diff --git a/Android.bp b/Android.bp
index 15adf7e..391411b 100644
--- a/Android.bp
+++ b/Android.bp
@@ -80,6 +80,41 @@
 }
 
 se_filegroup {
+    name: "26.0.board.compat.cil",
+    srcs: [
+        "compat/26.0/26.0.compat.cil",
+    ],
+}
+
+se_filegroup {
+    name: "27.0.board.compat.cil",
+    srcs: [
+        "compat/27.0/27.0.compat.cil",
+    ],
+}
+
+se_filegroup {
+    name: "28.0.board.compat.cil",
+    srcs: [
+        "compat/28.0/28.0.compat.cil",
+    ],
+}
+
+se_filegroup {
+    name: "29.0.board.compat.cil",
+    srcs: [
+        "compat/29.0/29.0.compat.cil",
+    ],
+}
+
+se_filegroup {
+    name: "30.0.board.compat.cil",
+    srcs: [
+        "compat/30.0/30.0.compat.cil",
+    ],
+}
+
+se_filegroup {
     name: "26.0.board.ignore.map",
     srcs: [
         "compat/26.0/26.0.ignore.cil",
@@ -259,34 +294,64 @@
     // top_half: "31.0.ignore.cil",
 }
 
-prebuilt_etc {
+se_compat_cil {
     name: "26.0.compat.cil",
-    src: "private/compat/26.0/26.0.compat.cil",
-    sub_dir: "selinux/mapping",
+    srcs: [":26.0.board.compat.cil"],
 }
 
-prebuilt_etc {
+se_compat_cil {
     name: "27.0.compat.cil",
-    src: "private/compat/27.0/27.0.compat.cil",
-    sub_dir: "selinux/mapping",
+    srcs: [":27.0.board.compat.cil"],
 }
 
-prebuilt_etc {
+se_compat_cil {
     name: "28.0.compat.cil",
-    src: "private/compat/28.0/28.0.compat.cil",
-    sub_dir: "selinux/mapping",
+    srcs: [":28.0.board.compat.cil"],
 }
 
-prebuilt_etc {
+se_compat_cil {
     name: "29.0.compat.cil",
-    src: "private/compat/29.0/29.0.compat.cil",
-    sub_dir: "selinux/mapping",
+    srcs: [":29.0.board.compat.cil"],
 }
 
-prebuilt_etc {
+se_compat_cil {
     name: "30.0.compat.cil",
-    src: "private/compat/30.0/30.0.compat.cil",
-    sub_dir: "selinux/mapping",
+    srcs: [":30.0.board.compat.cil"],
+}
+
+se_compat_cil {
+    name: "system_ext_26.0.compat.cil",
+    srcs: [":26.0.board.compat.cil"],
+    stem: "26.0.compat.cil",
+    system_ext_specific: true,
+}
+
+se_compat_cil {
+    name: "system_ext_27.0.compat.cil",
+    srcs: [":27.0.board.compat.cil"],
+    stem: "27.0.compat.cil",
+    system_ext_specific: true,
+}
+
+se_compat_cil {
+    name: "system_ext_28.0.compat.cil",
+    srcs: [":28.0.board.compat.cil"],
+    stem: "28.0.compat.cil",
+    system_ext_specific: true,
+}
+
+se_compat_cil {
+    name: "system_ext_29.0.compat.cil",
+    srcs: [":29.0.board.compat.cil"],
+    stem: "29.0.compat.cil",
+    system_ext_specific: true,
+}
+
+se_compat_cil {
+    name: "system_ext_30.0.compat.cil",
+    srcs: [":30.0.board.compat.cil"],
+    stem: "30.0.compat.cil",
+    system_ext_specific: true,
 }
 
 se_filegroup {
@@ -622,6 +687,21 @@
     additional_cil_files: ["private/technical_debt.cil"],
 }
 
