Merge "Enable Telephony AIDL-HIDL shim HAL"
diff --git a/build/soong/selinux_contexts.go b/build/soong/selinux_contexts.go
index bbb8639..5859fc1 100644
--- a/build/soong/selinux_contexts.go
+++ b/build/soong/selinux_contexts.go
@@ -219,25 +219,19 @@
 }
 
 func (m *selinuxContextsModule) AndroidMk() android.AndroidMkData {
+	nameSuffix := ""
+	if m.InRecovery() && !m.onlyInRecovery() {
+		nameSuffix = ".recovery"
+	}
 	return android.AndroidMkData{
-		Custom: func(w io.Writer, name, prefix, moduleDir string, data android.AndroidMkData) {
-			nameSuffix := ""
-			if m.InRecovery() && !m.onlyInRecovery() {
-				nameSuffix = ".recovery"
-			}
-			fmt.Fprintln(w, "\ninclude $(CLEAR_VARS)")
-			fmt.Fprintln(w, "LOCAL_PATH :=", moduleDir)
-			fmt.Fprintln(w, "LOCAL_MODULE :=", name+nameSuffix)
-			data.Entries.WriteLicenseVariables(w)
-			fmt.Fprintln(w, "LOCAL_MODULE_CLASS := ETC")
-			if m.Owner() != "" {
-				fmt.Fprintln(w, "LOCAL_MODULE_OWNER :=", m.Owner())
-			}
-			fmt.Fprintln(w, "LOCAL_MODULE_TAGS := optional")
-			fmt.Fprintln(w, "LOCAL_PREBUILT_MODULE_FILE :=", m.outputPath.String())
-			fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", m.installPath.ToMakePath().String())
-			fmt.Fprintln(w, "LOCAL_INSTALLED_MODULE_STEM :=", name)
-			fmt.Fprintln(w, "include $(BUILD_PREBUILT)")
+		Class:      "ETC",
+		OutputFile: android.OptionalPathForPath(m.outputPath),
+		SubName:    nameSuffix,
+		Extra: []android.AndroidMkExtraFunc{
+			func(w io.Writer, outputFile android.Path) {
+				fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", m.installPath.ToMakePath().String())
+				fmt.Fprintln(w, "LOCAL_INSTALLED_MODULE_STEM :=", m.Name())
+			},
 		},
 	}
 }
diff --git a/microdroid/system/private/file_contexts b/microdroid/system/private/file_contexts
index 89fa02f..8a5f628 100644
--- a/microdroid/system/private/file_contexts
+++ b/microdroid/system/private/file_contexts
@@ -51,6 +51,9 @@
 /dev/event-log-tags     u:object_r:runtime_event_log_tags_file:s0
 /dev/cgroup_info(/.*)?  u:object_r:cgroup_rc_file:s0
 /dev/fuse		u:object_r:fuse_device:s0
+/dev/hvc0               u:object_r:serial_device:s0
+/dev/hvc1               u:object_r:serial_device:s0
+/dev/hvc2               u:object_r:serial_device:s0
 /dev/hw_random		u:object_r:hw_random_device:s0
 /dev/hwbinder		u:object_r:hwbinder_device:s0
 /dev/loop-control	u:object_r:loop_control_device:s0
@@ -82,7 +85,6 @@
 /dev/uinput		u:object_r:uhid_device:s0
 /dev/uio[0-9]*		u:object_r:uio_device:s0
 /dev/urandom		u:object_r:random_device:s0
-/dev/hvc0		u:object_r:serial_device:s0
 /dev/vhost-vsock	u:object_r:kvm_device:s0
 /dev/vndbinder		u:object_r:vndbinder_device:s0
 /dev/vsock		u:object_r:vsock_device:s0
diff --git a/microdroid/system/private/logcat.te b/microdroid/system/private/logcat.te
new file mode 100644
index 0000000..be6e42a
--- /dev/null
+++ b/microdroid/system/private/logcat.te
@@ -0,0 +1,15 @@
+# logcat in Microdroid runs as a daemon process. It reads logs from logd and
+# emits the logs to the virtual serial console.
+typeattribute logcat coredomain;
+
+# logcat can be executed from init
+init_daemon_domain(logcat)
+
+# logcat can append to the virtual console devices
+allow logcat device:dir r_dir_perms;
+allow logcat serial_device:chr_file ra_file_perms;
+
+# logcat can get logs from logd
+read_logd(logcat)
+
+allow logcat self:global_capability_class_set { sys_nice };
diff --git a/microdroid/system/private/microdroid_manager.te b/microdroid/system/private/microdroid_manager.te
index caee216..3aa14ca 100644
--- a/microdroid/system/private/microdroid_manager.te
+++ b/microdroid/system/private/microdroid_manager.te
@@ -52,6 +52,7 @@
 # Allow microdroid_manager to start the services apexd-vm, apkdmverity and zipfuse
 set_prop(microdroid_manager, ctl_apexd_vm_prop)
 set_prop(microdroid_manager, ctl_apkdmverity_prop)
+set_prop(microdroid_manager, ctl_seriallogging_prop)
 set_prop(microdroid_manager, ctl_zipfuse_prop)
 
