diff --git a/Android.bp b/Android.bp
index aca6e40..0e9693a 100644
--- a/Android.bp
+++ b/Android.bp
@@ -493,137 +493,189 @@
     ],
 }
 
-// This is a minimized cil modules to test microdroid.
-// TODO(b/178993690): migrate cil files to Android.bp and remove below
-filegroup {
-    name: "microdroid_sepolicy_build_files",
+se_build_files {
+    name: "se_build_files",
     srcs: [
-        // This order is important. Should be identical to sepolicy_build_files in Android.mk
-        "private/security_classes",
-        "private/initial_sids",
-        "private/access_vectors",
-        "public/global_macros",
-        "public/neverallow_macros",
-        "private/mls_macros",
-        "private/mls_decl",
-        "private/mls",
-        "private/policy_capabilities",
-        "public/te_macros",
-        "public/attributes",
-        "private/attributes",
-        "public/ioctl_defines",
-        "public/ioctl_macros",
-        "public/*.te",
-        "private/*.te",
-        "private/roles_decl",
-        "public/roles",
-        "private/users",
-        "private/initial_sid_contexts",
-        "private/fs_use",
-        "private/genfs_contexts",
-        "private/port_contexts",
+        "security_classes",
+        "initial_sids",
+        "access_vectors",
+        "global_macros",
+        "neverallow_macros",
+        "mls_macros",
+        "mls_decl",
+        "mls",
+        "policy_capabilities",
+        "te_macros",
+        "attributes",
+        "ioctl_defines",
+        "ioctl_macros",
+        "*.te",
+        "roles_decl",
+        "roles",
+        "users",
+        "initial_sid_contexts",
+        "fs_use",
+        "genfs_contexts",
+        "port_contexts",
     ],
 }
 
-filegroup {
-    name: "microdroid_sepolicy_public_and_reqd_mask_build_files",
-    srcs: [
-        // This order is important. Should be identical to sepolicy_build_files in Android.mk
-        "reqd_mask/security_classes",
-        "reqd_mask/initial_sids",
-        "reqd_mask/access_vectors",
-        "public/global_macros",
-        "public/neverallow_macros",
-        "reqd_mask/mls_macros",
-        "reqd_mask/mls_decl",
-        "reqd_mask/mls",
-        "public/te_macros",
-        "public/attributes",
-        "public/ioctl_defines",
-        "public/ioctl_macros",
-        "public/*.te",
-        "reqd_mask/*.te",
-        "reqd_mask/roles_decl",
-        "public/roles",
-        "reqd_mask/roles",
-        "reqd_mask/users",
-        "reqd_mask/initial_sid_contexts",
-    ],
-}
-
-filegroup {
-    name: "microdroid_sepolicy_reqd_mask_build_files",
-    srcs: [
-        // This order is important. Should be identical to sepolicy_build_files in Android.mk
-        "reqd_mask/security_classes",
-        "reqd_mask/initial_sids",
-        "reqd_mask/access_vectors",
-        "reqd_mask/mls_macros",
-        "reqd_mask/mls_decl",
-        "reqd_mask/mls",
-        "reqd_mask/*.te",
-        "reqd_mask/roles_decl",
-        "reqd_mask/roles",
-        "reqd_mask/users",
-        "reqd_mask/initial_sid_contexts",
-    ],
-}
-
-// These variables are based on aosp_cf_x86_64_only_phone-userdebug. Other than target_arch,
-// these configurations should be fine to test microdroid on normal devices with full treble.
-// The exception is target_arch. But as target_arch is meaningful only on mips, and as we are not
-// running microdroid on mips for now, we skip assigning target_arch here. After cil files are fully
-// migrated into Soong, these will have correct values.
-policy_to_conf_flags = "$(location m4) --fatal-warnings " +
-"-D mls_num_sens=1 -D mls_num_cats=1024 " +
-"-D target_build_variant=userdebug " +
-"-D target_with_asan=false " +
-"-D target_with_native_coverage=false " +
-"-D target_full_treble=true " +
-"-D target_compatible_property=true " +
-"-D target_treble_sysprop_neverallow=true " +
-"-D target_enforce_sysprop_owner=true "
-
-genrule {
-    name: "microdroid_plat_sepolicy.cil_gen",
-    srcs: [":microdroid_sepolicy_build_files"],
-    tools: ["m4", "checkpolicy"],
-    out: ["plat_sepolicy.cil"],
-    cmd: policy_to_conf_flags +
-        "-s $(locations :microdroid_sepolicy_build_files) > $(out).conf" +
-        "&& $(location checkpolicy) -M -C -c 30 -o $(out) $(out).conf",
-    visibility: ["//visibility:private"],
-}
-
-prebuilt_etc {
-    name: "microdroid_plat_sepolicy.cil",
-    src: ":microdroid_plat_sepolicy.cil_gen",
-    filename: "plat_sepolicy.cil",
-    relative_install_path: "selinux",
+// reqd_policy_mask - a policy.conf file which contains only the bare minimum
+// policy necessary to use checkpolicy.
+//
+// This bare-minimum policy needs to be present in all policy.conf files, but
+// should not necessarily be exported as part of the public policy.
+//
+// The rules generated by reqd_policy_mask will allow the compilation of public
+// policy and subsequent removal of CIL policy that should not be exported.
+se_policy_conf {
+    name: "reqd_policy_mask.conf",
+    srcs: [":se_build_files{.reqd_mask}"],
     installable: false,
 }
 
-genrule {
-    name: "microdroid_reqd_policy_mask.cil_gen",
-    srcs: [":microdroid_sepolicy_reqd_mask_build_files"],
-    tools: ["m4", "checkpolicy"],
-    out: ["reqd_policy_mask.cil"],
-    cmd: policy_to_conf_flags +
-        "-s $(in) > $(out).conf" +
-        "&& $(location checkpolicy) -C -M -c 30 -o $(out) $(out).conf",
-    visibility: ["//visibility:private"],
+se_policy_cil {
+    name: "reqd_policy_mask.cil",
+    src: ":reqd_policy_mask.conf",
+    secilc_check: false,
+    installable: false,
 }
 