+// userdebug_plat_policy.conf - the userdebug version plat_sepolicy.cil
+se_policy_conf {
+    name: "userdebug_plat_sepolicy.conf",
+    srcs: [":se_build_files{.plat}"],
+    build_variant: "userdebug",
+    installable: false,
+}
+
+se_policy_cil {
+    name: "userdebug_plat_sepolicy.cil",
+    src: ":userdebug_plat_sepolicy.conf",
+    additional_cil_files: ["private/technical_debt.cil"],
+    debug_ramdisk: true,
+}
+
 // system_ext_policy.conf - A combination of the private and public system_ext
 // policy which will ship with the device. System_ext policy is not attributized
 se_policy_conf {
diff --git a/Android.mk b/Android.mk
index 767a864..01a8e67 100644
--- a/Android.mk
+++ b/Android.mk
@@ -458,6 +458,7 @@
     system_ext_service_contexts \
     system_ext_service_contexts_test \
     system_ext_mac_permissions.xml \
+    $(addprefix system_ext_,$(addsuffix .compat.cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \
 
 endif
 
@@ -784,55 +785,6 @@
 #################################
 include $(CLEAR_VARS)
 
-LOCAL_MODULE := userdebug_plat_sepolicy.cil
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_DEBUG_RAMDISK_OUT)
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-# userdebug_plat_policy.conf - the userdebug version plat_sepolicy.cil
-policy_files := $(call build_policy, $(sepolicy_build_files), \
-  $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
-userdebug_plat_policy.conf := $(intermediates)/userdebug_plat_policy.conf
-$(userdebug_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
-$(userdebug_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
-$(userdebug_plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := userdebug
-$(userdebug_plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
-$(userdebug_plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
-$(userdebug_plat_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
-$(userdebug_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(userdebug_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
-$(userdebug_plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(userdebug_plat_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
-$(userdebug_plat_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
-$(userdebug_plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
-$(userdebug_plat_policy.conf): $(policy_files) $(M4)
-	$(transform-policy-to-conf)
-	$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
-
-$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_CIL_FILES := \
-  $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY))
-$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
-$(LOCAL_BUILT_MODULE): $(userdebug_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
-  $(HOST_OUT_EXECUTABLES)/secilc \
-  $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \
-  $(built_sepolicy_neverallows)
-	@mkdir -p $(dir $@)
-	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
-		$(POLICYVERS) -o $@.tmp $<
-	$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@.tmp
-	$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@.tmp -o /dev/null -f /dev/null
-	$(hide) mv $@.tmp $@
-
-userdebug_plat_policy.conf :=
-
-#################################
-include $(CLEAR_VARS)
-
 LOCAL_MODULE := plat_sepolicy_vers.txt
 LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
 LOCAL_LICENSE_CONDITIONS := notice unencumbered
diff --git a/OWNERS b/OWNERS
index d7cde74..a0326af 100644
--- a/OWNERS
+++ b/OWNERS
@@ -2,6 +2,7 @@
 alanstokes@google.com
 bowgotsai@google.com
 cbrubaker@google.com
+inseob@google.com
 jbires@google.com
 jeffv@google.com
 jgalenson@google.com
diff --git a/build/soong/Android.bp b/build/soong/Android.bp
index aa6ad71..6a52fe5 100644
--- a/build/soong/Android.bp
+++ b/build/soong/Android.bp
@@ -33,6 +33,7 @@
     srcs: [
         "build_files.go",
         "cil_compat_map.go",
+        "compat_cil.go",
         "filegroup.go",
         "policy.go",
         "selinux.go",
diff --git a/build/soong/build_files.go b/build/soong/build_files.go
index 88c07fa..5de6122 100644
--- a/build/soong/build_files.go
+++ b/build/soong/build_files.go
@@ -44,7 +44,7 @@
 	// system/sepolicy/{public, private, vendor, reqd_mask}
 	// and directories specified by following config variables:
 	// BOARD_SEPOLICY_DIRS, BOARD_ODM_SEPOLICY_DIRS
-	// BOARD_PLAT_PUBLIC_SEPOLICY_DIR, BOARD_PLAT_PRIVATE_SEPOLICY_DIR
+	// SYSTEM_EXT_PUBLIC_SEPOLICY_DIR, SYSTEM_EXT_PRIVATE_SEPOLICY_DIR
 	Srcs []string
 }
 
