Merge "Expose domain_verification_service"
diff --git a/Android.bp b/Android.bp
index 8fa57ca..aca6e40 100644
--- a/Android.bp
+++ b/Android.bp
@@ -735,3 +735,30 @@
     relative_install_path: "selinux",
     installable: false,
 }
+
+se_build_files {
+    name: "se_build_files",
+    srcs: [
+        "security_classes",
+        "initial_sids",
+        "access_vectors",
+        "global_macros",
+        "neverallow_macros",
+        "mls_macros",
+        "mls_decl",
+        "mls",
+        "policy_capabilities",
+        "te_macros",
+        "attributes",
+        "ioctl_defines",
+        "ioctl_macros",
+        "*.te",
+        "roles_decl",
+        "roles",
+        "users",
+        "initial_sid_contexts",
+        "fs_use",
+        "genfs_contexts",
+        "port_contexts",
+    ],
+}
diff --git a/build/soong/Android.bp b/build/soong/Android.bp
index 5f951ce..4e1d27a 100644
--- a/build/soong/Android.bp
+++ b/build/soong/Android.bp
@@ -31,8 +31,10 @@
         "soong-sysprop",
     ],
     srcs: [
+        "build_files.go",
         "cil_compat_map.go",
         "filegroup.go",
+        "policy.go",
         "selinux.go",
         "selinux_contexts.go",
     ],
diff --git a/build/soong/build_files.go b/build/soong/build_files.go
new file mode 100644
index 0000000..1704366
--- /dev/null
+++ b/build/soong/build_files.go
@@ -0,0 +1,191 @@
+// Copyright 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package selinux
+
+import (
+	"fmt"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"android/soong/android"
+)
+
+func init() {
+	android.RegisterModuleType("se_build_files", buildFilesFactory)
+}
+
+// se_build_files gathers policy files from sepolicy dirs, and acts like a filegroup. A tag with
+// partition(plat, system_ext, product) and scope(public, private) is used to select directories.
+// Supported tags are: "plat", "plat_public", "system_ext", "system_ext_public", "product",
+// "product_public", and "reqd_mask".
+func buildFilesFactory() android.Module {
+	module := &buildFiles{}
+	module.AddProperties(&module.properties)
+	android.InitAndroidModule(module)
+	return module
+}
+
+type buildFilesProperties struct {
+	// list of source file suffixes used to collect selinux policy files.
+	// Source files will be looked up in the following local directories:
+	// system/sepolicy/{public, private, vendor, reqd_mask}
+	// and directories specified by following config variables:
+	// BOARD_SEPOLICY_DIRS, BOARD_ODM_SEPOLICY_DIRS
+	// BOARD_PLAT_PUBLIC_SEPOLICY_DIR, BOARD_PLAT_PRIVATE_SEPOLICY_DIR
+	Srcs []string
+}
+
+type buildFiles struct {
+	android.ModuleBase
+	properties buildFilesProperties
+
+	srcs map[string]android.Paths
+}
+
+func (b *buildFiles) findSrcsInDirs(ctx android.ModuleContext, dirs ...string) android.Paths {
+	result := android.Paths{}
+	for _, file := range b.properties.Srcs {
+		for _, dir := range dirs {
+			path := filepath.Join(dir, file)
+			files, err := ctx.GlobWithDeps(path, nil)
+			if err != nil {
+				ctx.ModuleErrorf("glob: %s", err.Error())
+			}
+			for _, f := range files {
+				result = append(result, android.PathForSource(ctx, f))
+			}
+		}
+	}
+	return result
+}
+
+func (b *buildFiles) DepsMutator(ctx android.BottomUpMutatorContext) {
+	// do nothing
+}
+
+func (b *buildFiles) OutputFiles(tag string) (android.Paths, error) {
+	if paths, ok := b.srcs[tag]; ok {
+		return paths, nil
+	}
+
+	return nil, fmt.Errorf("unknown tag %q. Supported tags are: %q", tag, strings.Join(android.SortedStringKeys(b.srcs), " "))
+}
+
+var _ android.OutputFileProducer = (*buildFiles)(nil)
+
+type partition int
+
+const (
+	system partition = iota
+	system_ext
+	product
+)
+
+type scope int
+
+const (
+	public scope = iota
+	private
+)
+
+type sepolicyDir struct {
+	partition partition
+	scope     scope
+	paths     []string
+}
+
+func (p partition) String() string {
+	switch p {
+	case system:
+		return "plat"
+	case system_ext:
+		return "system_ext"
+	case product:
+		return "product"
+	default:
+		panic(fmt.Sprintf("Unknown partition %#v", p))
+	}
+}
+
+func (b *buildFiles) GenerateAndroidBuildActions(ctx android.ModuleContext) {
+	// Sepolicy directories should be included in the following order.
+	//   - system_public
+	//   - system_private
+	//   - system_ext_public
+	//   - system_ext_private
+	//   - product_public
+	//   - product_private
+	dirs := []sepolicyDir{
+		sepolicyDir{partition: system, scope: public, paths: []string{filepath.Join(ctx.ModuleDir(), "public")}},
+		sepolicyDir{partition: system, scope: private, paths: []string{filepath.Join(ctx.ModuleDir(), "private")}},
+		sepolicyDir{partition: system_ext, scope: public, paths: ctx.DeviceConfig().SystemExtPublicSepolicyDirs()},
+		sepolicyDir{partition: system_ext, scope: private, paths: ctx.DeviceConfig().SystemExtPrivateSepolicyDirs()},
+		sepolicyDir{partition: product, scope: public, paths: ctx.Config().ProductPublicSepolicyDirs()},
+		sepolicyDir{partition: product, scope: private, paths: ctx.Config().ProductPrivateSepolicyDirs()},
+	}
+
+	if !sort.SliceIsSorted(dirs, func(i, j int) bool {
+		if dirs[i].partition != dirs[j].partition {
+			return dirs[i].partition < dirs[j].partition
+		}
+
+		return dirs[i].scope < dirs[j].scope
+	}) {
+		panic("dirs is not sorted")
+	}
+
+	// Exported cil policy files are built with the following policies.
+	//
+	//   - plat_pub_policy.cil: exported 'system'
+	//   - system_ext_pub_policy.cil: exported 'system' and 'system_ext'
+	//   - pub_policy.cil: exported 'system', 'system_ext', and 'product'
+	//
+	// cil policy files are built with the following policies.
+	//
+	//   - plat_policy.cil: 'system', including private
+	//   - system_ext_policy.cil: 'system_ext', including private
+	//   - product_sepolicy.cil: 'product', including private
+	//
+	// gatherDirsFor collects all needed directories for given partition and scope. For example,
+	//
+	//   - gatherDirsFor(system_ext, private) will return system + system_ext (including private)