+// pub_policy - policy that will be exported to be a part of non-platform
+// policy corresponding to this platform version.
+//
+// This is a limited subset of policy that would not compile in checkpolicy on
+// its own.
+//
+// To get around this limitation, add only the required files from private
+// policy, which will generate CIL policy that will then be filtered out by the
+// reqd_policy_mask.
+//
+// There are three pub_policy.cil files below:
+//   - pub_policy.cil: exported 'product', 'system_ext' and 'system' policy.
+//   - system_ext_pub_policy.cil: exported 'system_ext' and 'system' policy.
+//   - plat_pub_policy.cil: exported 'system' policy.
+//
+// Those above files will in turn be used to generate the following versioned cil files:
+//   - product_mapping_file: the versioned, exported 'product' policy in product partition.
+//   - system_ext_mapping_file: the versioned, exported 'system_ext' policy in system_ext partition.
+//   - plat_mapping_file: the versioned, exported 'system' policy in system partition.
+//   - plat_pub_versioned.cil: the versioned, exported 'product', 'system_ext' and 'system' policy
+//                             in vendor partition.
+//
+se_policy_conf {
+    name: "pub_policy.conf",
+    srcs: [":se_build_files{.product_public}"], // product_ includes system and system_ext
+    installable: false,
+}
+
+se_policy_cil {
+    name: "pub_policy.cil",
+    src: ":pub_policy.conf",
+    filter_out: [":reqd_policy_mask.cil"],
+    secilc_check: false,
+    installable: false,
+}
+
+se_policy_conf {
+    name: "system_ext_pub_policy.conf",
+    srcs: [":se_build_files{.system_ext_public}"], // system_ext_public includes system
+    installable: false,
+}
+
+se_policy_cil {
+    name: "system_ext_pub_policy.cil",
+    src: ":system_ext_pub_policy.conf",
+    filter_out: [":reqd_policy_mask.cil"],
+    secilc_check: false,
+    installable: false,
+}
+
+se_policy_conf {
+    name: "plat_pub_policy.conf",
+    srcs: [":se_build_files{.plat_public}"],
+    installable: false,
+}
+
+se_policy_cil {
+    name: "plat_pub_policy.cil",
+    src: ":plat_pub_policy.conf",
+    filter_out: [":reqd_policy_mask.cil"],
+    secilc_check: false,
+    installable: false,
+}
+
+// plat_policy.conf - A combination of the private and public platform policy
+// which will ship with the device.
+//
+// The platform will always reflect the most recent platform version and is not
+// currently being attributized.
+se_policy_conf {
+    name: "plat_sepolicy.conf",
+    srcs: [":se_build_files{.plat}"],
+    installable: false,
+}
+
+se_policy_cil {
+    name: "plat_sepolicy.cil",
+    src: ":plat_sepolicy.conf",
+    additional_cil_files: ["private/technical_debt.cil"],
+}
+
+// system_ext_policy.conf - A combination of the private and public system_ext
+// policy which will ship with the device. System_ext policy is not attributized
+se_policy_conf {
+    name: "system_ext_sepolicy.conf",
+    srcs: [":se_build_files{.system_ext}"],
+    installable: false,
+}
+
+se_policy_cil {
+    name: "system_ext_sepolicy.cil",
+    src: ":system_ext_sepolicy.conf",
+    system_ext_specific: true,
+    filter_out: [":plat_sepolicy.cil"],
+    remove_line_marker: true,
+}
+
+// product_policy.conf - A combination of the private and public product policy
+// which will ship with the device. Product policy is not attributized
+se_policy_conf {
+    name: "product_sepolicy.conf",
+    srcs: [":se_build_files{.product}"],
+    installable: false,
+}
+
+se_policy_cil {
+    name: "product_sepolicy.cil",
+    src: ":product_sepolicy.conf",
+    product_specific: true,
+    filter_out: [":plat_sepolicy.cil", ":system_ext_sepolicy.cil"],
+    remove_line_marker: true,
+}
+
+//////////////////////////////////
+// SELinux policy embedded into CTS.
+// CTS checks neverallow rules of this policy against the policy of the device under test.
+//////////////////////////////////
+se_policy_conf {
+    name: "general_sepolicy.conf",
+    srcs: [":se_build_files{.plat}"],
+    build_variant: "user",
+    cts: true,
+    exclude_build_test: true,
+}
+
+//////////////////////////////////
+// modules for microdroid
+// TODO(b/33691272): migrate Android.mk to Android.bp and remove workarounds
+//////////////////////////////////
 genrule {
     name: "microdroid_plat_mapping_file_gen",
-    srcs: [":microdroid_sepolicy_public_and_reqd_mask_build_files", ":microdroid_reqd_policy_mask.cil_gen"],
-    tools: ["m4", "checkpolicy", "build_sepolicy", "version_policy"],
+    srcs: [":plat_pub_policy.cil"],
+    tools: ["version_policy"],
     out: ["10000.0.cil"],
-    cmd: policy_to_conf_flags +
-        "-s $(locations :microdroid_sepolicy_public_and_reqd_mask_build_files) > $(out).conf" +
-        "&& $(location checkpolicy) -M -C -c 30 -o $(out).pub $(out).conf" +
-        "&& $(location build_sepolicy) filter_out -f $(location :microdroid_reqd_policy_mask.cil_gen) -t $(out).pub" +
-        "&& $(location version_policy) -b $(out).pub -m -n 10000.0 -o $(out)",
+    cmd: "$(location version_policy) -b $(location :plat_pub_policy.cil) -m -n 10000.0 -o $(out)",
     visibility: ["//visibility:private"],
 }
 