diff --git a/build/soong/compat_cil.go b/build/soong/compat_cil.go
new file mode 100644
index 0000000..5cc73f9
--- /dev/null
+++ b/build/soong/compat_cil.go
@@ -0,0 +1,122 @@
+// Copyright 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package selinux
+
+import (
+	"github.com/google/blueprint/proptools"
+
+	"android/soong/android"
+)
+
+func init() {
+	android.RegisterModuleType("se_compat_cil", compatCilFactory)
+}
+
+// se_compat_cil collects and installs backwards compatibility cil files.
+func compatCilFactory() android.Module {
+	c := &compatCil{}
+	c.AddProperties(&c.properties)
+	android.InitAndroidArchModule(c, android.DeviceSupported, android.MultilibCommon)
+	return c
+}
+
+type compatCil struct {
+	android.ModuleBase
+	properties    compatCilProperties
+	installSource android.Path
+	installPath   android.InstallPath
+}
+
+type compatCilProperties struct {
+	// List of source files. Can reference se_filegroup type modules with the ":module" syntax.
+	Srcs []string
+
+	// Output file name. Defaults to module name if unspecified.
+	Stem *string
+}
+
+func (c *compatCil) stem() string {
+	return proptools.StringDefault(c.properties.Stem, c.Name())
+}
+
+func (c *compatCil) expandSeSources(ctx android.ModuleContext) android.Paths {
+	srcPaths := make(android.Paths, 0, len(c.properties.Srcs))
+	for _, src := range c.properties.Srcs {
+		if m := android.SrcIsModule(src); m != "" {
+			module := ctx.GetDirectDepWithTag(m, android.SourceDepTag)
+			if module == nil {
+				// Error would have been handled by ExtractSourcesDeps
+				continue
+			}
+			if fg, ok := module.(*fileGroup); ok {
+				if c.SystemExtSpecific() {
+					srcPaths = append(srcPaths, fg.SystemExtPrivateSrcs()...)
+				} else {
+					srcPaths = append(srcPaths, fg.SystemPrivateSrcs()...)
+				}
+			} else {
+				ctx.PropertyErrorf("srcs", "%q is not an se_filegroup", m)
+			}
+		} else {
+			srcPaths = append(srcPaths, android.PathForModuleSrc(ctx, src))
+		}
+	}
+	return srcPaths
+}
+
+func (c *compatCil) DepsMutator(ctx android.BottomUpMutatorContext) {
+	android.ExtractSourcesDeps(ctx, c.properties.Srcs)
+}
+
+func (c *compatCil) GenerateAndroidBuildActions(ctx android.ModuleContext) {
+	if c.ProductSpecific() || c.SocSpecific() || c.DeviceSpecific() {
+		ctx.ModuleErrorf("Compat cil files only support system and system_ext partitions")
+	}
+
+	srcPaths := c.expandSeSources(ctx)
+	out := android.PathForModuleGen(ctx, c.Name())
+
+	// TODO(b/183362912): Patch secilc to handle empty cil files.
+	// Put a header so that the generated cil mustn't be empty.
+	header := android.PathForModuleGen(ctx, c.Name()+"_header")
+	rule := android.NewRuleBuilder(pctx, ctx)
+	rule.Command().Text("echo").Flag(proptools.ShellEscape(";; " + c.stem())).Text(">").Output(header)
+	rule.Build(c.Name()+"_header", "Generate cil header")
+	srcPaths = append(android.Paths{header}, srcPaths...)
+
+	ctx.Build(pctx, android.BuildParams{
+		Rule:        android.Cat,
+		Inputs:      srcPaths,
+		Output:      out,
+		Description: "Combining compat cil for " + c.Name(),
+	})
+
+	c.installPath = android.PathForModuleInstall(ctx, "etc", "selinux", "mapping")
+	c.installSource = out
+	ctx.InstallFile(c.installPath, c.stem(), c.installSource)
+}
+
+func (c *compatCil) AndroidMkEntries() []android.AndroidMkEntries {
+	return []android.AndroidMkEntries{android.AndroidMkEntries{
+		Class:      "ETC",
+		OutputFile: android.OptionalPathForPath(c.installSource),
+		ExtraEntries: []android.AndroidMkExtraEntriesFunc{
+			func(ctx android.AndroidMkExtraEntriesContext, entries *android.AndroidMkEntries) {
+				entries.SetPath("LOCAL_MODULE_PATH", c.installPath.ToMakePath())
+				entries.SetString("LOCAL_INSTALLED_MODULE_STEM", c.stem())
+			},
+		},
+	}}
+}
diff --git a/build/soong/filegroup.go b/build/soong/filegroup.go
index 700f8e0..0d426af 100644
--- a/build/soong/filegroup.go
+++ b/build/soong/filegroup.go
@@ -36,7 +36,7 @@
 	// system/sepolicy/{public, private, vendor, reqd_mask}
 	// and directories specified by following config variables:
 	// BOARD_SEPOLICY_DIRS, BOARD_ODM_SEPOLICY_DIRS
-	// BOARD_PLAT_PUBLIC_SEPOLICY_DIR, BOARD_PLAT_PRIVATE_SEPOLICY_DIR
+	// SYSTEM_EXT_PUBLIC_SEPOLICY_DIR, SYSTEM_EXT_PRIVATE_SEPOLICY_DIR
 	Srcs []string
 }
 
