICY_DIRS += device/google/gs101-sepolicy/private
+
+#
+# Pixel-wide
+#
+# Dauntless (uses Citadel policy currently)
+BOARD_SEPOLICY_DIRS += hardware/google/pixel-sepolicy/citadel
+
+# Wifi
+BOARD_SEPOLICY_DIRS += hardware/google/pixel-sepolicy/wifi_ext
+
+# PowerStats HAL
+BOARD_SEPOLICY_DIRS += hardware/google/pixel-sepolicy/powerstats
+
+# Display
+BOARD_SEPOLICY_DIRS += device/google/gs101-sepolicy/display/common
+BOARD_SEPOLICY_DIRS += device/google/gs101-sepolicy/display/gs101
diff --git a/private/gmscore_app.te b/private/gmscore_app.te
new file mode 100644
index 0000000..fa20f24
--- /dev/null
+++ b/private/gmscore_app.te
@@ -0,0 +1,2 @@
+# b/177389198
+dontaudit gmscore_app adbd_prop:file *;
diff --git a/private/hal_dumpstate_default.te b/private/hal_dumpstate_default.te
new file mode 100644
index 0000000..83c7568
--- /dev/null
+++ b/private/hal_dumpstate_default.te
@@ -0,0 +1,2 @@
+# b/176868217
+dontaudit hal_dumpstate adbd_prop:file *;
diff --git a/private/hal_vibrator_default.te b/private/hal_vibrator_default.te
new file mode 100644
index 0000000..f565173
--- /dev/null
+++ b/private/hal_vibrator_default.te
@@ -0,0 +1,2 @@
+# b/177176811
+dontaudit hal_vibrator adbd_prop:file *;
diff --git a/private/incidentd.te b/private/incidentd.te
new file mode 100644
index 0000000..1557f06
--- /dev/null
+++ b/private/incidentd.te
@@ -0,0 +1,14 @@
+# b/174961589
+dontaudit incidentd adbd_config_prop:file open ;
+dontaudit incidentd adbd_prop:file getattr ;
+dontaudit incidentd adbd_prop:file open ;
+dontaudit incidentd adbd_config_prop:file open ;
+dontaudit incidentd adbd_config_prop:file getattr ;
+dontaudit incidentd adbd_config_prop:file map ;
+dontaudit incidentd adbd_prop:file open ;
+dontaudit incidentd adbd_prop:file getattr ;
+dontaudit incidentd adbd_prop:file map ;
+dontaudit incidentd apexd_prop:file open ;
+dontaudit incidentd adbd_config_prop:file getattr ;
+dontaudit incidentd adbd_config_prop:file map ;
+dontaudit incidentd adbd_prop:file map ;
diff --git a/private/lpdumpd.te b/private/lpdumpd.te
new file mode 100644
index 0000000..86a101c
--- /dev/null
+++ b/private/lpdumpd.te
@@ -0,0 +1,7 @@
+# b/177176997
+dontaudit lpdumpd block_device:blk_file getattr ;
+dontaudit lpdumpd block_device:blk_file getattr ;
+dontaudit lpdumpd block_device:blk_file read ;
+dontaudit lpdumpd block_device:blk_file getattr ;
+dontaudit lpdumpd block_device:blk_file read ;
+dontaudit lpdumpd block_device:blk_file read ;
diff --git a/private/priv_app.te b/private/priv_app.te
new file mode 100644
index 0000000..2ef1f96
--- /dev/null
+++ b/private/priv_app.te
@@ -0,0 +1,19 @@
+# b/178433525
+dontaudit priv_app adbd_prop:file { map };
+dontaudit priv_app adbd_prop:file { getattr };
+dontaudit priv_app adbd_prop:file { open };
+dontaudit priv_app ab_update_gki_prop:file { map };
+dontaudit priv_app ab_update_gki_prop:file { getattr };
+dontaudit priv_app ab_update_gki_prop:file { open };
+dontaudit priv_app aac_drc_prop:file { map };
+dontaudit priv_app aac_drc_prop:file { getattr };
+dontaudit priv_app aac_drc_prop:file { open };
+dontaudit priv_app adbd_prop:file { map };
+dontaudit priv_app aac_drc_prop:file { open };
+dontaudit priv_app aac_drc_prop:file { getattr };
+dontaudit priv_app aac_drc_prop:file { map };
+dontaudit priv_app ab_update_gki_prop:file { open };
+dontaudit priv_app ab_update_gki_prop:file { getattr };
+dontaudit priv_app ab_update_gki_prop:file { map };
+dontaudit priv_app adbd_prop:file { open };
+dontaudit priv_app adbd_prop:file { getattr };
diff --git a/private/radio.te b/private/radio.te
new file mode 100644
index 0000000..a569b9c
--- /dev/null
+++ b/private/radio.te
@@ -0,0 +1 @@
+add_service(radio, uce_service)
diff --git a/private/service_contexts b/private/service_contexts
new file mode 100644
index 0000000..8877518
--- /dev/null
+++ b/private/service_contexts
@@ -0,0 +1 @@
+telephony.oem.oemrilhook u:object_r:radio_service:s0
diff --git a/private/untrusted_app_25.te b/private/untrusted_app_25.te
new file mode 100644
index 0000000..f26e081
--- /dev/null
+++ b/private/untrusted_app_25.te
@@ -0,0 +1,2 @@
+# b/177389321
+dontaudit untrusted_app_25 adbd_prop:file *;
diff --git a/tracking_denials/aocd.te b/tracking_denials/aocd.te
new file mode 100644
index 0000000..35c47c5
--- /dev/null
+++ b/tracking_denials/aocd.te
@@ -0,0 +1,2 @@
+# b/171267323
+dontaudit aocd device:dir r_dir_perms;
diff --git a/tracking_denials/bootanim.te b/tracking_denials/bootanim.te
new file mode 100644
index 0000000..2be251e
--- /dev/null
+++ b/tracking_denials/bootanim.te
@@ -0,0 +1,5 @@
+# b/180567480
+dontaudit bootanim traced_producer_socket:sock_file { write };
+dontaudit bootanim traced:unix_stream_socket { connectto };
+dontaudit bootanim traced:unix_stream_socket { connectto };
+dontaudit bootanim traced_producer_socket:sock_file { write };
diff --git a/tracking_denials/cbd.te b/tracking_denials/cbd.te
new file mode 100644
index 0000000..7cd0342
--- /dev/null
+++ b/tracking_denials/cbd.te
@@ -0,0 +1,51 @@
+# b/171267363
+dontaudit cbd cbd:capability {setuid };
+dontaudit cbd proc_cmdline:file {open };
+dontaudit cbd persist_file:dir {search };
+dontaudit cbd init:unix_stream_socket {connectto };
+dontaudit cbd proc_cmdline:file {read };
+dontaudit cbd kernel:system {syslog_read };
+# b/173971138
+dontaudit cbd radio_prop:file { map };
+dontaudit cbd radio_prop:file { open };
+dontaudit cbd radio_prop:file { read };
+dontaudit cbd radio_prop:file { open };
+dontaudit cbd radio_prop:file { map };
+dontaudit cbd radio_prop:file { read };
+dontaudit cbd radio_prop:file { getattr };
+dontaudit cbd radio_prop:file { getattr };
+# b/178331928
+dontaudit cbd mnt_vendor_file:dir { search };
+dontaudit cbd mnt_vendor_file:dir { search };
+# b/178979986
+dontaudit cbd unlabeled:dir { getattr };
+dontaudit cbd unlabeled:file { open };
+dontaudit cbd unlabeled:file { read };
+dontaudit cbd unlabeled:file { getattr };
+dontaudit cbd unlabeled:lnk_file { read };
+dontaudit cbd unlabeled:dir { search };
+dontaudit cbd unlabeled:file { getattr };
+dontaudit cbd unlabeled:dir { getattr };
+dontaudit cbd unlabeled:lnk_file { read };
+dontaudit cbd unlabeled:dir { search };
+dontaudit cbd unlabeled:file { read };
+dontaudit cbd unlabeled:file { open };
+# b/179198083
+dontaudit cbd radio_vendor_data_file:dir { search };
+dontaudit cbd radio_vendor_data_file:dir { write };
+dontaudit cbd radio_vendor_data_file:dir { add_name };
+dontaudit cbd radio_vendor_data_file:file { create };
+dontaudit cbd radio_vendor_data_file:file { write };
+dontaudit cbd radio_vendor_data_file:file { open };
+dontaudit cbd unlabeled:file { ioctl };
+dontaudit cbd radio_vendor_data_file:file { open };
+dontaudit cbd radio_vendor_data_file:file { read };
+dontaudit cbd radio_vendor_data_file:dir { search };
+dontaudit cbd unlabeled:file { ioctl };
+dontaudit cbd radio_vendor_data_file:file { open };
+dontaudit cbd radio_vendor_data_file:file { read };
+dontaudit cbd radio_vendor_data_file:file { write };
+dontaudit cbd radio_vendor_data_file:file { create };
+dontaudit cbd radio_vendor_data_file:dir { add_name };
+dontaudit cbd radio_vendor_data_file:dir { search };
+dontaudit cbd radio_vendor_data_file:dir { write };
diff --git a/tracking_denials/dumpstate.te b/tracking_denials/dumpstate.te
new file mode 100644
index 0000000..6c6d8ec
--- /dev/null
+++ b/tracking_denials/dumpstate.te
@@ -0,0 +1,35 @@
+# ag/13067824
+dontaudit dumpstate fuse:dir r_dir_perms;
+# b/174618507
+dontaudit dumpstate default_android_service:service_manager { find };
+dontaudit dumpstate vold:binder { call };
+dontaudit dumpstate modem_userdata_file:dir { getattr };
+dontaudit dumpstate modem_efs_file:dir { getattr };
+dontaudit dumpstate vold:binder { call };
+dontaudit dumpstate modem_userdata_file:dir { getattr };
+dontaudit dumpstate hal_drm_clearkey:process { signal };
+dontaudit dumpstate hal_drm_clearkey:process { signal };
+dontaudit dumpstate modem_efs_file:dir { getattr };
+# b/177778645
+dontaudit dumpstate ramdump_vendor_mnt_file:filesystem { getattr };
+dontaudit dumpstate ramdump_vendor_mnt_file:filesystem { getattr };
+dontaudit dumpstate ramdump_vendor_mnt_file:dir { getattr };
+dontaudit dumpstate ramdump_vendor_mnt_file:dir { getattr };
+# b/177860804
+dontaudit dumpstate incident:process { sigkill };
+dontaudit dumpstate incident:process { signal };
+dontaudit dumpstate incident:process { sigkill };
+dontaudit dumpstate incident:process { signal };
+# b/179310854
+dontaudit dumpstate unlabeled:dir { getattr };
+dontaudit dumpstate unlabeled:dir { getattr };
+# b/180963249
+dontaudit dumpstate hal_neuralnetworks_armnn:process { signal };
+dontaudit dumpstate hal_neuralnetworks_armnn:process { signal };
+# b/181915316
+dontaudit dumpstate vendor_dmabuf_debugfs:file { read };
+dontaudit dumpstate vendor_dmabuf_debugfs:file { open };
+dontaudit dumpstate vendor_dmabuf_debugfs:file { getattr };
+dontaudit dumpstate vendor_dmabuf_debugfs:file { getattr };
+dontaudit dumpstate vendor_dmabuf_debugfs:file { read };
+dontaudit dumpstate vendor_dmabuf_debugfs:file { open };
diff --git a/tracking_denials/gmscore_app.te b/tracking_denials/gmscore_app.te
new file mode 100644
index 0000000..2ace5b7
--- /dev/null
+++ b/tracking_denials/gmscore_app.te
@@ -0,0 +1,67 @@
+# b/177389198
+dontaudit gmscore_app aac_drc_prop:file { open };
+dontaudit gmscore_app ab_update_gki_prop:file { map };
+dontaudit gmscore_app ab_update_gki_prop:file { getattr };
+dontaudit gmscore_app aac_drc_prop:file { map };
+dontaudit gmscore_app ab_update_gki_prop:file { open };
+dontaudit gmscore_app aac_drc_prop:file { getattr };
+# b/177860960
+dontaudit gmscore_app hal_memtrack_default:binder { call };
+dontaudit gmscore_app hal_memtrack_default:binder { call };
+dontaudit gmscore_app hal_memtrack_default:binder { call };
+dontaudit gmscore_app hal_memtrack_default:binder { call };
+dontaudit gmscore_app hal_memtrack_default:binder { call };
+dontaudit gmscore_app hal_memtrack_default:binder { call };
+dontaudit gmscore_app hal_memtrack_default:binder { call };
+# b/178752576
+dontaudit gmscore_app apexd_prop:file { open };
+dontaudit gmscore_app ramdump_vendor_mnt_file:filesystem { getattr };
+dontaudit gmscore_app apexd_prop:file { getattr };
+dontaudit gmscore_app apexd_prop:file { map };
+dontaudit gmscore_app ramdump_vendor_mnt_file:filesystem { getattr };
+dontaudit gmscore_app ramdump_vendor_mnt_file:filesystem { getattr };
+# b/178753472
+dontaudit gmscore_app audio_config_prop:file { getattr };
+dontaudit gmscore_app apk_verity_prop:file { map };
+dontaudit gmscore_app apk_verity_prop:file { getattr };
+dontaudit gmscore_app apk_verity_prop:file { open };
+dontaudit gmscore_app audio_config_prop:file { open };
+# b/179310892
+dontaudit gmscore_app bluetooth_a2dp_offload_prop:file { map };
+dontaudit gmscore_app bluetooth_a2dp_offload_prop:file { open };
+dontaudit gmscore_app bluetooth_prop:file { getattr };
+dontaudit gmscore_app audio_config_prop:file { map };
+dontaudit gmscore_app bluetooth_audio_hal_prop:file { open };
+dontaudit gmscore_app bluetooth_audio_hal_prop:file { getattr };
+dontaudit gmscore_app bluetooth_audio_hal_prop:file { map };
+dontaudit gmscore_app bluetooth_prop:file { open };
+dontaudit gmscore_app bluetooth_a2dp_offload_prop:file { getattr };
+# b/179437292
+dontaudit gmscore_app bootloader_boot_reason_prop:file { getattr };
+dontaudit gmscore_app bluetooth_prop:file { map };
+dontaudit gmscore_app bootloader_boot_reason_prop:file { open };
+dontaudit gmscore_app boottime_prop:file { open };
+dontaudit gmscore_app bootloader_boot_reason_prop:file { map };
+# b/179437988
+dontaudit gmscore_app bluetooth_prop:file { map };
+dontaudit gmscore_app bootloader_boot_reason_prop:file { open };
+dontaudit gmscore_app bootloader_boot_reason_prop:file { getattr };
+dontaudit gmscore_app bootloader_boot_reason_prop:file { map };
+dontaudit gmscore_app boottime_prop:file { open };
+dontaudit gmscore_app boottime_prop:file { getattr };
+dontaudit gmscore_app boottime_prop:file { map };
+dontaudit gmscore_app boottime_public_prop:file { open };
+dontaudit gmscore_app boottime_public_prop:file { getattr };
+# b/180656125
+dontaudit gmscore_app boottime_public_prop:file { map };
+dontaudit gmscore_app build_bootimage_prop:file { open };
+dontaudit gmscore_app bpf_progs_loaded_prop:file { map };
+dontaudit gmscore_app bpf_progs_loaded_prop:file { getattr };
+dontaudit gmscore_app bpf_progs_loaded_prop:file { open };
+dontaudit gmscore_app build_bootimage_prop:file { open };
+dontaudit gmscore_app boottime_public_prop:file { map };
+dontaudit gmscore_app bpf_progs_loaded_prop:file { map };
+dontaudit gmscore_app bpf_progs_loaded_prop:file { getattr };
+dontaudit gmscore_app bpf_progs_loaded_prop:file { open };
+# b/180960879
+dontaudit gmscore_app property_type:file *;
diff --git a/tracking_denials/gpsd.te b/tracking_denials/gpsd.te
new file mode 100644
index 0000000..fe55439
--- /dev/null
+++ b/tracking_denials/gpsd.te
@@ -0,0 +1,11 @@
+# b/173969091
+dontaudit gpsd radio_prop:file { read };
+dontaudit gpsd radio_prop:file { open };
+dontaudit gpsd radio_prop:file { map };
+dontaudit gpsd radio_prop:file { map };
+dontaudit gpsd system_data_file:dir { search };
+dontaudit gpsd radio_prop:file { read };
+dontaudit gpsd radio_prop:file { open };
+dontaudit gpsd radio_prop:file { getattr };
+dontaudit gpsd system_data_file:dir { search };
+dontaudit gpsd radio_prop:file { getattr };
diff --git a/tracking_denials/hal_camera_default.te b/tracking_denials/hal_camera_default.te
new file mode 100644
index 0000000..18ae133
--- /dev/null
+++ b/tracking_denials/hal_camera_default.te
@@ -0,0 +1,15 @@
+# b/178980085
+dontaudit hal_camera_default system_data_file:dir { search };
+dontaudit hal_camera_default system_data_file:dir { search };
+# b/180567725
+dontaudit hal_camera_default traced:unix_stream_socket { connectto };
+dontaudit hal_camera_default traced:unix_stream_socket { connectto };
+dontaudit hal_camera_default traced_producer_socket:sock_file { write };
+dontaudit hal_camera_default traced_producer_socket:sock_file { write };
+# b/181913550
+dontaudit hal_camera_default dmabuf_system_heap_device:chr_file { read };
+dontaudit hal_camera_default dmabuf_system_heap_device:chr_file { read };
+dontaudit hal_camera_default dmabuf_system_heap_device:chr_file { open };
+dontaudit hal_camera_default dmabuf_system_heap_device:chr_file { ioctl };
+dontaudit hal_camera_default dmabuf_system_heap_device:chr_file { open };
+dontaudit hal_camera_default dmabuf_system_heap_device:chr_file { ioctl };
diff --git a/tracking_denials/hal_dumpstate_default.te b/tracking_denials/hal_dumpstate_default.te
new file mode 100644
index 0000000..66e10a9
--- /dev/null
+++ b/tracking_denials/hal_dumpstate_default.te
@@ -0,0 +1,16 @@
+# b/181915591
+dontaudit hal_dumpstate_default aac_drc_prop:file { open };
+dontaudit hal_dumpstate_default sysfs:dir { read };
+dontaudit hal_dumpstate_default sysfs:dir { open };
+dontaudit hal_dumpstate_default vendor_displaycolor_service:service_manager { find };
+dontaudit hal_dumpstate_default hal_graphics_composer_default:binder { call };
+dontaudit hal_dumpstate_default aac_drc_prop:file { getattr };
+dontaudit hal_dumpstate_default aac_drc_prop:file { map };
+dontaudit hal_dumpstate_default aac_drc_prop:file { open };
+dontaudit hal_dumpstate_default aac_drc_prop:file { getattr };
+dontaudit hal_dumpstate_default aac_drc_prop:file { map };
+dontaudit hal_dumpstate_default ab_update_gki_prop:file { open };
+dontaudit hal_dumpstate_default ab_update_gki_prop:file { open };
+dontaudit hal_dumpstate_default sysfs:dir { read };
+dontaudit hal_dumpstate_default sysfs:dir { open };
+dontaudit hal_dumpstate_default hal_graphics_composer_default:binder { call };
diff --git a/tracking_denials/hal_fingerprint_default.te b/tracking_denials/hal_fingerprint_default.te
new file mode 100644
index 0000000..0fced32
--- /dev/null
+++ b/tracking_denials/hal_fingerprint_default.te
@@ -0,0 +1,52 @@
+# b/174438167
+dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { read };
+dontaudit hal_fingerprint_default tee_device:chr_file { ioctl };
+dontaudit hal_fingerprint_default system_data_root_file:file { read };
+dontaudit hal_fingerprint_default system_data_root_file:file { open };
+dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { create };
+dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { bind };
+dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { write };
+dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { read };
+dontaudit hal_fingerprint_default tee_device:chr_file { open };
+dontaudit hal_fingerprint_default tee_device:chr_file { ioctl };
+dontaudit hal_fingerprint_default tee_device:chr_file { open };
+dontaudit hal_fingerprint_default tee_device:chr_file { read write };
+dontaudit hal_fingerprint_default device:chr_file { open };
+dontaudit hal_fingerprint_default device:chr_file { read write };
+dontaudit hal_fingerprint_default tee_device:chr_file { read write };
+dontaudit hal_fingerprint_default device:chr_file { ioctl };
+dontaudit hal_fingerprint_default device:chr_file { open };
+dontaudit hal_fingerprint_default system_data_root_file:file { read };
+dontaudit hal_fingerprint_default system_data_root_file:file { open };
+dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { create };
+dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { bind };
+dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { write };
+dontaudit hal_fingerprint_default hal_fingerprint_default:netlink_socket { read };
+dontaudit hal_fingerprint_default device:chr_file { ioctl };
+dontaudit hal_fingerprint_default device:chr_file { read write };
+# b/174714991
+dontaudit hal_fingerprint_default system_data_file:file { read };
+dontaudit hal_fingerprint_default system_data_file:file { open };
+dontaudit hal_fingerprint_default system_data_file:file { read };
+dontaudit hal_fingerprint_default system_data_file:file { open };
+# b/177966377
+dontaudit hal_fingerprint_default default_prop:file { getattr };
+dontaudit hal_fingerprint_default default_prop:file { map };
+dontaudit hal_fingerprint_default default_prop:file { open };
+dontaudit hal_fingerprint_default default_prop:file { read };
+dontaudit hal_fingerprint_default default_prop:file { map };
+dontaudit hal_fingerprint_default default_prop:file { getattr };
+dontaudit hal_fingerprint_default default_android_hwservice:hwservice_manager { add };
+dontaudit hal_fingerprint_default default_prop:file { open };
+dontaudit hal_fingerprint_default default_prop:file { read };
+# b/180655836
+dontaudit hal_fingerprint_default system_data_root_file:dir { write };
+dontaudit hal_fingerprint_default system_data_root_file:file { write };
+dontaudit hal_fingerprint_default system_data_root_file:file { create };
+dontaudit hal_fingerprint_default system_data_root_file:dir { create };
+dontaudit hal_fingerprint_default system_data_root_file:dir { write };
+dontaudit hal_fingerprint_default system_data_root_file:file { write };
+dontaudit hal_fingerprint_default system_data_root_file:file { create };
+dontaudit hal_fingerprint_default system_data_root_file:dir { create };
+dontaudit hal_fingerprint_default system_data_root_file:dir { add_name };
+dontaudit hal_fingerprint_default system_data_root_file:dir { add_name };
diff --git a/tracking_denials/hal_graphics_composer_default.te b/tracking_denials/hal_graphics_composer_default.te
new file mode 100644
index 0000000..3bc97c4
--- /dev/null
+++ b/tracking_denials/hal_graphics_composer_default.te
@@ -0,0 +1,23 @@
+# b/181712799
+dontaudit hal_graphics_composer_default hal_power_default:binder { call };
+dontaudit hal_graphics_composer_default boot_status_prop:file { read };
+dontaudit hal_graphics_composer_default boot_status_prop:file { open };
+dontaudit hal_graphics_composer_default boot_status_prop:file { getattr };
+dontaudit hal_graphics_composer_default boot_status_prop:file { map };
+dontaudit hal_graphics_composer_default hal_power_default:binder { call };
+dontaudit hal_graphics_composer_default boot_status_prop:file { map };
+dontaudit hal_graphics_composer_default vendor_log_file:file { create };
+dontaudit hal_graphics_composer_default vendor_log_file:file { append open };
+dontaudit hal_graphics_composer_default vendor_log_file:file { getattr };
+dontaudit hal_graphics_composer_default vendor_log_file:file { getattr };
+dontaudit hal_graphics_composer_default vendor_log_file:file { append open };
+dontaudit hal_graphics_composer_default vendor_log_file:file { create };
+dontaudit hal_graphics_composer_default hal_power_service:service_manager { find };
+dontaudit hal_graphics_composer_default boot_status_prop:file { read };
+dontaudit hal_graphics_composer_default boot_status_prop:file { open };
+dontaudit hal_graphics_composer_default boot_status_prop:file { getattr };
+# b/181915065
+dontaudit hal_graphics_composer_default hal_dumpstate_default:fd { use };
+dontaudit hal_graphics_composer_default hal_dumpstate_default:fifo_file { write };
+dontaudit hal_graphics_composer_default hal_dumpstate_default:fd { use };
+dontaudit hal_graphics_composer_default hal_dumpstate_default:fifo_file { write };
diff --git a/tracking_denials/hal_health_default.te b/tracking_denials/hal_health_default.te
new file mode 100644
index 0000000..2ffd763
--- /dev/null
+++ b/tracking_denials/hal_health_default.te
@@ -0,0 +1,15 @@
+# b/177966434
+dontaudit hal_health_default sysfs_wlc:dir { search };
+# b/181177925
+dontaudit hal_health_default thermal_link_device:dir { search };
+dontaudit hal_health_default sysfs_thermal:file { open };
+dontaudit hal_health_default sysfs_thermal:file { write };
+dontaudit hal_health_default sysfs_thermal:lnk_file { read };
+dontaudit hal_health_default sysfs_thermal:dir { search };
+dontaudit hal_health_default sysfs_thermal:file { write };
+dontaudit hal_health_default sysfs_thermal:file { open };
+dontaudit hal_health_default sysfs_batteryinfo:file { write };
+dontaudit hal_health_default sysfs_thermal:dir { search };
+dontaudit hal_health_default thermal_link_device:dir { search };
+dontaudit hal_health_default sysfs_batteryinfo:file { write };
+dontaudit hal_health_default sysfs_thermal:lnk_file { read };
diff --git a/tracking_denials/hal_memtrack_default.te b/tracking_denials/hal_memtrack_default.te
new file mode 100644
index 0000000..8bb56ce
--- /dev/null
+++ b/tracking_denials/hal_memtrack_default.te
@@ -0,0 +1,3 @@
+# b/181913683
+dontaudit hal_memtrack_default vendor_ion_debugfs:dir { search };
+dontaudit hal_memtrack_default vendor_ion_debugfs:dir { search };
diff --git a/tracking_denials/hal_neuralnetworks_armnn.te b/tracking_denials/hal_neuralnetworks_armnn.te
new file mode 100644
index 0000000..9ebda63
--- /dev/null
+++ b/tracking_denials/hal_neuralnetworks_armnn.te
@@ -0,0 +1,33 @@
+# b/171160755
+dontaudit hal_neuralnetworks_armnn traced:unix_stream_socket connectto ;
+dontaudit hal_neuralnetworks_armnn hal_neuralnetworks_hwservice:hwservice_manager add ;