@@ -635,34 +687,32 @@
     installable: false,
 }
 
-///////////////////////////////////////////////////////////////////
-genrule {
-    name: "microdroid_pub_policy.cil_gen",
-    srcs: [
-        ":microdroid_sepolicy_public_and_reqd_mask_build_files",
-        ":microdroid_reqd_policy_mask.cil_gen",
-    ],
-    tools: ["m4", "checkpolicy", "build_sepolicy"],
-    out: ["pub_policy.cil"],
-    cmd: policy_to_conf_flags + " -s $(locations :microdroid_sepolicy_public_and_reqd_mask_build_files) > $(out).conf && " +
-        "$(location checkpolicy) -C -M -c 30 -o $(out) $(out).conf && " +
-        "$(location build_sepolicy) filter_out -f $(location :microdroid_reqd_policy_mask.cil_gen) -t $(out)",
-    visibility: ["//visibility:private"],
-}
-
+// Normally plat_pub_versioned.cil is built from pub_policy.cil (including system_ext and product).
+// But microdroid only has system, so its plat_pub_versioned.cil uses plat_pub_policy.cil.
 genrule {
     name: "microdroid_plat_pub_versioned.cil_gen",
-    srcs: [":microdroid_pub_policy.cil_gen"],
+    srcs: [":plat_pub_policy.cil"],
     tools: ["version_policy"],
     out: ["plat_pub_versioned.cil"],
     cmd: "$(location version_policy) " +
-        "-b $(location :microdroid_pub_policy.cil_gen) " +
-        "-t $(location :microdroid_pub_policy.cil_gen) " +
+        "-b $(location :plat_pub_policy.cil) " +
+        "-t $(location :plat_pub_policy.cil) " +
         "-n 10000.0 " +
         "-o $(out)",
     visibility: ["//visibility:private"],
 }
 
+prebuilt_etc {
+    name: "microdroid_plat_pub_versioned.cil",
+    src: ":microdroid_plat_pub_versioned.cil_gen",
+    filename: "plat_pub_versioned.cil",
+    relative_install_path: "selinux",
+    installable: false,
+}
+
+// policy files for microdroid vendor
+// This contains a minimal set of policy files for microdroid vendor.
+// TODO(b/33691272): update se_build_files to cover this
 filegroup {
     name: "microdroid_vendor_sepolicy_build_files",
     srcs: [
@@ -689,31 +739,35 @@
     ],
 }
 
+se_policy_conf {
+    name: "microdroid_vendor_sepolicy.conf",
+    srcs: [":microdroid_vendor_sepolicy_build_files"],
+    installable: false,
+}
+
 genrule {
     name: "microdroid_vendor_sepolicy.cil_gen",
     srcs: [
-        ":microdroid_vendor_sepolicy_build_files",
+        ":microdroid_vendor_sepolicy.conf",
         ":microdroid_plat_pub_versioned.cil_gen",
-        ":microdroid_pub_policy.cil_gen",
-        ":microdroid_reqd_policy_mask.cil_gen",
+        ":plat_pub_policy.cil",
+        ":reqd_policy_mask.cil",
     ],
     tools: [
-        "m4",
         "build_sepolicy",
         "checkpolicy",
         "secilc",
         "version_policy",
     ],
     out: ["vendor_sepolicy.cil"],
-    cmd: policy_to_conf_flags + " -s $(locations :microdroid_vendor_sepolicy_build_files) > $(out).conf && " +
-        "$(location build_sepolicy) " +
+    cmd: "$(location build_sepolicy) " +
         "--android_host_path $$(dirname $(location build_sepolicy)) " +
         "build_cil " +
-        "--input_policy_conf $(out).conf " +
+        "--input_policy_conf $(location :microdroid_vendor_sepolicy.conf) " +
         "--checkpolicy_env ASAN_OPTIONS=detect_leaks=0 " +
-        "--base_policy $(location :microdroid_pub_policy.cil_gen) " +
+        "--base_policy $(location :plat_pub_policy.cil) " +
         "--filter_out_files $(location :microdroid_plat_pub_versioned.cil_gen) " +
-        "--reqd_mask $(location :microdroid_reqd_policy_mask.cil_gen) " +
+        "--reqd_mask $(location :reqd_policy_mask.cil) " +
         "--treble_sepolicy_vers 10000.0 " +
         "--policy_vers 30 " +
         "--output_cil $(out)",
@@ -727,38 +781,3 @@
     relative_install_path: "selinux",
     installable: false,
 }
-
-prebuilt_etc {
-    name: "microdroid_plat_pub_versioned.cil",
-    src: ":microdroid_plat_pub_versioned.cil_gen",
-    filename: "plat_pub_versioned.cil",
-    relative_install_path: "selinux",
-    installable: false,
-}
-
-se_build_files {
-    name: "se_build_files",
-    srcs: [
-        "security_classes",
-        "initial_sids",
-        "access_vectors",
-        "global_macros",
-        "neverallow_macros",
-        "mls_macros",
-        "mls_decl",
-        "mls",
-        "policy_capabilities",
-        "te_macros",
-        "attributes",
-        "ioctl_defines",
-        "ioctl_macros",
-        "*.te",
-        "roles_decl",
-        "roles",
-        "users",
-        "initial_sid_contexts",
-        "fs_use",
-        "genfs_contexts",
-        "port_contexts",
-    ],
-}
diff --git a/Android.mk b/Android.mk
index 77513a0..7c4ddbe 100644
--- a/Android.mk
+++ b/Android.mk
@@ -741,209 +741,36 @@
 endif # ifeq ($(mixed_sepolicy_build),true)
 
 ##################################
-# reqd_policy_mask - a policy.conf file which contains only the bare minimum
-# policy necessary to use checkpolicy.  This bare-minimum policy needs to be
-# present in all policy.conf files, but should not necessarily be exported as
-# part of the public policy.  The rules generated by reqd_policy_mask will allow
-# the compilation of public policy and subsequent removal of CIL policy that
-# should not be exported.
-
-policy_files := $(call build_policy, $(sepolicy_build_files), $(REQD_MASK_POLICY))
-reqd_policy_mask.conf := $(intermediates)/reqd_policy_mask.conf
-$(reqd_policy_mask.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
-$(reqd_policy_mask.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
-$(reqd_policy_mask.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
-$(reqd_policy_mask.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
-$(reqd_policy_mask.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
-$(reqd_policy_mask.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
-$(reqd_policy_mask.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(reqd_policy_mask.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
-$(reqd_policy_mask.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(reqd_policy_mask.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
-$(reqd_policy_mask.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
-$(reqd_policy_mask.conf): PRIVATE_POLICY_FILES := $(policy_files)
-$(reqd_policy_mask.conf): $(policy_files) $(M4)
-	$(transform-policy-to-conf)
-# b/37755687
-CHECKPOLICY_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0
-
-reqd_policy_mask.cil := $(intermediates)/reqd_policy_mask.cil
-$(reqd_policy_mask.cil): $(reqd_policy_mask.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
-	@mkdir -p $(dir $@)
-	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c \
-		$(POLICYVERS) -o $@ $<
-
-reqd_policy_mask.conf :=
+# plat policy files are now built with Android.bp. Grab them from intermediate.
+# See Android.bp for details of plat policy files.
+#
+reqd_policy_mask.cil := $(call intermediates-dir-for,ETC,reqd_policy_mask.cil)/reqd_policy_mask.cil
 reqd_policy_mask_$(PLATFORM_SEPOLICY_VERSION).cil := $(reqd_policy_mask.cil)
 