@@ -80,12 +80,12 @@
 	return fg.systemReqdMaskSrcs
 }
 
-// Source files from BOARD_PLAT_PUBLIC_SEPOLICY_DIR
+// Source files from SYSTEM_EXT_PUBLIC_SEPOLICY_DIR
 func (fg *fileGroup) SystemExtPublicSrcs() android.Paths {
 	return fg.systemExtPublicSrcs
 }
 
-// Source files from BOARD_PLAT_PRIVATE_SEPOLICY_DIR
+// Source files from SYSTEM_EXT_PRIVATE_SEPOLICY_DIR
 func (fg *fileGroup) SystemExtPrivateSrcs() android.Paths {
 	return fg.systemExtPrivateSrcs
 }
diff --git a/build/soong/policy.go b/build/soong/policy.go
index d734c97..9d574c9 100644
--- a/build/soong/policy.go
+++ b/build/soong/policy.go
@@ -317,7 +317,12 @@
 	conf := android.PathForModuleSrc(ctx, *c.properties.Src)
 	cil := c.compileConfToCil(ctx, conf)
 
-	c.installPath = android.PathForModuleInstall(ctx, "etc", "selinux")
+	if c.InstallInDebugRamdisk() {
+		// for userdebug_plat_sepolicy.cil
+		c.installPath = android.PathForModuleInstall(ctx)
+	} else {
+		c.installPath = android.PathForModuleInstall(ctx, "etc", "selinux")
+	}
 	c.installSource = cil
 	ctx.InstallFile(c.installPath, c.stem(), c.installSource)
 
diff --git a/build/soong/selinux_contexts.go b/build/soong/selinux_contexts.go
index d7a0798..a9aed60 100644
--- a/build/soong/selinux_contexts.go
+++ b/build/soong/selinux_contexts.go
@@ -257,6 +257,10 @@
 	return false
 }
 
+func (m *selinuxContextsModule) DebugRamdiskVariantNeeded(ctx android.BaseModuleContext) bool {
+	return false
+}
+
 func (m *selinuxContextsModule) RecoveryVariantNeeded(ctx android.BaseModuleContext) bool {
 	return m.InstallInRecovery() || proptools.Bool(m.properties.Recovery_available)
 }
diff --git a/private/adbd.te b/private/adbd.te
index f569ad2..3fc77a2 100644
--- a/private/adbd.te
+++ b/private/adbd.te
@@ -209,6 +209,10 @@
 allow adbd vendor_apex_file:dir search;
 allow adbd vendor_apex_file:file r_file_perms;
 
+# Allow adb pull of updated apex files in /data/apex/active.
+allow adbd apex_data_file:dir search;
+allow adbd staging_data_file:file r_file_perms;
+
 ###
 ### Neverallow rules
 ###
diff --git a/private/app.te b/private/app.te
index 0c81515..126f11f 100644
--- a/private/app.te
+++ b/private/app.te
@@ -34,6 +34,9 @@
 # Apps should not be reading vendor-defined properties.
 dontaudit appdomain vendor_default_prop:file read;
 