+	//   - gatherDirsFor(product, public) will return system + system_ext + product (public only)
+	//
+	// "dirs" should be sorted before calling this.
+	gatherDirsFor := func(p partition, s scope) []string {
+		var ret []string
+
+		for _, d := range dirs {
+			if d.partition <= p && d.scope <= s {
+				ret = append(ret, d.paths...)
+			}
+		}
+
+		return ret
+	}
+
+	reqdMaskDir := filepath.Join(ctx.ModuleDir(), "reqd_mask")
+
+	b.srcs = make(map[string]android.Paths)
+	b.srcs[".reqd_mask"] = b.findSrcsInDirs(ctx, reqdMaskDir)
+
+	for _, p := range []partition{system, system_ext, product} {
+		b.srcs["."+p.String()] = b.findSrcsInDirs(ctx, gatherDirsFor(p, private)...)
+
+		// reqd_mask is needed for public policies
+		b.srcs["."+p.String()+"_public"] = b.findSrcsInDirs(ctx, append(gatherDirsFor(p, public), reqdMaskDir)...)
+	}
+}
diff --git a/build/soong/policy.go b/build/soong/policy.go
new file mode 100644
index 0000000..caeb6eb
--- /dev/null
+++ b/build/soong/policy.go
@@ -0,0 +1,349 @@
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package selinux
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+
+	"github.com/google/blueprint/proptools"
+
+	"android/soong/android"
+)
+
+const (
+	// TODO: sync with Android.mk
+	MlsSens    = 1
+	MlsCats    = 1024
+	PolicyVers = 30
+)
+
+func init() {
+	android.RegisterModuleType("se_policy_conf", policyConfFactory)
+	android.RegisterModuleType("se_policy_cil", policyCilFactory)
+}
+
+type policyConfProperties struct {
+	// Name of the output. Default is {module_name}
+	Stem *string
+
+	// Policy files to be compiled to cil file.
+	Srcs []string `android:"path"`
+
+	// Target build variant (user / userdebug / eng). Default follows the current lunch target
+	Build_variant *string
+
+	// Whether to exclude build test or not. Default is false
+	Exclude_build_test *bool
+
+	// Whether to include asan specific policies or not. Default follows the current lunch target
+	With_asan *bool
+
+	// Whether to build CTS specific policy or not. Default is false
+	Cts *bool
+
+	// Whether this module is directly installable to one of the partitions. Default is true
+	Installable *bool
+}
+
+type policyConf struct {
+	android.ModuleBase
+
+	properties policyConfProperties
+
+	installSource android.Path
+	installPath   android.InstallPath
+}
+
+// se_policy_conf merges collection of policy files into a policy.conf file to be processed by
+// checkpolicy.
+func policyConfFactory() android.Module {
+	c := &policyConf{}
+	c.AddProperties(&c.properties)
+	android.InitAndroidArchModule(c, android.DeviceSupported, android.MultilibCommon)
+	return c
+}
+
+func (c *policyConf) installable() bool {
+	return proptools.BoolDefault(c.properties.Installable, true)
+}
+
+func (c *policyConf) stem() string {
+	return proptools.StringDefault(c.properties.Stem, c.Name())
+}
+
+func (c *policyConf) buildVariant(ctx android.ModuleContext) string {
+	if variant := proptools.String(c.properties.Build_variant); variant != "" {
+		return variant
+	}
+	if ctx.Config().Eng() {
+		return "eng"
+	}
+	if ctx.Config().Debuggable() {
+		return "userdebug"
+	}
+	return "user"
+}
+
+func (c *policyConf) cts() bool {
+	return proptools.Bool(c.properties.Cts)
+}
+
+func (c *policyConf) withAsan(ctx android.ModuleContext) string {
+	isAsanDevice := android.InList("address", ctx.Config().SanitizeDevice())
+	return strconv.FormatBool(proptools.BoolDefault(c.properties.With_asan, isAsanDevice))
+}
+
+func (c *policyConf) sepolicySplit(ctx android.ModuleContext) string {
+	if c.cts() {
+		return "cts"
+	}
+	return strconv.FormatBool(ctx.DeviceConfig().SepolicySplit())
+}
+
+func (c *policyConf) compatibleProperty(ctx android.ModuleContext) string {
+	if c.cts() {
+		return "cts"
+	}
+	return "true"
+}
+
+func (c *policyConf) trebleSyspropNeverallow(ctx android.ModuleContext) string {
+	if c.cts() {
+		return "cts"
+	}
+	return strconv.FormatBool(!ctx.DeviceConfig().BuildBrokenTrebleSyspropNeverallow())
+}
+
+func (c *policyConf) enforceSyspropOwner(ctx android.ModuleContext) string {
+	if c.cts() {
+		return "cts"
+	}
+	return strconv.FormatBool(!ctx.DeviceConfig().BuildBrokenEnforceSyspropOwner())
+}
+
+func (c *policyConf) transformPolicyToConf(ctx android.ModuleContext) android.OutputPath {
+	conf := android.PathForModuleOut(ctx, "conf").OutputPath
+	rule := android.NewRuleBuilder(pctx, ctx)
+	rule.Command().Tool(ctx.Config().PrebuiltBuildTool(ctx, "m4")).
+		Flag("--fatal-warnings").
+		FlagForEachArg("-D ", ctx.DeviceConfig().SepolicyM4Defs()).
+		FlagWithArg("-D mls_num_sens=", strconv.Itoa(MlsSens)).
+		FlagWithArg("-D mls_num_cats=", strconv.Itoa(MlsCats)).
+		FlagWithArg("-D target_arch=", ctx.DeviceConfig().DeviceArch()).
+		FlagWithArg("-D target_with_asan=", c.withAsan(ctx)).
+		FlagWithArg("-D target_with_native_coverage=", strconv.FormatBool(ctx.DeviceConfig().ClangCoverageEnabled() || ctx.DeviceConfig().GcovCoverageEnabled())).
+		FlagWithArg("-D target_build_variant=", c.buildVariant(ctx)).
+		FlagWithArg("-D target_full_treble=", c.sepolicySplit(ctx)).
+		FlagWithArg("-D target_compatible_property=", c.compatibleProperty(ctx)).
+		FlagWithArg("-D target_treble_sysprop_neverallow=", c.trebleSyspropNeverallow(ctx)).
+		FlagWithArg("-D target_enforce_sysprop_owner=", c.enforceSyspropOwner(ctx)).
+		FlagWithArg("-D target_exclude_build_test=", strconv.FormatBool(proptools.Bool(c.properties.Exclude_build_test))).
+		FlagWithArg("-D target_requires_insecure_execmem_for_swiftshader=", strconv.FormatBool(ctx.DeviceConfig().RequiresInsecureExecmemForSwiftshader())).
+		Flag("-s").
+		Inputs(android.PathsForModuleSrc(ctx, c.properties.Srcs)).
+		Text("> ").Output(conf)
+
+	rule.Build("conf", "Transform policy to conf: "+ctx.ModuleName())
+	return conf
+}
+
+func (c *policyConf) DepsMutator(ctx android.BottomUpMutatorContext) {
+	// do nothing
+}
+
+func (c *policyConf) GenerateAndroidBuildActions(ctx android.ModuleContext) {
+	c.installSource = c.transformPolicyToConf(ctx)
+	c.installPath = android.PathForModuleInstall(ctx, "etc")
+	ctx.InstallFile(c.installPath, c.stem(), c.installSource)