-##################################
-# pub_policy - policy that will be exported to be a part of non-platform
-# policy corresponding to this platform version.  This is a limited subset of
-# policy that would not compile in checkpolicy on its own.  To get around this
-# limitation, add only the required files from private policy, which will
-# generate CIL policy that will then be filtered out by the reqd_policy_mask.
-#
-# There are three pub_policy.cil files below:
-#   - pub_policy.cil: exported 'product', 'system_ext' and 'system' policy.
-#   - system_ext_pub_policy.cil: exported 'system_ext' and 'system' policy.
-#   - plat_pub_policy.cil: exported 'system' policy.
-#
-# Those above files will in turn be used to generate the following versioned cil files:
-#   - product_mapping_file: the versioned, exported 'product' policy in product partition.
-#   - system_ext_mapping_file: the versioned, exported 'system_ext' policy in system_ext partition.
-#   - plat_mapping_file: the versioned, exported 'system' policy in system partition.
-#   - plat_pub_versioned.cil: the versioned, exported 'product', 'system_ext' and 'system'
-#                             policy in vendor partition.
-#
-policy_files := $(call build_policy, $(sepolicy_build_files), \
-  $(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
-pub_policy.conf := $(intermediates)/pub_policy.conf
-$(pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
-$(pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
-$(pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
-$(pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
-$(pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
-$(pub_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
-$(pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
-$(pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
-$(pub_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
-$(pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
-$(pub_policy.conf): $(policy_files) $(M4)
-	$(transform-policy-to-conf)
-pub_policy.cil := $(intermediates)/pub_policy.cil
-$(pub_policy.cil): PRIVATE_POL_CONF := $(pub_policy.conf)
-$(pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
-$(pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \
-$(HOST_OUT_EXECUTABLES)/build_sepolicy $(pub_policy.conf) $(reqd_policy_mask.cil)
-	@mkdir -p $(dir $@)
-	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF)
-	$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
-		-f $(PRIVATE_REQD_MASK) -t $@
-
+pub_policy.cil := $(call intermediates-dir-for,ETC,pub_policy.cil)/pub_policy.cil
 pub_policy_$(PLATFORM_SEPOLICY_VERSION).cil := $(pub_policy.cil)
 
-pub_policy.conf :=
-
-##################################
-policy_files := $(call build_policy, $(sepolicy_build_files), \
-  $(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
-system_ext_pub_policy.conf := $(intermediates)/system_ext_pub_policy.conf
-$(system_ext_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
-$(system_ext_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
-$(system_ext_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
-$(system_ext_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
-$(system_ext_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
-$(system_ext_pub_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
-$(system_ext_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(system_ext_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
-$(system_ext_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(system_ext_pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
-$(system_ext_pub_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
-$(system_ext_pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
-$(system_ext_pub_policy.conf): $(policy_files) $(M4)
-	$(transform-policy-to-conf)
-
-system_ext_pub_policy.cil := $(intermediates)/system_ext_pub_policy.cil
-$(system_ext_pub_policy.cil): PRIVATE_POL_CONF := $(system_ext_pub_policy.conf)
-$(system_ext_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
-$(system_ext_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \
-$(HOST_OUT_EXECUTABLES)/build_sepolicy $(system_ext_pub_policy.conf) $(reqd_policy_mask.cil)
-	@mkdir -p $(dir $@)
-	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF)
-	$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
-		-f $(PRIVATE_REQD_MASK) -t $@
-
+system_ext_pub_policy.cil := $(call intermediates-dir-for,ETC,system_ext_pub_policy.cil)/system_ext_pub_policy.cil
 system_ext_pub_policy_$(PLATFORM_SEPOLICY_VERSION).cil := $(system_ext_pub_policy.cil)
 
-system_ext_pub_policy.conf :=
-
-##################################
-policy_files := $(call build_policy, $(sepolicy_build_files), \
-  $(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
-plat_pub_policy.conf := $(intermediates)/plat_pub_policy.conf
-$(plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
-$(plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
-$(plat_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
-$(plat_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
-$(plat_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
-$(plat_pub_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
-$(plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(plat_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
-$(plat_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(plat_pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
-$(plat_pub_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
-$(plat_pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
-$(plat_pub_policy.conf): $(policy_files) $(M4)
-	$(transform-policy-to-conf)
-
-plat_pub_policy.cil := $(intermediates)/plat_pub_policy.cil
-$(plat_pub_policy.cil): PRIVATE_POL_CONF := $(plat_pub_policy.conf)
-$(plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
-$(plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \
-$(HOST_OUT_EXECUTABLES)/build_sepolicy $(plat_pub_policy.conf) $(reqd_policy_mask.cil)
-	@mkdir -p $(dir $@)
-	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF)
-	$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
-		-f $(PRIVATE_REQD_MASK) -t $@
-
+plat_pub_policy.cil := $(call intermediates-dir-for,ETC,plat_pub_policy.cil)/plat_pub_policy.cil
 plat_pub_policy_$(PLATFORM_SEPOLICY_VERSION).cil := $(plat_pub_policy.cil)
 