+dontaudit hal_neuralnetworks_armnn hal_neuralnetworks_hwservice:hwservice_manager find ;
+dontaudit hal_neuralnetworks_armnn hwservicemanager:binder transfer ;
+dontaudit hal_neuralnetworks_armnn hwservicemanager:binder call ;
+dontaudit hal_neuralnetworks_armnn hwservicemanager_prop:file map ;
+dontaudit hal_neuralnetworks_armnn hwservicemanager_prop:file getattr ;
+dontaudit hal_neuralnetworks_armnn hwservicemanager_prop:file open ;
+dontaudit hal_neuralnetworks_armnn hwservicemanager_prop:file read ;
+dontaudit hal_neuralnetworks_armnn gpu_device:chr_file {read write} ;
+dontaudit hal_neuralnetworks_armnn gpu_device:chr_file open ;
+dontaudit hal_neuralnetworks_armnn gpu_device:chr_file getattr ;
+dontaudit hal_neuralnetworks_armnn gpu_device:chr_file ioctl ;
+dontaudit hal_neuralnetworks_armnn gpu_device:chr_file map ;
+dontaudit hal_neuralnetworks_armnn gpu_device:chr_file {read write} ;
+dontaudit hal_neuralnetworks_armnn traced_producer_socket:sock_file write ;
+dontaudit hal_neuralnetworks_armnn hidl_base_hwservice:hwservice_manager add ;
+# b/171670122
+dontaudit hal_neuralnetworks_armnn debugfs_tracing:file { read };
+dontaudit hal_neuralnetworks_armnn debugfs_tracing:file { open };
+# b/180550063
+dontaudit hal_neuralnetworks_armnn system_data_file:dir { search };
+dontaudit hal_neuralnetworks_armnn system_data_file:dir { search };
+# b/180858476
+dontaudit hal_neuralnetworks_armnn default_prop:file { read };
+dontaudit hal_neuralnetworks_armnn default_prop:file { read };
+dontaudit hal_neuralnetworks_armnn default_prop:file { open };
+dontaudit hal_neuralnetworks_armnn default_prop:file { getattr };
+dontaudit hal_neuralnetworks_armnn default_prop:file { map };
+dontaudit hal_neuralnetworks_armnn default_prop:file { open };
+dontaudit hal_neuralnetworks_armnn default_prop:file { getattr };
+dontaudit hal_neuralnetworks_armnn default_prop:file { map };
diff --git a/tracking_denials/hal_power_default.te b/tracking_denials/hal_power_default.te
new file mode 100644
index 0000000..ba08e0a
--- /dev/null
+++ b/tracking_denials/hal_power_default.te
@@ -0,0 +1,15 @@
+# b/171760921
+dontaudit hal_power_default hal_power_default:capability { dac_override };
+# b/178331773
+dontaudit hal_power_default sysfs:file { write };
+dontaudit hal_power_default sysfs:file { open };
+dontaudit hal_power_default sysfs:file { write };
+dontaudit hal_power_default sysfs:file { open };
+# b/178752616
+dontaudit hal_power_default sysfs:file { read };
+dontaudit hal_power_default sysfs:file { getattr };
+dontaudit hal_power_default sysfs:file { read };
+dontaudit hal_power_default sysfs:file { getattr };
+# b/181713002
+dontaudit hal_power_default hal_graphics_composer_default:binder { transfer };
+dontaudit hal_power_default hal_graphics_composer_default:binder { transfer };
diff --git a/tracking_denials/hal_power_stats_default.te b/tracking_denials/hal_power_stats_default.te
new file mode 100644
index 0000000..20c95e4
--- /dev/null
+++ b/tracking_denials/hal_power_stats_default.te
@@ -0,0 +1,68 @@
+# b/171760721
+dontaudit hal_power_stats_default sysfs:file { read };
+dontaudit hal_power_stats_default sysfs:file { getattr };
+dontaudit hal_power_stats_default citadeld:binder { call };
+dontaudit hal_power_stats_default sysfs:file { read };
+dontaudit hal_power_stats_default sysfs:file { getattr };
+dontaudit hal_power_stats_default sysfs:file { open };
+dontaudit hal_power_stats_default sysfs:file { getattr };
+dontaudit hal_power_stats_default sysfs:dir { read };
+dontaudit hal_power_stats_default sysfs:dir { open };
+dontaudit hal_power_stats_default sysfs:file { read };
+dontaudit hal_power_stats_default sysfs:file { open };
+dontaudit hal_power_stats_default sysfs:file { open };
+# b/176777337
+dontaudit hal_power_stats_default sysfs_leds:dir search ;
+dontaudit hal_power_stats_default sysfs_leds:file open ;
+dontaudit hal_power_stats_default sysfs_leds:dir search ;
+dontaudit hal_power_stats_default sysfs_leds:file read ;
+dontaudit hal_power_stats_default sysfs_leds:file open ;
+# b/176868314
+dontaudit hal_power_stats_default sysfs_leds:file read ;
+dontaudit hal_power_stats_default sysfs_leds:file open ;
+dontaudit hal_power_stats_default sysfs_leds:dir search ;
+# b/179093124
+dontaudit hal_power_stats_default sysfs_backlight:file { open };
+dontaudit hal_power_stats_default sysfs_backlight:file { read };
+dontaudit hal_power_stats_default sysfs_backlight:file { open };
+dontaudit hal_power_stats_default sysfs_backlight:dir { search };
+dontaudit hal_power_stats_default sysfs_backlight:dir { search };
+dontaudit hal_power_stats_default sysfs_backlight:file { read };
+# b/180963514
+dontaudit hal_power_stats_default sysfs_aoc:file { read };
+dontaudit hal_power_stats_default sysfs_aoc:file { read };
+dontaudit hal_power_stats_default sysfs_aoc:file { open };
+dontaudit hal_power_stats_default sysfs_aoc:file { getattr };
+dontaudit hal_power_stats_default sysfs_aoc:file { open };
+dontaudit hal_power_stats_default sysfs_aoc:file { getattr };
+dontaudit hal_power_stats_default sysfs_aoc:dir { search };
+dontaudit hal_power_stats_default sysfs_aoc:file { read };
+dontaudit hal_power_stats_default sysfs_aoc:file { open };
+dontaudit hal_power_stats_default sysfs_aoc:file { open };
+dontaudit hal_power_stats_default sysfs_aoc:file { getattr };
+dontaudit hal_power_stats_default sysfs_aoc:dir { search };
+dontaudit hal_power_stats_default sysfs_aoc:dir { search };
+dontaudit hal_power_stats_default sysfs_aoc:file { read };
+dontaudit hal_power_stats_default sysfs_aoc:file { open };
+dontaudit hal_power_stats_default sysfs_aoc:file { getattr };
+dontaudit hal_power_stats_default sysfs_aoc:file { read };
+# b/181915165
+dontaudit hal_power_stats_default sysfs_acpm_stats:file { read };
+dontaudit hal_power_stats_default sysfs_acpm_stats:dir { search };
+dontaudit hal_power_stats_default sysfs_wifi:file { getattr };
+dontaudit hal_power_stats_default sysfs_acpm_stats:file { read };
+dontaudit hal_power_stats_default sysfs_acpm_stats:dir { search };
+dontaudit hal_power_stats_default sysfs_wifi:file { open };
+dontaudit hal_power_stats_default sysfs_acpm_stats:file { open };
+dontaudit hal_power_stats_default sysfs_acpm_stats:file { getattr };
+dontaudit hal_power_stats_default sysfs_wifi:file { getattr };
+dontaudit hal_power_stats_default sysfs_wifi:file { open };
+dontaudit hal_power_stats_default sysfs_acpm_stats:file { read };
+dontaudit hal_power_stats_default sysfs_wifi:file { read };
+dontaudit hal_power_stats_default sysfs_wifi:dir { search };
+dontaudit hal_power_stats_default sysfs_acpm_stats:file { getattr };
+dontaudit hal_power_stats_default sysfs_acpm_stats:file { open };
+dontaudit hal_power_stats_default sysfs_acpm_stats:file { read };
+dontaudit hal_power_stats_default sysfs_acpm_stats:dir { search };
+dontaudit hal_power_stats_default sysfs_wifi:dir { search };
+dontaudit hal_power_stats_default sysfs_wifi:file { read };
diff --git a/tracking_denials/hal_vibrator_default.te b/tracking_denials/hal_vibrator_default.te
new file mode 100644
index 0000000..eea73ff
--- /dev/null
+++ b/tracking_denials/hal_vibrator_default.te
@@ -0,0 +1,2 @@
+# b/174961422
+dontaudit hal_vibrator_default property_type:file * ;
diff --git a/tracking_denials/hal_wifi_ext.te b/tracking_denials/hal_wifi_ext.te
new file mode 100644
index 0000000..c43741b
--- /dev/null
+++ b/tracking_denials/hal_wifi_ext.te
@@ -0,0 +1,4 @@
+# b/177966433
+dontaudit hal_wifi_ext vendor_default_prop:property_service { set };
+dontaudit hal_wifi_ext grilservice_app:binder { call };
+dontaudit hal_wifi_ext grilservice_app:binder { call };
diff --git a/tracking_denials/hardware_info_app.te b/tracking_denials/hardware_info_app.te
new file mode 100644
index 0000000..810cb70
--- /dev/null
+++ b/tracking_denials/hardware_info_app.te
@@ -0,0 +1,18 @@
+# b/181177926
+dontaudit hardware_info_app sysfs_scsi_devices_0000:file { getattr };
+dontaudit hardware_info_app sysfs_scsi_devices_0000:file { open };
+dontaudit hardware_info_app sysfs_batteryinfo:file { read };
+dontaudit hardware_info_app sysfs:file { read };
+dontaudit hardware_info_app sysfs:file { open };
+dontaudit hardware_info_app sysfs:file { getattr };
+dontaudit hardware_info_app sysfs_scsi_devices_0000:dir { search };
+dontaudit hardware_info_app sysfs_scsi_devices_0000:file { read };
+dontaudit hardware_info_app sysfs_batteryinfo:dir { search };
+# b/181914888
+dontaudit hardware_info_app sysfs_batteryinfo:file { open };
+dontaudit hardware_info_app sysfs_batteryinfo:file { getattr };
+dontaudit hardware_info_app vendor_regmap_debugfs:dir { search };
+# b/181915166
+dontaudit hardware_info_app sysfs_batteryinfo:file { getattr };
+dontaudit hardware_info_app sysfs_batteryinfo:file { open };
+dontaudit hardware_info_app vendor_regmap_debugfs:dir { search };
diff --git a/tracking_denials/incidentd.te b/tracking_denials/incidentd.te
new file mode 100644
index 0000000..61223df
--- /dev/null
+++ b/tracking_denials/incidentd.te
@@ -0,0 +1,139 @@
+# b/176868159
+dontaudit incidentd apk_verity_prop:file getattr ;
+dontaudit incidentd apk_verity_prop:file map ;
+dontaudit incidentd apk_verity_prop:file getattr ;
+dontaudit incidentd apk_verity_prop:file open ;
+dontaudit incidentd apexd_prop:file map ;
+dontaudit incidentd apexd_prop:file getattr ;
+dontaudit incidentd apexd_prop:file getattr ;
+dontaudit incidentd apexd_prop:file map ;
+dontaudit incidentd apk_verity_prop:file open ;
+dontaudit incidentd apk_verity_prop:file map ;
+# b/177176812
+dontaudit incidentd audio_config_prop:file open ;
+dontaudit incidentd ab_update_gki_prop:file open ;
+dontaudit incidentd ab_update_gki_prop:file map ;
+dontaudit incidentd ab_update_gki_prop:file getattr ;
+dontaudit incidentd audio_config_prop:file open ;
+dontaudit incidentd aac_drc_prop:file map ;
+dontaudit incidentd aac_drc_prop:file getattr ;
+dontaudit incidentd aac_drc_prop:file open ;
+dontaudit incidentd aac_drc_prop:file open ;
+dontaudit incidentd ab_update_gki_prop:file map ;
+dontaudit incidentd aac_drc_prop:file map ;
+dontaudit incidentd ab_update_gki_prop:file getattr ;
+dontaudit incidentd aac_drc_prop:file getattr ;
+dontaudit incidentd ab_update_gki_prop:file open ;
+# b/177389412
+dontaudit incidentd audio_config_prop:file { getattr };
+dontaudit incidentd audio_config_prop:file { getattr };
+dontaudit incidentd audio_config_prop:file { map };
+dontaudit incidentd bluetooth_a2dp_offload_prop:file { open };
+dontaudit incidentd bluetooth_a2dp_offload_prop:file { map };
+dontaudit incidentd nfc_service:service_manager { find };
+dontaudit incidentd bluetooth_a2dp_offload_prop:file { map };
+dontaudit incidentd bluetooth_a2dp_offload_prop:file { getattr };
+dontaudit incidentd bluetooth_a2dp_offload_prop:file { open };
+dontaudit incidentd audio_config_prop:file { map };
+dontaudit incidentd bluetooth_a2dp_offload_prop:file { getattr };
+# b/177614642
+dontaudit incidentd bluetooth_audio_hal_prop:file { map };
+dontaudit incidentd bluetooth_audio_hal_prop:file { open };
+dontaudit incidentd bluetooth_prop:file { map };
+dontaudit incidentd bluetooth_prop:file { getattr };
+dontaudit incidentd bluetooth_prop:file { open };
+dontaudit incidentd bluetooth_audio_hal_prop:file { map };
+dontaudit incidentd bluetooth_audio_hal_prop:file { getattr };
+dontaudit incidentd boottime_prop:file { open };
+dontaudit incidentd bluetooth_prop:file { map };
+dontaudit incidentd bluetooth_prop:file { getattr };
+dontaudit incidentd bluetooth_prop:file { open };
+dontaudit incidentd bluetooth_audio_hal_prop:file { open };
+dontaudit incidentd bluetooth_audio_hal_prop:file { getattr };
+dontaudit incidentd boottime_prop:file { open };
+# b/177778217
+dontaudit incidentd boottime_public_prop:file { getattr };
+dontaudit incidentd boottime_prop:file { getattr };
+dontaudit incidentd bpf_progs_loaded_prop:file { open };
+dontaudit incidentd boottime_public_prop:file { map };
+dontaudit incidentd boottime_public_prop:file { getattr };
+dontaudit incidentd boottime_public_prop:file { open };
+dontaudit incidentd boottime_prop:file { map };
+dontaudit incidentd bpf_progs_loaded_prop:file { getattr };
+dontaudit incidentd bpf_progs_loaded_prop:file { open };
+dontaudit incidentd boottime_public_prop:file { map };
+dontaudit incidentd boottime_prop:file { getattr };
+dontaudit incidentd boottime_prop:file { map };
+dontaudit incidentd boottime_public_prop:file { open };
+dontaudit incidentd bpf_progs_loaded_prop:file { getattr };
+# b/177860841
+dontaudit incidentd build_bootimage_prop:file { map };
+dontaudit incidentd build_config_prop:file { getattr };
+dontaudit incidentd build_config_prop:file { open };
+dontaudit incidentd bpf_progs_loaded_prop:file { map };
+dontaudit incidentd build_bootimage_prop:file { open };
+dontaudit incidentd build_bootimage_prop:file { getattr };
+dontaudit incidentd build_bootimage_prop:file { map };
+dontaudit incidentd build_bootimage_prop:file { getattr };
+dontaudit incidentd build_config_prop:file { getattr };
+dontaudit incidentd build_config_prop:file { map };
+dontaudit incidentd bpf_progs_loaded_prop:file { map };
+dontaudit incidentd build_bootimage_prop:file { open };
+dontaudit incidentd build_config_prop:file { open };
+dontaudit incidentd build_config_prop:file { map };
+# b/178752460
+dontaudit incidentd camera_calibration_prop:file { open };
+dontaudit incidentd charger_config_prop:file { getattr };
+dontaudit incidentd charger_config_prop:file { open };
+dontaudit incidentd camera_calibration_prop:file { map };
+dontaudit incidentd camera_calibration_prop:file { getattr };
+dontaudit incidentd charger_config_prop:file { getattr };
+dontaudit incidentd camera_calibration_prop:file { open };
+dontaudit incidentd camera_calibration_prop:file { getattr };
+dontaudit incidentd camera_calibration_prop:file { map };
+dontaudit incidentd charger_config_prop:file { open };
+# b/179310909
+dontaudit incidentd charger_status_prop:file { open };
+dontaudit incidentd charger_prop:file { open };
+dontaudit incidentd charger_prop:file { getattr };
+dontaudit incidentd charger_prop:file { map };
+dontaudit incidentd charger_status_prop:file { open };
+dontaudit incidentd charger_status_prop:file { getattr };
+dontaudit incidentd charger_status_prop:file { map };
+dontaudit incidentd charger_config_prop:file { map };
+dontaudit incidentd charger_status_prop:file { map };
+dontaudit incidentd charger_status_prop:file { getattr };
+dontaudit incidentd charger_config_prop:file { map };
+dontaudit incidentd charger_prop:file { open };
+dontaudit incidentd charger_prop:file { getattr };
+dontaudit incidentd charger_prop:file { map };
+# b/179437463
+dontaudit incidentd cold_boot_done_prop:file { map };
+dontaudit incidentd cold_boot_done_prop:file { getattr };
+dontaudit incidentd cpu_variant_prop:file { map };
+dontaudit incidentd cpu_variant_prop:file { getattr };
+dontaudit incidentd cold_boot_done_prop:file { map };
+dontaudit incidentd cpu_variant_prop:file { map };
+dontaudit incidentd cpu_variant_prop:file { open };
+dontaudit incidentd cold_boot_done_prop:file { getattr };
+dontaudit incidentd cold_boot_done_prop:file { open };
+dontaudit incidentd cold_boot_done_prop:file { open };
+dontaudit incidentd cpu_variant_prop:file { open };
+dontaudit incidentd cpu_variant_prop:file { getattr };
+# b/180963481
+dontaudit incidentd ctl_bootanim_prop:file { open };
+dontaudit incidentd ctl_adbd_prop:file { open };
+dontaudit incidentd ctl_adbd_prop:file { getattr };
+dontaudit incidentd ctl_adbd_prop:file { map };
+dontaudit incidentd ctl_apexd_prop:file { getattr };
+dontaudit incidentd ctl_apexd_prop:file { map };
+dontaudit incidentd ctl_adbd_prop:file { open };
+dontaudit incidentd ctl_adbd_prop:file { getattr };
+dontaudit incidentd ctl_adbd_prop:file { map };
+dontaudit incidentd ctl_apexd_prop:file { open };
+dontaudit incidentd ctl_apexd_prop:file { getattr };
+dontaudit incidentd ctl_apexd_prop:file { map };
+dontaudit incidentd ctl_bootanim_prop:file { open };
+dontaudit incidentd ctl_apexd_prop:file { open };
+# b/181177909
+dontaudit incidentd property_type:file *;
diff --git a/tracking_denials/init-thermal-symlinks-sh.te b/tracking_denials/init-thermal-symlinks-sh.te
new file mode 100644
index 0000000..bfb04c0
--- /dev/null
+++ b/tracking_denials/init-thermal-symlinks-sh.te
@@ -0,0 +1,9 @@
+# b/177862403
+dontaudit init-thermal-symlinks-sh sysfs_thermal:lnk_file { read };
+dontaudit init-thermal-symlinks-sh sysfs_thermal:lnk_file { read };
+dontaudit init-thermal-symlinks-sh sysfs_thermal:lnk_file { read };
+dontaudit init-thermal-symlinks-sh sysfs_thermal:lnk_file { read };
+dontaudit init-thermal-symlinks-sh sysfs_thermal:lnk_file { read };
+dontaudit init-thermal-symlinks-sh sysfs_thermal:lnk_file { read };
+dontaudit init-thermal-symlinks-sh sysfs_thermal:lnk_file { read };
+dontaudit init-thermal-symlinks-sh sysfs_thermal:lnk_file { read };
diff --git a/tracking_denials/init.te b/tracking_denials/init.te
new file mode 100644
index 0000000..48fddf6
--- /dev/null
+++ b/tracking_denials/init.te
@@ -0,0 +1,20 @@
+# b/177966144
+dontaudit init sysfs:file { open };
+dontaudit init sysfs:file { setattr };
+dontaudit init sysfs:file { open };
+dontaudit init sysfs:file { write };
+dontaudit init sysfs:file { setattr };
+dontaudit init sysfs:file { write };
+# b/178979985
+dontaudit init device:chr_file { ioctl };
+dontaudit init modem_img_file:dir { mounton };
+dontaudit init device:chr_file { open };
+dontaudit init device:chr_file { read write };
+dontaudit init modem_img_file:dir { mounton };
+dontaudit init device:chr_file { ioctl };
+dontaudit init device:chr_file { open };
+dontaudit init device:chr_file { read write };
+# b/180963348
+dontaudit init overlayfs_file:chr_file { unlink };
+dontaudit init unlabeled:dir { mounton };
+dontaudit init overlayfs_file:file { rename };
diff --git a/tracking_denials/mediacodec.te b/tracking_denials/mediacodec.te
new file mode 100644
index 0000000..2d3f447
--- /dev/null
+++ b/tracking_denials/mediacodec.te
@@ -0,0 +1,6 @@
+# b/172173484
+dontaudit mediacodec sysfs:file { getattr };
+dontaudit mediacodec sysfs:file { open };
+dontaudit mediacodec sysfs:file { read };
+# b/176777184
+dontaudit mediacodec default_android_vndservice:service_manager add ;
diff --git a/tracking_denials/modem_logging_control.te b/tracking_denials/modem_logging_control.te
new file mode 100644
index 0000000..e7b7792
--- /dev/null
+++ b/tracking_denials/modem_logging_control.te
@@ -0,0 +1,13 @@
+# b/176777145
+dontaudit modem_logging_control vendor_sys_default_prop:property_service set ;
+# b/176851633
+dontaudit modem_logging_control vendor_sys_default_prop:file { read };
+dontaudit modem_logging_control vendor_sys_default_prop:file { read };
+dontaudit modem_logging_control vendor_sys_default_prop:file { open };
+dontaudit modem_logging_control vendor_sys_default_prop:file { getattr };
+dontaudit modem_logging_control vendor_sys_default_prop:file { map };
+dontaudit modem_logging_control vendor_sys_default_prop:file { open };
+dontaudit modem_logging_control vendor_sys_default_prop:file { getattr };
+dontaudit modem_logging_control vendor_sys_default_prop:file { map };
+# b/176868315
+dontaudit modem_logging_control vendor_sys_default_prop:property_service set ;
diff --git a/tracking_denials/pixelstats_vendor.te b/tracking_denials/pixelstats_vendor.te
new file mode 100644
index 0000000..4eb0f6d
--- /dev/null
+++ b/tracking_denials/pixelstats_vendor.te
@@ -0,0 +1,4 @@
+# b/181914749
+dontaudit pixelstats_vendor servicemanager:binder { call };
+# b/181915066
+dontaudit pixelstats_vendor servicemanager:binder { call };
diff --git a/tracking_denials/platform_app.te b/tracking_denials/platform_app.te
new file mode 100644
index 0000000..6e8841a
--- /dev/null
+++ b/tracking_denials/platform_app.te
@@ -0,0 +1,8 @@
+# b/178433506
+dontaudit platform_app property_type:file *;
+# b/179093352
+dontaudit platform_app hal_wlc:binder { transfer };
+dontaudit platform_app hal_wlc:binder { call };
+dontaudit platform_app hal_wlc_hwservice:hwservice_manager { find };
+dontaudit platform_app hal_wlc:binder { call };
+dontaudit platform_app hal_wlc:binder { transfer };
diff --git a/tracking_denials/priv_app.te b/tracking_denials/priv_app.te
new file mode 100644
index 0000000..4eba31d
--- /dev/null
+++ b/tracking_denials/priv_app.te
@@ -0,0 +1,51 @@
+# b/180551518
+dontaudit priv_app apk_verity_prop:file { getattr };
+dontaudit priv_app audio_config_prop:file { getattr };
+dontaudit priv_app apexd_prop:file { open };
+dontaudit priv_app apexd_prop:file { getattr };
+dontaudit priv_app apexd_prop:file { map };
+dontaudit priv_app apk_verity_prop:file { open };
+dontaudit priv_app audio_config_prop:file { open };
+dontaudit priv_app apk_verity_prop:file { map };
+dontaudit priv_app apk_verity_prop:file { getattr };
+dontaudit priv_app apk_verity_prop:file { open };
+dontaudit priv_app apexd_prop:file { map };
+dontaudit priv_app apexd_prop:file { getattr };
+dontaudit priv_app apexd_prop:file { open };
+dontaudit priv_app apexd_prop:file { open };
+dontaudit priv_app apexd_prop:file { getattr };
+dontaudit priv_app apexd_prop:file { map };
+dontaudit priv_app apk_verity_prop:file { open };
+dontaudit priv_app apk_verity_prop:file { getattr };
+dontaudit priv_app apk_verity_prop:file { map };
+dontaudit priv_app audio_config_prop:file { open };
+dontaudit priv_app audio_config_prop:file { getattr };
+dontaudit priv_app apexd_prop:file { open };
+dontaudit priv_app apexd_prop:file { getattr };
+dontaudit priv_app apexd_prop:file { map };
+dontaudit priv_app apk_verity_prop:file { open };
+dontaudit priv_app apk_verity_prop:file { getattr };
+# b/180567612
+dontaudit priv_app audio_config_prop:file { map };
+dontaudit priv_app bluetooth_audio_hal_prop:file { getattr };
+dontaudit priv_app bluetooth_audio_hal_prop:file { map };
+dontaudit priv_app bluetooth_prop:file { open };
+dontaudit priv_app bluetooth_prop:file { getattr };
+dontaudit priv_app bluetooth_audio_hal_prop:file { open };
+dontaudit priv_app bluetooth_a2dp_offload_prop:file { map };
+dontaudit priv_app bluetooth_a2dp_offload_prop:file { getattr };
+dontaudit priv_app bluetooth_a2dp_offload_prop:file { open };
+dontaudit priv_app audio_config_prop:file { map };
+dontaudit priv_app bluetooth_a2dp_offload_prop:file { open };
+dontaudit priv_app bluetooth_a2dp_offload_prop:file { getattr };
+dontaudit priv_app bluetooth_a2dp_offload_prop:file { map };
+dontaudit priv_app bluetooth_audio_hal_prop:file { open };
+dontaudit priv_app bluetooth_audio_hal_prop:file { getattr };
+dontaudit priv_app bluetooth_audio_hal_prop:file { map };
+dontaudit priv_app bluetooth_prop:file { open };
+dontaudit priv_app bluetooth_prop:file { getattr };
+# b/180656244
+dontaudit priv_app property_type:file *;
+# b/180858511
+dontaudit priv_app hal_neuralnetworks_armnn:binder { call };
+dontaudit priv_app hal_neuralnetworks_armnn:binder { call };