+
+	if !c.installable() {
+		c.SkipInstall()
+	}
+}
+
+func (c *policyConf) AndroidMkEntries() []android.AndroidMkEntries {
+	return []android.AndroidMkEntries{android.AndroidMkEntries{
+		OutputFile: android.OptionalPathForPath(c.installSource),
+		Class:      "ETC",
+		ExtraEntries: []android.AndroidMkExtraEntriesFunc{
+			func(ctx android.AndroidMkExtraEntriesContext, entries *android.AndroidMkEntries) {
+				entries.SetBool("LOCAL_UNINSTALLABLE_MODULE", !c.installable())
+				entries.SetPath("LOCAL_MODULE_PATH", c.installPath.ToMakePath())
+				entries.SetString("LOCAL_INSTALLED_MODULE_STEM", c.stem())
+			},
+		},
+	}}
+}
+
+func (c *policyConf) OutputFiles(tag string) (android.Paths, error) {
+	if tag == "" {
+		return android.Paths{c.installSource}, nil
+	}
+	return nil, fmt.Errorf("Unknown tag %q", tag)
+}
+
+var _ android.OutputFileProducer = (*policyConf)(nil)
+
+type policyCilProperties struct {
+	// Name of the output. Default is {module_name}
+	Stem *string
+
+	// Policy file to be compiled to cil file.
+	Src *string `android:"path"`
+
+	// Additional cil files to be added in the end of the output. This is to support workarounds
+	// which are not supported by the policy language.
+	Additional_cil_files []string `android:"path"`
+
+	// Cil files to be filtered out by the filter_out tool of "build_sepolicy". Used to build
+	// exported policies
+	Filter_out []string `android:"path"`
+
+	// Whether to remove line markers (denoted by ;;) out of compiled cil files. Defaults to false
+	Remove_line_marker *bool
+
+	// Whether to run secilc to check compiled policy or not. Defaults to true
+	Secilc_check *bool
+
+	// Whether to ignore neverallow when running secilc check. Defaults to
+	// SELINUX_IGNORE_NEVERALLOWS.
+	Ignore_neverallow *bool
+
+	// Whether this module is directly installable to one of the partitions. Default is true
+	Installable *bool
+}
+
+type policyCil struct {
+	android.ModuleBase
+
+	properties policyCilProperties
+
+	installSource android.Path
+	installPath   android.InstallPath
+}
+
+// se_policy_cil compiles a policy.conf file to a cil file with checkpolicy, and optionally runs
+// secilc to check the output cil file. Affected by SELINUX_IGNORE_NEVERALLOWS.
+func policyCilFactory() android.Module {
+	c := &policyCil{}
+	c.AddProperties(&c.properties)
+	android.InitAndroidArchModule(c, android.DeviceSupported, android.MultilibCommon)
+	return c
+}
+
+func (c *policyCil) Installable() bool {
+	return proptools.BoolDefault(c.properties.Installable, true)
+}
+
+func (c *policyCil) stem() string {
+	return proptools.StringDefault(c.properties.Stem, c.Name())
+}
+
+func (c *policyCil) compileConfToCil(ctx android.ModuleContext, conf android.Path) android.OutputPath {
+	cil := android.PathForModuleOut(ctx, c.stem()).OutputPath
+	rule := android.NewRuleBuilder(pctx, ctx)
+	rule.Command().BuiltTool("checkpolicy").
+		Flag("-C"). // Write CIL
+		Flag("-M"). // Enable MLS
+		FlagWithArg("-c ", strconv.Itoa(PolicyVers)).
+		FlagWithOutput("-o ", cil).
+		Input(conf)
+
+	if len(c.properties.Additional_cil_files) > 0 {
+		rule.Command().Text("cat").
+			Inputs(android.PathsForModuleSrc(ctx, c.properties.Additional_cil_files)).
+			Text(">> ").Output(cil)
+	}
+
+	if len(c.properties.Filter_out) > 0 {
+		rule.Command().BuiltTool("build_sepolicy").
+			Text("filter_out").
+			Flag("-f").
+			Inputs(android.PathsForModuleSrc(ctx, c.properties.Filter_out)).
+			FlagWithOutput("-t ", cil)
+	}
+
+	if proptools.Bool(c.properties.Remove_line_marker) {
+		rule.Command().Text("grep -v").
+			Text(proptools.ShellEscape(";;")).
+			Text(cil.String()).
+			Text(">").
+			Text(cil.String() + ".tmp").
+			Text("&& mv").
+			Text(cil.String() + ".tmp").
+			Text(cil.String())
+	}
+
+	if proptools.BoolDefault(c.properties.Secilc_check, true) {
+		secilcCmd := rule.Command().BuiltTool("secilc").
+			Flag("-m").                 // Multiple decls
+			FlagWithArg("-M ", "true"). // Enable MLS
+			Flag("-G").                 // expand and remove auto generated attributes
+			FlagWithArg("-c ", strconv.Itoa(PolicyVers)).
+			Inputs(android.PathsForModuleSrc(ctx, c.properties.Filter_out)). // Also add cil files which are filtered out
+			Text(cil.String()).
+			FlagWithArg("-o ", os.DevNull).
+			FlagWithArg("-f ", os.DevNull)
+
+		if proptools.BoolDefault(c.properties.Ignore_neverallow, ctx.Config().SelinuxIgnoreNeverallows()) {
+			secilcCmd.Flag("-N")
+		}
+	}
+
+	rule.Build("cil", "Building cil for "+ctx.ModuleName())
+	return cil
+}
+
+func (c *policyCil) GenerateAndroidBuildActions(ctx android.ModuleContext) {
+	if proptools.String(c.properties.Src) == "" {
+		ctx.PropertyErrorf("src", "must be specified")
+		return
+	}
+	conf := android.PathForModuleSrc(ctx, *c.properties.Src)
+	cil := c.compileConfToCil(ctx, conf)
+
+	c.installPath = android.PathForModuleInstall(ctx, "etc", "selinux")
+	c.installSource = cil
+	ctx.InstallFile(c.installPath, c.stem(), c.installSource)
+
+	if !c.Installable() {
+		c.SkipInstall()
+	}
+}
+
+func (c *policyCil) AndroidMkEntries() []android.AndroidMkEntries {
+	return []android.AndroidMkEntries{android.AndroidMkEntries{
+		OutputFile: android.OptionalPathForPath(c.installSource),
+		Class:      "ETC",
+		ExtraEntries: []android.AndroidMkExtraEntriesFunc{
+			func(ctx android.AndroidMkExtraEntriesContext, entries *android.AndroidMkEntries) {
+				entries.SetBool("LOCAL_UNINSTALLABLE_MODULE", !c.Installable())
+				entries.SetPath("LOCAL_MODULE_PATH", c.installPath.ToMakePath())
+				entries.SetString("LOCAL_INSTALLED_MODULE_STEM", c.stem())
+			},
+		},
+	}}
+}
+
+func (c *policyCil) OutputFiles(tag string) (android.Paths, error) {
+	if tag == "" {
+		return android.Paths{c.installSource}, nil
+	}
+	return nil, fmt.Errorf("Unknown tag %q", tag)
+}
+
+var _ android.OutputFileProducer = (*policyCil)(nil)
diff --git a/private/access_vectors b/private/access_vectors
index a02a2a8..c1c0359 100644
--- a/private/access_vectors
+++ b/private/access_vectors
@@ -182,6 +182,9 @@
 	entrypoint
 }
 