 # Allow microdroid_manager to wait for linkerconfig to be ready
@@ -60,4 +61,12 @@
 # Allow microdroid_manager to pass the roothash to apkdmverity
 set_prop(microdroid_manager, microdroid_manager_roothash_prop)
 
+# Allow microdroid_manager to read sysprops from bootconfigs. It will use the
+# sysprops to decide whether services required for debugging (adbd, logd, etc.)
+# need to be started or not.
+get_prop(microdroid_manager, bootloader_prop)
+
+# Allow microdroid_manager to shutdown the device when verification fails
+set_prop(microdroid_manager, powerctl_prop)
+
 neverallow microdroid_manager { file_type fs_type }:file execute_no_trans;
diff --git a/microdroid/system/private/property_contexts b/microdroid/system/private/property_contexts
index 93ba1b5..9384a75 100644
--- a/microdroid/system/private/property_contexts
+++ b/microdroid/system/private/property_contexts
@@ -23,15 +23,17 @@
 
 ctl.stop$apexd u:object_r:ctl_apexd_prop:s0
 
-ctl.start$apexd-vm    u:object_r:ctl_apexd_vm_prop:s0
-ctl.start$apkdmverity u:object_r:ctl_apkdmverity_prop:s0
-ctl.start$zipfuse     u:object_r:ctl_zipfuse_prop:s0
+ctl.start$apexd-vm      u:object_r:ctl_apexd_vm_prop:s0
+ctl.start$apkdmverity   u:object_r:ctl_apkdmverity_prop:s0
+ctl.start$seriallogging u:object_r:ctl_seriallogging_prop:s0
+ctl.start$zipfuse       u:object_r:ctl_zipfuse_prop:s0
 
 ctl.console     u:object_r:ctl_console_prop:s0
 ctl.fuse_       u:object_r:ctl_fuse_prop:s0
 ctl.            u:object_r:ctl_default_prop:s0
 
 sys.init.perf_lsm_hooks u:object_r:init_perf_lsm_hooks_prop:s0 exact bool
+sys.powerctl            u:object_r:powerctl_prop:s0
 
 service.adb.root u:object_r:shell_prop:s0 exact bool
 
@@ -90,11 +92,13 @@
 
 init.svc.vendor.keymint-microdroid u:object_r:vendor_default_prop:s0 exact string
 