diff --git a/tracking_denials/rild.te b/tracking_denials/rild.te
new file mode 100644
index 0000000..10680da
--- /dev/null
+++ b/tracking_denials/rild.te
@@ -0,0 +1,16 @@
+# b/178980065
+dontaudit rild unlabeled:dir { search };
+dontaudit rild unlabeled:lnk_file { read };
+dontaudit rild unlabeled:dir { search };
+dontaudit rild unlabeled:lnk_file { read };
+# b/179198085
+dontaudit rild unlabeled:file { ioctl };
+dontaudit rild unlabeled:file { open };
+dontaudit rild unlabeled:file { read };
+dontaudit rild unlabeled:file { getattr };
+dontaudit rild unlabeled:file { lock };
+dontaudit rild unlabeled:file { ioctl };
+dontaudit rild unlabeled:file { open };
+dontaudit rild unlabeled:file { read };
+dontaudit rild unlabeled:file { getattr };
+dontaudit rild unlabeled:file { lock };
diff --git a/tracking_denials/scd.te b/tracking_denials/scd.te
new file mode 100644
index 0000000..f66f49e
--- /dev/null
+++ b/tracking_denials/scd.te
@@ -0,0 +1,13 @@
+# b/173969190
+dontaudit scd vendor_data_file:dir { write };
+dontaudit scd vendor_data_file:dir { add_name };
+dontaudit scd vendor_data_file:dir { write };
+dontaudit scd vendor_data_file:file { create };
+dontaudit scd vendor_data_file:file { lock };
+dontaudit scd vendor_data_file:file { create };
+dontaudit scd vendor_data_file:file { lock };
+dontaudit scd vendor_data_file:file { open };
+dontaudit scd vendor_data_file:file { write };
+dontaudit scd vendor_data_file:file { write };
+dontaudit scd vendor_data_file:file { open };
+dontaudit scd vendor_data_file:dir { add_name };
diff --git a/tracking_denials/sced.te b/tracking_denials/sced.te
new file mode 100644
index 0000000..fa8893f
--- /dev/null
+++ b/tracking_denials/sced.te
@@ -0,0 +1,10 @@
+# b/171760846
+dontaudit sced hwservicemanager:binder { call };
+dontaudit sced hidl_base_hwservice:hwservice_manager { add };
+dontaudit sced hal_vendor_oem_hwservice:hwservice_manager { add };
+dontaudit sced hal_vendor_oem_hwservice:hwservice_manager { find };
+dontaudit sced hwservicemanager_prop:file { read };
+dontaudit sced hwservicemanager_prop:file { open };
+dontaudit sced hwservicemanager:binder { transfer };
+dontaudit sced hwservicemanager_prop:file { map };
+dontaudit sced hwservicemanager_prop:file { getattr };
diff --git a/tracking_denials/shell.te b/tracking_denials/shell.te
new file mode 100644
index 0000000..66ac4fb
--- /dev/null
+++ b/tracking_denials/shell.te
@@ -0,0 +1,7 @@
+# b/171760597
+dontaudit shell property_type:file *;
+# b/178979984
+dontaudit shell device:chr_file { ioctl };
+dontaudit shell device:chr_file { read write };
+dontaudit shell device:chr_file { read write };
+dontaudit shell device:chr_file { ioctl };
diff --git a/tracking_denials/surfaceflinger.te b/tracking_denials/surfaceflinger.te
new file mode 100644
index 0000000..1f7fd2a
--- /dev/null
+++ b/tracking_denials/surfaceflinger.te
@@ -0,0 +1,12 @@
+# b/176868297
+dontaudit surfaceflinger hal_graphics_composer_default:dir search ;
+# b/177176899
+dontaudit surfaceflinger hal_graphics_composer_default:file open ;
+dontaudit surfaceflinger hal_graphics_composer_default:file read ;
+dontaudit surfaceflinger hal_graphics_composer_default:file getattr ;
+dontaudit surfaceflinger hal_graphics_composer_default:file read ;
+dontaudit surfaceflinger hal_graphics_composer_default:file open ;
+dontaudit surfaceflinger hal_graphics_composer_default:file read ;
+dontaudit surfaceflinger hal_graphics_composer_default:file open ;
+dontaudit surfaceflinger hal_graphics_composer_default:file getattr ;
+dontaudit surfaceflinger hal_graphics_composer_default:file getattr ;
diff --git a/tracking_denials/system_app.te b/tracking_denials/system_app.te
new file mode 100644
index 0000000..0dd274b
--- /dev/null
+++ b/tracking_denials/system_app.te
@@ -0,0 +1,4 @@
+# b/178433618
+dontaudit system_app property_type:file *;
+# b/179435036
+dontaudit system_app default_android_service:service_manager { add };
diff --git a/tracking_denials/system_server.te b/tracking_denials/system_server.te
new file mode 100644
index 0000000..d7e456a
--- /dev/null
+++ b/tracking_denials/system_server.te
@@ -0,0 +1,2 @@
+# b/178980142
+dontaudit system_server property_type:file *;
diff --git a/tracking_denials/tee.te b/tracking_denials/tee.te
new file mode 100644
index 0000000..9148a9c
--- /dev/null
+++ b/tracking_denials/tee.te
@@ -0,0 +1,11 @@
+# b/173971240
+dontaudit tee persist_file:file { open };
+dontaudit tee tee_data_file:lnk_file { read };
+dontaudit tee mnt_vendor_file:dir { search };
+dontaudit tee persist_file:dir { search };
+dontaudit tee persist_file:file { open };
+dontaudit tee persist_file:file { read write };
+dontaudit tee persist_file:dir { search };
+dontaudit tee mnt_vendor_file:dir { search };
+dontaudit tee tee_data_file:lnk_file { read };
+dontaudit tee persist_file:file { read write };
diff --git a/tracking_denials/trusty_apploader.te b/tracking_denials/trusty_apploader.te
new file mode 100644
index 0000000..0914a14
--- /dev/null
+++ b/tracking_denials/trusty_apploader.te
@@ -0,0 +1,9 @@
+# b/180874342
+dontaudit trusty_apploader dmabuf_system_heap_device:chr_file { read };
+dontaudit trusty_apploader dmabuf_system_heap_device:chr_file { open };
+dontaudit trusty_apploader dmabuf_system_heap_device:chr_file { ioctl };
+dontaudit trusty_apploader dmabuf_system_heap_device:chr_file { read };
+dontaudit trusty_apploader dmabuf_system_heap_device:chr_file { open };
+dontaudit trusty_apploader dmabuf_system_heap_device:chr_file { ioctl };
+dontaudit trusty_apploader trusty_apploader:capability { dac_override };
+dontaudit trusty_apploader trusty_apploader:capability { dac_override };
diff --git a/tracking_denials/untrusted_app.te b/tracking_denials/untrusted_app.te
new file mode 100644
index 0000000..703cdf5
--- /dev/null
+++ b/tracking_denials/untrusted_app.te
@@ -0,0 +1,14 @@
+# b/178331791
+dontaudit untrusted_app selinuxfs:file { open };
+dontaudit untrusted_app vendor_camera_prop:file { map };
+dontaudit untrusted_app vendor_camera_prop:file { open };
+dontaudit untrusted_app vendor_camera_prop:file { getattr };
+dontaudit untrusted_app selinuxfs:file { read };
+dontaudit untrusted_app selinuxfs:file { read };
+dontaudit untrusted_app selinuxfs:file { open };
+dontaudit untrusted_app vendor_camera_prop:file { open };
+dontaudit untrusted_app vendor_camera_prop:file { getattr };
+dontaudit untrusted_app vendor_camera_prop:file { map };
+# b/178433597
+dontaudit untrusted_app vendor_camera_prop:file { read };
+dontaudit untrusted_app vendor_camera_prop:file { read };
diff --git a/tracking_denials/untrusted_app_25.te b/tracking_denials/untrusted_app_25.te
new file mode 100644
index 0000000..3dcf461
--- /dev/null
+++ b/tracking_denials/untrusted_app_25.te
@@ -0,0 +1,149 @@
+# b/177389321
+dontaudit untrusted_app_25 ab_update_gki_prop:file { map };
+dontaudit untrusted_app_25 aac_drc_prop:file { open };
+dontaudit untrusted_app_25 ab_update_gki_prop:file { getattr };
+dontaudit untrusted_app_25 ab_update_gki_prop:file { open };
+dontaudit untrusted_app_25 aac_drc_prop:file { map };
+dontaudit untrusted_app_25 aac_drc_prop:file { getattr };
+# b/177614659
+dontaudit untrusted_app_25 apk_verity_prop:file { open };
+dontaudit untrusted_app_25 apexd_prop:file { getattr };
+dontaudit untrusted_app_25 apexd_prop:file { open };
+dontaudit untrusted_app_25 apexd_prop:file { map };
+dontaudit untrusted_app_25 apk_verity_prop:file { map };
+dontaudit untrusted_app_25 audio_config_prop:file { open };
+dontaudit untrusted_app_25 audio_config_prop:file { getattr };
+dontaudit untrusted_app_25 audio_config_prop:file { map };
+dontaudit untrusted_app_25 apk_verity_prop:file { getattr };
+# b/177616188
+dontaudit untrusted_app_25 bluetooth_a2dp_offload_prop:file { open };
+dontaudit untrusted_app_25 bluetooth_a2dp_offload_prop:file { getattr };
+dontaudit untrusted_app_25 bluetooth_a2dp_offload_prop:file { map };
+dontaudit untrusted_app_25 bluetooth_audio_hal_prop:file { open };
+dontaudit untrusted_app_25 bluetooth_audio_hal_prop:file { getattr };
+dontaudit untrusted_app_25 bluetooth_audio_hal_prop:file { map };
+dontaudit untrusted_app_25 bluetooth_prop:file { open };
+dontaudit untrusted_app_25 bluetooth_prop:file { getattr };
+dontaudit untrusted_app_25 bluetooth_prop:file { map };
+# b/177778551
+dontaudit untrusted_app_25 boottime_public_prop:file { open };
+dontaudit untrusted_app_25 bootloader_boot_reason_prop:file { getattr };
+dontaudit untrusted_app_25 bootloader_boot_reason_prop:file { map };
+dontaudit untrusted_app_25 boottime_prop:file { open };
+dontaudit untrusted_app_25 boottime_prop:file { getattr };
+dontaudit untrusted_app_25 boottime_prop:file { map };
+dontaudit untrusted_app_25 bootloader_boot_reason_prop:file { open };
+# b/177778793
+dontaudit untrusted_app_25 boottime_public_prop:file { getattr };
+dontaudit untrusted_app_25 boottime_public_prop:file { map };
+dontaudit untrusted_app_25 bpf_progs_loaded_prop:file { open };
+dontaudit untrusted_app_25 bpf_progs_loaded_prop:file { getattr };
+dontaudit untrusted_app_25 bpf_progs_loaded_prop:file { map };
+dontaudit untrusted_app_25 build_bootimage_prop:file { open };
+dontaudit untrusted_app_25 build_bootimage_prop:file { getattr };
+dontaudit untrusted_app_25 build_bootimage_prop:file { map };
+dontaudit untrusted_app_25 build_config_prop:file { open };
+# b/177860838
+dontaudit untrusted_app_25 charger_status_prop:file { open };
+dontaudit untrusted_app_25 charger_prop:file { map };
+dontaudit untrusted_app_25 charger_prop:file { getattr };
+dontaudit untrusted_app_25 charger_prop:file { open };
+dontaudit untrusted_app_25 charger_config_prop:file { map };
+dontaudit untrusted_app_25 charger_config_prop:file { getattr };
+dontaudit untrusted_app_25 build_config_prop:file { map };
+dontaudit untrusted_app_25 build_config_prop:file { getattr };
+dontaudit untrusted_app_25 charger_config_prop:file { open };
+# b/177862777
+dontaudit untrusted_app_25 charger_status_prop:file { getattr };
+dontaudit untrusted_app_25 charger_status_prop:file { map };
+dontaudit untrusted_app_25 cold_boot_done_prop:file { open };
+dontaudit untrusted_app_25 cold_boot_done_prop:file { getattr };
+dontaudit untrusted_app_25 cold_boot_done_prop:file { map };
+dontaudit untrusted_app_25 cpu_variant_prop:file { open };
+dontaudit untrusted_app_25 cpu_variant_prop:file { getattr };
+dontaudit untrusted_app_25 cpu_variant_prop:file { map };
+dontaudit untrusted_app_25 ctl_adbd_prop:file { open };
+# b/178752409
+dontaudit untrusted_app_25 ctl_adbd_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_apexd_prop:file { open };
+dontaudit untrusted_app_25 ctl_adbd_prop:file { map };
+dontaudit untrusted_app_25 ctl_apexd_prop:file { map };
+dontaudit untrusted_app_25 ctl_apexd_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_apexd_prop:file { open };
+dontaudit untrusted_app_25 ctl_adbd_prop:file { map };
+dontaudit untrusted_app_25 ctl_adbd_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_apexd_prop:file { map };
+dontaudit untrusted_app_25 ctl_bootanim_prop:file { map };
+dontaudit untrusted_app_25 ctl_bootanim_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_bootanim_prop:file { open };
+dontaudit untrusted_app_25 ctl_apexd_prop:file { getattr };
+# b/178753151
+dontaudit untrusted_app_25 ctl_bugreport_prop:file { open };
+dontaudit untrusted_app_25 ctl_bugreport_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_bugreport_prop:file { map };
+dontaudit untrusted_app_25 ctl_console_prop:file { open };
+dontaudit untrusted_app_25 ctl_console_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_console_prop:file { map };
+dontaudit untrusted_app_25 ctl_default_prop:file { open };
+dontaudit untrusted_app_25 ctl_default_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_bugreport_prop:file { open };
+dontaudit untrusted_app_25 ctl_bugreport_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_bugreport_prop:file { map };
+dontaudit untrusted_app_25 ctl_console_prop:file { open };
+dontaudit untrusted_app_25 ctl_console_prop:file { getattr };
+# b/179310875
+dontaudit untrusted_app_25 ctl_dumpstate_prop:file { map };
+dontaudit untrusted_app_25 ctl_fuse_prop:file { open };
+dontaudit untrusted_app_25 ctl_dumpstate_prop:file { map };
+dontaudit untrusted_app_25 ctl_dumpstate_prop:file { open };
+dontaudit untrusted_app_25 ctl_default_prop:file { map };
+dontaudit untrusted_app_25 ctl_dumpstate_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_dumpstate_prop:file { open };
+dontaudit untrusted_app_25 ctl_default_prop:file { map };
+dontaudit untrusted_app_25 ctl_gsid_prop:file { open };
+dontaudit untrusted_app_25 ctl_fuse_prop:file { map };
+dontaudit untrusted_app_25 ctl_fuse_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_fuse_prop:file { open };
+dontaudit untrusted_app_25 ctl_dumpstate_prop:file { getattr };
+# b/179437293
+dontaudit untrusted_app_25 ctl_interface_stop_prop:file { open };
+dontaudit untrusted_app_25 ctl_interface_restart_prop:file { map };
+dontaudit untrusted_app_25 ctl_interface_restart_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_interface_restart_prop:file { open };
+dontaudit untrusted_app_25 ctl_gsid_prop:file { map };
+dontaudit untrusted_app_25 ctl_gsid_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_interface_start_prop:file { map };
+dontaudit untrusted_app_25 ctl_interface_start_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_interface_start_prop:file { open };
+dontaudit untrusted_app_25 ctl_interface_restart_prop:file { map };
+dontaudit untrusted_app_25 ctl_interface_restart_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_interface_restart_prop:file { open };
+dontaudit untrusted_app_25 ctl_gsid_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_gsid_prop:file { map };
+# b/179437737
+dontaudit untrusted_app_25 ctl_interface_restart_prop:file { open };
+dontaudit untrusted_app_25 ctl_gsid_prop:file { map };
+dontaudit untrusted_app_25 ctl_gsid_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_interface_restart_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_interface_restart_prop:file { map };
+dontaudit untrusted_app_25 ctl_interface_start_prop:file { open };
+dontaudit untrusted_app_25 ctl_interface_start_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_interface_start_prop:file { map };
+dontaudit untrusted_app_25 ctl_gsid_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_gsid_prop:file { map };
+dontaudit untrusted_app_25 ctl_interface_restart_prop:file { open };
+dontaudit untrusted_app_25 ctl_interface_restart_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_interface_restart_prop:file { map };
+# b/180963328
+dontaudit untrusted_app_25 ctl_mdnsd_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_interface_stop_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_interface_stop_prop:file { map };
+dontaudit untrusted_app_25 ctl_mdnsd_prop:file { open };
+dontaudit untrusted_app_25 ctl_mdnsd_prop:file { map };
+dontaudit untrusted_app_25 ctl_mdnsd_prop:file { map };
+dontaudit untrusted_app_25 ctl_mdnsd_prop:file { getattr };
+dontaudit untrusted_app_25 ctl_mdnsd_prop:file { open };
+dontaudit untrusted_app_25 ctl_interface_stop_prop:file { map };
+dontaudit untrusted_app_25 ctl_interface_stop_prop:file { getattr };
+# b/180963587
+dontaudit untrusted_app_25 property_type:file *;
diff --git a/tracking_denials/update_engine.te b/tracking_denials/update_engine.te
new file mode 100644
index 0000000..e1f320a
--- /dev/null
+++ b/tracking_denials/update_engine.te
@@ -0,0 +1,5 @@
+# b/174961421
+dontaudit update_engine dumpstate:fifo_file write ;
+dontaudit update_engine dumpstate:fifo_file write ;
+dontaudit update_engine dumpstate:fd use ;
+dontaudit update_engine dumpstate:fd use ;
diff --git a/tracking_denials/vendor_init.te b/tracking_denials/vendor_init.te
new file mode 100644
index 0000000..f00248a
--- /dev/null
+++ b/tracking_denials/vendor_init.te
@@ -0,0 +1,20 @@
+# b/176528556
+dontaudit vendor_init tmpfs:dir { add_name write };
+# b/176528557
+dontaudit vendor_init debugfs_trace_marker:file { getattr };
+# b/177186257
+dontaudit vendor_init system_data_file:dir { open ioctl read };
+# b/174443175
+dontaudit vendor_init vendor_power_prop:property_service { set };
+# b/177386448
+dontaudit vendor_init device:file { create };
+dontaudit vendor_init device:file { create };
+# b/178980032
+dontaudit vendor_init unlabeled:dir { setattr };
+dontaudit vendor_init unlabeled:dir { read };
+dontaudit vendor_init unlabeled:dir { search };
+dontaudit vendor_init unlabeled:dir { search };
+dontaudit vendor_init unlabeled:dir { open };
+dontaudit vendor_init unlabeled:dir { read };
+dontaudit vendor_init unlabeled:dir { setattr };
+dontaudit vendor_init unlabeled:dir { open };
diff --git a/tracking_denials/vendor_telephony_app.te b/tracking_denials/vendor_telephony_app.te
new file mode 100644
index 0000000..2969a57
--- /dev/null
+++ b/tracking_denials/vendor_telephony_app.te
@@ -0,0 +1,21 @@
+# b/174961423
+dontaudit vendor_telephony_app vendor_persist_sys_default_prop:file open ;
+dontaudit vendor_telephony_app vendor_persist_sys_default_prop:file read ;
+dontaudit vendor_telephony_app system_app_data_file:dir search ;
+dontaudit vendor_telephony_app system_app_data_file:dir getattr ;
+dontaudit vendor_telephony_app system_data_file:dir search ;
+# b/176868380
+dontaudit vendor_telephony_app user_profile_root_file:dir search ;
+dontaudit vendor_telephony_app user_profile_root_file:dir search ;
+dontaudit vendor_telephony_app vendor_persist_sys_default_prop:file getattr ;
+dontaudit vendor_telephony_app vendor_persist_sys_default_prop:file map ;
+dontaudit vendor_telephony_app vendor_slog_file:dir search ;
+# b/177176900
+dontaudit vendor_telephony_app vendor_rild_prop:file getattr ;
+dontaudit vendor_telephony_app vendor_rild_prop:file open ;
+dontaudit vendor_telephony_app vendor_rild_prop:file read ;
+dontaudit vendor_telephony_app vendor_rild_prop:file map ;
+# b/179437464
+dontaudit vendor_telephony_app activity_service:service_manager { find };
+dontaudit vendor_telephony_app thermal_service:service_manager { find };
+dontaudit vendor_telephony_app tethering_service:service_manager { find };
diff --git a/usf/file.te b/usf/file.te
new file mode 100644
index 0000000..e264c27
--- /dev/null
+++ b/usf/file.te
@@ -0,0 +1,12 @@
+#
+# USF file SELinux type enforcements.
+#
+
+# Declare the sensor registry persist file type. By convention, persist file
+# types begin with "persist_".
+type persist_sensor_reg_file, file_type, vendor_persist_type;
+
+# Declare the sensor registry data file type. By convention, data file types
+# end with "data_file".
+type sensor_reg_data_file, file_type, data_file_type;
+
diff --git a/usf/file_contexts b/usf/file_contexts
new file mode 100644
index 0000000..ff3d41d
--- /dev/null
+++ b/usf/file_contexts
@@ -0,0 +1,10 @@
+#
+# USF SELinux file security contexts.
+#
+
+# Sensor registry persist files.
+/mnt/vendor/persist/sensors/registry(/.*)? u:object_r:persist_sensor_reg_file:s0
+
+# Sensor registry data files.
+/data/vendor/sensors/registry(/.*)? u:object_r:sensor_reg_data_file:s0
+
diff --git a/usf/sensor_hal.te b/usf/sensor_hal.te
new file mode 100644
index 0000000..afb7463
--- /dev/null
+++ b/usf/sensor_hal.te
@@ -0,0 +1,22 @@
+#
+# USF sensor HAL SELinux type enforcements.
+#
+
+# Allow reading of sensor registry persist files.
+allow hal_sensors_default persist_file:dir search;
+allow hal_sensors_default mnt_vendor_file:dir search;
+r_dir_file(hal_sensors_default, persist_sensor_reg_file)
+
+# Allow creation and writing of sensor registry data files.
+allow hal_sensors_default sensor_reg_data_file:dir rw_dir_perms;
+allow hal_sensors_default sensor_reg_data_file:file create_file_perms;
+
+# Allow access to the AoC communication driver.
+allow hal_sensors_default aoc_device:chr_file rw_file_perms;
+
+# Allow access to the AoC clock and kernel boot time sys FS node. This is needed
+# to synchronize the AP and AoC clock timestamps.
+allow hal_sensors_default sysfs_aoc_boottime:file rw_file_perms;
+
+# Allow create thread to watch AOC's device.
+allow hal_sensors_default device:dir r_dir_perms;
diff --git a/whitechapel/vendor/google/abox.te b/whitechapel/vendor/google/abox.te
new file mode 100644
index 0000000..eb2c3aa
--- /dev/null
+++ b/whitechapel/vendor/google/abox.te
@@ -0,0 +1,4 @@
+type abox, domain;
+type abox_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(abox)
+
diff --git a/whitechapel/vendor/google/aocd.te b/whitechapel/vendor/google/aocd.te
new file mode 100644
index 0000000..4cab55a
--- /dev/null
+++ b/whitechapel/vendor/google/aocd.te
@@ -0,0 +1,14 @@
+type aocd, domain;
+type aocd_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(aocd)
+
+# access persist files
+allow aocd mnt_vendor_file:dir search;
+allow aocd persist_file:dir search;
+
+# sysfs operations
+allow aocd sysfs_aoc:dir search;
+allow aocd sysfs_aoc_firmware:file w_file_perms;
+
+# dev operations
+allow aocd aoc_device:chr_file r_file_perms;
diff --git a/whitechapel/vendor/google/aocdump.te b/whitechapel/vendor/google/aocdump.te
new file mode 100644
index 0000000..bfd11d4
--- /dev/null
+++ b/whitechapel/vendor/google/aocdump.te
@@ -0,0 +1,16 @@
+type aocdump, domain;
+type aocdump_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(aocdump)
+
+userdebug_or_eng(`
+ # Permit communication with AoC
+ allow aocdump aoc_device:chr_file rw_file_perms;
+
+ allow aocdump radio_vendor_data_file:dir rw_dir_perms;
+ allow aocdump radio_vendor_data_file:file create_file_perms;
+ set_prop(aocdump, vendor_audio_prop);
+
+ allow aocdump self:unix_stream_socket create_stream_socket_perms;
+ allow aocdump property_socket:sock_file { write };
+ allow aocdump audio_vendor_data_file:sock_file { create unlink };
+')
diff --git a/whitechapel/vendor/google/attributes b/whitechapel/vendor/google/attributes
new file mode 100644
index 0000000..7e6def7
--- /dev/null
+++ b/whitechapel/vendor/google/attributes
@@ -0,0 +1 @@
+attribute vendor_persist_type;
diff --git a/whitechapel/vendor/google/bipchmgr.te b/whitechapel/vendor/google/bipchmgr.te
new file mode 100644
index 0000000..9298e32
--- /dev/null
+++ b/whitechapel/vendor/google/bipchmgr.te
@@ -0,0 +1,9 @@
+type bipchmgr, domain;
+type bipchmgr_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(bipchmgr)
+
+get_prop(bipchmgr, hwservicemanager_prop);
+
+allow bipchmgr hal_exynos_rild_hwservice:hwservice_manager find;
+hwbinder_use(bipchmgr)
+binder_call(bipchmgr, rild)
diff --git a/whitechapel/vendor/google/bootanim.te b/whitechapel/vendor/google/bootanim.te
new file mode 100644
index 0000000..7b3019d
--- /dev/null
+++ b/whitechapel/vendor/google/bootanim.te
@@ -0,0 +1,5 @@
+# TODO(b/62954877). On Android Wear, bootanim reads the time
+# during boot to display. It currently gets that time from a file
+# in /data/system. This should be moved. In the meantime, suppress
+# this denial on phones since this functionality is not used.