+class anon_inode
+inherits file
+
 class lnk_file
 inherits file
 
@@ -718,6 +721,7 @@
 	change_user
 	clear_ns
 	clear_uid
+	get_auth_token
 	get_state
 	list
 	lock
diff --git a/private/apexd.te b/private/apexd.te
index a2a77ab..44e38b6 100644
--- a/private/apexd.te
+++ b/private/apexd.te
@@ -13,6 +13,10 @@
 allow apexd apex_metadata_file:dir create_dir_perms;
 allow apexd apex_metadata_file:file create_file_perms;
 
+# Allow reserving space on /data/apex/ota_reserved for apex decompression
+allow apexd apex_ota_reserved_file:dir create_dir_perms;
+allow apexd apex_ota_reserved_file:file create_file_perms;
+
 # Allow apexd to create files and directories for snapshots of apex data
 allow apexd apex_art_data_file:dir { create_dir_perms relabelto };
 allow apexd apex_art_data_file:file { create_file_perms relabelto };
@@ -158,6 +162,9 @@
 # apexd uses it to decide whether it needs to keep retrying polling for loop device.
 get_prop(apexd, cold_boot_done_prop)
 
+# Allow apexd to read per-device configuration properties.
+get_prop(apexd, apexd_config_prop)
+
 neverallow { domain -apexd -init } apex_data_file:dir no_w_dir_perms;
 neverallow { domain -apexd -init } apex_metadata_file:dir no_w_dir_perms;
 neverallow { domain -apexd -init -kernel } apex_data_file:file no_w_file_perms;
diff --git a/private/compat/30.0/30.0.ignore.cil b/private/compat/30.0/30.0.ignore.cil
index cbee4b7..0f9b7ec 100644
--- a/private/compat/30.0/30.0.ignore.cil
+++ b/private/compat/30.0/30.0.ignore.cil
@@ -13,6 +13,7 @@
     apex_info_file
     apex_ota_reserved_file
     apex_scheduling_data_file
+    apexd_config_prop
     app_hibernation_service
     appcompat_data_file
     arm64_memtag_prop
@@ -57,6 +58,7 @@
     hal_secureclock_service
     hal_sharedsecret_service
     hal_weaver_service
+    hw_timeout_multiplier_prop
     keystore_compat_hal_service
     keystore_maintenance_service
     keystore2_key_contexts_file
@@ -75,6 +77,7 @@
     odsign
     odsign_data_file
     odsign_exec
+    pac_proxy_service
     people_service
     persist_vendor_debug_wifi_prop
     power_debug_prop
diff --git a/private/dex2oat.te b/private/dex2oat.te
index b08462e..697ec1f 100644
--- a/private/dex2oat.te
+++ b/private/dex2oat.te
@@ -2,6 +2,8 @@
 type dex2oat, domain, coredomain;
 type dex2oat_exec, system_file_type, exec_type, file_type;
 
+userfaultfd_use(dex2oat)
+
 r_dir_file(dex2oat, apk_data_file)
 # Access to /vendor/app
 r_dir_file(dex2oat, vendor_app_file)
diff --git a/private/dexoptanalyzer.te b/private/dexoptanalyzer.te
index a99f8a2..5f0a41e 100644
--- a/private/dexoptanalyzer.te
+++ b/private/dexoptanalyzer.te
@@ -14,6 +14,8 @@
 # processes.
 tmpfs_domain(dexoptanalyzer)
 
+userfaultfd_use(dexoptanalyzer)
+
 # Allow dexoptanalyzer to read files in the dalvik cache.
 allow dexoptanalyzer dalvikcache_data_file:dir { getattr search };
 allow dexoptanalyzer dalvikcache_data_file:file r_file_perms;
diff --git a/private/file.te b/private/file.te
index 4b0f48a..910210d 100644
--- a/private/file.te
+++ b/private/file.te
@@ -33,6 +33,9 @@
 # /data/gsi/ota
 type ota_image_data_file, file_type, data_file_type, core_data_file_type;
 