-plat_pub_policy.conf :=
-
-#################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := plat_sepolicy.cil
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-# plat_policy.conf - A combination of the private and public platform policy
-# which will ship with the device.  The platform will always reflect the most
-# recent platform version and is not currently being attributized.
-policy_files := $(call build_policy, $(sepolicy_build_files), \
-  $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
-plat_policy.conf := $(intermediates)/plat_policy.conf
-$(plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
-$(plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
-$(plat_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
-$(plat_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
-$(plat_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
-$(plat_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
-$(plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
-$(plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(plat_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
-$(plat_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
-$(plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
-$(plat_policy.conf): $(policy_files) $(M4)
-	$(transform-policy-to-conf)
-	$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
-
-$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_CIL_FILES := \
-  $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY))
-$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
-$(LOCAL_BUILT_MODULE): $(plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
-  $(HOST_OUT_EXECUTABLES)/secilc \
-  $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \
-  $(built_sepolicy_neverallows)
-	@mkdir -p $(dir $@)
-	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
-		$(POLICYVERS) -o $@.tmp $<
-	$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@.tmp
-	$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@.tmp -o /dev/null -f /dev/null
-	$(hide) mv $@.tmp $@
-
-built_plat_cil := $(LOCAL_BUILT_MODULE)
+built_plat_cil := $(call intermediates-dir-for,ETC,plat_sepolicy.cil)/plat_sepolicy.cil
 built_plat_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_plat_cil)
-plat_policy.conf :=
+
+ifdef HAS_SYSTEM_EXT_SEPOLICY
+built_system_ext_cil := $(call intermediates-dir-for,ETC,system_ext_sepolicy.cil)/system_ext_sepolicy.cil
+built_system_ext_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_system_ext_cil)
+endif # ifdef HAS_SYSTEM_EXT_SEPOLICY
+
+ifdef HAS_PRODUCT_SEPOLICY
+built_product_cil := $(call intermediates-dir-for,ETC,product_sepolicy.cil)/product_sepolicy.cil
+built_product_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_product_cil)
+endif # ifdef HAS_PRODUCT_SEPOLICY
+
+# b/37755687
+CHECKPOLICY_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0
 
 #################################
 include $(CLEAR_VARS)
@@ -997,128 +824,6 @@
 #################################
 include $(CLEAR_VARS)
 
-ifdef HAS_SYSTEM_EXT_SEPOLICY
-LOCAL_MODULE := system_ext_sepolicy.cil
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT_SYSTEM_EXT)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-# system_ext_policy.conf - A combination of the private and public system_ext policy
-# which will ship with the device. System_ext policy is not attributized.
-policy_files := $(call build_policy, $(sepolicy_build_files), \
-  $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
-  $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY))
-system_ext_policy.conf := $(intermediates)/system_ext_policy.conf
-$(system_ext_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
-$(system_ext_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
-$(system_ext_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
-$(system_ext_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
-$(system_ext_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
-$(system_ext_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
-$(system_ext_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(system_ext_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
-$(system_ext_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(system_ext_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
-$(system_ext_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
-$(system_ext_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
-$(system_ext_policy.conf): $(policy_files) $(M4)
-	$(transform-policy-to-conf)
-	$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
-
-$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
-$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_CIL := $(built_plat_cil)
-$(LOCAL_BUILT_MODULE): $(system_ext_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
-$(HOST_OUT_EXECUTABLES)/build_sepolicy $(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil)
-	@mkdir -p $(dir $@)
-	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
-	$(POLICYVERS) -o $@ $<
-	$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
-		-f $(PRIVATE_PLAT_CIL) -t $@
-	# Line markers (denoted by ;;) are malformed after above cmd. They are only
-	# used for debugging, so we remove them.
-	$(hide) grep -v ';;' $@ > $@.tmp
-	$(hide) mv $@.tmp $@
-	# Combine plat_sepolicy.cil and system_ext_sepolicy.cil to make sure that the
-	# latter doesn't accidentally depend on vendor/odm policies.
-	$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) \
-		$(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_PLAT_CIL) $@ -o /dev/null -f /dev/null
-
-
-built_system_ext_cil := $(LOCAL_BUILT_MODULE)
-built_system_ext_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_system_ext_cil)
-system_ext_policy.conf :=
-endif # ifdef HAS_SYSTEM_EXT_SEPOLICY
-
-#################################
-include $(CLEAR_VARS)
-
-ifdef HAS_PRODUCT_SEPOLICY
-LOCAL_MODULE := product_sepolicy.cil
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-# product_policy.conf - A combination of the private and public product policy
-# which will ship with the device. Product policy is not attributized.
-policy_files := $(call build_policy, $(sepolicy_build_files), \
-  $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
-  $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
-  $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY))
-product_policy.conf := $(intermediates)/product_policy.conf
-$(product_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
-$(product_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
-$(product_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
-$(product_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
-$(product_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
-$(product_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
-$(product_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(product_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
-$(product_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(product_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
-$(product_policy.conf): PRIVATE_ENFORCE_SYSPROP_OWNER := $(enforce_sysprop_owner)
-$(product_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
-$(product_policy.conf): $(policy_files) $(M4)
-	$(transform-policy-to-conf)
-	$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
-
-$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
-$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_CIL_FILES := $(built_plat_cil) $(built_system_ext_cil)
-$(LOCAL_BUILT_MODULE): $(product_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
-$(HOST_OUT_EXECUTABLES)/build_sepolicy $(HOST_OUT_EXECUTABLES)/secilc \
-$(built_plat_cil) $(built_system_ext_cil)
-	@mkdir -p $(dir $@)
-	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
-	$(POLICYVERS) -o $@ $<
-	$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
-		-f $(PRIVATE_PLAT_CIL_FILES) -t $@
-	# Line markers (denoted by ;;) are malformed after above cmd. They are only
-	# used for debugging, so we remove them.
-	$(hide) grep -v ';;' $@ > $@.tmp
-	$(hide) mv $@.tmp $@
-	# Combine plat_sepolicy.cil, system_ext_sepolicy.cil and product_sepolicy.cil to
-	# make sure that the latter doesn't accidentally depend on vendor/odm policies.
-	$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) \
-		$(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_PLAT_CIL_FILES) $@ -o /dev/null -f /dev/null
-
-
-built_product_cil := $(LOCAL_BUILT_MODULE)
-built_product_cil_$(PLATFORM_SEPOLICY_VERSION) := $(built_product_cil)
-product_policy.conf :=
-endif # ifdef HAS_PRODUCT_SEPOLICY
-
-#################################
-include $(CLEAR_VARS)
-
 LOCAL_MODULE := plat_sepolicy_vers.txt
 LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
 LOCAL_LICENSE_CONDITIONS := notice unencumbered
@@ -1688,38 +1393,6 @@
 sepolicy.recovery.conf :=
 