+dontaudit bootanim system_data_file:dir r_dir_perms;
diff --git a/whitechapel/vendor/google/bootdevice_sysdev.te b/whitechapel/vendor/google/bootdevice_sysdev.te
new file mode 100644
index 0000000..2ff0acb
--- /dev/null
+++ b/whitechapel/vendor/google/bootdevice_sysdev.te
@@ -0,0 +1 @@
+allow bootdevice_sysdev sysfs:filesystem associate;
diff --git a/whitechapel/vendor/google/cbd.te b/whitechapel/vendor/google/cbd.te
new file mode 100644
index 0000000..6e21902
--- /dev/null
+++ b/whitechapel/vendor/google/cbd.te
@@ -0,0 +1,44 @@
+type cbd, domain;
+type cbd_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(cbd)
+
+set_prop(cbd, vendor_modem_prop)
+set_prop(cbd, vendor_cbd_prop)
+set_prop(cbd, vendor_rild_prop)
+
+allow cbd kmsg_device:chr_file rw_file_perms;
+
+allow cbd vendor_shell_exec:file execute_no_trans;
+allow cbd vendor_toolbox_exec:file execute_no_trans;
+
+# Allow cbd to access modem block device
+allow cbd block_device:dir search;
+allow cbd modem_block_device:blk_file r_file_perms;
+
+# Allow cbd to access sysfs chosen files
+allow cbd sysfs_chosen:file r_file_perms;
+allow cbd sysfs_chosen:dir r_dir_perms;
+
+allow cbd radio_device:chr_file rw_file_perms;
+
+# Allow cbd to operate with modem EFS file/dir
+allow cbd modem_efs_file:dir create_dir_perms;
+allow cbd modem_efs_file:file create_file_perms;
+
+# Allow cbd to operate with modem userdata file/dir
+allow cbd modem_userdata_file:dir create_dir_perms;
+allow cbd modem_userdata_file:file create_file_perms;
+
+# Allow cbd to access modem image file/dir
+allow cbd modem_img_file:dir r_dir_perms;
+allow cbd modem_img_file:file r_file_perms;
+
+# Allow cbd to collect crash info
+allow cbd sscoredump_vendor_data_crashinfo_file:dir r_dir_perms;
+allow cbd sscoredump_vendor_data_crashinfo_file:file create_file_perms;
+
+userdebug_or_eng(`
+ allow cbd sscoredump_vendor_data_coredump_file:dir create_dir_perms;
+ allow cbd sscoredump_vendor_data_coredump_file:file create_file_perms;
+')
+
diff --git a/whitechapel/vendor/google/chre.te b/whitechapel/vendor/google/chre.te
new file mode 100644
index 0000000..f8d395f
--- /dev/null
+++ b/whitechapel/vendor/google/chre.te
@@ -0,0 +1,13 @@
+type chre, domain;
+type chre_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(chre)
+
+# Permit communication with AoC
+allow chre aoc_device:chr_file rw_file_perms;
+
+# Allow CHRE to determine AoC's current clock
+allow chre sysfs_aoc:dir search;
+allow chre sysfs_aoc_boottime:file r_file_perms;
+
+# Allow CHRE to create thread to watch AOC's device
+allow chre device:dir r_dir_perms;
diff --git a/whitechapel/vendor/google/device.te b/whitechapel/vendor/google/device.te
new file mode 100644
index 0000000..375c91c
--- /dev/null
+++ b/whitechapel/vendor/google/device.te
@@ -0,0 +1,52 @@
+# Block Devices
+type efs_block_device, dev_type;
+type fat_block_device, dev_type;
+type modem_block_device, dev_type;
+type modem_userdata_block_device, dev_type;
+type persist_block_device, dev_type;
+type vendor_block_device, dev_type;
+type sda_block_device, dev_type;
+
+# Exynos devices
+type vendor_m2m1shot_device, dev_type;
+type vendor_gnss_device, dev_type;
+type vendor_nanohub_device, dev_type;
+type vendor_secmem_device, dev_type;
+type pktrouter_device, dev_type;
+type vendor_toe_device, dev_type;
+type custom_ab_block_device, dev_type;
+type devinfo_block_device, dev_type;
+type tui_device, dev_type;
+
+# usbpd
+type logbuffer_device, dev_type;
+
+# EdgeTPU device (DarwiNN)
+type edgetpu_device, dev_type, mlstrustedobject;
+
+#cpuctl
+type cpuctl_device, dev_type;
+
+# Bt Wifi Coexistence device
+type wb_coexistence_dev, dev_type;
+
+# LWIS (Lightweight Imaging Subsystem) devices, used by Lyric camera HAL
+type lwis_device, dev_type;
+
+# sensor direct DMA-BUF heap
+type sensor_direct_heap_device, dmabuf_heap_device_type, dev_type;
+
+#faceauth DMA-BUF heaps
+type faceauth_heap_device, dmabuf_heap_device_type, dev_type;
+
+#vframe-secure DMA-BUF heap
+type vframe_heap_device, dmabuf_heap_device_type, dev_type;
+
+#vscaler-secure DMA-BUF heap
+type vscaler_heap_device, dmabuf_heap_device_type, dev_type;
+
+# subsystem-coredump
+type sscoredump_device, dev_type;
+
+# AOC device
+type aoc_device, dev_type;
diff --git a/whitechapel/vendor/google/dmd.te b/whitechapel/vendor/google/dmd.te
new file mode 100644
index 0000000..c0c695f
--- /dev/null
+++ b/whitechapel/vendor/google/dmd.te
@@ -0,0 +1,29 @@
+type dmd, domain;
+type dmd_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(dmd)
+
+# Grant to access serial device for external logging tool
+allow dmd serial_device:chr_file rw_file_perms;
+
+# Grant to access radio device
+allow dmd radio_device:chr_file rw_file_perms;
+
+# Grant to access slog dir/file
+allow dmd vendor_slog_file:dir create_dir_perms;
+allow dmd vendor_slog_file:file create_file_perms;
+
+# Grant to access tcp socket
+allow dmd node:tcp_socket node_bind;
+allow dmd self:tcp_socket { create_socket_perms_no_ioctl listen accept bind };
+
+# Grant to access log related properties
+set_prop(dmd, vendor_diag_prop)
+set_prop(dmd, vendor_slog_prop)
+set_prop(dmd, vendor_modem_prop)
+
+get_prop(dmd, vendor_persist_config_default_prop)
+
+# Grant to access hwservice manager
+get_prop(dmd, hwservicemanager_prop)
+add_hwservice(dmd, hal_vendor_oem_hwservice)
+binder_call(dmd, hwservicemanager)
diff --git a/whitechapel/vendor/google/domain.te b/whitechapel/vendor/google/domain.te
new file mode 100644
index 0000000..cffaf8c
--- /dev/null
+++ b/whitechapel/vendor/google/domain.te
@@ -0,0 +1 @@
+allow {domain -appdomain -rs} sysfs_vendor_sched:file w_file_perms;
diff --git a/whitechapel/vendor/google/dumpstate.te b/whitechapel/vendor/google/dumpstate.te
new file mode 100644
index 0000000..fb32505
--- /dev/null
+++ b/whitechapel/vendor/google/dumpstate.te
@@ -0,0 +1,4 @@
+dump_hal(hal_telephony)
+
+allow dumpstate sysfs_scsi_devices_0000:file r_file_perms;
+allow dumpstate persist_file:dir r_dir_perms;
diff --git a/whitechapel/vendor/google/edgetpu_logging.te b/whitechapel/vendor/google/edgetpu_logging.te
new file mode 100644
index 0000000..021338f
--- /dev/null
+++ b/whitechapel/vendor/google/edgetpu_logging.te
@@ -0,0 +1,6 @@
+type edgetpu_logging, domain;
+type edgetpu_logging_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(edgetpu_logging)
+
+# The logging service accesses /dev/abrolhos
+allow edgetpu_logging edgetpu_device:chr_file rw_file_perms;
diff --git a/whitechapel/vendor/google/edgetpu_service.te b/whitechapel/vendor/google/edgetpu_service.te
new file mode 100644
index 0000000..241a87e
--- /dev/null
+++ b/whitechapel/vendor/google/edgetpu_service.te
@@ -0,0 +1,28 @@
+# EdgeTPU server process which runs the EdgeTPU binder service.
+type edgetpu_server, coredomain, domain;
+type edgetpu_server_exec, exec_type, system_file_type, file_type;
+init_daemon_domain(edgetpu_server, edgetpu_server_exec)
+
+# The server will use binder calls.
+binder_use(edgetpu_server);
+
+# The server will serve a binder service.
+binder_service(edgetpu_server);
+
+# EdgeTPU binder service type declaration.
+type edgetpu_service, service_manager_type;
+
+# EdgeTPU server to register the service to service_manager.
+add_service(edgetpu_server, edgetpu_service);
+
+# EdgeTPU service needs to access /dev/abrolhos.
+allow edgetpu_server edgetpu_device:chr_file rw_file_perms;
+allow edgetpu_server sysfs_edgetpu:dir r_dir_perms;
+allow edgetpu_server sysfs_edgetpu:file rw_file_perms;
+
+# Applications are not allowed to open the EdgeTPU device directly.
+neverallow appdomain edgetpu_device:chr_file { open };
+
+# Allow EdgeTPU service access to its data files.
+allow edgetpu_server edgetpu_service_data_file:file create_file_perms;
+allow edgetpu_server edgetpu_service_data_file:dir rw_dir_perms;
diff --git a/whitechapel/vendor/google/exo_camera_injection/dumpstate.te b/whitechapel/vendor/google/exo_camera_injection/dumpstate.te
new file mode 100644
index 0000000..1a5b393
--- /dev/null
+++ b/whitechapel/vendor/google/exo_camera_injection/dumpstate.te
@@ -0,0 +1,2 @@
+# For collecting bugreports.
+dump_hal(hal_camera)
diff --git a/whitechapel/vendor/google/exo_camera_injection/file_contexts b/whitechapel/vendor/google/exo_camera_injection/file_contexts
new file mode 100644
index 0000000..cfcbd6f
--- /dev/null
+++ b/whitechapel/vendor/google/exo_camera_injection/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/hw/vendor\.google\.exo_camera_injection@1\.0-service u:object_r:hal_exo_camera_injection_exec:s0
diff --git a/whitechapel/vendor/google/exo_camera_injection/hal_exo_camera_injection.te b/whitechapel/vendor/google/exo_camera_injection/hal_exo_camera_injection.te
new file mode 100644
index 0000000..138d1b1
--- /dev/null
+++ b/whitechapel/vendor/google/exo_camera_injection/hal_exo_camera_injection.te
@@ -0,0 +1,10 @@
+# TODO(b/180558115): It will moved to pixel-sepolicy after pixel 6 launches.
+type hal_exo_camera_injection, domain;
+hal_server_domain(hal_exo_camera_injection, hal_camera)
+
+type hal_exo_camera_injection_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_exo_camera_injection)
+
+hwbinder_use(hal_exo_camera_injection)
+add_hwservice(hal_exo_camera_injection, hal_exo_camera_injection_hwservice)
+allow hal_exo_camera_injection hal_graphics_mapper_hwservice:hwservice_manager find;
diff --git a/whitechapel/vendor/google/exo_camera_injection/hwservice.te b/whitechapel/vendor/google/exo_camera_injection/hwservice.te
new file mode 100644
index 0000000..cea9768
--- /dev/null
+++ b/whitechapel/vendor/google/exo_camera_injection/hwservice.te
@@ -0,0 +1 @@
+type hal_exo_camera_injection_hwservice, hwservice_manager_type;
diff --git a/whitechapel/vendor/google/exo_camera_injection/hwservice_contexts b/whitechapel/vendor/google/exo_camera_injection/hwservice_contexts
new file mode 100644
index 0000000..59ccfe6
--- /dev/null
+++ b/whitechapel/vendor/google/exo_camera_injection/hwservice_contexts
@@ -0,0 +1 @@
+vendor.google.exo_camera_injection::IExoCameraInjection u:object_r:hal_exo_camera_injection_hwservice:s0
diff --git a/whitechapel/vendor/google/exo_camera_injection/platform_app.te b/whitechapel/vendor/google/exo_camera_injection/platform_app.te
new file mode 100644
index 0000000..b4dee87
--- /dev/null
+++ b/whitechapel/vendor/google/exo_camera_injection/platform_app.te
@@ -0,0 +1,3 @@
+# Allow exo app to find and bind exo camera injection hal.
+allow platform_app hal_exo_camera_injection_hwservice:hwservice_manager find;
+binder_call(platform_app, hal_exo_camera_injection)
diff --git a/whitechapel/vendor/google/file.te b/whitechapel/vendor/google/file.te
new file mode 100644
index 0000000..5ec18e2
--- /dev/null
+++ b/whitechapel/vendor/google/file.te
@@ -0,0 +1,177 @@
+# Exynos Data Files
+#type vendor_data_file, file_type, data_file_type;
+type vendor_cbd_boot_file, file_type, data_file_type;
+type vendor_media_data_file, file_type, data_file_type;
+
+# Exynos Log Files
+type vendor_log_file, file_type, data_file_type;
+type vendor_abox_log_file, file_type, data_file_type;
+type vendor_cbd_log_file, file_type, data_file_type;
+type vendor_dmd_log_file, file_type, data_file_type;
+type vendor_rfsd_log_file, file_type, data_file_type;
+type vendor_dump_log_file, file_type, data_file_type;
+type vendor_rild_log_file, file_type, data_file_type;
+type vendor_sced_log_file, file_type, data_file_type;
+type vendor_slog_file, file_type, data_file_type, mlstrustedobject;
+type vendor_telephony_log_file, file_type, data_file_type;
+type vendor_vcd_log_file, file_type, data_file_type;
+
+# app data files
+type vendor_test_data_file, file_type, data_file_type;
+type vendor_telephony_data_file, file_type, data_file_type;
+type vendor_ims_data_file, file_type, data_file_type;
+type vendor_misc_data_file, file_type, data_file_type;
+type vendor_rpmbmock_data_file, file_type, data_file_type;
+
+# Exynos debugfs
+type vendor_abox_debugfs, fs_type, debugfs_type;
+type vendor_ion_debugfs, fs_type, debugfs_type, sysfs_type;
+type vendor_dmabuf_debugfs, fs_type, debugfs_type, sysfs_type;
+type vendor_mali_debugfs, fs_type, debugfs_type;
+type vendor_dri_debugfs, fs_type, debugfs_type, sysfs_type;
+type vendor_pm_genpd_debugfs, fs_type, debugfs_type, sysfs_type;
+type vendor_regmap_debugfs, fs_type, debugfs_type, sysfs_type;
+type vendor_usb_debugfs, fs_type, debugfs_type, sysfs_type;
+type vendor_maxfg_debugfs, fs_type, debugfs_type, sysfs_type;
+type vendor_charger_debugfs, fs_type, debugfs_type, sysfs_type;
+type vendor_votable_debugfs, fs_type, debugfs_type, sysfs_type;
+type vendor_battery_debugfs, fs_type, debugfs_type, sysfs_type;
+
+# Exynos sysfs
+type sysfs_exynos_bts, sysfs_type, fs_type;
+type sysfs_exynos_bts_stats, sysfs_type, fs_type;
+
+# Exynos Firmware
+type vendor_fw_file, vendor_file_type, file_type;
+
+# ACPM
+type sysfs_acpm_stats, sysfs_type, fs_type;
+
+# Vendor tools
+type vendor_usf_stats, vendor_file_type, file_type;
+type vendor_dumpsys, vendor_file_type, file_type;
+
+# Sensors
+type nanohub_lock_file, file_type, data_file_type;
+type sensor_vendor_data_file, file_type, data_file_type, mlstrustedobject;
+type sensors_cal_file, file_type;
+type sysfs_nanoapp_cmd, sysfs_type, fs_type;
+
+# CHRE
+type chre_socket, file_type;
+
+# IOMMU
+type sysfs_iommu, sysfs_type, fs_type;
+
+type sysfs_devicetree, sysfs_type, fs_type;
+type sysfs_mem, sysfs_type, fs_type;
+type sysfs_sscoredump_level, sysfs_type, fs_type;
+
+# WiFi
+type sysfs_wifi, sysfs_type, fs_type;
+
+# Widevine DRM
+type mediadrm_vendor_data_file, file_type, data_file_type;
+
+# Subsystem coredump
+type sscoredump_vendor_data_coredump_file, file_type, data_file_type, mlstrustedobject;
+type sscoredump_vendor_data_crashinfo_file, file_type, data_file_type, mlstrustedobject;
+
+# Storage Health HAL
+type sysfs_scsi_devices_0000, sysfs_type, fs_type;
+type debugfs_f2fs, debugfs_type, fs_type;
+type proc_f2fs, proc_type, fs_type;
+
+type bootdevice_sysdev, dev_type;
+
+# ZRam
+type per_boot_file, file_type, data_file_type, core_data_file_type;
+
+# Touch
+type proc_touch, proc_type, fs_type, mlstrustedobject;
+type sysfs_touch, sysfs_type, fs_type;
+
+# AOC
+type sysfs_aoc_boottime, sysfs_type, fs_type;
+type sysfs_aoc_firmware, sysfs_type, fs_type;
+type sysfs_aoc, sysfs_type, fs_type;
+
+# Audio
+type persist_audio_file, file_type , vendor_persist_type;
+type audio_vendor_data_file, file_type, data_file_type;
+type aoc_audio_file, file_type, vendor_file_type;
+
+# Radio
+type radio_vendor_data_file, file_type, data_file_type, mlstrustedobject;
+
+# RILD
+type rild_vendor_data_file, file_type, data_file_type;
+
+# Modem
+type modem_stat_data_file, file_type, data_file_type;
+type modem_efs_file, file_type;
+type modem_img_file, file_type;
+type modem_userdata_file, file_type;
+type sysfs_modem, sysfs_type, fs_type;
+
+# Wireless
+type sysfs_wlc, sysfs_type, fs_type;
+
+# Kernel modules
+type vendor_kernel_modules, vendor_file_type, file_type;
+
+# Camera
+type persist_camera_file, file_type;
+type vendor_camera_tuning_file, vendor_file_type, file_type;
+type vendor_camera_data_file, file_type, data_file_type;
+
+# EdgeTPU device (DarwiNN)
+type hal_neuralnetworks_darwinn_data_file, file_type, data_file_type;
+
+# EdgeTPU
+type edgetpu_service_data_file, file_type, data_file_type, core_data_file_type;
+type sysfs_edgetpu, sysfs_type, fs_type;
+
+# Vendor sched files
+type sysfs_vendor_sched, sysfs_type, fs_type;
+
+# GPS
+type vendor_gps_file, file_type, data_file_type;
+userdebug_or_eng(`
+ typeattribute vendor_gps_file mlstrustedobject;
+')
+type sysfs_gps, sysfs_type, fs_type;
+
+# Display
+type sysfs_display, sysfs_type, fs_type;
+
+# Backlight
+type sysfs_backlight, sysfs_type, fs_type;
+
+# Charger
+type sysfs_chargelevel, sysfs_type, fs_type;
+
+# ODPM
+type odpm_config_file, file_type, data_file_type;
+type sysfs_odpm, sysfs_type, fs_type;
+
+# Chosen
+type sysfs_chosen, sysfs_type, fs_type;
+
+type sysfs_chip_id, sysfs_type, fs_type;
+type sysfs_spi, sysfs_type, fs_type;
+
+# subsystem-coredump
+type sscoredump_sysfs_level, sysfs_type, fs_type;
+
+# Battery
+type persist_battery_file, file_type, vendor_persist_type;
+
+# CPU
+type sysfs_cpu, sysfs_type, fs_type;
+
+# Memory
+type sysfs_memory, sysfs_type, fs_type;
+
+# bcmdhd (Broadcom FullMAC wireless cards support)
+type sysfs_bcmdhd, sysfs_type, fs_type;
diff --git a/whitechapel/vendor/google/file_contexts b/whitechapel/vendor/google/file_contexts
new file mode 100644
index 0000000..d16737e
--- /dev/null
+++ b/whitechapel/vendor/google/file_contexts
@@ -0,0 +1,397 @@
+#
+# Exynos HAL
+#
+/(vendor|system/vendor)/bin/hw/android\.hardware\.drm@1\.4-service\.widevine u:object_r:hal_drm_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.drm@1\.3-service\.clearkey u:object_r:hal_drm_clearkey_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.usb@1\.0-service32 u:object_r:hal_usb_default_exec:s0
+/(vendor|system/vendor)/bin/hw/vendor\.samsung_slsi\.hardware\.ExynosHWCServiceTW@1\.0-service u:object_r:hal_vendor_hwcservice_default_exec:s0
+/(vendor|system/vendor)/bin/hw/vendor\.samsung_slsi\.hardware\.power@1\.0-service u:object_r:hal_power_default_exec:s0
+/(vendor|system/vendor)/bin/hw/vendor\.samsung_slsi\.hardware\.configstore@1\.0-service u:object_r:hal_configstore_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.usb@1\.3-service\.gs101 u:object_r:hal_usb_impl_exec:s0
+/(vendor|system/vendor)/lib(64)?/libion_exynos\.so u:object_r:same_process_hal_file:s0
+
+/(vendor|system/vendor)/lib(64)?/libOpenCL\.so u:object_r:same_process_hal_file:s0
+/(vendor|system/vendor)/lib(64)?/libOpenCL-pixel\.so u:object_r:same_process_hal_file:s0
+/(vendor|system/vendor)/lib(64)?/libdmabufheap\.so u:object_r:same_process_hal_file:s0
+
+/vendor/bin/usf_stats u:object_r:vendor_usf_stats:s0
+/vendor/bin/dumpsys u:object_r:vendor_dumpsys:s0
+
+#
+# HALs
+#
+/(vendor|system/vendor)/bin/hw/android\.hardware\.boot@1\.[0-2]-service-gs101 u:object_r:hal_bootctl_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.gnss@1\.1-service-brcm u:object_r:hal_gnss_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.gnss@2\.0-service-brcm u:object_r:hal_gnss_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.gnss@[0-9]\.[0-9]-service-brcm u:object_r:hal_gnss_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.dumpstate@1\.0-service\.gs101 u:object_r:hal_dumpstate_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.power\.stats@1\.0-service\.gs101 u:object_r:hal_power_stats_default_exec:s0
+# Wireless charger HAL
+/(vendor|system/vendor)/bin/hw/vendor\.google\.wireless_charger@1\.2-service-vendor u:object_r:hal_wlc_exec:s0
+
+# Vendor Firmwares
+/(vendor|system/vendor)/firmware(/.*)? u:object_r:vendor_fw_file:s0
+
+#
+# Exynos Block Devices
+#
+/dev/block/platform/14700000\.ufs/by-name/cache u:object_r:cache_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/efs u:object_r:efs_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/efs_backup u:object_r:efs_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/modem_userdata u:object_r:modem_userdata_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/fat u:object_r:fat_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/modem_[ab] u:object_r:modem_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/modem u:object_r:modem_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/persist u:object_r:persist_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/system u:object_r:system_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/userdata u:object_r:userdata_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/vendor u:object_r:vendor_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/frp u:object_r:frp_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/misc u:object_r:misc_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/devinfo u:object_r:devinfo_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/abl_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/acpm_test_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/bl1_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/bl2_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/bl31_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/boot_[ab] u:object_r:boot_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/dram_train_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/dtb_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/dtbo_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/ect_test_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/gsa_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/hypervisor_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/keystorage_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/ldfw_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/metadata u:object_r:metadata_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/pbl_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/reclaim_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/super u:object_r:super_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/tzsw_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/vbmeta_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/vbmeta_system_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/platform/14700000\.ufs/by-name/vendor_boot_[ab] u:object_r:custom_ab_block_device:s0
+/dev/block/sda u:object_r:sda_block_device:s0
+/dev/sys/block/bootdevice(/.*)? u:object_r:bootdevice_sysdev:s0
+
+#
+# Exynos Devices
+#
+/dev/gnss_ipc u:object_r:vendor_gnss_device:s0
+/dev/bbd_control u:object_r:vendor_gnss_device:s0
+/dev/ttyBCM u:object_r:vendor_gnss_device:s0
+/dev/nanohub u:object_r:vendor_nanohub_device:s0
+/dev/nanohub_comms u:object_r:vendor_nanohub_device:s0
+/dev/m2m1shot_scaler0 u:object_r:vendor_m2m1shot_device:s0
+/dev/radio0 u:object_r:radio_device:s0
+/dev/dri/card0 u:object_r:graphics_device:s0
+/dev/fimg2d u:object_r:graphics_device:s0
+/dev/g2d u:object_r:graphics_device:s0