+# /data/gsi_persistent_data
+type gsi_persistent_data_file, file_type, data_file_type, core_data_file_type;
+
 # /data/misc/emergencynumberdb
 type emergency_data_file, file_type, data_file_type, core_data_file_type;
 
diff --git a/private/file_contexts b/private/file_contexts
index a4a0449..f8bb5ec 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -532,6 +532,7 @@
 /data/app-private(/.*)?               u:object_r:apk_private_data_file:s0
 /data/app-private/vmdl.*\.tmp(/.*)?   u:object_r:apk_private_tmp_file:s0
 /data/gsi(/.*)?        u:object_r:gsi_data_file:s0
+/data/gsi_persistent_data    u:object_r:gsi_persistent_data_file:s0
 /data/gsi/ota(/.*)?    u:object_r:ota_image_data_file:s0
 /data/tombstones(/.*)?	u:object_r:tombstone_data_file:s0
 /data/vendor/tombstones/wifi(/.*)? u:object_r:tombstone_wifi_data_file:s0
diff --git a/private/genfs_contexts b/private/genfs_contexts
index 79b0313..af1b692 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -280,6 +280,7 @@
 genfscon tracefs /events/thermal/cdev_update/                            u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/cpuhp/cpuhp_enter/                              u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/cpuhp/cpuhp_exit/                               u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/cpuhp/cpuhp_pause/                              u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/ipi/                                            u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/irq/                                            u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/clk/clk_enable/                                 u:object_r:debugfs_tracing:s0
diff --git a/private/incidentd.te b/private/incidentd.te
index eda55e3..70e1187 100644
--- a/private/incidentd.te
+++ b/private/incidentd.te
@@ -53,6 +53,9 @@
 allow incidentd perfetto_traces_data_file:dir r_dir_perms;
 allow incidentd perfetto_traces_data_file:file r_file_perms;
 
+# section id 3052, allow accessing nfc_service
+allow incidentd nfc_service:service_manager find;
+
 # Create and write into /data/misc/incidents
 allow incidentd incident_data_file:dir rw_dir_perms;
 allow incidentd incident_data_file:file create_file_perms;
diff --git a/private/mediametrics.te b/private/mediametrics.te
index f8b2fa5..5a6f2e1 100644
--- a/private/mediametrics.te
+++ b/private/mediametrics.te
@@ -1,3 +1,8 @@
 typeattribute mediametrics coredomain;
 
 init_daemon_domain(mediametrics)
+
+# Needed for stats callback registration to statsd.
+allow mediametrics stats_service:service_manager find;
+allow mediametrics statsmanager_service:service_manager find;
+binder_call(mediametrics, statsd)
diff --git a/private/mls b/private/mls
index 1588a13..955c27b 100644
--- a/private/mls
+++ b/private/mls
@@ -48,6 +48,13 @@
 	     (l2 eq h2 and (l1 eq l2 or t1 == mlstrustedsubject));
 
 #
+# Userfaultfd constraints
+#
+# To enforce that anonymous inodes are self contained in the application's process.
+mlsconstrain anon_inode { ioctl read write create getattr setattr lock relabelfrom relabelto append map unlink link rename execute open execmod }
+	     (l1 eq l2);
+
+#
 # Constraints for app data files only.
 #
 
diff --git a/private/network_stack.te b/private/network_stack.te
index 9598fa5..6fa3055 100644
--- a/private/network_stack.te
+++ b/private/network_stack.te
@@ -49,10 +49,9 @@
 allow network_stack bpfloader:bpf { map_read map_write prog_run };
 
 # Only the bpfloader and the network_stack should ever touch 'fs_bpf_tethering' programs/maps.
-# TODO: remove netd once netd/tethering mainline module split is complete
 # Unfortunately init/vendor_init have all sorts of extra privs
-neverallow { domain -bpfloader -init -netd -network_stack -vendor_init } fs_bpf_tethering:dir ~getattr;
-neverallow { domain -bpfloader -init -netd -network_stack -vendor_init } fs_bpf_tethering:file *;
+neverallow { domain -bpfloader -init -network_stack -vendor_init } fs_bpf_tethering:dir ~getattr;
+neverallow { domain -bpfloader -init -network_stack -vendor_init } fs_bpf_tethering:file *;
 
-neverallow { domain -bpfloader -netd -network_stack } fs_bpf_tethering:dir ~{ getattr open read search setattr };
-neverallow { domain -bpfloader -netd -network_stack } fs_bpf_tethering:file ~{ map open read setattr };
+neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:dir ~{ getattr open read search setattr };
+neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file ~{ map open read setattr };
diff --git a/private/odrefresh.te b/private/odrefresh.te
index 9c615fa..e6b1023 100644
--- a/private/odrefresh.te
+++ b/private/odrefresh.te
@@ -7,6 +7,8 @@
 allow odrefresh apex_art_data_file:dir { create_dir_perms relabelfrom };
 allow odrefresh apex_art_data_file:file create_file_perms;
 
+userfaultfd_use(odrefresh)
+
 # Staging area labels (/data/misc/apexdata/com.android.art/staging). odrefresh
 # sets up files here and passes file descriptors for dex2oat to write to.
 allow odrefresh apex_art_staging_data_file:dir { create_dir_perms relabelto };
diff --git a/private/odsign.te b/private/odsign.te
index b35a3ca..0ff3b7b 100644
--- a/private/odsign.te
+++ b/private/odsign.te
@@ -50,6 +50,10 @@
 # Run fsverity_init to add key to fsverity keyring
 domain_auto_trans(odsign, fsverity_init_exec, fsverity_init)
 