-ro.boot.hardware                   u:object_r:bootloader_prop:s0 exact string
+ro.boot.adb.enabled                u:object_r:bootloader_prop:s0 exact bool
 ro.boot.avb_version                u:object_r:bootloader_prop:s0 exact string
 ro.boot.boot_devices               u:object_r:bootloader_prop:s0 exact string
 ro.boot.first_stage_console        u:object_r:bootloader_prop:s0 exact string
 ro.boot.force_normal_boot          u:object_r:bootloader_prop:s0 exact string
+ro.boot.hardware                   u:object_r:bootloader_prop:s0 exact string
+ro.boot.logd.enabled               u:object_r:bootloader_prop:s0 exact bool
 ro.boot.slot_suffix                u:object_r:bootloader_prop:s0 exact string
 ro.boot.vbmeta.avb_version         u:object_r:bootloader_prop:s0 exact string
 ro.boot.vbmeta.device_state        u:object_r:bootloader_prop:s0 exact string
diff --git a/microdroid/system/public/attributes b/microdroid/system/public/attributes
index ffc2b3b..50c2c81 100644
--- a/microdroid/system/public/attributes
+++ b/microdroid/system/public/attributes
@@ -7,7 +7,7 @@
 # in tools/checkfc.c
 attribute dev_type;
 
-# Attribute for block devices.
+# TODO(b/202520796) Remove this attribute once the sc-dev branch stops using it.
 attribute bdev_type;
 
 # All types used for processes.
diff --git a/microdroid/system/public/device.te b/microdroid/system/public/device.te
index 898224c..c03fb4d 100644
--- a/microdroid/system/public/device.te
+++ b/microdroid/system/public/device.te
@@ -1,7 +1,7 @@
 type ashmem_device, dev_type, mlstrustedobject;
 type ashmem_libcutils_device, dev_type, mlstrustedobject;
 type binder_device, dev_type, mlstrustedobject;
-type block_device, dev_type, bdev_type;
+type block_device, dev_type;
 type console_device, dev_type;
 type device, dev_type, fs_type;
 type dm_device, dev_type;
@@ -34,7 +34,7 @@
 type uhid_device, dev_type, mlstrustedobject;
 type uio_device, dev_type;
 type userdata_sysdev, dev_type;
-type vd_device, dev_type, bdev_type;
+type vd_device, dev_type;
 type vndbinder_device, dev_type;
 type vsock_device, dev_type;
 type zero_device, dev_type, mlstrustedobject;
diff --git a/microdroid/system/public/logcat.te b/microdroid/system/public/logcat.te
index 902fd8a..cf2bb7e 100644
--- a/microdroid/system/public/logcat.te
+++ b/microdroid/system/public/logcat.te
@@ -1,2 +1,2 @@
-type logcat;
+type logcat, domain;
 type logcat_exec, file_type, exec_type, system_file_type;
diff --git a/microdroid/system/public/property.te b/microdroid/system/public/property.te
index 45b4151..f92face 100644
--- a/microdroid/system/public/property.te
+++ b/microdroid/system/public/property.te
@@ -17,6 +17,7 @@
 type ctl_interface_start_prop, property_type;
 type ctl_interface_stop_prop, property_type;
 type ctl_restart_prop, property_type;
+type ctl_seriallogging_prop, property_type;
 type ctl_sigstop_prop, property_type;
 type ctl_start_prop, property_type;
 type ctl_stop_prop, property_type;
@@ -44,6 +45,7 @@
 type usb_control_prop, property_type;
 type vendor_default_prop, property_type;
 type vmsecret_keymint_prop, property_type;
+type powerctl_prop, property_type;
 
 allow property_type tmpfs:filesystem associate;
 