+/dev/tsmux u:object_r:video_device:s0
+/dev/repeater u:object_r:video_device:s0
+/dev/scsc_h4_0 u:object_r:radio_device:s0
+/dev/umts_boot0 u:object_r:radio_device:s0
+/dev/tui-driver u:object_r:tui_device:s0
+/dev/logbuffer_usbpd u:object_r:logbuffer_device:s0
+/dev/logbuffer_ssoc u:object_r:logbuffer_device:s0
+/dev/logbuffer_wireless u:object_r:logbuffer_device:s0
+/dev/logbuffer_ttf u:object_r:logbuffer_device:s0
+/dev/logbuffer_maxq u:object_r:logbuffer_device:s0
+/dev/logbuffer_rtx u:object_r:logbuffer_device:s0
+/dev/logbuffer_maxfg u:object_r:logbuffer_device:s0
+
+# DM tools device
+/dev/umts_dm0 u:object_r:radio_device:s0
+/dev/umts_router u:object_r:radio_device:s0
+
+# OEM IPC device
+/dev/oem_ipc[0-7] u:object_r:radio_device:s0
+
+# SIPC RIL device
+/dev/umts_ipc0 u:object_r:radio_device:s0
+/dev/umts_ipc1 u:object_r:radio_device:s0
+/dev/umts_rfs0 u:object_r:radio_device:s0
+/dev/ttyGS[0-3] u:object_r:serial_device:s0
+/dev/watchdog0 u:object_r:watchdog_device:s0
+
+# GPU device
+/dev/mali0 u:object_r:gpu_device:s0
+/dev/s5p-smem u:object_r:vendor_secmem_device:s0
+/dev/umts_wfc[01] u:object_r:pktrouter_device:s0
+
+#
+# Exynos Daemon Exec
+#
+/(vendor|system/vendor)/bin/cbd u:object_r:cbd_exec:s0
+/(vendor|system/vendor)/bin/dmd u:object_r:dmd_exec:s0
+/(vendor|system/vendor)/bin/hw/scd u:object_r:scd_exec:s0
+/(vendor|system/vendor)/bin/hw/gpsd u:object_r:gpsd_exec:s0
+/(vendor|system/vendor)/bin/hw/lhd u:object_r:lhd_exec:s0
+/(vendor|system/vendor)/bin/hw/rild_exynos u:object_r:rild_exec:s0
+/(vendor|system/vendor)/bin/main_abox u:object_r:abox_exec:s0
+/(vendor|system/vendor)/bin/rfsd u:object_r:rfsd_exec:s0
+/(vendor|system/vendor)/bin/rpmbd u:object_r:rpmbd_exec:s0
+/(vendor|system/vendor)/bin/sced u:object_r:sced_exec:s0
+/(vendor|system/vendor)/bin/vcd u:object_r:vcd_exec:s0
+/(vendor|system/vendor)/bin/bipchmgr u:object_r:bipchmgr_exec:s0
+
+# WFC
+/(vendor|system/vendor)/bin/wfc-pkt-router u:object_r:pktrouter_exec:s0
+
+#
+# Exynos Data Files
+#
+# gnss/gps data/log files
+/data/vendor/gps(/.*)? u:object_r:vendor_gps_file:s0
+
+#
+# Exynos Log Files
+#
+/data/vendor/log(/.*)? u:object_r:vendor_log_file:s0
+/data/vendor/log/abox(/.*)? u:object_r:vendor_abox_log_file:s0
+/data/vendor/log/cbd(/.*)? u:object_r:vendor_cbd_log_file:s0
+/data/vendor/log/dmd(/.*)? u:object_r:vendor_dmd_log_file:s0
+/data/vendor/log/rfsd(/.*)? u:object_r:vendor_rfsd_log_file:s0
+/data/vendor/log/dump(/.*)? u:object_r:vendor_dump_log_file:s0
+/data/vendor/log/rild(/.*)? u:object_r:vendor_rild_log_file:s0
+/data/vendor/log/sced(/.*)? u:object_r:vendor_sced_log_file:s0
+/data/vendor/log/slog(/.*)? u:object_r:vendor_slog_file:s0
+/data/vendor/slog(/.*)? u:object_r:vendor_slog_file:s0
+/data/vendor/log/vcd(/.*)? u:object_r:vendor_vcd_log_file:s0
+
+/persist/sensorcal\.json u:object_r:sensors_cal_file:s0
+
+# data files
+/data/vendor/mediadrm(/.*)? u:object_r:mediadrm_vendor_data_file:s0
+
+# Camera
+/vendor/bin/hw/android\.hardware\.camera\.provider@2\.7-service-google u:object_r:hal_camera_default_exec:s0
+/vendor/lib64/camera u:object_r:vendor_camera_tuning_file:s0
+/vendor/lib64/camera/ghawb_para_lut\.bin u:object_r:vendor_camera_tuning_file:s0
+/vendor/lib64/camera/slider_.*\.binarypb u:object_r:vendor_camera_tuning_file:s0
+/vendor/bin/rlsservice u:object_r:rlsservice_exec:s0
+/mnt/vendor/persist/camera(/.*)? u:object_r:persist_camera_file:s0
+/data/vendor/camera(/.*)? u:object_r:vendor_camera_data_file:s0
+
+/dev/lwis-act0 u:object_r:lwis_device:s0
+/dev/lwis-act1 u:object_r:lwis_device:s0
+/dev/lwis-act-ak7377 u:object_r:lwis_device:s0
+/dev/lwis-act-sem1215sa u:object_r:lwis_device:s0
+/dev/lwis-csi u:object_r:lwis_device:s0
+/dev/lwis-dpm u:object_r:lwis_device:s0
+/dev/lwis-eeprom0 u:object_r:lwis_device:s0
+/dev/lwis-eeprom1 u:object_r:lwis_device:s0
+/dev/lwis-eeprom2 u:object_r:lwis_device:s0
+/dev/lwis-eeprom-lc898128 u:object_r:lwis_device:s0
+/dev/lwis-eeprom-m24c64s u:object_r:lwis_device:s0
+/dev/lwis-eeprom-m24c64x u:object_r:lwis_device:s0
+/dev/lwis-eeprom-m24c64x-imx386 u:object_r:lwis_device:s0
+/dev/lwis-eeprom-m24c64x-imx663 u:object_r:lwis_device:s0
+/dev/lwis-eeprom-sem1215sa u:object_r:lwis_device:s0
+/dev/lwis-flash0 u:object_r:lwis_device:s0
+/dev/lwis-flash-lm3644 u:object_r:lwis_device:s0
+/dev/lwis-g3aa u:object_r:lwis_device:s0
+/dev/lwis-gdc0 u:object_r:lwis_device:s0
+/dev/lwis-gdc1 u:object_r:lwis_device:s0
+/dev/lwis-gtnr-align u:object_r:lwis_device:s0
+/dev/lwis-gtnr-merge u:object_r:lwis_device:s0
+/dev/lwis-ipp u:object_r:lwis_device:s0
+/dev/lwis-itp u:object_r:lwis_device:s0
+/dev/lwis-mcsc u:object_r:lwis_device:s0
+/dev/lwis-ois-lc898128 u:object_r:lwis_device:s0
+/dev/lwis-ois-sem1215sa u:object_r:lwis_device:s0
+/dev/lwis-pdp u:object_r:lwis_device:s0
+/dev/lwis-scsc u:object_r:lwis_device:s0
+/dev/lwis-sensor0 u:object_r:lwis_device:s0
+/dev/lwis-sensor1 u:object_r:lwis_device:s0
+/dev/lwis-sensor2 u:object_r:lwis_device:s0
+/dev/lwis-sensor-gn1 u:object_r:lwis_device:s0
+/dev/lwis-sensor-imx355 u:object_r:lwis_device:s0
+/dev/lwis-sensor-imx386 u:object_r:lwis_device:s0
+/dev/lwis-sensor-imx586 u:object_r:lwis_device:s0
+/dev/lwis-sensor-imx663 u:object_r:lwis_device:s0
+/dev/lwis-slc u:object_r:lwis_device:s0
+/dev/lwis-top u:object_r:lwis_device:s0
+/dev/lwis-votf u:object_r:lwis_device:s0
+
+# VIDEO
+/vendor/bin/hw/samsung\.hardware\.media\.c2@1\.0-service u:object_r:mediacodec_exec:s0
+/vendor/bin/hw/google\.hardware\.media\.c2@1\.0-service u:object_r:mediacodec_exec:s0
+/data/vendor/media(/.*)? u:object_r:vendor_media_data_file:s0
+
+# thermal sysfs files
+/sys/class/thermal(/.*)? u:object_r:sysfs_thermal:s0
+/sys/devices/virtual/thermal(/.*)? u:object_r:sysfs_thermal:s0
+
+
+# IMS VoWiFi
+/data/vendor/misc(/.*)? u:object_r:vendor_misc_data_file:s0
+/data/vendor/VoWiFi(/.*)? u:object_r:vendor_ims_data_file:s0
+
+# Sensors
+/data/vendor/sensor(/.*)? u:object_r:sensor_vendor_data_file:s0
+/dev/acd-com.google.usf u:object_r:aoc_device:s0
+/dev/acd-logging u:object_r:aoc_device:s0
+/dev/aoc u:object_r:aoc_device:s0
+
+# Contexthub
+/vendor/bin/hw/android\.hardware\.contexthub@1\.2-service\.small_fragments u:object_r:hal_contexthub_default_exec:s0
+/(vendor|system/vendor)/bin/chre u:object_r:chre_exec:s0
+/dev/socket/chre u:object_r:chre_socket:s0
+
+# Modem logging
+/vendor/bin/modem_logging_control u:object_r:modem_logging_control_exec:s0
+
+# Audio logging
+/vendor/bin/aocdump u:object_r:aocdump_exec:s0
+
+# modem_svc_sit files
+/vendor/bin/modem_svc_sit u:object_r:modem_svc_sit_exec:s0
+/data/vendor/modem_stat/debug\.txt u:object_r:modem_stat_data_file:s0
+
+# modem mnt files
+/mnt/vendor/efs(/.*)? u:object_r:modem_efs_file:s0
+/mnt/vendor/efs_backup(/.*)? u:object_r:modem_efs_file:s0
+/mnt/vendor/modem_img(/.*)? u:object_r:modem_img_file:s0
+/mnt/vendor/modem_userdata(/.*)? u:object_r:modem_userdata_file:s0
+
+# Subsystem coredump
+/vendor/bin/sscoredump u:object_r:sscoredump_exec:s0
+/data/vendor/ssrdump(/.*)? u:object_r:sscoredump_vendor_data_crashinfo_file:s0
+/data/vendor/ssrdump/coredump(/.*)? u:object_r:sscoredump_vendor_data_coredump_file:s0
+/dev/sscd_.* u:object_r:sscoredump_device:s0
+
+# Kernel modules related
+/vendor/bin/init\.insmod\.sh u:object_r:init-insmod-sh_exec:s0
+
+# NFC
+/(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@1\.2-service\.st u:object_r:hal_nfc_default_exec:s0
+/dev/st21nfc u:object_r:nfc_device:s0
+/data/nfc(/.*)? u:object_r:nfc_data_file:s0
+
+# SecureElement
+/(vendor|system/vendor)/bin/hw/android\.hardware\.secure_element@1\.2-service\.st u:object_r:hal_secure_element_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.secure_element@1\.2-service-gto u:object_r:hal_secure_element_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.secure_element@1\.2-service-gto-ese2 u:object_r:hal_secure_element_default_exec:s0
+/dev/st54j_se u:object_r:secure_element_device:s0
+/dev/st54spi u:object_r:secure_element_device:s0
+/dev/st33spi u:object_r:secure_element_device:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.secure_element@1\.2-uicc-service u:object_r:hal_secure_element_default_exec:s0
+
+# Bluetooth
+/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.1-service\.bcmbtlinux u:object_r:hal_bluetooth_btlinux_exec:s0
+/dev/wbrc u:object_r:wb_coexistence_dev:s0
+/dev/ttySAC16 u:object_r:hci_attach_dev:s0
+
+# Audio
+/mnt/vendor/persist/audio(/.*)? u:object_r:persist_audio_file:s0
+/data/vendor/audio(/.*)? u:object_r:audio_vendor_data_file:s0
+/vendor/etc/aoc(/.*)? u:object_r:aoc_audio_file:s0
+/dev/acd-audio_output_tuning u:object_r:aoc_device:s0
+/dev/acd-audio_bulk_tx u:object_r:aoc_device:s0
+/dev/acd-audio_bulk_rx u:object_r:aoc_device:s0
+/dev/acd-audio_input_tuning u:object_r:aoc_device:s0
+/dev/acd-audio_input_bulk_tx u:object_r:aoc_device:s0
+/dev/acd-audio_input_bulk_rx u:object_r:aoc_device:s0
+/dev/acd-sound_trigger u:object_r:aoc_device:s0
+/dev/acd-hotword_notification u:object_r:aoc_device:s0
+/dev/acd-hotword_pcm u:object_r:aoc_device:s0
+/dev/acd-ambient_pcm u:object_r:aoc_device:s0
+/dev/acd-model_data u:object_r:aoc_device:s0
+/dev/acd-debug u:object_r:aoc_device:s0
+/dev/acd-audio_tap[0-9]* u:object_r:aoc_device:s0
+
+# Trusty
+/vendor/bin/securedpud.slider u:object_r:securedpud_slider_exec:s0
+/vendor/bin/storageproxyd u:object_r:tee_exec:s0
+/vendor/bin/trusty_apploader u:object_r:trusty_apploader_exec:s0
+/vendor/bin/hw/android\.hardware\.gatekeeper@1\.0-service\.trusty u:object_r:hal_gatekeeper_default_exec:s0
+/vendor/bin/hw/android\.hardware\.keymaster@4\.0-service\.trusty u:object_r:hal_keymaster_default_exec:s0
+/vendor/bin/hw/android\.hardware\.confirmationui@1\.0-service\.trusty\.vendor u:object_r:hal_confirmationui_default_exec:s0
+/dev/trusty-ipc-dev0 u:object_r:tee_device:s0
+/data/vendor/ss(/.*)? u:object_r:tee_data_file:s0
+/mnt/vendor/persist/data/ss(/.*)? u:object_r:tee_data_file:s0
+/dev/sg1 u:object_r:sg_device:s0
+
+# Battery
+/mnt/vendor/persist/battery(/.*)? u:object_r:persist_battery_file:s0
+
+# AoC file contexts.
+/vendor/bin/aocd u:object_r:aocd_exec:s0
+
+# NeuralNetworks file contexts
+/vendor/bin/hw/android\.hardware\.neuralnetworks@1\.2-service-armnn u:object_r:hal_neuralnetworks_armnn_exec:s0
+/vendor/bin/hw/android\.hardware\.neuralnetworks@1\.3-service-darwinn u:object_r:hal_neuralnetworks_darwinn_exec:s0
+
+# GRIL
+/vendor/bin/hw/vendor\.google\.radioext@1\.0-service u:object_r:hal_radioext_default_exec:s0
+
+# Radio files.
+/data/vendor/radio(/.*)? u:object_r:radio_vendor_data_file:s0
+
+# RILD files
+/data/vendor/rild(/.*)? u:object_r:rild_vendor_data_file:s0
+
+# Citadel StrongBox
+/dev/gsc0 u:object_r:citadel_device:s0
+
+# EdgeTPU device (DarwiNN)
+/dev/abrolhos u:object_r:edgetpu_device:s0
+/vendor/bin/hw/android\.hardware\.edgetpu\.logging@service-edgetpu-logging u:object_r:edgetpu_logging_exec:s0
+/system_ext/bin/hw/vendor\.google\.edgetpu@1\.0-service u:object_r:edgetpu_server_exec:s0
+/vendor/lib64/libedgetpu_darwinn2\.so u:object_r:same_process_hal_file:s0
+/data/vendor/hal_neuralnetworks_darwinn(/.*)? u:object_r:hal_neuralnetworks_darwinn_data_file:s0
+
+# EdgeTPU data file
+/data/edgetpu(/.*)? u:object_r:edgetpu_service_data_file:s0
+
+# Tetheroffload Service
+/dev/dit2 u:object_r:vendor_toe_device:s0
+/vendor/bin/hw/vendor\.samsung_slsi\.hardware\.tetheroffload@1\.0-service u:object_r:hal_tetheroffload_default_exec:s0
+
+# pixelstats binary
+/vendor/bin/pixelstats-vendor u:object_r:pixelstats_vendor_exec:s0
+
+# Vendor_kernel_modules
+/vendor/lib/modules/.*\.ko u:object_r:vendor_kernel_modules:s0
+
+# Display
+/vendor/lib(64)?/libion_google\.so u:object_r:same_process_hal_file:s0
+/vendor/lib(64)?/libdrm\.so u:object_r:same_process_hal_file:s0
+/vendor/lib(64)?/hw/gralloc\.gs101\.so u:object_r:same_process_hal_file:s0
+/vendor/lib(64)?/hw/vulkan\.gs101\.so u:object_r:same_process_hal_file:s0
+
+# Fingerprint
+/vendor/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service\.goodix u:object_r:hal_fingerprint_default_exec:s0
+/vendor/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service\.fpc u:object_r:hal_fingerprint_default_exec:s0
+
+# ECC List
+/vendor/bin/init\.radio\.sh u:object_r:init_radio_exec:s0
+
+# Zram
+/data/per_boot(/.*)? u:object_r:per_boot_file:s0
+
+# cpuctl
+/dev/cpuctl(/.*)? u:object_r:cpuctl_device:s0
+
+# ODPM
+/data/vendor/powerstats(/.*)? u:object_r:odpm_config_file:s0
+
+# sensor direct DMA-BUF heap
+/dev/dma_heap/sensor_direct_heap u:object_r:sensor_direct_heap_device:s0
+
+# Console
+/dev/ttySAC0 u:object_r:tty_device:s0
+
+# faceauth DMA-BUF heaps
+/dev/dma_heap/faceauth_tpu-secure u:object_r:faceauth_heap_device:s0
+/dev/dma_heap/faimg-secure u:object_r:faceauth_heap_device:s0
+/dev/dma_heap/famodel-secure u:object_r:faceauth_heap_device:s0
+/dev/dma_heap/faprev-secure u:object_r:faceauth_heap_device:s0
+/dev/dma_heap/farawimg-secure u:object_r:faceauth_heap_device:s0
+
+# vframe-secure DMA-BUF heap
+/dev/dma_heap/vframe-secure u:object_r:vframe_heap_device:s0
+
+# vscaler-secure DMA-BUF heap
+/dev/dma_heap/vscaler-secure u:object_r:vscaler_heap_device:s0
diff --git a/whitechapel/vendor/google/fsck.te b/whitechapel/vendor/google/fsck.te
new file mode 100644
index 0000000..d29555b
--- /dev/null
+++ b/whitechapel/vendor/google/fsck.te
@@ -0,0 +1,3 @@
+allow fsck persist_block_device:blk_file rw_file_perms;
+allow fsck efs_block_device:blk_file rw_file_perms;
+allow fsck modem_userdata_block_device:blk_file rw_file_perms;
diff --git a/whitechapel/vendor/google/genfs_contexts b/whitechapel/vendor/google/genfs_contexts
new file mode 100644
index 0000000..b98a749
--- /dev/null
+++ b/whitechapel/vendor/google/genfs_contexts
@@ -0,0 +1,178 @@
+# AOC
+genfscon sysfs /devices/platform/19000000.aoc/aoc_clock_and_kernel_boottime u:object_r:sysfs_aoc_boottime:s0
+genfscon sysfs /devices/platform/19000000.aoc/firmware u:object_r:sysfs_aoc_firmware:s0
+genfscon sysfs /devices/platform/19000000.aoc u:object_r:sysfs_aoc:s0
+
+# WiFi
+genfscon sysfs /wifi u:object_r:sysfs_wifi:s0
+# Battery
+genfscon sysfs /devices/platform/google,battery/power_supply/battery u:object_r:sysfs_batteryinfo:s0
+genfscon sysfs /devices/platform/google,cpm/power_supply u:object_r:sysfs_batteryinfo:s0
+
+# Slider
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-8/8-0050 u:object_r:sysfs_batteryinfo:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-8/8-0050/power_supply u:object_r:sysfs_batteryinfo:s0
+genfscon sysfs /devices/platform/10d10000.hsi2c/i2c-7/7-003c u:object_r:sysfs_wlc:s0
+genfscon sysfs /devices/platform/10d10000.hsi2c/i2c-7/7-003c/power_supply u:object_r:sysfs_batteryinfo:s0
+# Whitefin
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0050 u:object_r:sysfs_batteryinfo:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0050/power_supply u:object_r:sysfs_batteryinfo:s0
+# R4 / P7 LunchBox
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-6/6-0025 u:object_r:sysfs_batteryinfo:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-6/6-0025/power_supply u:object_r:sysfs_batteryinfo:s0
+genfscon sysfs /devices/platform/10970000.hsi2c/i2c-5/5-003c u:object_r:sysfs_wlc:s0
+genfscon sysfs /devices/platform/10970000.hsi2c/i2c-5/5-003c/power_supply u:object_r:sysfs_batteryinfo:s0
+# O6
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0025 u:object_r:sysfs_batteryinfo:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0025/power_supply u:object_r:sysfs_batteryinfo:s0
+genfscon sysfs /devices/platform/10970000.hsi2c/i2c-4/4-003c u:object_r:sysfs_wlc:s0
+genfscon sysfs /devices/platform/10970000.hsi2c/i2c-4/4-003c/power_supply u:object_r:sysfs_batteryinfo:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0069/power_supply u:object_r:sysfs_batteryinfo:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0036/power_supply u:object_r:sysfs_batteryinfo:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0057/power_supply u:object_r:sysfs_batteryinfo:s0
+
+# Storage
+genfscon debugfs /f2fs u:object_r:debugfs_f2fs:s0
+genfscon proc /fs/f2fs u:object_r:proc_f2fs:s0
+genfscon proc /sys/vm/swappiness u:object_r:proc_dirty:s0
+genfscon sysfs /devices/platform/14700000.ufs/slowio_read_cnt u:object_r:sysfs_scsi_devices_0000:s0
+genfscon sysfs /devices/platform/14700000.ufs/slowio_write_cnt u:object_r:sysfs_scsi_devices_0000:s0
+genfscon sysfs /devices/platform/14700000.ufs/slowio_unmap_cnt u:object_r:sysfs_scsi_devices_0000:s0
+genfscon sysfs /devices/platform/14700000.ufs/slowio_sync_cnt u:object_r:sysfs_scsi_devices_0000:s0
+genfscon sysfs /devices/platform/14700000.ufs/manual_gc u:object_r:sysfs_scsi_devices_0000:s0
+genfscon sysfs /devices/platform/14700000.ufs/io_stats u:object_r:sysfs_scsi_devices_0000:s0
+genfscon sysfs /devices/platform/14700000.ufs/req_stats u:object_r:sysfs_scsi_devices_0000:s0
+genfscon sysfs /devices/platform/14700000.ufs/err_stats u:object_r:sysfs_scsi_devices_0000:s0
+genfscon sysfs /devices/platform/14700000.ufs/device_descriptor u:object_r:sysfs_scsi_devices_0000:s0
+genfscon sysfs /devices/platform/14700000.ufs/clkgate_enable u:object_r:sysfs_scsi_devices_0000:s0
+genfscon sysfs /devices/platform/14700000.ufs/hibern8_on_idle_enable u:object_r:sysfs_scsi_devices_0000:s0
+genfscon sysfs /devices/platform/14700000.ufs/health_descriptor u:object_r:sysfs_scsi_devices_0000:s0
+genfscon sysfs /devices/platform/14700000.ufs/host0/target0:0:0/0:0:0: u:object_r:sysfs_scsi_devices_0000:s0
+genfscon sysfs /devices/platform/14700000.ufs/ufs_stats u:object_r:sysfs_scsi_devices_0000:s0
+
+# Vibrator
+genfscon sysfs /devices/platform/10970000.hsi2c/i2c-4/4-005a u:object_r:sysfs_vibrator:s0
+genfscon sysfs /devices/platform/10970000.hsi2c/i2c-4/4-0043 u:object_r:sysfs_vibrator:s0
+
+# System_suspend
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0069/power_supply/main-charger/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/cpif/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0050/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/google,cpm/power_supply/gcpm/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0050/power_supply/usb/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/175b0000.serial/serial0/serial0-0/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/google,battery/power_supply/battery/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/gpio_keys/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/acpm_mfd_bus@17510000/i2c-7/7-002f/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/acpm_mfd_bus@17500000/i2c-6/6-001f/s2mpg10-rtc/rtc/rtc0/alarmtimer.1.auto/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/10d40000.spi/spi_master/spi11/spi11.0/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/11110000.usb/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/acpm_mfd_bus@17500000/i2c-6/6-001f/s2mpg10-rtc/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /sys/devices/platform/10d50000.hsi2c/i2c-5/5-0036/power_supply/maxfg/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0036/power_supply/maxfg/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0050/power_supply/tcpm-source-psy-5-0050/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/10960000.hsi2c/i2c-3/3-0008/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/acpm_mfd_bus@17500000/i2c-6/6-001f/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/19000000.aoc/usb_control/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+
+# Touch
+genfscon sysfs /class/spi_master/spi11/spi11.0 u:object_r:sysfs_touch:s0
+genfscon proc /fts/driver_test u:object_r:proc_touch:s0
+genfscon sysfs /devices/virtual/sec/tsp u:object_r:sysfs_touch:s0
+
+# EdgeTPU
+genfscon sysfs /class/edgetpu u:object_r:sysfs_edgetpu:s0
+
+# Vendor sched files
+genfscon sysfs /kernel/vendor_sched/clear_prefer_high_cap u:object_r:sysfs_vendor_sched:s0
+genfscon sysfs /kernel/vendor_sched/set_prefer_high_cap u:object_r:sysfs_vendor_sched:s0
+genfscon sysfs /kernel/vendor_sched/prefer_high_cap_enable u:object_r:sysfs_vendor_sched:s0
+
+# GPS
+genfscon sysfs /devices/platform/10940000.spi/spi_master/spi5/spi5.0/nstandby u:object_r:sysfs_gps:s0
+
+# Display
+genfscon sysfs /devices/platform/1c2c0000.drmdsim/1c2c0000.drmdsim.0/gamma u:object_r:sysfs_display:s0
+genfscon sysfs /devices/platform/1c2d0000.drmdsim/1c2d0000.drmdsim.0/gamma u:object_r:sysfs_display:s0
+
+# Modem
+genfscon sysfs /devices/platform/cp-tm1/cp_temp u:object_r:sysfs_modem:s0
+
+# Bluetooth
+genfscon sysfs /devices/platform/175b0000.serial/serial0/serial0-0/bluetooth/hci0/rfkill0/state u:object_r:sysfs_bluetooth_writable:s0
+genfscon sysfs /devices/platform/odm/odm:btbcm/rfkill/rfkill0/state u:object_r:sysfs_bluetooth_writable:s0
+genfscon sysfs /devices/platform/odm/odm:btbcm/rfkill/rfkill2/state u:object_r:sysfs_bluetooth_writable:s0
+genfscon proc /bluetooth/sleep/lpm u:object_r:proc_bluetooth_writable:s0
+genfscon proc /bluetooth/sleep/btwrite u:object_r:proc_bluetooth_writable:s0
+genfscon proc /bluetooth/sleep/btwake u:object_r:proc_bluetooth_writable:s0
+
+# ODPM
+genfscon sysfs /devices/platform/acpm_mfd_bus@17500000/i2c-7/7-001f/s2mpg10-meter/s2mpg10-odpm/iio:device0/enabled_rails u:object_r:sysfs_odpm:s0
+genfscon sysfs /devices/platform/acpm_mfd_bus@17510000/i2c-8/8-002f/s2mpg11-meter/s2mpg11-odpm/iio:device1/enabled_rails u:object_r:sysfs_odpm:s0
+
+# Chosen
+genfscon sysfs /firmware/devicetree/base/chosen u:object_r:sysfs_chosen:s0
+
+genfscon sysfs /devices/system/chip-id/ap_hw_tune_str u:object_r:sysfs_chip_id:s0
+genfscon sysfs /devices/system/chip-id/evt_ver u:object_r:sysfs_chip_id:s0
+genfscon sysfs /devices/system/chip-id/lot_id u:object_r:sysfs_chip_id:s0
+genfscon sysfs /devices/system/chip-id/product_id u:object_r:sysfs_chip_id:s0
+genfscon sysfs /devices/system/chip-id/revision u:object_r:sysfs_chip_id:s0
+genfscon sysfs /devices/system/chip-id/raw_str u:object_r:sysfs_chip_id:s0
+
+# system_suspend wakeup nodes
