diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 3747a52..6248cab 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -9,7 +9,6 @@
   untrusted_app
   untrusted_app_25
   untrusted_app_27
-  untrusted_app_29
   untrusted_app_all
 }')
 # Receive or send uevent messages.
@@ -112,14 +111,6 @@
   alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket xdp_socket
 } *;
 
-# Disallow calling bind() and sending RTM_GETLINK messages on netlink sockets.
-neverallow {
-  all_untrusted_apps
-  -untrusted_app_25
-  -untrusted_app_27
-  -untrusted_app_29
-} domain:netlink_route_socket { bind nlmsg_readpriv };
-
 # Do not allow untrusted apps access to /cache
 neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
 neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr };
diff --git a/private/compat/29.0/29.0.ignore.cil b/private/compat/29.0/29.0.ignore.cil
index 9c9cc12..3a5be19 100644
--- a/private/compat/29.0/29.0.ignore.cil
+++ b/private/compat/29.0/29.0.ignore.cil
@@ -69,7 +69,6 @@
     system_unsolzygote_socket
     tethering_service
     timezonedetector_service
-    untrusted_app_29
     usb_serial_device
     userspace_reboot_prop
     userspace_reboot_config_prop
diff --git a/private/seapp_contexts b/private/seapp_contexts
index fed4325..3838578 100644
--- a/private/seapp_contexts
+++ b/private/seapp_contexts
@@ -163,8 +163,7 @@
 user=_app isPrivApp=true name=com.google.android.gms domain=gmscore_app type=privapp_data_file levelFrom=user
 user=_app isPrivApp=true name=com.google.android.gms.* domain=gmscore_app type=privapp_data_file levelFrom=user
 user=_app isPrivApp=true name=com.google.android.gms:* domain=gmscore_app type=privapp_data_file levelFrom=user
-user=_app minTargetSdkVersion=30 domain=untrusted_app type=app_data_file levelFrom=all
-user=_app minTargetSdkVersion=29 domain=untrusted_app_29 type=app_data_file levelFrom=all
+user=_app minTargetSdkVersion=29 domain=untrusted_app type=app_data_file levelFrom=all
 user=_app minTargetSdkVersion=28 domain=untrusted_app_27 type=app_data_file levelFrom=all
 user=_app minTargetSdkVersion=26 domain=untrusted_app_27 type=app_data_file levelFrom=user
 user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user
diff --git a/private/untrusted_app.te b/private/untrusted_app.te
index 6e7a99c..c15fa22 100644
--- a/private/untrusted_app.te
+++ b/private/untrusted_app.te
@@ -1,11 +1,20 @@
 ###
 ### Untrusted apps.
 ###
-### This file defines the rules for untrusted apps running with
-### targetSdkVersion >= 30.
-###
-### See public/untrusted_app.te for more information about which apps are
-### placed in this selinux domain.
+### This file defines the rules for untrusted apps.
+### Apps are labeled based on mac_permissions.xml (maps signer and
+### optionally package name to seinfo value) and seapp_contexts (maps UID
+### and optionally seinfo value to domain for process and type for data
+### directory).  The untrusted_app domain is the default assignment in
+### seapp_contexts for any app with UID between APP_AID (10000)
+### and AID_ISOLATED_START (99000) if the app has no specific seinfo
+### value as determined from mac_permissions.xml.  In current AOSP, this
+### domain is assigned to all non-system apps as well as to any system apps
+### that are not signed by the platform key.  To move
+### a system app into a specific domain, add a signer entry for it to
+### mac_permissions.xml and assign it one of the pre-existing seinfo values
+### or define and use a new seinfo value in both mac_permissions.xml and
+### seapp_contexts.
 ###
 