+# only odsign can set odsign sysprop
+set_prop(odsign, odsign_prop)
+neverallow { domain -odsign -init } odsign_prop:property_service set;
+
 # Neverallows
 neverallow { domain -odsign -init -fsverity_init } odsign_data_file:dir *;
 neverallow { domain -odsign -init -fsverity_init } odsign_data_file:file *;
diff --git a/private/property.te b/private/property.te
index e435628..4a17f62 100644
--- a/private/property.te
+++ b/private/property.te
@@ -22,6 +22,7 @@
 system_internal_prop(net_464xlat_fromvendor_prop)
 system_internal_prop(net_connectivity_prop)
 system_internal_prop(netd_stable_secret_prop)
+system_internal_prop(odsign_prop)
 system_internal_prop(pm_prop)
 system_internal_prop(rollback_test_prop)
 system_internal_prop(setupwizard_prop)
@@ -33,9 +34,6 @@
 system_internal_prop(verity_status_prop)
 system_internal_prop(zygote_wrap_prop)
 
-# TODO Remove this property when Keystore 2.0 migration is complete b/171563717
-system_internal_prop(keystore2_enable_prop)
-
 ###
 ### Neverallow rules
 ###
@@ -540,16 +538,6 @@
   lower_kptr_restrict_prop
 }:property_service set;
 
-# TODO Remove this property when Keystore 2.0 migration is complete b/171563717
-neverallow {
-  domain
-  -init
-  -dumpstate
-  -system_app
-  -system_server
-  -zygote
-} keystore2_enable_prop:file no_rw_file_perms;
-
 neverallow {
   domain
   -init
diff --git a/private/property_contexts b/private/property_contexts
index 134be15..7d49fa2 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -244,6 +244,8 @@
 persist.device_config.global_settings.sys_traced u:object_r:device_config_sys_traced_prop:s0
 
 apexd.                  u:object_r:apexd_prop:s0
+apexd.config.dm_delete.timeout           u:object_r:apexd_config_prop:s0 exact uint
+apexd.config.dm_create.timeout           u:object_r:apexd_config_prop:s0 exact uint
 persist.apexd.          u:object_r:apexd_prop:s0
 
 bpf.progs_loaded        u:object_r:bpf_progs_loaded_prop:s0
@@ -544,6 +546,10 @@
 
 apexd.status u:object_r:apexd_prop:s0 exact enum starting activated ready
 
+odsign.key.done u:object_r:odsign_prop:s0 exact bool
+odsign.verification.done u:object_r:odsign_prop:s0 exact bool
+odsign.verification.success u:object_r:odsign_prop:s0 exact bool
+
 dev.bootcomplete   u:object_r:boot_status_prop:s0 exact bool
 sys.boot_completed u:object_r:boot_status_prop:s0 exact bool
 
@@ -750,6 +756,7 @@
 ro.odm.build.date.utc            u:object_r:build_odm_prop:s0 exact int
 ro.odm.build.fingerprint         u:object_r:build_odm_prop:s0 exact string
 ro.odm.build.version.incremental u:object_r:build_odm_prop:s0 exact string
+ro.odm.build.media_performance_class   u:object_r:build_odm_prop:s0 exact int
 
 ro.product.odm.brand        u:object_r:build_odm_prop:s0 exact string
 ro.product.odm.device       u:object_r:build_odm_prop:s0 exact string
@@ -806,6 +813,9 @@
 ro.product.vendor.model        u:object_r:build_vendor_prop:s0 exact string
 ro.product.vendor.name         u:object_r:build_vendor_prop:s0 exact string
 
+# GRF property for the first api level of the vendor partition
+ro.board.first_api_level u:object_r:build_vendor_prop:s0 exact int
+
 # Boot image build props set by /{second_stage_resources/,}boot/etc/build.prop
 ro.bootimage.build.date                        u:object_r:build_bootimage_prop:s0 exact string
 ro.bootimage.build.date.utc                    u:object_r:build_bootimage_prop:s0 exact int
@@ -923,6 +933,8 @@
 ro.hardware.virtual_device       u:object_r:exported_default_prop:s0 exact string
 ro.hardware.vulkan               u:object_r:exported_default_prop:s0 exact string
 
+ro.hw_timeout_multiplier u:object_r:hw_timeout_multiplier_prop:s0 exact int
+
 ro.hwui.use_vulkan u:object_r:exported_default_prop:s0 exact bool
 
 ro.kernel.qemu             u:object_r:exported_default_prop:s0 exact bool
@@ -1076,10 +1088,6 @@
 
 ro.zygote.disable_gl_preload u:object_r:zygote_config_prop:s0 exact bool
 
-# Enable Keystore 2.0.
-# TODO remove this property when Keystore 2.0 migration is complete b/171563717
-persist.android.security.keystore2.enable    u:object_r:keystore2_enable_prop:s0 exact bool
-
 # Broadcast boot stages, which keystore listens to
 keystore.boot_level u:object_r:keystore_listen_prop:s0 exact int
 
diff --git a/private/security_classes b/private/security_classes
index 3e9bff0..200b030 100644
--- a/private/security_classes
+++ b/private/security_classes
@@ -15,6 +15,7 @@
 # file-related classes
 class filesystem
 class file
+class anon_inode
 class dir
 class fd
 class lnk_file
diff --git a/private/service_contexts b/private/service_contexts
index 9a85459..1965d65 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -190,6 +190,7 @@
 oem_lock                                  u:object_r:oem_lock_service:s0
 otadexopt                                 u:object_r:otadexopt_service:s0
 overlay                                   u:object_r:overlay_service:s0
+pac_proxy                                 u:object_r:pac_proxy_service:s0
 package                                   u:object_r:package_service:s0
 package_native                            u:object_r:package_native_service:s0
 people                                    u:object_r:people_service:s0
diff --git a/private/stats.te b/private/stats.te
index 3e8a3d5..9b9d4ba 100644
--- a/private/stats.te
+++ b/private/stats.te
@@ -43,6 +43,7 @@
   -gmscore_app
   -gpuservice
   -incidentd
+  -mediametrics
   -platform_app
   -priv_app
   -shell
diff --git a/private/system_app.te b/private/system_app.te
index 36208bf..58322b8 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -172,9 +172,6 @@
 # Settings app reads ro.oem_unlock_supported
 get_prop(system_app, oem_unlock_prop)
 
-# TODO Remove this property when Keystore 2.0 migration is complete b/171563717
-get_prop(system_app, keystore2_enable_prop)
-
 ###
 ### Neverallow rules
 ###
diff --git a/private/system_server.te b/private/system_server.te
index 34b3d9f..084ea22 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -12,6 +12,8 @@
 # Define a type for tmpfs-backed ashmem regions.
 tmpfs_domain(system_server)
 
+userfaultfd_use(system_server)
+
 # Create a socket for connections from crash_dump.
 type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";
 