+# Access to /mnt/media_rw/<vol> (limited by DAC to apps with external_storage gid)
+allow appdomain mnt_media_rw_file:dir search;
+
 neverallow appdomain system_server:udp_socket {
         accept append bind create ioctl listen lock name_bind
         relabelfrom relabelto setattr shutdown };
diff --git a/private/compat/30.0/30.0.ignore.cil b/private/compat/30.0/30.0.ignore.cil
index a115831..2b06fd8 100644
--- a/private/compat/30.0/30.0.ignore.cil
+++ b/private/compat/30.0/30.0.ignore.cil
@@ -18,6 +18,7 @@
     appcompat_data_file
     arm64_memtag_prop
     authorization_service
+    camerax_extensions_prop
     cgroup_desc_api_file
     cgroup_v2
     codec2_config_prop
@@ -125,6 +126,7 @@
     update_engine_stable_service
     userdata_sysdev
     userspace_reboot_metadata_file
+    uwb_service
     vcn_management_service
     vd_device
     vendor_kernel_modules
diff --git a/private/domain.te b/private/domain.te
index d5c9193..87518a7 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -201,7 +201,7 @@
 # do not change between system_server staging the files and apexd processing
 # the files.
 neverallow { domain -init -system_server -apexd -installd -iorap_inode2filename -priv_app } staging_data_file:dir *;
-neverallow { domain -init -system_app -system_server -apexd -kernel -installd -iorap_inode2filename -priv_app } staging_data_file:file *;
+neverallow { domain -init -system_app -system_server -apexd -adbd -kernel -installd -iorap_inode2filename -priv_app } staging_data_file:file *;
 neverallow { domain -init -system_server -installd} staging_data_file:dir no_w_dir_perms;
 # apexd needs the link and unlink permissions, so list every `no_w_file_perms`
 # except for `link` and `unlink`.
diff --git a/private/file.te b/private/file.te
index 984a7b6..2b6f2cb 100644
--- a/private/file.te
+++ b/private/file.te
@@ -51,6 +51,9 @@
 # /data/font/files
 type font_data_file, file_type, data_file_type, core_data_file_type;
 
+# /data/misc/odrefresh
+type odrefresh_data_file, file_type, data_file_type, core_data_file_type;
+
 # /data/misc/odsign
 type odsign_data_file, file_type, data_file_type, core_data_file_type;
 
diff --git a/private/file_contexts b/private/file_contexts
index 3a8642d..7cb7f1c 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -600,6 +600,7 @@
 /data/misc/net(/.*)?            u:object_r:net_data_file:s0
 /data/misc/network_watchlist(/.*)? u:object_r:network_watchlist_data_file:s0
 /data/misc/nfc/logs(/.*)?       u:object_r:nfc_logs_data_file:s0
+/data/misc/odrefresh(/.*)?      u:object_r:odrefresh_data_file:s0
 /data/misc/odsign(/.*)?         u:object_r:odsign_data_file:s0
 /data/misc/perfetto-traces/bugreport(.*)? u:object_r:perfetto_traces_bugreport_data_file:s0
 /data/misc/perfetto-traces(/.*)?          u:object_r:perfetto_traces_data_file:s0
diff --git a/private/gsid.te b/private/gsid.te
index e6a395a..8a13cb1 100644
--- a/private/gsid.te
+++ b/private/gsid.te
@@ -183,7 +183,10 @@
 } gsi_public_metadata_file:file_class_set ~{ r_file_perms };
 
 # Prevent apps from accessing gsi_metadata_file_type.
-neverallow appdomain gsi_metadata_file_type:dir_file_class_set *;
+neverallow {
+    appdomain
+    -shell
+} gsi_metadata_file_type:dir_file_class_set *;
 
 neverallow {
     domain
diff --git a/private/keystore2_key_contexts b/private/keystore2_key_contexts
index 5695cc3..3833971 100644
--- a/private/keystore2_key_contexts
+++ b/private/keystore2_key_contexts
@@ -16,10 +16,13 @@
 # odsign_key is a keystore2_key namespace for the on-device signing daemon.
 101            u:object_r:odsign_key:s0
 