 ##################################
-# SELinux policy embedded into CTS.
-# CTS checks neverallow rules of this policy against the policy of the device under test.
-##################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := general_sepolicy.conf
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := tests
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-policy_files := $(call build_policy, $(sepolicy_build_files), \
-  $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
-$(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS)
-$(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS)
-$(LOCAL_BUILT_MODULE): PRIVATE_TARGET_BUILD_VARIANT := user
-$(LOCAL_BUILT_MODULE): PRIVATE_TGT_ARCH := $(my_target_arch)
-$(LOCAL_BUILT_MODULE): PRIVATE_WITH_ASAN := false
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_SPLIT := cts
-$(LOCAL_BUILT_MODULE): PRIVATE_COMPATIBLE_PROPERTY := cts
-$(LOCAL_BUILT_MODULE): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := cts
-$(LOCAL_BUILT_MODULE): PRIVATE_ENFORCE_SYSPROP_OWNER := cts
-$(LOCAL_BUILT_MODULE): PRIVATE_EXCLUDE_BUILD_TEST := true
-$(LOCAL_BUILT_MODULE): PRIVATE_POLICY_FILES := $(policy_files)
-$(LOCAL_BUILT_MODULE): $(policy_files) $(M4)
-	$(transform-policy-to-conf)
-	$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
-
-##################################
 # TODO - remove this.   Keep around until we get the filesystem creation stuff taken care of.
 #
 include $(CLEAR_VARS)
diff --git a/apex/com.android.sdkext-file_contexts b/apex/com.android.sdkext-file_contexts
index 2d59dda..551a12c 100644
--- a/apex/com.android.sdkext-file_contexts
+++ b/apex/com.android.sdkext-file_contexts
@@ -1,2 +1,3 @@
-(/.*)?                u:object_r:system_file:s0
-/bin/derive_sdk       u:object_r:derive_sdk_exec:s0
+(/.*)?                       u:object_r:system_file:s0
+/bin/derive_classpath        u:object_r:derive_classpath_exec:s0
+/bin/derive_sdk              u:object_r:derive_sdk_exec:s0
diff --git a/build/soong/policy.go b/build/soong/policy.go
index caeb6eb..d734c97 100644
--- a/build/soong/policy.go
+++ b/build/soong/policy.go
@@ -145,6 +145,7 @@
 		FlagWithArg("-D mls_num_cats=", strconv.Itoa(MlsCats)).
 		FlagWithArg("-D target_arch=", ctx.DeviceConfig().DeviceArch()).
 		FlagWithArg("-D target_with_asan=", c.withAsan(ctx)).
+		FlagWithArg("-D target_with_dexpreopt=", strconv.FormatBool(ctx.DeviceConfig().WithDexpreopt())).
 		FlagWithArg("-D target_with_native_coverage=", strconv.FormatBool(ctx.DeviceConfig().ClangCoverageEnabled() || ctx.DeviceConfig().GcovCoverageEnabled())).
 		FlagWithArg("-D target_build_variant=", c.buildVariant(ctx)).
 		FlagWithArg("-D target_full_treble=", c.sepolicySplit(ctx)).
diff --git a/private/access_vectors b/private/access_vectors
index a1d4b1d..8fbc2dc 100644
--- a/private/access_vectors
+++ b/private/access_vectors
@@ -732,6 +732,7 @@
 
 class keystore2_key
 {
+	convert_storage_key_to_ephemeral
 	delete
 	gen_unique_id
 	get_info
diff --git a/private/compat/30.0/30.0.cil b/private/compat/30.0/30.0.cil
index 9dff2c6..73374e6 100644
--- a/private/compat/30.0/30.0.cil
+++ b/private/compat/30.0/30.0.cil
@@ -1300,6 +1300,7 @@
 (typeattributeset default_prop_30_0 (
     default_prop
     build_config_prop
+    suspend_prop
     init_service_status_private_prop
     setupwizard_prop
     sqlite_log_prop
diff --git a/private/compat/30.0/30.0.ignore.cil b/private/compat/30.0/30.0.ignore.cil
index 0f9b7ec..3e66106 100644
--- a/private/compat/30.0/30.0.ignore.cil
+++ b/private/compat/30.0/30.0.ignore.cil
@@ -20,6 +20,7 @@
     authorization_service
     cgroup_desc_api_file
     cgroup_v2
+    codec2_config_prop
     ctl_snapuserd_prop
     debugfs_kprobes
     debugfs_mm_events_tracing
@@ -41,6 +42,7 @@
     font_data_file
     gki_apex_prepostinstall
     gki_apex_prepostinstall_exec
+    hal_audio_service
     hal_authsecret_service
     hal_audiocontrol_service
     hal_face_service
@@ -87,6 +89,7 @@
     profcollectd
     profcollectd_data_file
     profcollectd_exec
+    profcollectd_node_id_prop
     profcollectd_service
     qemu_hw_prop
     qemu_sf_lcd_density_prop
diff --git a/private/derive_classpath.te b/private/derive_classpath.te
new file mode 100644
index 0000000..71960d3
--- /dev/null
+++ b/private/derive_classpath.te
@@ -0,0 +1,12 @@
+
+# Domain for derive_classpath
+type derive_classpath, domain, coredomain;
+type derive_classpath_exec, system_file_type, exec_type, file_type;
+init_daemon_domain(derive_classpath)
+
+# Create /data/system/environ/classpath file
+allow derive_classpath environ_system_data_file:dir rw_dir_perms;
+allow derive_classpath environ_system_data_file:file create_file_perms;
+
+# b/183079517 fails on gphone targets otherwise
+allow derive_classpath unlabeled:dir search;
diff --git a/private/file.te b/private/file.te
index 910210d..984a7b6 100644
--- a/private/file.te
+++ b/private/file.te
@@ -53,3 +53,6 @@
 