+genfscon sysfs /devices/platform/10970000.hsi2c/i2c-4/4-003c/power_supply/wireless/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/10970000.hsi2c/i2c-4/4-003c/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/14520000.pcie/pci0001:00/0001:00:00.0/0001:01:00.0/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0025/power_supply/tcpm-source-psy-5-0025/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0069/power_supply/dc/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0025/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0057/power_supply/pca9468-mains/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/10970000.hsi2c/i2c-4/4-0043/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/10d50000.hsi2c/i2c-5/5-0025/power_supply/usb/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/14520000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/google,cpm/power_supply/gcpm_pps/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/odm/odm:btbcm/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+
+# subsystem-coredump
+genfscon sysfs /class/sscoredump/level u:object_r:sscoredump_sysfs_level:s0
+
+# ACPM
+genfscon sysfs /devices/platform/1742048c.acpm_stats u:object_r:sysfs_acpm_stats:s0
+
+genfscon sysfs /devices/platform/10d40000.spi/spi_master u:object_r:sysfs_spi:s0
+
+# Exynos
+genfscon sysfs /devices/platform/exynos-bts u:object_r:sysfs_exynos_bts:s0
+genfscon sysfs /devices/platform/exynos-bts/bts_stats u:object_r:sysfs_exynos_bts_stats:s0
+
+# CPU
+genfscon sysfs /devices/platform/17000010.devfreq_mif/devfreq/17000010.devfreq_mif/time_in_state u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/cpupm/cpupm/time_in_state u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000030.devfreq_intcam/devfreq/17000030.devfreq_intcam/time_in_state u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000020.devfreq_int/devfreq/17000020.devfreq_int/time_in_state u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000040.devfreq_disp/devfreq/17000040.devfreq_disp/time_in_state u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000050.devfreq_cam/devfreq/17000050.devfreq_cam/time_in_state u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/1c500000.mali/time_in_state u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000080.devfreq_bo/devfreq/17000080.devfreq_bo/time_in_state u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000060.devfreq_tnr/devfreq/17000060.devfreq_tnr/time_in_state u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000070.devfreq_mfc/devfreq/17000070.devfreq_mfc/time_in_state u:object_r:sysfs_cpu:s0
+
+# nvmem (Non Volatile Memory layer)
+genfscon sysfs /devices/platform/10970000.hsi2c/i2c-4/4-0050/4-00500/nvmem u:object_r:sysfs_memory:s0
+
+# Broadcom
+genfscon sysfs /module/bcmdhd4389 u:object_r:sysfs_bcmdhd:s0
+
+# debugfs
+
+genfscon debugfs /maxfg u:object_r:vendor_maxfg_debugfs:s0
+genfscon debugfs /dma_buf/bufinfo u:object_r:vendor_dmabuf_debugfs:s0
+genfscon debugfs /dri/0/crtc- u:object_r:vendor_dri_debugfs:s0
+genfscon debugfs /ion u:object_r:vendor_ion_debugfs:s0
+genfscon debugfs /pm_genpd/pm_genpd_summary u:object_r:vendor_pm_genpd_debugfs:s0
+genfscon debugfs /regmap u:object_r:vendor_regmap_debugfs:s0
+genfscon debugfs /usb u:object_r:vendor_usb_debugfs:s0
+genfscon debugfs /google_charger u:object_r:vendor_charger_debugfs:s0
+genfscon debugfs /gvotables u:object_r:vendor_votable_debugfs:s0
+genfscon debugfs /google_battery u:object_r:vendor_battery_debugfs:s0
diff --git a/whitechapel/vendor/google/gpsd.te b/whitechapel/vendor/google/gpsd.te
new file mode 100644
index 0000000..64591cb
--- /dev/null
+++ b/whitechapel/vendor/google/gpsd.te
@@ -0,0 +1,25 @@
+type gpsd, domain;
+type gpsd_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(gpsd)
+
+# Allow gpsd access PixelLogger unix socket in debug build only
+userdebug_or_eng(`
+ typeattribute gpsd mlstrustedsubject;
+ allow gpsd logger_app:unix_stream_socket connectto;
+')
+
+# Allow gpsd to obtain wakelock
+wakelock_use(gpsd)
+
+# Allow gpsd access data vendor gps files
+allow gpsd vendor_gps_file:dir create_dir_perms;
+allow gpsd vendor_gps_file:file create_file_perms;
+allow gpsd vendor_gps_file:fifo_file create_file_perms;
+
+# Allow gpsd to access rild
+binder_call(gpsd, rild);
+allow gpsd hal_exynos_rild_hwservice:hwservice_manager find;
+
+# Allow gpsd to access sensor service
+binder_call(gpsd, system_server);
+allow gpsd fwk_sensor_hwservice:hwservice_manager find;
diff --git a/whitechapel/vendor/google/grilservice_app.te b/whitechapel/vendor/google/grilservice_app.te
new file mode 100644
index 0000000..9eb8b8e
--- /dev/null
+++ b/whitechapel/vendor/google/grilservice_app.te
@@ -0,0 +1,8 @@
+type grilservice_app, domain;
+app_domain(grilservice_app)
+
+allow grilservice_app hal_radioext_hwservice:hwservice_manager find;
+allow grilservice_app hal_wifi_ext_hwservice:hwservice_manager find;
+allow grilservice_app app_api_service:service_manager find;
+binder_call(grilservice_app, hal_radioext_default)
+binder_call(grilservice_app, hal_wifi_ext)
diff --git a/whitechapel/vendor/google/hal_audio_default.te b/whitechapel/vendor/google/hal_audio_default.te
new file mode 100644
index 0000000..079d6bd
--- /dev/null
+++ b/whitechapel/vendor/google/hal_audio_default.te
@@ -0,0 +1,22 @@
+vndbinder_use(hal_audio_default)
+hwbinder_use(hal_audio_default)
+
+allow hal_audio_default audio_vendor_data_file:dir rw_dir_perms;
+allow hal_audio_default audio_vendor_data_file:file create_file_perms;
+
+r_dir_file(hal_audio_default, aoc_audio_file);
+r_dir_file(hal_audio_default, mnt_vendor_file);
+r_dir_file(hal_audio_default, persist_audio_file);
+
+allow hal_audio_default persist_file:dir search;
+allow hal_audio_default aoc_device:file rw_file_perms;
+allow hal_audio_default aoc_device:chr_file rw_file_perms;
+
+allow hal_audio_default hal_audio_ext_hwservice:hwservice_manager { find add };
+
+get_prop(hal_audio_default, vendor_audio_prop);
+
+userdebug_or_eng(`
+ allow hal_audio_default self:unix_stream_socket create_stream_socket_perms;
+ allow hal_audio_default audio_vendor_data_file:sock_file { create unlink };
+')
diff --git a/whitechapel/vendor/google/hal_bluetooth_btlinux.te b/whitechapel/vendor/google/hal_bluetooth_btlinux.te
new file mode 100644
index 0000000..4e61c62
--- /dev/null
+++ b/whitechapel/vendor/google/hal_bluetooth_btlinux.te
@@ -0,0 +1,19 @@
+add_hwservice(hal_bluetooth_btlinux, hal_bluetooth_coexistence_hwservice);
+
+allow hal_bluetooth_btlinux sysfs_bluetooth_writable:file rw_file_perms;
+allow hal_bluetooth_btlinux proc_bluetooth_writable:file rw_file_perms;
+allow hal_bluetooth_btlinux hci_attach_dev:chr_file rw_file_perms;
+allow hal_bluetooth_btlinux wb_coexistence_dev:chr_file rw_file_perms;
+
+# power stats
+vndbinder_use(hal_bluetooth_btlinux)
+allow hal_bluetooth_btlinux hal_power_stats_vendor_service:service_manager find;
+binder_call(hal_bluetooth_btlinux, hal_power_stats_default)
+
+allow hal_bluetooth_btlinux sscoredump_vendor_data_crashinfo_file:dir create_dir_perms;
+allow hal_bluetooth_btlinux sscoredump_vendor_data_crashinfo_file:file create_file_perms;
+
+userdebug_or_eng(`
+ allow hal_bluetooth_btlinux sscoredump_vendor_data_coredump_file:dir create_dir_perms;
+ allow hal_bluetooth_btlinux sscoredump_vendor_data_coredump_file:file create_file_perms;
+')
diff --git a/whitechapel/vendor/google/hal_bootctl_default.te b/whitechapel/vendor/google/hal_bootctl_default.te
new file mode 100644
index 0000000..63741ae
--- /dev/null
+++ b/whitechapel/vendor/google/hal_bootctl_default.te
@@ -0,0 +1 @@
+allow hal_bootctl_default sda_block_device:blk_file rw_file_perms;
diff --git a/whitechapel/vendor/google/hal_camera_default.te b/whitechapel/vendor/google/hal_camera_default.te
new file mode 100644
index 0000000..0de8785
--- /dev/null
+++ b/whitechapel/vendor/google/hal_camera_default.te
@@ -0,0 +1,36 @@
+allow hal_camera_default self:global_capability_class_set sys_nice;
+
+vndbinder_use(hal_camera_default);
+
+allow hal_camera_default vendor_camera_tuning_file:dir r_dir_perms;
+allow hal_camera_default vendor_camera_tuning_file:file r_file_perms;
+allow hal_camera_default vendor_camera_data_file:dir rw_dir_perms;
+allow hal_camera_default vendor_camera_data_file:file create_file_perms;
+allow hal_camera_default lwis_device:chr_file rw_file_perms;
+allow hal_camera_default gpu_device:chr_file rw_file_perms;
+allow hal_camera_default edgetpu_device:chr_file rw_file_perms;
+allow hal_camera_default sysfs_edgetpu:dir r_dir_perms;
+allow hal_camera_default sysfs_edgetpu:file r_file_perms;
+allow hal_camera_default sysfs_chip_id:file r_file_perms;
+
+allow hal_camera_default mnt_vendor_file:dir search;
+allow hal_camera_default persist_file:dir search;
+allow hal_camera_default persist_camera_file:dir search;
+allow hal_camera_default persist_camera_file:file r_file_perms;
+
+get_prop(hal_camera_default, vendor_camera_prop);
+get_prop(hal_camera_default, vendor_camera_debug_prop);
+
+hal_client_domain(hal_camera_default, hal_graphics_allocator);
+hal_client_domain(hal_camera_default, hal_power);
+hal_client_domain(hal_camera_default, hal_thermal);
+
+# Allow access to sensor service for sensor_listener
+binder_call(hal_camera_default, system_server);
+
+# Allow Binder calls to ECO service, needed by Entropy-Aware Filtering
+allow hal_camera_default eco_service:service_manager find;
+binder_call(hal_camera_default, mediacodec);
+
+# grant access to hal_graphics_composer
+hal_client_domain(hal_camera_default, hal_graphics_composer)
diff --git a/whitechapel/vendor/google/hal_confirmationui.te b/whitechapel/vendor/google/hal_confirmationui.te
new file mode 100644
index 0000000..a8f4ae8
--- /dev/null
+++ b/whitechapel/vendor/google/hal_confirmationui.te
@@ -0,0 +1,13 @@
+allow hal_confirmationui_default tee_device:chr_file rw_file_perms;
+
+binder_call(hal_confirmationui_default, keystore)
+
+vndbinder_use(hal_confirmationui_default)
+binder_call(hal_confirmationui_default, citadeld)
+allow hal_confirmationui_default citadeld_service:service_manager find;
+
+allow hal_confirmationui_default input_device:chr_file rw_file_perms;
+allow hal_confirmationui_default input_device:dir r_dir_perms;
+
+allow hal_confirmationui_default dmabuf_system_heap_device:chr_file r_file_perms;
+allow hal_confirmationui_default ion_device:chr_file r_file_perms;
diff --git a/whitechapel/vendor/google/hal_contexthub.te b/whitechapel/vendor/google/hal_contexthub.te
new file mode 100644
index 0000000..ba776c8
--- /dev/null
+++ b/whitechapel/vendor/google/hal_contexthub.te
@@ -0,0 +1,3 @@
+# Allow context hub HAL to communicate with daemon via socket
+allow hal_contexthub_default chre:unix_stream_socket connectto;
+allow hal_contexthub_default chre_socket:sock_file write;
\ No newline at end of file
diff --git a/whitechapel/vendor/google/hal_drm_clearkey.te b/whitechapel/vendor/google/hal_drm_clearkey.te
new file mode 100644
index 0000000..0e0a5c2
--- /dev/null
+++ b/whitechapel/vendor/google/hal_drm_clearkey.te
@@ -0,0 +1,5 @@
+type hal_drm_clearkey, domain;
+type hal_drm_clearkey_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(hal_drm_clearkey)
+
+hal_server_domain(hal_drm_clearkey, hal_drm)
diff --git a/whitechapel/vendor/google/hal_drm_default.te b/whitechapel/vendor/google/hal_drm_default.te
new file mode 100644
index 0000000..30e443a
--- /dev/null
+++ b/whitechapel/vendor/google/hal_drm_default.te
@@ -0,0 +1,6 @@
+# L3
+allow hal_drm_default mediadrm_vendor_data_file:file create_file_perms;
+allow hal_drm_default mediadrm_vendor_data_file:dir create_dir_perms;
+
+# L1
+allow hal_drm_default dmabuf_system_heap_device:chr_file r_file_perms;
diff --git a/whitechapel/vendor/google/hal_dumpstate_default.te b/whitechapel/vendor/google/hal_dumpstate_default.te
new file mode 100644
index 0000000..d590a06
--- /dev/null
+++ b/whitechapel/vendor/google/hal_dumpstate_default.te
@@ -0,0 +1,142 @@
+allow hal_dumpstate_default sysfs_exynos_bts:dir search;
+allow hal_dumpstate_default sysfs_exynos_bts_stats:file r_file_perms;
+
+allow hal_dumpstate_default sysfs_bcmdhd:dir search;
+allow hal_dumpstate_default sysfs_bcmdhd:file r_file_perms;
+
+allow hal_dumpstate_default sysfs_memory:file r_file_perms;
+allow hal_dumpstate_default sysfs_cpu:file r_file_perms;
+
+vndbinder_use(hal_dumpstate_default)
+
+allow hal_dumpstate_default vendor_gps_file:dir r_dir_perms;
+allow hal_dumpstate_default vendor_gps_file:file r_file_perms;
+
+allow hal_dumpstate_default sysfs_wlc:dir search;
+allow hal_dumpstate_default sysfs_wlc:file r_file_perms;
+
+allow hal_dumpstate_default shell_data_file:file getattr;
+
+allow hal_dumpstate_default radio_vendor_data_file:dir create_dir_perms;
+allow hal_dumpstate_default radio_vendor_data_file:file create_file_perms;
+
+allow hal_dumpstate_default vendor_rfsd_log_file:dir r_dir_perms;
+allow hal_dumpstate_default vendor_rfsd_log_file:file r_file_perms;
+
+allow hal_dumpstate_default vendor_log_file:dir search;
+
+allow hal_dumpstate_default vendor_usf_stats:file execute_no_trans;
+allow hal_dumpstate_default vendor_dumpsys:file execute_no_trans;
+
+allow hal_dumpstate_default sscoredump_vendor_data_crashinfo_file:dir r_dir_perms;
+allow hal_dumpstate_default sscoredump_vendor_data_crashinfo_file:file r_file_perms;
+
+allow hal_dumpstate_default sysfs_acpm_stats:dir r_dir_perms;
+allow hal_dumpstate_default sysfs_acpm_stats:file r_file_perms;
+
+allow hal_dumpstate_default sysfs_spi:dir search;
+allow hal_dumpstate_default sysfs_spi:file rw_file_perms;
+
+allow hal_dumpstate_default device:dir r_dir_perms;
+allow hal_dumpstate_default logbuffer_device:chr_file r_file_perms;
+allow hal_dumpstate_default aoc_device:chr_file rw_file_perms;
+
+allow hal_dumpstate_default sysfs_wifi:dir search;
+allow hal_dumpstate_default sysfs_wifi:file r_file_perms;
+
+allow hal_dumpstate_default sysfs_thermal:dir r_dir_perms;
+allow hal_dumpstate_default sysfs_thermal:file r_file_perms;
+allow hal_dumpstate_default sysfs_thermal:lnk_file read;
+
+allow hal_dumpstate_default modem_efs_file:dir search;
+allow hal_dumpstate_default modem_efs_file:file r_file_perms;
+allow hal_dumpstate_default modem_stat_data_file:file r_file_perms;
+
+allow hal_dumpstate_default block_device:dir r_dir_perms;
+
+allow hal_dumpstate_default proc_f2fs:dir r_dir_perms;
+allow hal_dumpstate_default proc_f2fs:file r_file_perms;
+allow hal_dumpstate_default proc_touch:file rw_file_perms;
+
+allow hal_dumpstate_default sysfs_batteryinfo:dir search;
+allow hal_dumpstate_default sysfs_batteryinfo:file r_file_perms;
+allow hal_dumpstate_default sysfs_chip_id:file r_file_perms;
+
+allow hal_dumpstate_default vendor_toolbox_exec:file execute_no_trans;
+allow hal_dumpstate_default vendor_shell_exec:file execute_no_trans;
+
+allow hal_dumpstate_default debugfs_f2fs:dir r_dir_perms;
+allow hal_dumpstate_default debugfs_f2fs:file r_file_perms;
+allow hal_dumpstate_default sysfs_scsi_devices_0000:dir r_dir_perms;
+allow hal_dumpstate_default sysfs_scsi_devices_0000:file r_file_perms;
+
+userdebug_or_eng(`
+ allow hal_dumpstate_default mnt_vendor_file:dir search;
+ allow hal_dumpstate_default ramdump_vendor_mnt_file:dir search;
+ allow hal_dumpstate_default ramdump_vendor_mnt_file:file r_file_perms;
+')
+
+get_prop(hal_dumpstate_default, boottime_public_prop)
+get_prop(hal_dumpstate_default, vendor_gps_prop)
+get_prop(hal_dumpstate_default, vendor_persist_sys_modem_prop)
+get_prop(hal_dumpstate_default, vendor_rild_prop)
+
+userdebug_or_eng(`
+ allow hal_dumpstate_default vendor_ion_debugfs:dir r_dir_perms;
+ allow hal_dumpstate_default vendor_ion_debugfs:file r_file_perms;
+
+ allow hal_dumpstate_default vendor_dri_debugfs:file r_file_perms;
+ allow hal_dumpstate_default vendor_dri_debugfs:dir search;
+
+ allow hal_dumpstate_default vendor_pm_genpd_debugfs:file r_file_perms;
+
+ allow hal_dumpstate_default vendor_usb_debugfs:dir r_dir_perms;
+ allow hal_dumpstate_default vendor_usb_debugfs:file r_file_perms;
+
+ allow hal_dumpstate_default vendor_dmabuf_debugfs:file r_file_perms;
+
+ allow hal_dumpstate_default vendor_regmap_debugfs:dir r_dir_perms;
+ allow hal_dumpstate_default vendor_regmap_debugfs:file r_file_perms;
+
+ allow hal_dumpstate_default vendor_maxfg_debugfs:dir search;
+ allow hal_dumpstate_default vendor_maxfg_debugfs:file r_file_perms;
+
+ allow hal_dumpstate_default vendor_charger_debugfs:dir r_dir_perms;
+ allow hal_dumpstate_default vendor_charger_debugfs:file r_file_perms;
+
+ allow hal_dumpstate_default debugfs:dir r_dir_perms;
+ allow hal_dumpstate_default vendor_battery_debugfs:dir r_dir_perms;
+ allow hal_dumpstate_default vendor_battery_debugfs:file r_file_perms;
+
+ allow hal_dumpstate_default vendor_votable_debugfs:dir r_dir_perms;
+ allow hal_dumpstate_default vendor_votable_debugfs:file r_file_perms;
+')
+
+dontaudit hal_dumpstate_default vendor_ion_debugfs:dir r_dir_perms;
+dontaudit hal_dumpstate_default vendor_ion_debugfs:file r_file_perms;
+
+dontaudit hal_dumpstate_default vendor_dri_debugfs:file r_file_perms;
+dontaudit hal_dumpstate_default vendor_dri_debugfs:dir search;
+
+dontaudit hal_dumpstate_default vendor_pm_genpd_debugfs:file r_file_perms;
+
+dontaudit hal_dumpstate_default vendor_usb_debugfs:dir r_dir_perms;
+dontaudit hal_dumpstate_default vendor_usb_debugfs:file r_file_perms;
+
+dontaudit hal_dumpstate_default vendor_dmabuf_debugfs:file r_file_perms;
+
+dontaudit hal_dumpstate_default vendor_regmap_debugfs:dir r_dir_perms;
+dontaudit hal_dumpstate_default vendor_regmap_debugfs:file r_file_perms;
+
+dontaudit hal_dumpstate_default vendor_maxfg_debugfs:dir search;
+dontaudit hal_dumpstate_default vendor_maxfg_debugfs:file r_file_perms;
+
+dontaudit hal_dumpstate_default vendor_charger_debugfs:dir r_dir_perms;
+dontaudit hal_dumpstate_default vendor_charger_debugfs:file r_file_perms;
+
+dontaudit hal_dumpstate_default debugfs:dir r_dir_perms;
+dontaudit hal_dumpstate_default vendor_battery_debugfs:dir r_dir_perms;
+dontaudit hal_dumpstate_default vendor_battery_debugfs:file r_file_perms;
+
+dontaudit hal_dumpstate_default vendor_votable_debugfs:dir r_dir_perms;
+dontaudit hal_dumpstate_default vendor_votable_debugfs:file r_file_perms;
diff --git a/whitechapel/vendor/google/hal_gnss_default.te b/whitechapel/vendor/google/hal_gnss_default.te
new file mode 100644
index 0000000..e300423
--- /dev/null
+++ b/whitechapel/vendor/google/hal_gnss_default.te
@@ -0,0 +1,4 @@
+# Allow hal_gnss_default access data vendor gps files
+allow hal_gnss_default vendor_gps_file:dir create_dir_perms;
+allow hal_gnss_default vendor_gps_file:file create_file_perms;
+allow hal_gnss_default vendor_gps_file:fifo_file create_file_perms;
diff --git a/whitechapel/vendor/google/hal_graphics_allocator_default.te b/whitechapel/vendor/google/hal_graphics_allocator_default.te
new file mode 100644
index 0000000..63a7dcf
--- /dev/null
+++ b/whitechapel/vendor/google/hal_graphics_allocator_default.te
@@ -0,0 +1,4 @@
+allow hal_graphics_allocator_default sensor_direct_heap_device:chr_file r_file_perms;
+allow hal_graphics_allocator_default faceauth_heap_device:chr_file r_file_perms;
+allow hal_graphics_allocator_default vframe_heap_device:chr_file r_file_perms;
+allow hal_graphics_allocator_default vscaler_heap_device:chr_file r_file_perms;
diff --git a/whitechapel/vendor/google/hal_graphics_composer_default.te b/whitechapel/vendor/google/hal_graphics_composer_default.te
new file mode 100644
index 0000000..f1d9714
--- /dev/null
+++ b/whitechapel/vendor/google/hal_graphics_composer_default.te
@@ -0,0 +1,5 @@
+allow hal_graphics_composer_default sysfs_display:dir search;
+allow hal_graphics_composer_default sysfs_display:file rw_file_perms;
+
+# allow HWC to access power hal
+binder_call(hal_graphics_composer_default, hal_power_default);
diff --git a/whitechapel/vendor/google/hal_health_default.te b/whitechapel/vendor/google/hal_health_default.te
new file mode 100644
index 0000000..4bc85f2
--- /dev/null
+++ b/whitechapel/vendor/google/hal_health_default.te
@@ -0,0 +1,7 @@
+allow hal_health_default mnt_vendor_file:dir search;
+allow hal_health_default persist_file:dir search;
+allow hal_health_default persist_battery_file:file create_file_perms;
+allow hal_health_default persist_battery_file:dir rw_dir_perms;
+
+set_prop(hal_health_default, vendor_battery_defender_prop)
+r_dir_file(hal_health_default, sysfs_scsi_devices_0000)
diff --git a/whitechapel/vendor/google/hal_health_storage_default.te b/whitechapel/vendor/google/hal_health_storage_default.te
new file mode 100644
index 0000000..2aa0881
--- /dev/null
+++ b/whitechapel/vendor/google/hal_health_storage_default.te
@@ -0,0 +1,3 @@
+# Access to /sys/devices/platform/14700000.ufs/*
+allow hal_health_storage_default sysfs_scsi_devices_0000:dir r_dir_perms;
+allow hal_health_storage_default sysfs_scsi_devices_0000:file rw_file_perms;
diff --git a/whitechapel/vendor/google/hal_neuralnetworks_armnn.te b/whitechapel/vendor/google/hal_neuralnetworks_armnn.te
new file mode 100644
index 0000000..f81d617
--- /dev/null
+++ b/whitechapel/vendor/google/hal_neuralnetworks_armnn.te
@@ -0,0 +1,4 @@
+type hal_neuralnetworks_armnn, domain;
+type hal_neuralnetworks_armnn_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(hal_neuralnetworks_armnn)
+
diff --git a/whitechapel/vendor/google/hal_neuralnetworks_darwinn.te b/whitechapel/vendor/google/hal_neuralnetworks_darwinn.te
new file mode 100644
index 0000000..9329a87
--- /dev/null
+++ b/whitechapel/vendor/google/hal_neuralnetworks_darwinn.te
@@ -0,0 +1,20 @@
+type hal_neuralnetworks_darwinn, domain;
+hal_server_domain(hal_neuralnetworks_darwinn, hal_neuralnetworks)
+
+type hal_neuralnetworks_darwinn_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_neuralnetworks_darwinn)
+
+# The TPU HAL looks for TPU instance in /dev/abrolhos
+allow hal_neuralnetworks_darwinn edgetpu_device:chr_file rw_file_perms;
+
+# Allow DawriNN service to use a client-provided fd residing in /vendor/etc/.