-# wifi_key is a keystore2_key namspace for the WI-FI subsystem. It replaces the WIFI_UID
+# wifi_key is a keystore2_key namespace for the WI-FI subsystem. It replaces the WIFI_UID
 # namespace in keystore.
 102            u:object_r:wifi_key:s0
 
+# locksettings_key is a keystore2_key namespace for the LockSettingsService.
+103            u:object_r:locksettings_key:s0
+
 # resume_on_reboot_key is a keystore2_key namespace intended for resume on reboot.
 120            u:object_r:resume_on_reboot_key:s0
 
diff --git a/private/keystore_keys.te b/private/keystore_keys.te
index 8d33d5d..2f97608 100644
--- a/private/keystore_keys.te
+++ b/private/keystore_keys.te
@@ -14,6 +14,9 @@
 # A keystore2 namespace for the on-device signing daemon.
 type odsign_key, keystore2_key_type;
 
+# A keystore2 namespace for LockSettingsService.
+type locksettings_key, keystore2_key_type;
+
 # A keystore2 namespace for resume on reboot.
 type resume_on_reboot_key, keystore2_key_type;
 
diff --git a/private/mediaprovider.te b/private/mediaprovider.te
index 978ae2a..78bbdb0 100644
--- a/private/mediaprovider.te
+++ b/private/mediaprovider.te
@@ -24,6 +24,7 @@
 
 allow mediaprovider app_api_service:service_manager find;
 allow mediaprovider audioserver_service:service_manager find;
+allow mediaprovider cameraserver_service:service_manager find;
 allow mediaprovider drmserver_service:service_manager find;
 allow mediaprovider mediaextractor_service:service_manager find;
 allow mediaprovider mediaserver_service:service_manager find;
diff --git a/private/network_stack.te b/private/network_stack.te
index 6fa3055..9a22a19 100644
--- a/private/network_stack.te
+++ b/private/network_stack.te
@@ -32,6 +32,9 @@
 # in order to invoke side effect of close() on such a socket calling synchronize_rcu()
 # TODO: Remove this permission when 4.9 kernel is deprecated.
 allow network_stack self:key_socket create;
+# Java's Os.close() in libcore/luni/src/main/java/libcore/io/BlockGuardOs.java;l=100
+# calls if (fd.isSocket$()) if (isLingerSocket(fd)) ...
+dontaudit network_stack self:key_socket getopt;
 
 # Grant read permission of connectivity namespace system property prefix.
 get_prop(network_stack, device_config_connectivity_prop)
diff --git a/private/odrefresh.te b/private/odrefresh.te
index e6b1023..6321b3d 100644
--- a/private/odrefresh.te
+++ b/private/odrefresh.te
@@ -7,6 +7,10 @@
 allow odrefresh apex_art_data_file:dir { create_dir_perms relabelfrom };
 allow odrefresh apex_art_data_file:file create_file_perms;
 
+# Allow odrefresh to create data files (typically for metrics before statsd starts).
+allow odrefresh odrefresh_data_file:dir create_dir_perms;
+allow odrefresh odrefresh_data_file:file create_file_perms;
+
 userfaultfd_use(odrefresh)
 
 # Staging area labels (/data/misc/apexdata/com.android.art/staging). odrefresh
@@ -36,3 +40,8 @@
 
 # No other processes should be creating files in the staging area.
 neverallow { domain -init -odrefresh } apex_art_staging_data_file:file open;
+
+# No processes other than init, odrefresh and system_server access
+# odrefresh_data_files.
+neverallow { domain -init -odrefresh -system_server } odrefresh_data_file:dir *;
+neverallow { domain -init -odrefresh -system_server } odrefresh_data_file:file *;
diff --git a/private/property_contexts b/private/property_contexts
index c7d6743..dae6939 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -323,6 +323,8 @@
 ro.camera.notify_nfc    u:object_r:camera_config_prop:s0 exact bool
 ro.camera.enableLazyHal u:object_r:camera_config_prop:s0 exact bool
 