 # /data/misc/odsign
 type odsign_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/system/environ
+type environ_system_data_file, file_type, data_file_type, core_data_file_type;
diff --git a/private/file_contexts b/private/file_contexts
index f8bb5ec..1347797 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -504,6 +504,7 @@
 #
 /data		u:object_r:system_data_root_file:s0
 /data/(.*)?		u:object_r:system_data_file:s0
+/data/system/environ(/.*)? u:object_r:environ_system_data_file:s0
 /data/system/packages\.list u:object_r:packages_list_file:s0
 /data/unencrypted(/.*)?         u:object_r:unencrypted_data_file:s0
 /data/backup(/.*)?		u:object_r:backup_data_file:s0
diff --git a/private/gsid.te b/private/gsid.te
index a0b74b6..c523731 100644
--- a/private/gsid.te
+++ b/private/gsid.te
@@ -168,21 +168,7 @@
     -gsid
     -fastbootd
     -vold
-} gsi_metadata_file:notdevfile_class_set ~{ relabelto getattr };
-
-neverallow {
-    domain
-    -init
-    -gsid
-    -fastbootd
-    -vold
-} { gsi_data_file gsi_metadata_file }:notdevfile_class_set *;
-
-neverallow {
-    domain
-    -gsid
-    -init
-} gsi_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
+} gsi_metadata_file:file_class_set *;
 
 neverallow {
     domain
@@ -192,5 +178,13 @@
 
 neverallow {
     domain
+    -init
     -gsid
-} gsi_data_file:notdevfile_class_set ~{ relabelto getattr };
+    -fastbootd
+    -vold
+} gsi_data_file:file_class_set *;
+
+neverallow {
+    domain
+    -gsid
+} gsi_data_file:file_class_set ~{ relabelto getattr };
diff --git a/private/priv_app.te b/private/priv_app.te
index e5889d1..4fd86e5 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -69,6 +69,11 @@
 # Allow traceur to pass file descriptors through a content provider to betterbug
 allow priv_app trace_data_file:file { getattr read };
 
+# Allow betterbug to read profile reports generated by profcollect.
+userdebug_or_eng(`
+  allow priv_app profcollectd_data_file:file r_file_perms;
+')
+
 # Allow the bug reporting frontend to read the presence and timestamp of the
 # trace attached to the bugreport (but not its contents, which will go in the
 # usual bugreport .zip file). This is used by the bug reporting UI to tell if
diff --git a/private/profcollectd.te b/private/profcollectd.te
index baccf88..24fb056 100644
--- a/private/profcollectd.te
+++ b/private/profcollectd.te
@@ -40,6 +40,7 @@
 
   # Allow profcollectd to read its system properties.
   get_prop(profcollectd, device_config_profcollect_native_boot_prop)
+  set_prop(profcollectd, profcollectd_node_id_prop)
 
   # Allow profcollectd to publish a binder service and make binder calls.
   binder_use(profcollectd)
diff --git a/private/property.te b/private/property.te
index 2f5fcde..8565275 100644
--- a/private/property.te
+++ b/private/property.te
@@ -25,10 +25,10 @@
 system_internal_prop(odsign_prop)
 system_internal_prop(perf_drop_caches_prop)
 system_internal_prop(pm_prop)
+system_internal_prop(profcollectd_node_id_prop)
 system_internal_prop(rollback_test_prop)
 system_internal_prop(setupwizard_prop)
 system_internal_prop(system_adbd_prop)
-system_internal_prop(suspend_prop)
 system_internal_prop(traced_perf_enabled_prop)
 system_internal_prop(userspace_reboot_log_prop)
 system_internal_prop(userspace_reboot_test_prop)
@@ -590,3 +590,12 @@
   -init
   -shell
 } rollback_test_prop:property_service set;
+
+neverallow {
+  # Only allow init and profcollectd to access profcollectd_node_id_prop
+  domain
+  -init
+  -dumpstate
+  -profcollectd
+} profcollectd_node_id_prop:file r_file_perms;
+
diff --git a/private/property_contexts b/private/property_contexts
index 7f3cb2f..306b40a 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -64,6 +64,7 @@
 persist.mmc.            u:object_r:mmc_prop:s0
 persist.netd.stable_secret      u:object_r:netd_stable_secret_prop:s0
 persist.pm.mock-upgrade u:object_r:mock_ota_prop:s0
+persist.profcollectd.node_id    u:object_r:profcollectd_node_id_prop:s0     exact   string
 persist.sys.            u:object_r:system_prop:s0
 persist.sys.safemode    u:object_r:safemode_prop:s0
 persist.sys.theme       u:object_r:theme_prop:s0
@@ -187,7 +188,7 @@
 ro.dalvik.              u:object_r:dalvik_prop:s0
 
 # qemu_hw_prop is read/written by both system and vendor.
-qemu.hw.mainkeys        u:object_r:qemu_hw_prop:s0
+qemu.hw.mainkeys        u:object_r:qemu_hw_prop:s0 exact string
 
 # qemu_sf_lcd_density_prop is read/written by both system and vendor.
 qemu.sf.lcd_density     u:object_r:qemu_sf_lcd_density_prop:s0 exact int
@@ -398,6 +399,8 @@
 
 keyguard.no_require_sim u:object_r:keyguard_config_prop:s0 exact bool
 
+media.c2.dmabuf.padding                      u:object_r:codec2_config_prop:s0 exact int
+
 media.recorder.show_manufacturer_and_model   u:object_r:media_config_prop:s0 exact bool
 media.stagefright.cache-params               u:object_r:media_config_prop:s0 exact string
 media.stagefright.enable-aac                 u:object_r:media_config_prop:s0 exact bool
diff --git a/private/service_contexts b/private/service_contexts
index 1965d65..826bc3a 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -15,6 +15,7 @@
 android.hardware.security.keymint.IRemotelyProvisionedComponent/default u:object_r:hal_remotelyprovisionedcomponent_service:s0
 android.hardware.security.secureclock.ISecureClock/default             u:object_r:hal_secureclock_service:s0
 android.hardware.security.sharedsecret.ISharedSecret/default             u:object_r:hal_sharedsecret_service:s0
+android.hardware.soundtrigger3.ISoundTriggerHw/default               u:object_r:hal_audio_service:s0
 android.hardware.vibrator.IVibrator/default                          u:object_r:hal_vibrator_service:s0
 android.hardware.vibrator.IVibratorManager/default                   u:object_r:hal_vibrator_service:s0
 android.hardware.weaver.IWeaver/default                              u:object_r:hal_weaver_service:s0
diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index 23ee943..d57939b 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -170,6 +170,9 @@
 userdebug_or_eng(`
   allow untrusted_app_all debugfs_kcov:file rw_file_perms;
   allowxperm untrusted_app_all debugfs_kcov:file ioctl { KCOV_INIT_TRACE KCOV_ENABLE KCOV_DISABLE };
+  # The use of debugfs kcov is considered a breach of the kernel integrity
+  # according to the heuristic of lockdown.
+  allow untrusted_app_all self:lockdown integrity;
 ')
 