+allow hal_neuralnetworks_darwinn vendor_configs_file:file r_file_perms;
+
+# Allow DarwiNN service to access data files.
+allow hal_neuralnetworks_darwinn hal_neuralnetworks_darwinn_data_file:file create_file_perms;
+allow hal_neuralnetworks_darwinn hal_neuralnetworks_darwinn_data_file:dir rw_dir_perms;
+
+# Register to hwbinder service
+add_hwservice(hal_neuralnetworks_darwinn, hal_neuralnetworks_hwservice)
+hwbinder_use(hal_neuralnetworks_darwinn)
+get_prop(hal_neuralnetworks_darwinn, hwservicemanager_prop)
diff --git a/whitechapel/vendor/google/hal_nfc_default.te b/whitechapel/vendor/google/hal_nfc_default.te
new file mode 100644
index 0000000..f98e78c
--- /dev/null
+++ b/whitechapel/vendor/google/hal_nfc_default.te
@@ -0,0 +1,9 @@
+# NFC property
+set_prop(hal_nfc_default, vendor_nfc_prop)
+
+# SecureElement property
+set_prop(hal_nfc_default, vendor_secure_element_prop)
+
+# Modem property
+set_prop(hal_nfc_default, vendor_modem_prop)
+
diff --git a/whitechapel/vendor/google/hal_power_default.te b/whitechapel/vendor/google/hal_power_default.te
new file mode 100644
index 0000000..c5aa154
--- /dev/null
+++ b/whitechapel/vendor/google/hal_power_default.te
@@ -0,0 +1,8 @@
+allow hal_power_default sysfs_scsi_devices_0000:file rw_file_perms;
+allow hal_power_default sysfs_fs_f2fs:dir r_dir_perms;
+allow hal_power_default sysfs_fs_f2fs:file rw_file_perms;
+allow hal_power_default sysfs_vendor_sched:file rw_file_perms;
+allow hal_power_default cpuctl_device:file rw_file_perms;
+set_prop(hal_power_default, vendor_camera_prop)
+set_prop(hal_power_default, vendor_camera_debug_prop)
+set_prop(hal_power_default, vendor_camera_fatp_prop)
diff --git a/whitechapel/vendor/google/hal_power_stats_default.te b/whitechapel/vendor/google/hal_power_stats_default.te
new file mode 100644
index 0000000..8ffff07
--- /dev/null
+++ b/whitechapel/vendor/google/hal_power_stats_default.te
@@ -0,0 +1,9 @@
+allow hal_power_stats_default sysfs_scsi_devices_0000:dir r_dir_perms;
+allow hal_power_stats_default sysfs_scsi_devices_0000:file r_file_perms;
+
+# getStats AIDL callback to each power entry
+binder_call(hal_power_stats_default, hal_bluetooth_btlinux)
+
+allow hal_power_stats_default odpm_config_file:dir search;
+allow hal_power_stats_default odpm_config_file:file r_file_perms;
+allow hal_power_stats_default sysfs_odpm:file rw_file_perms;
diff --git a/whitechapel/vendor/google/hal_radioext_default.te b/whitechapel/vendor/google/hal_radioext_default.te
new file mode 100644
index 0000000..666d8db
--- /dev/null
+++ b/whitechapel/vendor/google/hal_radioext_default.te
@@ -0,0 +1,12 @@
+type hal_radioext_default, domain;
+type hal_radioext_default_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(hal_radioext_default)
+
+hwbinder_use(hal_radioext_default)
+get_prop(hal_radioext_default, hwservicemanager_prop)
+add_hwservice(hal_radioext_default, hal_radioext_hwservice)
+
+binder_call(hal_radioext_default, grilservice_app)
+
+# RW /dev/oem_ipc0
+allow hal_radioext_default radio_device:chr_file rw_file_perms;
diff --git a/whitechapel/vendor/google/hal_secure_element_default.te b/whitechapel/vendor/google/hal_secure_element_default.te
new file mode 100644
index 0000000..dc04874
--- /dev/null
+++ b/whitechapel/vendor/google/hal_secure_element_default.te
@@ -0,0 +1,10 @@
+allow hal_secure_element_default secure_element_device:chr_file rw_file_perms;
+allow hal_secure_element_default nfc_device:chr_file rw_file_perms;
+set_prop(hal_secure_element_default, vendor_secure_element_prop)
+set_prop(hal_secure_element_default, vendor_nfc_prop)
+set_prop(hal_secure_element_default, vendor_modem_prop)
+
+# Allow hal_secure_element_default to access rild
+binder_call(hal_secure_element_default, rild);
+allow hal_secure_element_default hal_exynos_rild_hwservice:hwservice_manager find;
+
diff --git a/whitechapel/vendor/google/hal_sensors_default.te b/whitechapel/vendor/google/hal_sensors_default.te
new file mode 100644
index 0000000..64620ba
--- /dev/null
+++ b/whitechapel/vendor/google/hal_sensors_default.te
@@ -0,0 +1,19 @@
+# Allow access to the files of CDT information.
+r_dir_file(hal_sensors_default, sysfs_chosen)
+
+# Allow access to the leds driver.
+allow hal_sensors_default sysfs_leds:dir search;
+allow hal_sensors_default sysfs_leds:file rw_file_perms;
+
+# Allow access to the power supply files for MagCC.
+r_dir_file(hal_sensors_default, sysfs_batteryinfo)
+allow hal_sensors_default sysfs_wlc:dir r_dir_perms;
+
+# Allow access to sensor service for sensor_listener.
+binder_call(hal_sensors_default, system_server);
+
+# Allow access to the stats service.
+allow hal_sensors_default fwk_stats_hwservice:hwservice_manager find;
+
+# Allow access to the sysfs_aoc.
+allow hal_sensors_default sysfs_aoc:dir search;
diff --git a/whitechapel/vendor/google/hal_tetheroffload_default.te b/whitechapel/vendor/google/hal_tetheroffload_default.te
new file mode 100644
index 0000000..00ae321
--- /dev/null
+++ b/whitechapel/vendor/google/hal_tetheroffload_default.te
@@ -0,0 +1,17 @@
+# associate netdomain to use for accessing internet sockets
+net_domain(hal_tetheroffload_default)
+
+# Allow operations with TOE device
+allow hal_tetheroffload_default vendor_toe_device:chr_file rw_file_perms;
+
+# Allow NETLINK and socket
+allow hal_tetheroffload_default self:{
+ netlink_socket
+ netlink_generic_socket
+ unix_dgram_socket
+} create_socket_perms_no_ioctl;
+
+# Register to hwbinder service
+add_hwservice(hal_tetheroffload_default, hal_tetheroffload_hwservice)
+hwbinder_use(hal_tetheroffload_default)
+get_prop(hal_tetheroffload_default, hwservicemanager_prop)
diff --git a/whitechapel/vendor/google/hal_thermal_default.te b/whitechapel/vendor/google/hal_thermal_default.te
new file mode 100644
index 0000000..66c3af8
--- /dev/null
+++ b/whitechapel/vendor/google/hal_thermal_default.te
@@ -0,0 +1 @@
+allow hal_thermal_default self:netlink_generic_socket create_socket_perms_no_ioctl;
diff --git a/whitechapel/vendor/google/hal_usb_impl.te b/whitechapel/vendor/google/hal_usb_impl.te
new file mode 100644
index 0000000..c95035c
--- /dev/null
+++ b/whitechapel/vendor/google/hal_usb_impl.te
@@ -0,0 +1,12 @@
+type hal_usb_impl, domain;
+hal_server_domain(hal_usb_impl, hal_usb)
+hal_server_domain(hal_usb_impl, hal_usb_gadget)
+
+type hal_usb_impl_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(hal_usb_impl)
+
+allow hal_usb_impl functionfs:dir { watch watch_reads };
+set_prop(hal_usb_impl, vendor_usb_config_prop)
+
+allow hal_usb_impl sysfs_batteryinfo:dir search;
+allow hal_usb_impl sysfs_batteryinfo:file r_file_perms;
diff --git a/whitechapel/vendor/google/hal_vendor_hwcservice_default.te b/whitechapel/vendor/google/hal_vendor_hwcservice_default.te
new file mode 100644
index 0000000..0cd13b3
--- /dev/null
+++ b/whitechapel/vendor/google/hal_vendor_hwcservice_default.te
@@ -0,0 +1,4 @@
+type hal_vendor_hwcservice_default, domain;
+type hal_vendor_hwcservice_default_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(hal_vendor_hwcservice_default)
+
diff --git a/whitechapel/vendor/google/hal_wlc.te b/whitechapel/vendor/google/hal_wlc.te
new file mode 100644
index 0000000..891853c
--- /dev/null
+++ b/whitechapel/vendor/google/hal_wlc.te
@@ -0,0 +1,16 @@
+type hal_wlc, domain;
+type hal_wlc_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(hal_wlc)
+hwbinder_use(hal_wlc)
+add_hwservice(hal_wlc, hal_wlc_hwservice)
+get_prop(hal_wlc, hwservicemanager_prop)
+
+r_dir_file(hal_wlc, sysfs_batteryinfo)
+allow hal_wlc sysfs_wlc:dir r_dir_perms;
+allow hal_wlc sysfs_wlc:file rw_file_perms;
+
+allow hal_wlc self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+
+binder_call(hal_wlc, platform_app)
+binder_call(hal_wlc, system_app)
\ No newline at end of file
diff --git a/whitechapel/vendor/google/hardware_info_app.te b/whitechapel/vendor/google/hardware_info_app.te
new file mode 100644
index 0000000..b877418
--- /dev/null
+++ b/whitechapel/vendor/google/hardware_info_app.te
@@ -0,0 +1,5 @@
+type hardware_info_app, domain;
+
+app_domain(hardware_info_app)
+
+allow hardware_info_app app_api_service:service_manager find;
diff --git a/whitechapel/vendor/google/hbmsvmanager_app.te b/whitechapel/vendor/google/hbmsvmanager_app.te
new file mode 100644
index 0000000..534f6c8
--- /dev/null
+++ b/whitechapel/vendor/google/hbmsvmanager_app.te
@@ -0,0 +1,11 @@
+type hbmsvmanager_app, domain, coredomain;
+
+app_domain(hbmsvmanager_app);
+
+allow hbmsvmanager_app hal_pixel_display_service:service_manager find;
+binder_call(hbmsvmanager_app, hal_graphics_composer_default)
+
+# Standard system services
+allow hbmsvmanager_app app_api_service:service_manager find;
+
+allow hbmsvmanager_app cameraserver_service:service_manager find;
diff --git a/whitechapel/vendor/google/hwservice.te b/whitechapel/vendor/google/hwservice.te
new file mode 100644
index 0000000..0b48902
--- /dev/null
+++ b/whitechapel/vendor/google/hwservice.te
@@ -0,0 +1,20 @@
+type hal_vendor_telephony_hwservice, hwservice_manager_type;
+type hal_vendor_surfaceflinger_hwservice, hwservice_manager_type;
+
+# dmd servcie
+type hal_vendor_oem_hwservice, hwservice_manager_type;
+
+# rild service
+type hal_exynos_rild_hwservice, hwservice_manager_type;
+
+# GRIL service
+type hal_radioext_hwservice, hwservice_manager_type;
+
+# Audio
+type hal_audio_ext_hwservice, hwservice_manager_type;
+
+# WLC
+type hal_wlc_hwservice, hwservice_manager_type;
+
+# Bluetooth HAL extension
+type hal_bluetooth_coexistence_hwservice, hwservice_manager_type, vendor_hwservice_type;
diff --git a/whitechapel/vendor/google/hwservice_contexts b/whitechapel/vendor/google/hwservice_contexts
new file mode 100644
index 0000000..64a59cb
--- /dev/null
+++ b/whitechapel/vendor/google/hwservice_contexts
@@ -0,0 +1,28 @@
+vendor.samsung_slsi.hardware.radio::IOemSamsungslsi u:object_r:hal_telephony_hwservice:s0
+vendor.samsung_slsi.hardware.ExynosHWCServiceTW::IExynosHWCServiceTW u:object_r:hal_vendor_surfaceflinger_hwservice:s0
+vendor.samsung_slsi.hardware.configstore::IExynosHWCConfigs u:object_r:hal_configstore_ISurfaceFlingerConfigs:s0
+
+# dmd HAL
+vendor.samsung_slsi.telephony.hardware.oemservice::IOemService u:object_r:hal_vendor_oem_hwservice:s0
+
+# rild HAL
+vendor.samsung_slsi.telephony.hardware.radio::IOemSamsungslsi u:object_r:hal_exynos_rild_hwservice:s0
+android.vendor.samsung_slsi.telephony.hardware.radio::IOemSamsungslsi u:object_r:hal_exynos_rild_hwservice:s0
+vendor.samsung_slsi.telephony.hardware.radioExternal::IOemSlsiRadioExternal u:object_r:hal_exynos_rild_hwservice:s0
+
+# VIDEO
+android.hardware.media.c2::IComponentStore u:object_r:hal_codec2_hwservice:s0
+android.hardware.media.c2::IConfigurable u:object_r:hal_codec2_hwservice:s0
+
+# GRIL HAL
+vendor.google.radioext::IRadioExt u:object_r:hal_radioext_hwservice:s0
+
+#Audio
+vendor.google.whitechapel.audio.audioext::IAudioExt u:object_r:hal_audio_ext_hwservice:s0
+
+# Wireless charger hal
+vendor.google.wireless_charger::IWirelessCharger u:object_r:hal_wlc_hwservice:s0
+
+# Bluetooth HAL extension
+hardware.google.bluetooth.bt_channel_avoidance::IBTChannelAvoidance u:object_r:hal_bluetooth_coexistence_hwservice:s0
+hardware.google.bluetooth.sar::IBluetoothSar u:object_r:hal_bluetooth_coexistence_hwservice:s0
diff --git a/whitechapel/vendor/google/hwservicemanager.te b/whitechapel/vendor/google/hwservicemanager.te
new file mode 100644
index 0000000..7b64499
--- /dev/null
+++ b/whitechapel/vendor/google/hwservicemanager.te
@@ -0,0 +1 @@
+binder_call(hwservicemanager, bipchmgr)
diff --git a/whitechapel/vendor/google/init-insmod-sh.te b/whitechapel/vendor/google/init-insmod-sh.te
new file mode 100644
index 0000000..e842494
--- /dev/null
+++ b/whitechapel/vendor/google/init-insmod-sh.te
@@ -0,0 +1,11 @@
+type init-insmod-sh, domain;
+type init-insmod-sh_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(init-insmod-sh)
+
+allow init-insmod-sh self:capability sys_module;
+allow init-insmod-sh vendor_kernel_modules:system module_load;
+allow init-insmod-sh vendor_toolbox_exec:file execute_no_trans;
+
+set_prop(init-insmod-sh, vendor_device_prop)
+
+dontaudit init-insmod-sh proc_cmdline:file r_file_perms;
diff --git a/whitechapel/vendor/google/init.te b/whitechapel/vendor/google/init.te
new file mode 100644
index 0000000..a703c47
--- /dev/null
+++ b/whitechapel/vendor/google/init.te
@@ -0,0 +1,15 @@
+allow init custom_ab_block_device:lnk_file relabelto;
+
+# This is needed for chaining a boot partition vbmeta
+# descriptor, where init will probe the boot partition
+# to read the chained vbmeta in the first-stage, then
+# relabel /dev/block/by-name/boot_[a|b] to block_device
+# after loading sepolicy in the second stage.
+allow init boot_block_device:lnk_file relabelto;
+
+allow init persist_file:dir mounton;
+allow init modem_efs_file:dir mounton;
+allow init modem_userdata_file:dir mounton;
+allow init ram_device:blk_file w_file_perms;
+allow init per_boot_file:file ioctl;
+allowxperm init per_boot_file:file ioctl { F2FS_IOC_SET_PIN_FILE };
diff --git a/whitechapel/vendor/google/init_radio.te b/whitechapel/vendor/google/init_radio.te
new file mode 100644
index 0000000..3a29edf
--- /dev/null
+++ b/whitechapel/vendor/google/init_radio.te
@@ -0,0 +1,8 @@
+type init_radio, domain;
+type init_radio_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(init_radio);
+
+allow init_radio vendor_toolbox_exec:file execute_no_trans;
+allow init_radio radio_vendor_data_file:dir create_dir_perms;
+allow init_radio radio_vendor_data_file:file create_file_perms;
diff --git a/whitechapel/vendor/google/kernel.te b/whitechapel/vendor/google/kernel.te
new file mode 100644
index 0000000..cab39fb
--- /dev/null
+++ b/whitechapel/vendor/google/kernel.te
@@ -0,0 +1,5 @@
+allow kernel vendor_fw_file:dir search;
+allow kernel vendor_fw_file:file r_file_perms;
+
+# ZRam
+allow kernel per_boot_file:file r_file_perms;
diff --git a/whitechapel/vendor/google/lhd.te b/whitechapel/vendor/google/lhd.te
new file mode 100644
index 0000000..e980897
--- /dev/null
+++ b/whitechapel/vendor/google/lhd.te
@@ -0,0 +1,23 @@
+type lhd, domain;
+type lhd_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(lhd)
+
+# Allow lhd access PixelLogger unix socket in debug build only
+userdebug_or_eng(`
+ typeattribute lhd mlstrustedsubject;
+ allow lhd logger_app:unix_stream_socket connectto;
+')
+
+# Allow lhd access data vendor gps files
+allow lhd vendor_gps_file:dir create_dir_perms;
+allow lhd vendor_gps_file:file create_file_perms;
+allow lhd vendor_gps_file:fifo_file create_file_perms;
+
+# Allow lhd to obtain wakelock
+wakelock_use(lhd)
+
+# Allow lhd access /dev/bbd_control file
+allow lhd vendor_gnss_device:chr_file rw_file_perms;
+
+# Allow lhd access nstandby gpio
+allow lhd sysfs_gps:file rw_file_perms;
diff --git a/whitechapel/vendor/google/logger_app.te b/whitechapel/vendor/google/logger_app.te
new file mode 100644
index 0000000..3e603c5
--- /dev/null
+++ b/whitechapel/vendor/google/logger_app.te
@@ -0,0 +1,19 @@
+type logger_app, domain;
+
+userdebug_or_eng(`
+ app_domain(logger_app)
+ net_domain(logger_app)
+
+ allow logger_app app_api_service:service_manager find;
+ allow logger_app surfaceflinger_service:service_manager find;
+
+ allow logger_app radio_vendor_data_file:file create_file_perms;
+ allow logger_app radio_vendor_data_file:dir create_dir_perms;
+ allow logger_app vendor_slog_file:file {r_file_perms unlink};
+ allow logger_app vendor_gps_file:file create_file_perms;
+ allow logger_app vendor_gps_file:dir create_dir_perms;
+
+ set_prop(logger_app, vendor_modem_prop)
+ set_prop(logger_app, vendor_persist_sys_modem_prop)
+ set_prop(logger_app, vendor_gps_prop)
+')
diff --git a/whitechapel/vendor/google/mediacodec.te b/whitechapel/vendor/google/mediacodec.te
new file mode 100644
index 0000000..d3b108f
--- /dev/null
+++ b/whitechapel/vendor/google/mediacodec.te
@@ -0,0 +1,6 @@
+userdebug_or_eng(`
+ set_prop(mediacodec, vendor_codec2_debug_prop)
+')
+
+add_service(mediacodec, eco_service)
+allow mediacodec hal_camera_default:binder call;
diff --git a/whitechapel/vendor/google/modem_logging_control.te b/whitechapel/vendor/google/modem_logging_control.te
new file mode 100644
index 0000000..7392297
--- /dev/null
+++ b/whitechapel/vendor/google/modem_logging_control.te
@@ -0,0 +1,17 @@
+type modem_logging_control, domain;
+type modem_logging_control_exec, vendor_file_type, exec_type, file_type;
+
+init_daemon_domain(modem_logging_control)
+
+hwbinder_use(modem_logging_control)
+binder_call(modem_logging_control, dmd)
+
+allow modem_logging_control radio_device:chr_file rw_file_perms;
+allow modem_logging_control hal_vendor_oem_hwservice:hwservice_manager find;
+allow modem_logging_control radio_vendor_data_file:dir create_dir_perms;
+allow modem_logging_control radio_vendor_data_file:file create_file_perms;
+allow modem_logging_control vendor_slog_file:dir create_dir_perms;
+allow modem_logging_control vendor_slog_file:file create_file_perms;
+
+set_prop(modem_logging_control, vendor_modem_prop)
+get_prop(modem_logging_control, hwservicemanager_prop)
diff --git a/whitechapel/vendor/google/modem_svc_sit.te b/whitechapel/vendor/google/modem_svc_sit.te
new file mode 100644
index 0000000..9ee5976
--- /dev/null
+++ b/whitechapel/vendor/google/modem_svc_sit.te
@@ -0,0 +1,24 @@
+type modem_svc_sit, domain;
+type modem_svc_sit_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(modem_svc_sit)
+
+hwbinder_use(modem_svc_sit)
+binder_call(modem_svc_sit, rild)
+
+# Grant sysfs_modem access
+allow modem_svc_sit sysfs_modem:file rw_file_perms;
+
+# Grant radio device access
+allow modem_svc_sit radio_device:chr_file rw_file_perms;
+
+# Grant vendor radio and modem file/dir creation permission
+allow modem_svc_sit radio_vendor_data_file:dir create_dir_perms;
+allow modem_svc_sit radio_vendor_data_file:file create_file_perms;
+allow modem_svc_sit modem_stat_data_file:file create_file_perms;
+
+# RIL property
+get_prop(modem_svc_sit, vendor_rild_prop)
+
+# hwservice permission
+allow modem_svc_sit hal_exynos_rild_hwservice:hwservice_manager find;
+get_prop(modem_svc_sit, hwservicemanager_prop)
diff --git a/whitechapel/vendor/google/netutils_wrapper.te b/whitechapel/vendor/google/netutils_wrapper.te
new file mode 100644
index 0000000..a8090e3
--- /dev/null
+++ b/whitechapel/vendor/google/netutils_wrapper.te
@@ -0,0 +1,4 @@
+allow netutils_wrapper pktrouter:fd use;
+allow netutils_wrapper pktrouter:fifo_file write;
+allow netutils_wrapper pktrouter:packet_socket { read write };
+allow netutils_wrapper pktrouter:rawip_socket { read write };
diff --git a/whitechapel/vendor/google/pixelstats_vendor.te b/whitechapel/vendor/google/pixelstats_vendor.te
new file mode 100644
index 0000000..23ae03d
--- /dev/null
+++ b/whitechapel/vendor/google/pixelstats_vendor.te
@@ -0,0 +1,15 @@
+# pixelstats vendor
+type pixelstats_vendor, domain;
+
+type pixelstats_vendor_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(pixelstats_vendor)
+
+unix_socket_connect(pixelstats_vendor, chre, chre)
+
+get_prop(pixelstats_vendor, hwservicemanager_prop)
+hwbinder_use(pixelstats_vendor)
+
+allow pixelstats_vendor fwk_stats_hwservice:hwservice_manager find;
+binder_call(pixelstats_vendor, stats_service_server)
+
+allow pixelstats_vendor sysfs_scsi_devices_0000:file rw_file_perms;
diff --git a/whitechapel/vendor/google/pktrouter.te b/whitechapel/vendor/google/pktrouter.te
new file mode 100644
index 0000000..8c436f3
--- /dev/null
+++ b/whitechapel/vendor/google/pktrouter.te
@@ -0,0 +1,12 @@
+type pktrouter, domain;
+type pktrouter_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(pktrouter)
+net_domain(pktrouter)
+
+domain_auto_trans(pktrouter, netutils_wrapper_exec, netutils_wrapper);
+
+allow pktrouter pktrouter_device:chr_file rw_file_perms;
+allow pktrouter self:netlink_route_socket nlmsg_write;
+allow pktrouter self:packet_socket { bind create read write getattr shutdown};
+
+get_prop(pktrouter, vendor_ims_prop);
diff --git a/whitechapel/vendor/google/platform_app.te b/whitechapel/vendor/google/platform_app.te
new file mode 100644
index 0000000..3c7be06
--- /dev/null
+++ b/whitechapel/vendor/google/platform_app.te
@@ -0,0 +1,8 @@
+binder_call(platform_app, rild)
+allow platform_app hal_exynos_rild_hwservice:hwservice_manager find;
+
+allow platform_app hal_wlc_hwservice:hwservice_manager find;
+binder_call(platform_app, hal_wlc)
+
+allow platform_app fwk_stats_hwservice:hwservice_manager find;
+allow platform_app nfc_service:service_manager find;
\ No newline at end of file
diff --git a/whitechapel/vendor/google/priv_app.te b/whitechapel/vendor/google/priv_app.te
new file mode 100644
index 0000000..aed639f
--- /dev/null
+++ b/whitechapel/vendor/google/priv_app.te
@@ -0,0 +1,6 @@
+# Allows privileged applications to discover the EdgeTPU service.
+allow priv_app edgetpu_service:service_manager find;
+
+# Allows privileged applications to access the EdgeTPU device, except open,
+# which is guarded by the EdgeTPU service.