diff --git a/private/apexd.te b/private/apexd.te
index 50a7a72..feee8ff 100644
--- a/private/apexd.te
+++ b/private/apexd.te
@@ -186,3 +186,6 @@
 allow apexd postinstall_apex_mnt_dir:file { create_file_perms relabelfrom };
 allow apexd postinstall_apex_mnt_dir:lnk_file create;
 allow apexd proc_filesystems:file r_file_perms;
+
+# Allow calling derive_classpath to gather BCP information for staged sessions
+domain_auto_trans(apexd, derive_classpath_exec, apexd_derive_classpath);
diff --git a/private/apexd_derive_classpath.te b/private/apexd_derive_classpath.te
new file mode 100644
index 0000000..d4c5496
--- /dev/null
+++ b/private/apexd_derive_classpath.te
@@ -0,0 +1,9 @@
+# Exclusive domain for apexd calling into derive_classpath binary
+type apexd_derive_classpath, domain, coredomain;
+
+# Allow the binary to write into output file at location /apex/derive_classpath_temp
+allow apexd_derive_classpath apexd:fd use;
+allow apexd_derive_classpath apex_mnt_dir:file { write open };
+# Allow the binary to log using logwrap
+allow apexd_derive_classpath apexd_devpts:chr_file { read write };
+
diff --git a/private/atrace.te b/private/atrace.te
index d9e351c..cbb5b7c 100644
--- a/private/atrace.te
+++ b/private/atrace.te
@@ -44,7 +44,6 @@
 # Allow notifying the processes hosting specific binder services that
 # trace-related system properties have changed.
 binder_use(atrace)
-allow atrace healthd:binder call;
 allow atrace surfaceflinger:binder call;
 allow atrace system_server:binder call;
 allow atrace cameraserver:binder call;
diff --git a/private/compat/31.0/31.0.cil b/private/compat/31.0/31.0.cil
index 362b412..061edca 100644
--- a/private/compat/31.0/31.0.cil
+++ b/private/compat/31.0/31.0.cil
@@ -3,6 +3,8 @@
 (type apex_permission_data_file)
 (type apex_scheduling_data_file)
 (type apex_wifi_data_file)
+(type healthd_exec)
+(type nonplat_service_contexts_file)
 (type vr_hwc)
 (type vr_hwc_exec)
 
@@ -1960,7 +1962,10 @@
 (typeattributeset print_service_31_0 (print_service))
 (typeattributeset priv_app_31_0 (priv_app))
 (typeattributeset privapp_data_file_31_0 (privapp_data_file))
-(typeattributeset proc_31_0 (proc))
+(typeattributeset proc_31_0
+  ( proc
+    proc_cpu_alignment
+))
 (typeattributeset proc_abi_31_0 (proc_abi))
 (typeattributeset proc_asound_31_0 (proc_asound))
 (typeattributeset proc_bluetooth_writable_31_0 (proc_bluetooth_writable))
diff --git a/private/compat/31.0/31.0.ignore.cil b/private/compat/31.0/31.0.ignore.cil
index 7decba1..f9645f4 100644
--- a/private/compat/31.0/31.0.ignore.cil
+++ b/private/compat/31.0/31.0.ignore.cil
@@ -13,12 +13,16 @@
     extra_free_kbytes_exec
     hal_contexthub_service
     hal_graphics_composer_service
+    hal_health_service
     hal_sensors_service
     hal_system_suspend_service
+    hal_radio_service
     hal_tv_tuner_service
     hal_uwb_service
     hal_uwb_vendor_service
     hal_wifi_hostapd_service
+    hal_wifi_supplicant_service
+    hal_nlinterceptor_service
     hypervisor_prop
     locale_service
     power_stats_service
@@ -31,6 +35,7 @@
     untrusted_app_30
     proc_vendor_sched
     sysfs_vendor_sched
+    tv_iapp_service
     vendor_vm_file
     vendor_vm_data_file
     virtual_device_service
diff --git a/private/coredomain.te b/private/coredomain.te
index dde80b2..f8a61d2 100644
--- a/private/coredomain.te
+++ b/private/coredomain.te
@@ -190,7 +190,6 @@
     -bootstat
     -charger
     -dumpstate
-    -healthd
     userdebug_or_eng(`-incidentd')
     -init
     -logd
diff --git a/private/domain.te b/private/domain.te
index 85b4228..a0e188b 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -409,7 +409,6 @@
   -init
   -recovery
   -ueventd
-  -healthd
   -uncrypt
   -tee
   -hal_bootctl_server
diff --git a/private/file_contexts b/private/file_contexts
index 18be045..3049bc6 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -48,29 +48,21 @@
 