 typeattribute untrusted_app coredomain;
diff --git a/private/untrusted_app_25.te b/private/untrusted_app_25.te
index a1abc41..2091f2e 100644
--- a/private/untrusted_app_25.te
+++ b/private/untrusted_app_25.te
@@ -4,8 +4,19 @@
 ### This file defines the rules for untrusted apps running with
 ### targetSdkVersion <= 25.
 ###
-### See public/untrusted_app.te for more information about which apps are
-### placed in this selinux domain.
+### Apps are labeled based on mac_permissions.xml (maps signer and
+### optionally package name to seinfo value) and seapp_contexts (maps UID
+### and optionally seinfo value to domain for process and type for data
+### directory).  The untrusted_app domain is the default assignment in
+### seapp_contexts for any app with UID between APP_AID (10000)
+### and AID_ISOLATED_START (99000) if the app has no specific seinfo
+### value as determined from mac_permissions.xml.  In current AOSP, this
+### domain is assigned to all non-system apps as well as to any system apps
+### that are not signed by the platform key.  To move
+### a system app into a specific domain, add a signer entry for it to
+### mac_permissions.xml and assign it one of the pre-existing seinfo values
+### or define and use a new seinfo value in both mac_permissions.xml and
+### seapp_contexts.
 ###
 
 typeattribute untrusted_app_25 coredomain;
@@ -48,6 +59,3 @@
 
 # Read /mnt/sdcard symlink.
 allow untrusted_app_25 mnt_sdcard_file:lnk_file r_file_perms;
-
-# allow binding to netlink route sockets and sending RTM_GETLINK messages.
-allow untrusted_app_25 self:netlink_route_socket { bind nlmsg_readpriv };
diff --git a/private/untrusted_app_27.te b/private/untrusted_app_27.te
index b7b6d72..03b3013 100644
--- a/private/untrusted_app_27.te
+++ b/private/untrusted_app_27.te
@@ -4,8 +4,20 @@
 ### This file defines the rules for untrusted apps running with
 ### 25 < targetSdkVersion <= 28.
 ###
-### See public/untrusted_app.te for more information about which apps are
-### placed in this selinux domain.
+### This file defines the rules for untrusted apps.
+### Apps are labeled based on mac_permissions.xml (maps signer and
+### optionally package name to seinfo value) and seapp_contexts (maps UID
+### and optionally seinfo value to domain for process and type for data
+### directory).  The untrusted_app_27 domain is the default assignment in
+### seapp_contexts for any app with UID between APP_AID (10000)
+### and AID_ISOLATED_START (99000) if the app has no specific seinfo
+### value as determined from mac_permissions.xml.  In current AOSP, this
+### domain is assigned to all non-system apps as well as to any system apps
+### that are not signed by the platform key.  To move
+### a system app into a specific domain, add a signer entry for it to
+### mac_permissions.xml and assign it one of the pre-existing seinfo values
+### or define and use a new seinfo value in both mac_permissions.xml and
+### seapp_contexts.
 ###
 
 typeattribute untrusted_app_27 coredomain;
@@ -36,6 +48,3 @@
 
 # Read /mnt/sdcard symlink.
 allow untrusted_app_27 mnt_sdcard_file:lnk_file r_file_perms;
-
-# allow binding to netlink route sockets and sending RTM_GETLINK messages.
-allow untrusted_app_27 self:netlink_route_socket { bind nlmsg_readpriv };
diff --git a/private/untrusted_app_29.te b/private/untrusted_app_29.te
deleted file mode 100644
index 344ae89..0000000
--- a/private/untrusted_app_29.te
+++ /dev/null
@@ -1,19 +0,0 @@
-###
-### Untrusted_29.
-###
-### This file defines the rules for untrusted apps running with
-### targetSdkVersion = 29.
-###
-### See public/untrusted_app.te for more information about which apps are
-### placed in this selinux domain.
-###
-
-typeattribute untrusted_app_29 coredomain;
-
-app_domain(untrusted_app_29)
-untrusted_app_domain(untrusted_app_29)
-net_domain(untrusted_app_29)
-bluetooth_domain(untrusted_app_29)
-
-# allow binding to netlink route sockets and sending RTM_GETLINK messages.
-allow untrusted_app_29 self:netlink_route_socket { bind nlmsg_readpriv };