+ro.camerax.extensions.enabled u:object_r:camerax_extensions_prop:s0 exact bool
+
 # Should always_debuggable be bool? It's checked against the string "1".
 dalvik.vm.always_debuggable                   u:object_r:dalvik_config_prop:s0 exact int
 dalvik.vm.appimageformat                      u:object_r:dalvik_config_prop:s0 exact string
@@ -635,6 +637,8 @@
 ro.boot.hardware.sku       u:object_r:bootloader_prop:s0 exact string
 ro.boot.keymaster          u:object_r:bootloader_prop:s0 exact string
 ro.boot.mode               u:object_r:bootloader_prop:s0 exact string
+# Populated on Android Studio Emulator (for emulator specific workarounds)
+ro.boot.qemu               u:object_r:bootloader_prop:s0 exact bool
 ro.boot.revision           u:object_r:bootloader_prop:s0 exact string
 ro.boot.vbmeta.avb_version u:object_r:bootloader_prop:s0 exact string
 ro.boot.verifiedbootstate  u:object_r:bootloader_prop:s0 exact string
diff --git a/private/service_contexts b/private/service_contexts
index a4179b5..728df40 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -284,6 +284,7 @@
 usagestats                                u:object_r:usagestats_service:s0
 usb                                       u:object_r:usb_service:s0
 user                                      u:object_r:user_service:s0
+uwb                                       u:object_r:uwb_service:s0
 vcn_management                            u:object_r:vcn_management_service:s0
 vibrator                                  u:object_r:vibrator_service:s0
 vibrator_manager                          u:object_r:vibrator_manager_service:s0
diff --git a/private/shell.te b/private/shell.te
index 66e2d4d..5831d54 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -194,3 +194,6 @@
 # Never allow others to set or get the perf.drop_caches property.
 neverallow { domain -shell -init } perf_drop_caches_prop:property_service set;
 neverallow { domain -shell -init -dumpstate } perf_drop_caches_prop:file read;
+
+# Allow ReadDefaultFstab() for CTS.
+read_fstab(shell)
diff --git a/private/system_app.te b/private/system_app.te
index 58322b8..48d5f9d 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -21,9 +21,6 @@
 allow system_app misc_user_data_file:dir create_dir_perms;
 allow system_app misc_user_data_file:file create_file_perms;
 
-# Access to vold-mounted storage for measuring free space
-allow system_app mnt_media_rw_file:dir search;
-
 # Access to apex files stored on /data (b/136063500)
 # Needed so that Settings can access NOTICE files inside apex
 # files located in the assets/ directory.
diff --git a/private/system_server.te b/private/system_server.te
index 084ea22..d3478bd 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -905,6 +905,16 @@
 	use
 };
 
+# Allow lock_settings service to manage locksettings keys (e.g. the synthetic password key).
+allow system_server locksettings_key:keystore2_key {
+	delete
+	get_info
+	rebind
+	update
+	use
+};
+
+
 # Allow system server to search and write to the persistent factory reset
 # protection partition. This block device does not get wiped in a factory reset.
 allow system_server block_device:dir search;
@@ -1270,6 +1280,10 @@
 allow system_server gsi_persistent_data_file:dir rw_dir_perms;
 allow system_server gsi_persistent_data_file:file create_file_perms;
 
+# Allow system server read and remove files under /data/misc/odrefresh
+allow system_server odrefresh_data_file:dir rw_dir_perms;
+allow system_server odrefresh_data_file:file { r_file_perms unlink };
+
 # Allow system server r access to /system/bin/surfaceflinger for PinnerService.
 allow system_server surfaceflinger_exec:file r_file_perms;
 
diff --git a/private/traced.te b/private/traced.te
index aa16966..6e3ad46 100644
--- a/private/traced.te
+++ b/private/traced.te
@@ -3,7 +3,6 @@
 # type traced is defined under /public (because iorapd rules
 # under public/ need to refer to it).
 type traced_exec, system_file_type, exec_type, file_type;
-type traced_tmpfs, file_type;
 
 # Allow init to exec the daemon.
 init_daemon_domain(traced)
diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index d57939b..6064c14 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -84,10 +84,6 @@
 allow untrusted_app_all media_rw_data_file:dir create_dir_perms;
 allow untrusted_app_all media_rw_data_file:file create_file_perms;
 