 # SELinux policy files
 /vendor_file_contexts   u:object_r:file_contexts_file:s0
-/nonplat_file_contexts  u:object_r:file_contexts_file:s0
 /plat_file_contexts     u:object_r:file_contexts_file:s0
 /product_file_contexts  u:object_r:file_contexts_file:s0
 /mapping_sepolicy\.cil   u:object_r:sepolicy_file:s0
-/nonplat_sepolicy\.cil   u:object_r:sepolicy_file:s0
 /plat_sepolicy\.cil      u:object_r:sepolicy_file:s0
 /plat_property_contexts  u:object_r:property_contexts_file:s0
 /product_property_contexts  u:object_r:property_contexts_file:s0
-/nonplat_property_contexts  u:object_r:property_contexts_file:s0
 /vendor_property_contexts   u:object_r:property_contexts_file:s0
 /seapp_contexts     u:object_r:seapp_contexts_file:s0
-/nonplat_seapp_contexts     u:object_r:seapp_contexts_file:s0
 /vendor_seapp_contexts      u:object_r:seapp_contexts_file:s0
 /plat_seapp_contexts     u:object_r:seapp_contexts_file:s0
 /sepolicy           u:object_r:sepolicy_file:s0
 /plat_service_contexts   u:object_r:service_contexts_file:s0
 /plat_hwservice_contexts   u:object_r:hwservice_contexts_file:s0
 /plat_keystore2_key_contexts u:object_r:keystore2_key_contexts_file:s0
-/nonplat_service_contexts   u:object_r:nonplat_service_contexts_file:s0
-# Use nonplat_service_contexts_file to allow servicemanager to read it
-# on non full-treble devices.
-/vendor_service_contexts    u:object_r:nonplat_service_contexts_file:s0
-/nonplat_hwservice_contexts   u:object_r:hwservice_contexts_file:s0
+/vendor_service_contexts    u:object_r:vendor_service_contexts_file:s0
 /vendor_hwservice_contexts    u:object_r:hwservice_contexts_file:s0
 /vndservice_contexts   u:object_r:vndservice_contexts_file:s0
 
@@ -292,7 +284,6 @@
 /system/bin/racoon	u:object_r:racoon_exec:s0
 /system/xbin/su		u:object_r:su_exec:s0
 /system/bin/dnsmasq     u:object_r:dnsmasq_exec:s0
-/system/bin/healthd     u:object_r:healthd_exec:s0
 /system/bin/clatd	u:object_r:clatd_exec:s0
 /system/bin/linker(64)? u:object_r:system_linker_exec:s0
 /system/bin/linkerconfig u:object_r:linkerconfig_exec:s0
@@ -403,8 +394,6 @@
 # HAL location
 /(vendor|system/vendor)/lib(64)?/hw            u:object_r:vendor_hal_file:s0
 
-/(vendor|system/vendor)/etc/selinux/nonplat_service_contexts u:object_r:nonplat_service_contexts_file:s0
-
 /(vendor|system/vendor)/etc/selinux/vendor_service_contexts u:object_r:vendor_service_contexts_file:s0
 
 #############################
diff --git a/private/fwk_bufferhub.te b/private/fwk_bufferhub.te
index 6b69cca..5286f3e 100644
--- a/private/fwk_bufferhub.te
+++ b/private/fwk_bufferhub.te
@@ -4,5 +4,4 @@
 hal_client_domain(fwk_bufferhub, hal_graphics_allocator)
 allow fwk_bufferhub ion_device:chr_file r_file_perms;
 