@@ -1265,6 +1267,9 @@
 allow system_server watchdog_metadata_file:dir rw_dir_perms;
 allow system_server watchdog_metadata_file:file create_file_perms;
 
+allow system_server gsi_persistent_data_file:dir rw_dir_perms;
+allow system_server gsi_persistent_data_file:file create_file_perms;
+
 # Allow system server r access to /system/bin/surfaceflinger for PinnerService.
 allow system_server surfaceflinger_exec:file r_file_perms;
 
@@ -1285,9 +1290,6 @@
 # Read/Write /proc/pressure/memory
 allow system_server proc_pressure_mem:file rw_file_perms;
 
-# TODO Remove this property when Keystore 2.0 migration is complete b/171563717
-get_prop(system_server, keystore2_enable_prop)
-
 # dexoptanalyzer is currently used only for secondary dex files which
 # system_server should never access.
 neverallow system_server dexoptanalyzer_exec:file no_x_file_perms;
diff --git a/private/webview_zygote.te b/private/webview_zygote.te
index bfdad06..3f217e1 100644
--- a/private/webview_zygote.te
+++ b/private/webview_zygote.te
@@ -10,6 +10,8 @@
 # a domain macro.
 tmpfs_domain(webview_zygote);
 
+userfaultfd_use(webview_zygote)
+
 # Allow reading/executing installed binaries to enable preloading the
 # installed WebView implementation.
 allow webview_zygote apk_data_file:dir r_dir_perms;
diff --git a/private/zygote.te b/private/zygote.te
index 5f24115..c2c6e89 100644
--- a/private/zygote.te
+++ b/private/zygote.te
@@ -24,6 +24,8 @@
 allow zygote appdomain:dir { getattr search };
 allow zygote appdomain:file { r_file_perms };
 
+userfaultfd_use(zygote)
+
 # Move children into the peer process group.
 allow zygote system_server:process { getpgid setpgid };
 allow zygote appdomain:process { getpgid setpgid };
@@ -221,9 +223,6 @@
 # Allow zygote to read /apex/apex-info-list.xml
 allow zygote apex_info_file:file r_file_perms;
 
-# TODO Remove this property when Keystore 2.0 migration is complete b/171563717
-get_prop(zygote, keystore2_enable_prop)
-
 ###
 ### neverallow rules
 ###
diff --git a/public/app.te b/public/app.te
index 67a996a..af19d10 100644
--- a/public/app.te
+++ b/public/app.te
@@ -298,6 +298,9 @@
 allow { appdomain -isolated_app -ephemeral_app } keystore:keystore_key { get_state get insert delete exist list sign verify };
 allow { appdomain -isolated_app -ephemeral_app } keystore:keystore2_key { delete use get_info rebind update };
 
+allow { appdomain -isolated_app -ephemeral_app } keystore_maintenance_service:service_manager find;
+allow { appdomain -isolated_app -ephemeral_app } keystore:keystore2 get_state;
+
 use_keystore({ appdomain -isolated_app -ephemeral_app })
 
 use_credstore({ appdomain -isolated_app -ephemeral_app })
diff --git a/public/credstore.te b/public/credstore.te
index a2376d2..97d942d 100644
--- a/public/credstore.te
+++ b/public/credstore.te
@@ -12,6 +12,8 @@
 add_service(credstore, credstore_service)
 allow credstore sec_key_att_app_id_provider_service:service_manager find;
 allow credstore dropbox_service:service_manager find;
+allow credstore authorization_service:service_manager find;
+allow credstore keystore:keystore2 get_auth_token;
 
 r_dir_file(credstore, cgroup)
 r_dir_file(credstore, cgroup_v2)
diff --git a/public/domain.te b/public/domain.te
index 3666fbc..e1d6739 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -113,6 +113,7 @@
 get_prop(domain, exported_system_prop)
 get_prop(domain, fingerprint_prop)
 get_prop(domain, hal_instrumentation_prop)
+get_prop(domain, hw_timeout_multiplier_prop)
 get_prop(domain, init_service_status_prop)
 get_prop(domain, libc_debug_prop)
 get_prop(domain, logd_prop)
@@ -550,6 +551,7 @@
     neverallow { domain -init } exported_secure_prop:property_service set;
     neverallow { domain -init -vendor_init } vendor_default_prop:property_service set;
     neverallow { domain -init -vendor_init } storage_config_prop:property_service set;
+    neverallow { domain -init -vendor_init } hw_timeout_multiplier_prop:property_service set;
 ')
 
 compatible_property_only(`
@@ -677,6 +679,7 @@
     -cameraserver_service
     -drmserver_service
     -credstore_service
+    -keystore_maintenance_service
     -keystore_service
     -mediadrmserver_service
     -mediaextractor_service
diff --git a/public/dumpstate.te b/public/dumpstate.te
index 45540b3..28bdb82 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -370,6 +370,7 @@
 #Allow access to /dev/binderfs/binder_logs
 allow dumpstate binderfs_logs:dir r_dir_perms;
 allow dumpstate binderfs_logs:file r_file_perms;
+allow dumpstate binderfs_logs_proc:file r_file_perms;
 
 allow dumpstate apex_info_file:file getattr;
 
diff --git a/public/fastbootd.te b/public/fastbootd.te
index fb3e953..9614545 100644
--- a/public/fastbootd.te
+++ b/public/fastbootd.te
@@ -98,6 +98,8 @@
     }:{ file lnk_file } unlink;
     allow fastbootd tmpfs:dir rw_dir_perms;
     allow fastbootd labeledfs:filesystem { mount unmount };
+    # Fetch vendor_boot partition
+    allow fastbootd boot_block_device:blk_file r_file_perms;
   ')
 
   # Allow using libfiemap/gsid directly (no binder in recovery).
diff --git a/public/netd.te b/public/netd.te
index 4472938..ff0bff6 100644
--- a/public/netd.te
+++ b/public/netd.te
@@ -64,9 +64,8 @@
 
 r_dir_file(netd, cgroup_v2)
 
-# TODO: remove 'fs_bpf_tethering' once netd/tethering mainline module split is completed.
-allow netd { fs_bpf fs_bpf_tethering }:dir search;
-allow netd { fs_bpf fs_bpf_tethering }:file { read write };
+allow netd fs_bpf:dir search;
+allow netd fs_bpf:file { read write };
 