-# Traverse into /mnt/media_rw for bypassing FUSE daemon
-# TODO: narrow this to just MediaProvider
-allow untrusted_app_all mnt_media_rw_file:dir search;
-
 # allow cts to query all services
 allow untrusted_app_all servicemanager:service_manager list;
 
diff --git a/public/app.te b/public/app.te
index af19d10..ae8d7fd 100644
--- a/public/app.te
+++ b/public/app.te
@@ -592,3 +592,6 @@
     { open read write append execute execute_no_trans map };
 neverallow appdomain system_bootstrap_lib_file:dir
     { open read getattr search };
+
+# Allow to ro.camerax.extensions.enabled
+get_prop(appdomain, camerax_extensions_prop)
diff --git a/public/hal_neuralnetworks.te b/public/hal_neuralnetworks.te
index 416448a..4eb8bb2 100644
--- a/public/hal_neuralnetworks.te
+++ b/public/hal_neuralnetworks.te
@@ -33,4 +33,6 @@
 hal_attribute_service(hal_neuralnetworks, hal_neuralnetworks_service)
 binder_call(hal_neuralnetworks_server, servicemanager)
 
+binder_use(hal_neuralnetworks_server)
+
 allow hal_neuralnetworks_server dumpstate:fifo_file write;
diff --git a/public/property.te b/public/property.te
index 8cae47c..caa705a 100644
--- a/public/property.te
+++ b/public/property.te
@@ -122,6 +122,7 @@
 system_vendor_config_prop(build_vendor_prop)
 system_vendor_config_prop(camera_calibration_prop)
 system_vendor_config_prop(camera_config_prop)
+system_vendor_config_prop(camerax_extensions_prop)
 system_vendor_config_prop(charger_config_prop)
 system_vendor_config_prop(codec2_config_prop)
 system_vendor_config_prop(cpu_variant_prop)
diff --git a/public/service.te b/public/service.te
index 0b4f8e9..8632887 100644
--- a/public/service.te
+++ b/public/service.te
@@ -220,6 +220,7 @@
 type usagestats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type usb_service, app_api_service, system_server_service, service_manager_type;
 type user_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type uwb_service, app_api_service, system_server_service, service_manager_type;
 type vcn_management_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type vibrator_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type vibrator_manager_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
diff --git a/public/su.te b/public/su.te
index cefc44d..074ff2e 100644
--- a/public/su.te
+++ b/public/su.te
@@ -18,6 +18,7 @@
   vndbinder_use(su)
 
   dontaudit su self:capability_class_set *;
+  dontaudit su self:capability2 *;
   dontaudit su kernel:security *;
   dontaudit su { kernel file_type }:system *;
   dontaudit su self:memprotect *;
diff --git a/public/traced.te b/public/traced.te
index ec5b850..922d46e 100644
--- a/public/traced.te
+++ b/public/traced.te
@@ -1,2 +1,3 @@
 type traced, domain, coredomain, mlstrustedsubject;
+type traced_tmpfs, file_type;
 
diff --git a/public/update_engine_common.te b/public/update_engine_common.te
index 286ff4d..e8fd29e 100644
--- a/public/update_engine_common.te
+++ b/public/update_engine_common.te
@@ -59,6 +59,10 @@
 # Needed because libdm reads sysfs to validate when a dm path is ready.
 r_dir_file(update_engine_common, sysfs_dm)
 
+# Scan files in /sys/fs/ext4 and /sys/fs/f2fs for device-mapper diagnostics.
+allow update_engine_common sysfs:dir r_dir_perms;
+allow update_engine_common sysfs_fs_f2fs:dir r_dir_perms;
+
 # read / write on /dev/device-mapper to map / unmap devices
 allow update_engine_common dm_device:chr_file rw_file_perms;
 
diff --git a/public/vendor_init.te b/public/vendor_init.te
index 25d0dcb..a8f9418 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -223,6 +223,7 @@
 set_prop(vendor_init, apk_verity_prop)
 set_prop(vendor_init, bluetooth_a2dp_offload_prop)
 set_prop(vendor_init, bluetooth_audio_hal_prop)
+set_prop(vendor_init, camerax_extensions_prop)
 set_prop(vendor_init, cpu_variant_prop)
 set_prop(vendor_init, dalvik_runtime_prop)
 set_prop(vendor_init, debug_prop)