+allow priv_app edgetpu_device:chr_file { getattr read write ioctl map };
diff --git a/whitechapel/vendor/google/property.te b/whitechapel/vendor/google/property.te
new file mode 100644
index 0000000..5ac31d8
--- /dev/null
+++ b/whitechapel/vendor/google/property.te
@@ -0,0 +1,34 @@
+# For Exynos Properties
+vendor_internal_prop(vendor_prop)
+vendor_internal_prop(vendor_ims_prop)
+vendor_internal_prop(vendor_rild_prop)
+vendor_internal_prop(vendor_slog_prop)
+vendor_internal_prop(sensors_prop)
+vendor_internal_prop(vendor_ssrdump_prop)
+vendor_internal_prop(vendor_device_prop)
+vendor_internal_prop(vendor_usb_config_prop)
+vendor_internal_prop(vendor_secure_element_prop)
+vendor_internal_prop(vendor_modem_prop)
+vendor_internal_prop(vendor_diag_prop)
+vendor_internal_prop(vendor_cbd_prop)
+# vendor defaults
+vendor_internal_prop(vendor_config_default_prop)
+vendor_internal_prop(vendor_ro_config_default_prop)
+vendor_internal_prop(vendor_persist_config_default_prop)
+vendor_internal_prop(vendor_sys_default_prop)
+vendor_internal_prop(vendor_ro_sys_default_prop)
+vendor_internal_prop(vendor_persist_sys_default_prop)
+vendor_internal_prop(vendor_audio_prop)
+vendor_internal_prop(vendor_codec2_debug_prop)
+vendor_internal_prop(vendor_display_prop)
+vendor_internal_prop(vendor_persist_sys_modem_prop)
+vendor_internal_prop(vendor_camera_prop)
+vendor_internal_prop(vendor_camera_debug_prop)
+vendor_internal_prop(vendor_camera_fatp_prop)
+vendor_internal_prop(vendor_gps_prop)
+
+# Battery defender
+vendor_internal_prop(vendor_battery_defender_prop)
+
+# NFC
+vendor_internal_prop(vendor_nfc_prop)
diff --git a/whitechapel/vendor/google/property_contexts b/whitechapel/vendor/google/property_contexts
new file mode 100644
index 0000000..a3f993b
--- /dev/null
+++ b/whitechapel/vendor/google/property_contexts
@@ -0,0 +1,89 @@
+# for rild
+persist.vendor.debug_level u:object_r:vendor_rild_prop:s0
+persist.vendor.ril. u:object_r:vendor_rild_prop:s0
+persist.vendor.radio. u:object_r:vendor_rild_prop:s0
+vendor.radio.ril. u:object_r:vendor_rild_prop:s0
+vendor.sys.rild_reset u:object_r:vendor_rild_prop:s0
+vendor.ril. u:object_r:vendor_rild_prop:s0
+ro.vendor.build.svn u:object_r:vendor_rild_prop:s0
+
+# for ims service
+vendor.charon. u:object_r:vendor_ims_prop:s0
+vendor.pktrouter u:object_r:vendor_ims_prop:s0
+
+# Ramdump
+persist.vendor.sys.crash_rcu u:object_r:vendor_ramdump_prop:s0
+
+# SSR Detector
+vendor.debug.ssrdump. u:object_r:vendor_ssrdump_prop:s0
+persist.vendor.sys.ssr. u:object_r:vendor_ssrdump_prop:s0
+
+# Kernel modules related
+vendor.common.modules.ready u:object_r:vendor_device_prop:s0
+vendor.device.modules.ready u:object_r:vendor_device_prop:s0
+vendor.all.modules.ready u:object_r:vendor_device_prop:s0
+vendor.all.devices.ready u:object_r:vendor_device_prop:s0
+
+# for codec2
+vendor.debug.c2.level u:object_r:vendor_codec2_debug_prop:s0
+vendor.debug.c2.dump u:object_r:vendor_codec2_debug_prop:s0
+vendor.debug.c2.dump.opt u:object_r:vendor_codec2_debug_prop:s0
+
+# USB HAL
+persist.vendor.usb. u:object_r:vendor_usb_config_prop:s0
+vendor.usb. u:object_r:vendor_usb_config_prop:s0
+
+# for modem
+persist.vendor.modem. u:object_r:vendor_modem_prop:s0
+vendor.modem. u:object_r:vendor_modem_prop:s0
+vendor.sys.modem. u:object_r:vendor_modem_prop:s0
+vendor.sys.exynos.modempath u:object_r:vendor_modem_prop:s0
+persist.vendor.sys.modem. u:object_r:vendor_persist_sys_modem_prop:s0
+
+# for cbd
+vendor.cbd. u:object_r:vendor_cbd_prop:s0
+persist.vendor.cbd. u:object_r:vendor_cbd_prop:s0
+
+# for slog
+vendor.sys.silentlog. u:object_r:vendor_slog_prop:s0
+vendor.sys.exynos.slog. u:object_r:vendor_slog_prop:s0
+
+# for dmd
+persist.vendor.sys.dm. u:object_r:vendor_diag_prop:s0
+persist.vendor.sys.diag. u:object_r:vendor_diag_prop:s0
+vendor.sys.dmd. u:object_r:vendor_diag_prop:s0
+vendor.sys.diag. u:object_r:vendor_diag_prop:s0
+
+# vendor default
+vendor.config. u:object_r:vendor_config_default_prop:s0
+ro.vendor.config. u:object_r:vendor_ro_config_default_prop:s0
+persist.vendor.config. u:object_r:vendor_persist_config_default_prop:s0
+vendor.sys. u:object_r:vendor_sys_default_prop:s0
+ro.vendor.sys. u:object_r:vendor_ro_sys_default_prop:s0
+persist.vendor.sys. u:object_r:vendor_persist_sys_default_prop:s0
+
+
+# for audio
+vendor.audio_hal.period_multiplier u:object_r:vendor_audio_prop:s0
+vendor.audiodump.enable u:object_r:vendor_audio_prop:s0
+
+# for display
+ro.vendor.hwc.drm.device u:object_r:vendor_display_prop:s0
+
+# for camera
+persist.camera. u:object_r:vendor_camera_prop:s0
+vendor.camera. u:object_r:vendor_camera_prop:s0
+vendor.camera.debug. u:object_r:vendor_camera_debug_prop:s0
+vendor.camera.fatp. u:object_r:vendor_camera_fatp_prop:s0
+
+# for gps
+vendor.gps u:object_r:vendor_gps_prop:s0
+
+# SecureElement
+persist.vendor.se. u:object_r:vendor_secure_element_prop:s0
+
+# NFC
+persist.vendor.nfc. u:object_r:vendor_nfc_prop:s0
+
+# Battery
+vendor.battery.defender. u:object_r:vendor_battery_defender_prop:s0
diff --git a/whitechapel/vendor/google/radio.te b/whitechapel/vendor/google/radio.te
new file mode 100644
index 0000000..ffa4352
--- /dev/null
+++ b/whitechapel/vendor/google/radio.te
@@ -0,0 +1 @@
+allow radio hal_exynos_rild_hwservice:hwservice_manager find;
diff --git a/whitechapel/vendor/google/ramdump_app.te b/whitechapel/vendor/google/ramdump_app.te
new file mode 100644
index 0000000..308e9fb
--- /dev/null
+++ b/whitechapel/vendor/google/ramdump_app.te
@@ -0,0 +1,24 @@
+type ramdump_app, domain;
+
+userdebug_or_eng(`
+ app_domain(ramdump_app)
+
+ allow ramdump_app app_api_service:service_manager find;
+
+ allow ramdump_app ramdump_vendor_data_file:file create_file_perms;
+ allow ramdump_app ramdump_vendor_data_file:dir create_dir_perms;
+
+ set_prop(ramdump_app, vendor_ramdump_prop)
+ get_prop(ramdump_app, system_boot_reason_prop)
+
+ # To access ramdumpfs.
+ allow ramdump_app mnt_vendor_file:dir search;
+ allow ramdump_app ramdump_vendor_mnt_file:dir create_dir_perms;
+ allow ramdump_app ramdump_vendor_mnt_file:file create_file_perms;
+
+ # To access subsystem ramdump files and dirs.
+ allow ramdump_app sscoredump_vendor_data_crashinfo_file:dir r_dir_perms;
+ allow ramdump_app sscoredump_vendor_data_crashinfo_file:file r_file_perms;
+ allow ramdump_app sscoredump_vendor_data_coredump_file:dir r_dir_perms;
+ allow ramdump_app sscoredump_vendor_data_coredump_file:file r_file_perms;
+')
diff --git a/whitechapel/vendor/google/rfsd.te b/whitechapel/vendor/google/rfsd.te
new file mode 100644
index 0000000..df395cb
--- /dev/null
+++ b/whitechapel/vendor/google/rfsd.te
@@ -0,0 +1,32 @@
+type rfsd, domain;
+type rfsd_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(rfsd)
+
+# Allow to setuid from root to radio
+allow rfsd self:capability { chown setuid };
+
+# Allow to search block device and mnt dir for modem EFS partitions
+allow rfsd mnt_vendor_file:dir search;
+allow rfsd block_device:dir search;
+
+# Allow to operate with modem EFS file/dir
+allow rfsd modem_efs_file:dir create_dir_perms;
+allow rfsd modem_efs_file:file create_file_perms;
+
+allow rfsd radio_vendor_data_file:dir r_dir_perms;
+allow rfsd radio_vendor_data_file:file r_file_perms;
+
+# Allow to access rfsd log file/dir
+allow rfsd vendor_log_file:dir search;
+allow rfsd vendor_rfsd_log_file:dir create_dir_perms;
+allow rfsd vendor_rfsd_log_file:file create_file_perms;
+
+# Allow to read/write modem block device
+allow rfsd modem_block_device:blk_file rw_file_perms;
+
+# Allow to operate with radio device
+allow rfsd radio_device:chr_file rw_file_perms;
+
+# Allow to set rild and modem property
+set_prop(rfsd, vendor_modem_prop)
+set_prop(rfsd, vendor_rild_prop)
diff --git a/whitechapel/vendor/google/rild.te b/whitechapel/vendor/google/rild.te
new file mode 100644
index 0000000..a45d2b5
--- /dev/null
+++ b/whitechapel/vendor/google/rild.te
@@ -0,0 +1,28 @@
+set_prop(rild, vendor_rild_prop)
+
+get_prop(rild, vendor_persist_config_default_prop)
+get_prop(rild, vendor_ro_config_default_prop)
+set_prop(rild, vendor_sys_default_prop)
+
+get_prop(rild, system_boot_reason_prop)
+
+allow rild proc_net:file rw_file_perms;
+allow rild radio_vendor_data_file:dir create_dir_perms;
+allow rild radio_vendor_data_file:file create_file_perms;
+allow rild rild_vendor_data_file:dir create_dir_perms;
+allow rild rild_vendor_data_file:file create_file_perms;
+allow rild vendor_fw_file:file r_file_perms;
+allow rild mnt_vendor_file:dir r_dir_perms;
+
+r_dir_file(rild, modem_img_file)
+
+binder_call(rild, bipchmgr)
+binder_call(rild, gpsd)
+binder_call(rild, hal_audio_default)
+binder_call(rild, hal_secure_element_default)
+binder_call(rild, platform_app)
+binder_call(rild, modem_svc_sit)
+
+# for hal service
+add_hwservice(rild, hal_exynos_rild_hwservice)
+allow rild hal_audio_ext_hwservice:hwservice_manager find;
diff --git a/whitechapel/vendor/google/rlsservice.te b/whitechapel/vendor/google/rlsservice.te
new file mode 100644
index 0000000..2217908
--- /dev/null
+++ b/whitechapel/vendor/google/rlsservice.te
@@ -0,0 +1,21 @@
+type rlsservice, domain;
+type rlsservice_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(rlsservice)
+
+vndbinder_use(rlsservice)
+
+add_service(rlsservice, rls_service)
+
+# access rainbow sensor calibration files
+allow rlsservice persist_file:dir search;
+allow rlsservice persist_camera_file:dir search;
+allow rlsservice persist_camera_file:file r_file_perms;
+allow rlsservice mnt_vendor_file:dir search;
+
+binder_call(rlsservice, hal_sensors_default)
+binder_call(rlsservice, hal_camera_default)
+
+# Allow access to always-on compute device node
+allow rlsservice device:dir { read watch };
+allow rlsservice aoc_device:chr_file rw_file_perms;
diff --git a/whitechapel/vendor/google/rpmbd.te b/whitechapel/vendor/google/rpmbd.te
new file mode 100644
index 0000000..4113c2d
--- /dev/null
+++ b/whitechapel/vendor/google/rpmbd.te
@@ -0,0 +1,4 @@
+type rpmbd, domain;
+type rpmbd_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(rpmbd)
+
diff --git a/whitechapel/vendor/google/scd.te b/whitechapel/vendor/google/scd.te
new file mode 100644
index 0000000..28aaee0
--- /dev/null
+++ b/whitechapel/vendor/google/scd.te
@@ -0,0 +1,17 @@
+type scd, domain;
+type scd_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(scd)
+
+# Allow scd access PixelLogger unix socket in debug build only
+userdebug_or_eng(`
+ typeattribute scd mlstrustedsubject;
+ allow scd logger_app:unix_stream_socket connectto;
+')
+
+# Allow a base set of permissions required for network access.
+net_domain(scd);
+
+# Allow scd access data vendor gps files
+allow scd vendor_gps_file:dir create_dir_perms;
+allow scd vendor_gps_file:file create_file_perms;
+allow scd vendor_gps_file:fifo_file create_file_perms;
diff --git a/whitechapel/vendor/google/sced.te b/whitechapel/vendor/google/sced.te
new file mode 100644
index 0000000..52c2b2b
--- /dev/null
+++ b/whitechapel/vendor/google/sced.te
@@ -0,0 +1,10 @@
+type sced, domain;
+type sced_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(sced)
+
+userdebug_or_eng(`
+hwbinder_use(sced)
+binder_call(sced, dmd)
+
+get_prop(sced, hwservicemanager_prop)
+')
\ No newline at end of file
diff --git a/whitechapel/vendor/google/seapp_contexts b/whitechapel/vendor/google/seapp_contexts
new file mode 100644
index 0000000..8dfa07e
--- /dev/null
+++ b/whitechapel/vendor/google/seapp_contexts
@@ -0,0 +1,30 @@
+# Samsung S.LSI telephony
+user=system seinfo=platform name=com.samsung.slsi.telephony.silentlogging domain=vendor_telephony_app
+user=system seinfo=platform name=com.samsung.slsi.telephony.silentlogging:remote domain=vendor_telephony_app
+user=system seinfo=platform name=com.samsung.slsi.telephony.testmode domain=vendor_telephony_app
+user=system seinfo=platform name=com.samsung.slsi.telephony.uartswitch domain=vendor_telephony_app
+user=system seinfo=platform name=com.samsung.slsi.sysdebugmode domain=vendor_telephony_app
+user=system seinfo=platform name=com.samsung.slsi.telephony.networktestmode domain=vendor_telephony_app
+
+# Samsung S.LSI IMS
+user=system seinfo=platform name=com.shannon.imsservice domain=vendor_ims_app
+user=system seinfo=platform name=com.shannon.imsservice:remote domain=vendor_ims_app
+user=system seinfo=platform name=com.shannon.dataservice domain=vendor_ims_app
+user=system seinfo=platform name=com.shannon.networkservice domain=vendor_ims_app
+user=system seinfo=platform name=com.shannon.qualifiednetworksservice domain=vendor_ims_app
+
+# coredump/ramdump
+user=system seinfo=platform name=com.google.SSRestartDetector domain=ssr_detector_app type=system_app_data_file levelFrom=user
+user=_app seinfo=platform name=com.android.ramdump domain=ramdump_app type=app_data_file levelFrom=all
+
+# grilservice
+user=_app isPrivApp=true seinfo=platform name=com.google.android.grilservice domain=grilservice_app levelFrom=all
+
+# PixelLogger
+user=_app seinfo=platform name=com.android.pixellogger domain=logger_app type=app_data_file levelFrom=all
+
+# HbmSVManager
+user=_app seinfo=platform name=com.android.hbmsvmanager domain=hbmsvmanager_app type=app_data_file levelFrom=all
+
+# Hardware Info Collection
+user=_app isPrivApp=true name=com.google.android.hardwareinfo domain=hardware_info_app type=app_data_file levelFrom=user
diff --git a/whitechapel/vendor/google/securedpud.slider.te b/whitechapel/vendor/google/securedpud.slider.te
new file mode 100644
index 0000000..fd553a3
--- /dev/null
+++ b/whitechapel/vendor/google/securedpud.slider.te
@@ -0,0 +1,9 @@
+type securedpud_slider, domain;
+type securedpud_slider_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(securedpud_slider)
+
+allow securedpud_slider dmabuf_heap_device:chr_file r_file_perms;
+allow securedpud_slider ion_device:chr_file r_file_perms;
+allow securedpud_slider tee_device:chr_file rw_file_perms;
+allow securedpud_slider tui_device:chr_file rw_file_perms;
diff --git a/whitechapel/vendor/google/service.te b/whitechapel/vendor/google/service.te
new file mode 100644
index 0000000..9c935e9
--- /dev/null
+++ b/whitechapel/vendor/google/service.te
@@ -0,0 +1 @@
+type hal_pixel_display_service, service_manager_type, vendor_service;
diff --git a/whitechapel/vendor/google/service_contexts b/whitechapel/vendor/google/service_contexts
new file mode 100644
index 0000000..aed0533
--- /dev/null
+++ b/whitechapel/vendor/google/service_contexts
@@ -0,0 +1,3 @@
+# EdgeTPU service
+com.google.edgetpu.IEdgeTpuService/default u:object_r:edgetpu_service:s0
+com.google.hardware.pixel.display.IDisplay/default u:object_r:hal_pixel_display_service:s0
diff --git a/whitechapel/vendor/google/shell.te b/whitechapel/vendor/google/shell.te
new file mode 100644
index 0000000..29274f5
--- /dev/null
+++ b/whitechapel/vendor/google/shell.te
@@ -0,0 +1 @@
+allow shell eco_service:service_manager find;
diff --git a/whitechapel/vendor/google/sscoredump.te b/whitechapel/vendor/google/sscoredump.te
new file mode 100644
index 0000000..e66abc6
--- /dev/null
+++ b/whitechapel/vendor/google/sscoredump.te
@@ -0,0 +1,17 @@
+type sscoredump, domain;
+type sscoredump_exec, vendor_file_type, exec_type, file_type;
+
+init_daemon_domain(sscoredump)
+
+set_prop(sscoredump, vendor_ssrdump_prop)
+
+allow sscoredump device:dir r_dir_perms;
+allow sscoredump sscoredump_device:chr_file rw_file_perms;
+allow sscoredump sscoredump_vendor_data_crashinfo_file:dir create_dir_perms;
+allow sscoredump sscoredump_vendor_data_crashinfo_file:file create_file_perms;
+
+userdebug_or_eng(`
+ allow sscoredump sscoredump_sysfs_level:file rw_file_perms;
+ allow sscoredump sscoredump_vendor_data_coredump_file:dir create_dir_perms;
+ allow sscoredump sscoredump_vendor_data_coredump_file:file create_file_perms;
+')
diff --git a/whitechapel/vendor/google/ssr_detector.te b/whitechapel/vendor/google/ssr_detector.te
new file mode 100644
index 0000000..48361bd
--- /dev/null
+++ b/whitechapel/vendor/google/ssr_detector.te
@@ -0,0 +1,16 @@
+type ssr_detector_app, domain;
+
+app_domain(ssr_detector_app)
+allow ssr_detector_app app_api_service:service_manager find;
+allow ssr_detector_app radio_service:service_manager find;
+
+allow ssr_detector_app system_app_data_file:dir r_dir_perms;
+
+allow ssr_detector_app sscoredump_vendor_data_crashinfo_file:dir r_dir_perms;
+allow ssr_detector_app sscoredump_vendor_data_crashinfo_file:file r_file_perms;
+userdebug_or_eng(`
+ allow ssr_detector_app sscoredump_vendor_data_coredump_file:dir r_dir_perms;
+ allow ssr_detector_app sscoredump_vendor_data_coredump_file:file r_file_perms;
+')
+
+get_prop(ssr_detector_app, vendor_ssrdump_prop)
diff --git a/whitechapel/vendor/google/storageproxyd.te b/whitechapel/vendor/google/storageproxyd.te
new file mode 100644
index 0000000..ef9d93a
--- /dev/null
+++ b/whitechapel/vendor/google/storageproxyd.te
@@ -0,0 +1,4 @@
+type sg_device, dev_type;
+
+allow tee sg_device:chr_file rw_file_perms;
+allow tee self:capability { setgid setuid };
diff --git a/whitechapel/vendor/google/system_app.te b/whitechapel/vendor/google/system_app.te
new file mode 100644
index 0000000..f8fe4f2
--- /dev/null
+++ b/whitechapel/vendor/google/system_app.te
@@ -0,0 +1,6 @@
+allow system_app sysfs_vendor_sched:file w_file_perms;
+
+allow system_app hal_wlc_hwservice:hwservice_manager find;
+binder_call(system_app, hal_wlc)
+
+allow system_app fwk_stats_hwservice:hwservice_manager find;
\ No newline at end of file
diff --git a/whitechapel/vendor/google/system_server.te b/whitechapel/vendor/google/system_server.te
new file mode 100644
index 0000000..329a693
--- /dev/null
+++ b/whitechapel/vendor/google/system_server.te
@@ -0,0 +1,3 @@
+# Allow system server to send sensor data callbacks to GPS and camera HALs
+binder_call(system_server, gpsd);
+binder_call(system_server, hal_camera_default);
diff --git a/whitechapel/vendor/google/toolbox.te b/whitechapel/vendor/google/toolbox.te
new file mode 100644
index 0000000..9fbbb7a
--- /dev/null
+++ b/whitechapel/vendor/google/toolbox.te
@@ -0,0 +1,3 @@
+allow toolbox ram_device:blk_file rw_file_perms;
+allow toolbox per_boot_file:dir create_dir_perms;
+allow toolbox per_boot_file:file create_file_perms;
diff --git a/whitechapel/vendor/google/trusty_apploader.te b/whitechapel/vendor/google/trusty_apploader.te
new file mode 100644
index 0000000..b3f9179
--- /dev/null
+++ b/whitechapel/vendor/google/trusty_apploader.te
@@ -0,0 +1,6 @@
+type trusty_apploader, domain;
+type trusty_apploader_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(trusty_apploader)
+
+allow trusty_apploader ion_device:chr_file r_file_perms;
+allow trusty_apploader tee_device:chr_file rw_file_perms;
diff --git a/whitechapel/vendor/google/untrusted_app_all.te b/whitechapel/vendor/google/untrusted_app_all.te
new file mode 100644
index 0000000..8e79515
--- /dev/null
+++ b/whitechapel/vendor/google/untrusted_app_all.te
@@ -0,0 +1,6 @@
+# Allows applications to discover the EdgeTPU service.
+allow untrusted_app_all edgetpu_service:service_manager find;
+
+# Allows applications to access the EdgeTPU device, except open, which is guarded
+# by the EdgeTPU service.
+allow untrusted_app_all edgetpu_device:chr_file { getattr read write ioctl map };
diff --git a/whitechapel/vendor/google/vcd.te b/whitechapel/vendor/google/vcd.te
new file mode 100644
index 0000000..c4af485
--- /dev/null
+++ b/whitechapel/vendor/google/vcd.te
@@ -0,0 +1,11 @@
+type vcd, domain;
+type vcd_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(vcd)
+
+get_prop(vcd, vendor_rild_prop);
+get_prop(vcd, vendor_persist_config_default_prop);
+
+allow vcd serial_device:chr_file rw_file_perms;
+allow vcd radio_device:chr_file rw_file_perms;
+allow vcd self:tcp_socket { create_socket_perms_no_ioctl listen accept };
+allow vcd node:tcp_socket node_bind;
diff --git a/whitechapel/vendor/google/vendor_ims_app.te b/whitechapel/vendor/google/vendor_ims_app.te
new file mode 100644
index 0000000..058450d
--- /dev/null
+++ b/whitechapel/vendor/google/vendor_ims_app.te
@@ -0,0 +1,2 @@
+type vendor_ims_app, domain;
+app_domain(vendor_ims_app)
diff --git a/whitechapel/vendor/google/vendor_init.te b/whitechapel/vendor/google/vendor_init.te
new file mode 100644
index 0000000..7a0a9d5
--- /dev/null
+++ b/whitechapel/vendor/google/vendor_init.te
@@ -0,0 +1,14 @@
+set_prop(vendor_init, vendor_device_prop)
+set_prop(vendor_init, vendor_modem_prop)
+set_prop(vendor_init, vendor_cbd_prop)
+get_prop(vendor_init, vendor_rild_prop)
+get_prop(vendor_init, vendor_persist_sys_modem_prop)
+
+allow vendor_init proc_dirty:file w_file_perms;
+allow vendor_init proc_sched:file write;
+allow vendor_init bootdevice_sysdev:file create_file_perms;
+
+# NFC vendor property
+set_prop(vendor_init, vendor_nfc_prop)
+# SecureElement vendor property
+set_prop(vendor_init, vendor_secure_element_prop)
diff --git a/whitechapel/vendor/google/vendor_telephony_app.te b/whitechapel/vendor/google/vendor_telephony_app.te
new file mode 100644
index 0000000..06d867c
--- /dev/null
+++ b/whitechapel/vendor/google/vendor_telephony_app.te
@@ -0,0 +1,4 @@
+type vendor_telephony_app, domain;
+app_domain(vendor_telephony_app)
+
+set_prop(vendor_telephony_app, vendor_modem_prop)
\ No newline at end of file
diff --git a/whitechapel/vendor/google/vndservice.te b/whitechapel/vendor/google/vndservice.te
new file mode 100644
index 0000000..f70a26f
--- /dev/null
+++ b/whitechapel/vendor/google/vndservice.te
@@ -0,0 +1,4 @@
+type rls_service, vndservice_manager_type;
+type vendor_surfaceflinger_vndservice, vndservice_manager_type;
+type vendor_displaycolor_service, vndservice_manager_type;
+type eco_service, vndservice_manager_type;
diff --git a/whitechapel/vendor/google/vndservice_contexts b/whitechapel/vendor/google/vndservice_contexts
new file mode 100644
index 0000000..d44e1cb
--- /dev/null
+++ b/whitechapel/vendor/google/vndservice_contexts
@@ -0,0 +1,4 @@
+Exynos.HWCService u:object_r:vendor_surfaceflinger_vndservice:s0
+rlsservice u:object_r:rls_service:s0
+displaycolor u:object_r:vendor_displaycolor_service:s0
+media.ecoservice u:object_r:eco_service:s0
diff --git a/whitechapel/vendor/google/vold.te b/whitechapel/vendor/google/vold.te
new file mode 100644
index 0000000..ecea194
--- /dev/null
+++ b/whitechapel/vendor/google/vold.te
@@ -0,0 +1,6 @@
+allow vold sysfs_scsi_devices_0000:file rw_file_perms;
+allow vold modem_efs_file:dir rw_dir_perms;
+allow vold modem_userdata_file:dir rw_dir_perms;
+
+dontaudit vold dumpstate:fifo_file rw_file_perms;
+dontaudit vold dumpstate:fd { use };