 # Allow signalling simpleperf domain, which is the domain that the simpleperf
diff --git a/private/vold.te b/private/vold.te
index 09388f1..ba5ad8c 100644
--- a/private/vold.te
+++ b/private/vold.te
@@ -35,6 +35,7 @@
 # Vold will use Keystore instead of using Keymint directly. But it still needs
 # to manage its Keymint blobs. This is why it needs the `manage_blob` permission.
 allow vold vold_key:keystore2_key {
+    convert_storage_key_to_ephemeral
     delete
     get_info
     manage_blob
diff --git a/private/zygote.te b/private/zygote.te
index c2c6e89..9038c4f 100644
--- a/private/zygote.te
+++ b/private/zygote.te
@@ -78,6 +78,9 @@
 # Goes into media directory and bind mount obb directory
 allow zygote media_rw_data_file:dir { getattr search };
 
+# Bind mount on top of existing mounted obb and data directory
+allow zygote media_rw_data_file:dir { mounton };
+
 # Read if sdcardfs is supported
 allow zygote proc_filesystems:file r_file_perms;
 
diff --git a/public/domain.te b/public/domain.te
index e1d6739..f46ca67 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -275,6 +275,14 @@
 allow domain debugfs_tracing_debug:dir search;
 allow domain debugfs_trace_marker:file w_file_perms;
 
+# Linux lockdown mode offers coarse-grained definitions for access controls.
+# The "confidentiality" level detects access to tracefs or the perf subsystem.
+# This overlaps with more precise declarations in Android's policy. The
+# debugfs_trace_marker above is an example in which all processes should have
+# some access to tracefs. Therefore, allow all domains to access this level.
+# The "integrity" level is however enforced.
+allow domain self:lockdown confidentiality;
+
 # Filesystem access.
 allow domain fs_type:filesystem getattr;
 allow domain fs_type:dir getattr;
@@ -1396,3 +1404,6 @@
 } ashmem_device:chr_file open;
 
 neverallow { domain -traced_probes -init -vendor_init } debugfs_tracing_printk_formats:file *;
+
+# Linux lockdown "integrity" level is enforced for user builds.
+neverallow { domain userdebug_or_eng(`-domain') } self:lockdown integrity;
diff --git a/public/hal_audio.te b/public/hal_audio.te
index eb8155b..d1970b9 100644
--- a/public/hal_audio.te
+++ b/public/hal_audio.te
@@ -3,6 +3,7 @@
 binder_call(hal_audio_server, hal_audio_client)
 
 hal_attribute_hwservice(hal_audio, hal_audio_hwservice)
+hal_attribute_service(hal_audio, hal_audio_service)
 
 allow hal_audio ion_device:chr_file r_file_perms;
 
diff --git a/public/hal_codec2.te b/public/hal_codec2.te
index 8c7816a..a379bb3 100644
--- a/public/hal_codec2.te
+++ b/public/hal_codec2.te
@@ -1,5 +1,7 @@
 get_prop(hal_codec2_client, media_variant_prop)
 get_prop(hal_codec2_server, media_variant_prop)
+get_prop(hal_codec2_client, codec2_config_prop)
+get_prop(hal_codec2_server, codec2_config_prop)
 
 binder_call(hal_codec2_client, hal_codec2_server)
 binder_call(hal_codec2_server, hal_codec2_client)
diff --git a/public/property.te b/public/property.te
index 01bd68e..e367ae4 100644
--- a/public/property.te
+++ b/public/property.te
@@ -87,6 +87,7 @@
 system_restricted_prop(userspace_reboot_exported_prop)
 system_restricted_prop(vold_status_prop)
 system_restricted_prop(vts_status_prop)
+system_restricted_prop(suspend_prop)
 
 compatible_property_only(`
     # DO NOT ADD ANY PROPERTIES HERE
@@ -122,6 +123,7 @@
 system_vendor_config_prop(camera_calibration_prop)
 system_vendor_config_prop(camera_config_prop)
 system_vendor_config_prop(charger_config_prop)
+system_vendor_config_prop(codec2_config_prop)
 system_vendor_config_prop(cpu_variant_prop)
 system_vendor_config_prop(dalvik_config_prop)
 system_vendor_config_prop(drm_service_config_prop)
diff --git a/public/service.te b/public/service.te
index 229131c..e618cdb 100644
--- a/public/service.te
+++ b/public/service.te
@@ -240,8 +240,9 @@
 ### HAL Services
 ###
 
-type hal_authsecret_service, vendor_service, protected_service, service_manager_type;
+type hal_audio_service, vendor_service, protected_service, service_manager_type;
 type hal_audiocontrol_service, vendor_service, service_manager_type;
+type hal_authsecret_service, vendor_service, protected_service, service_manager_type;
 type hal_face_service, vendor_service, protected_service, service_manager_type;
 type hal_fingerprint_service, vendor_service, protected_service, service_manager_type;
 type hal_gnss_service, vendor_service, protected_service, service_manager_type;
diff --git a/public/te_macros b/public/te_macros
index 1d919eb..097d068 100644
--- a/public/te_macros
+++ b/public/te_macros
@@ -687,11 +687,11 @@
 
 ###########################################
 # hal_attribute_service(attribute, service)
-# Ability for domain to get a service to hwservice_manager
+# Ability for domain to get a service to service_manager
 # and find it. It also creates a neverallow preventing
 # others from adding it.
 #
-# Used to pair hal_foo_client with hal_foo_hwservice
+# Used to pair hal_foo_client with hal_foo_service
 define(`hal_attribute_service', `
   allow $1_client $2:service_manager find;
   add_service($1_server, $2)