 # TODO: netd previously thought it needed these permissions to do WiFi related
 #       work.  However, after all the WiFi stuff is gone, we still need them.
diff --git a/public/property.te b/public/property.te
index 506e985..01bd68e 100644
--- a/public/property.te
+++ b/public/property.te
@@ -112,6 +112,7 @@
 ')
 
 # Properties which can be written only by vendor_init
+system_vendor_config_prop(apexd_config_prop)
 system_vendor_config_prop(aaudio_config_prop)
 system_vendor_config_prop(apk_verity_prop)
 system_vendor_config_prop(audio_config_prop)
@@ -131,6 +132,7 @@
 system_vendor_config_prop(framework_watchdog_config_prop)
 system_vendor_config_prop(graphics_config_prop)
 system_vendor_config_prop(hdmi_config_prop)
+system_vendor_config_prop(hw_timeout_multiplier_prop)
 system_vendor_config_prop(incremental_prop)
 system_vendor_config_prop(keyguard_config_prop)
 system_vendor_config_prop(lmkd_config_prop)
diff --git a/public/service.te b/public/service.te
index 462b78f..229131c 100644
--- a/public/service.te
+++ b/public/service.te
@@ -117,7 +117,7 @@
 type face_service, app_api_service, system_server_service, service_manager_type;
 type fingerprint_service, app_api_service, system_server_service, service_manager_type;
 type fwk_stats_service, system_server_service, service_manager_type;
-type game_service, app_api_service, system_server_service, service_manager_type;
+type game_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type gfxinfo_service, system_api_service, system_server_service, service_manager_type;
 type graphicsstats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type hardware_service, system_server_service, service_manager_type;
@@ -135,7 +135,7 @@
 type light_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type location_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type location_time_zone_manager_service, system_server_service, service_manager_type;
-type lock_settings_service, system_api_service, system_server_service, service_manager_type;
+type lock_settings_service, app_api_service, system_api_service, system_server_service, service_manager_type;
 type looper_stats_service, system_server_service, service_manager_type;
 type media_communication_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type media_metrics_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
@@ -156,6 +156,7 @@
 type oem_lock_service, system_api_service, system_server_service, service_manager_type;
 type otadexopt_service, system_server_service, service_manager_type;
 type overlay_service, system_api_service, system_server_service, service_manager_type;
+type pac_proxy_service, system_server_service, service_manager_type;
 type package_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type package_native_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type people_service, app_api_service, system_server_service, service_manager_type;
@@ -203,7 +204,7 @@
 type texttospeech_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type telecom_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type thermal_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
-type timedetector_service, system_server_service, service_manager_type;
+type timedetector_service, app_api_service, system_server_service, service_manager_type;
 type timezone_service, system_server_service, service_manager_type;
 type timezonedetector_service, app_api_service, system_server_service, service_manager_type;
 type transformer_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
diff --git a/public/statsd.te b/public/statsd.te
index 435bbdf..baf05d4 100644
--- a/public/statsd.te
+++ b/public/statsd.te
@@ -33,6 +33,10 @@
 allow statsd gpu_service:service_manager find;
 binder_call(statsd, gpuservice)
 
+# Allow statsd to interact with mediametrics
+allow statsd mediametrics_service:service_manager find;
+binder_call(statsd, mediametrics)
+
 # Allow logd access.
 read_logd(statsd)
 control_logd(statsd)
diff --git a/public/te_macros b/public/te_macros
index 50532c1..1d919eb 100644
--- a/public/te_macros
+++ b/public/te_macros
@@ -163,6 +163,21 @@
 domain_auto_trans(init, $1_exec, $1)
 ')
 
+####################################
+# userfaultfd_use(domain)
+# Allow domain to create/use userfaultfd.
+define(`userfaultfd_use', `
+# Set up a type_transition to "userfaultfd" named anonymous inode object.
+type $1_userfaultfd;
+type_transition $1 $1:anon_inode $1_userfaultfd "[userfaultfd]";
+# Allow domain to create/use userfaultfd anon_inode.
+allow $1 $1_userfaultfd:anon_inode { create ioctl read };
+# Other domains may not use userfaultfd anon_inodes created by this domain.
+neverallow { domain -$1 } $1_userfaultfd:anon_inode *;
+# This domain may not use userfaultfd anon_inodes created by other domains.
+neverallow $1 ~$1_userfaultfd:anon_inode *;
+')
+
 #####################################
 # app_domain(domain)
 # Allow a base set of permissions required for all apps.
@@ -170,6 +185,7 @@
 typeattribute $1 appdomain;
 # Label tmpfs objects for all apps.
 type_transition $1 tmpfs:file appdomain_tmpfs;
+userfaultfd_use($1)
 allow $1 appdomain_tmpfs:file { execute getattr map read write };
 neverallow { $1 -runas_app -shell -simpleperf } { domain -$1 }:file no_rw_file_perms;
 neverallow { appdomain -runas_app -shell -simpleperf -$1 } $1:file no_rw_file_perms;
diff --git a/public/update_engine.te b/public/update_engine.te
index 206d29c..b7cf827 100644
--- a/public/update_engine.te
+++ b/public/update_engine.te
@@ -29,14 +29,6 @@
 allow update_engine update_engine_log_data_file:dir create_dir_perms;
 allow update_engine update_engine_log_data_file:file create_file_perms;
 
-# TODO(b/172911822): remove these access when we have transferred
-# reservation responsibility to apexd
-
-# Allow reserving space on /data/apex/ota_reserved for apex decompression
-allow update_engine apex_ota_reserved_file:dir create_dir_perms;
-allow update_engine apex_ota_reserved_file:file create_file_perms;
-allow update_engine apex_data_file:dir search;
-
 # Don't allow kernel module loading, just silence the logs.
 dontaudit update_engine kernel:system module_request;
 
diff --git a/public/vendor_init.te b/public/vendor_init.te
index a54befb..c8b8b12 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -233,6 +233,7 @@
 set_prop(vendor_init, exported_overlay_prop)
 set_prop(vendor_init, exported_pm_prop)
 set_prop(vendor_init, ffs_control_prop)
+set_prop(vendor_init, hw_timeout_multiplier_prop)
 set_prop(vendor_init, incremental_prop)
 set_prop(vendor_init, lmkd_prop)
 set_prop(vendor_init, logd_prop)