-hal_server_domain(fwk_bufferhub, hal_bufferhub)
 init_daemon_domain(fwk_bufferhub)
diff --git a/private/genfs_contexts b/private/genfs_contexts
index 664a3b3..2006ffe 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -7,6 +7,7 @@
 genfscon proc /buddyinfo u:object_r:proc_buddyinfo:s0
 genfscon proc /cmdline u:object_r:proc_cmdline:s0
 genfscon proc /config.gz u:object_r:config_gz:s0
+genfscon proc /cpu/alignment u:object_r:proc_cpu_alignment:s0
 genfscon proc /diskstats u:object_r:proc_diskstats:s0
 genfscon proc /filesystems u:object_r:proc_filesystems:s0
 genfscon proc /interrupts u:object_r:proc_interrupts:s0
@@ -119,7 +120,6 @@
 genfscon sysfs /devices/system/cpu u:object_r:sysfs_devices_system_cpu:s0
 genfscon sysfs /class/android_usb                 u:object_r:sysfs_android_usb:s0
 genfscon sysfs /class/extcon                      u:object_r:sysfs_extcon:s0
-genfscon sysfs /class/block                       u:object_r:sysfs_block:s0
 genfscon sysfs /class/leds                        u:object_r:sysfs_leds:s0
 genfscon sysfs /class/net                         u:object_r:sysfs_net:s0
 genfscon sysfs /class/rfkill/rfkill0/state        u:object_r:sysfs_bluetooth_writable:s0
diff --git a/private/gsid.te b/private/gsid.te
index 2ccc51c..fa76da0 100644
--- a/private/gsid.te
+++ b/private/gsid.te
@@ -55,8 +55,15 @@
 # Needed to stat /data/gsi/* and realpath on /dev/block/by-name/*
 allow gsid block_device:dir r_dir_perms;
 
+# Allow querying the size of super_block_device_type.
+allow gsid super_block_device_type:blk_file r_file_perms;
+
 # liblp queries these block alignment properties.
-allowxperm gsid { userdata_block_device sdcard_block_device }:blk_file ioctl {
+allowxperm gsid {
+  userdata_block_device
+  sdcard_block_device
+  super_block_device_type
+}:blk_file ioctl {
   BLKIOMIN
   BLKALIGNOFF
 };
diff --git a/private/healthd.te b/private/healthd.te
index 93bc3d8..cf422ed 100644
--- a/private/healthd.te
+++ b/private/healthd.te
@@ -1,12 +1 @@
 typeattribute healthd coredomain;
-
-init_daemon_domain(healthd)
-
-# Allow healthd to serve health HAL
-hal_server_domain(healthd, hal_health)
-
-# Healthd needs to tell init to continue the boot
-# process when running in charger mode.
-set_prop(healthd, system_prop)
-set_prop(healthd, exported_system_prop)
-set_prop(healthd, exported3_system_prop)
diff --git a/private/init.te b/private/init.te
index 3b64e25..09a9a5e 100644
--- a/private/init.te
+++ b/private/init.te
@@ -3,7 +3,6 @@
 tmpfs_domain(init)
 
 # Transitions to seclabel processes in init.rc
-domain_trans(init, rootfs, healthd)
 domain_trans(init, rootfs, slideshow)
 domain_auto_trans(init, charger_exec, charger)
 domain_auto_trans(init, e2fs_exec, e2fs)
diff --git a/private/mediatranscoding.te b/private/mediatranscoding.te
index 6f7d027..817416d 100644
--- a/private/mediatranscoding.te
+++ b/private/mediatranscoding.te
@@ -18,6 +18,7 @@
 hal_client_domain(mediatranscoding, hal_configstore)
 hal_client_domain(mediatranscoding, hal_omx)
 hal_client_domain(mediatranscoding, hal_codec2)
+hal_client_domain(mediatranscoding, hal_allocator)
 
 allow mediatranscoding mediaserver_service:service_manager find;
 allow mediatranscoding mediametrics_service:service_manager find;
diff --git a/private/property_contexts b/private/property_contexts
index 5d4c3b7..040ffe6 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -44,6 +44,8 @@
 log.tag                 u:object_r:log_tag_prop:s0
 log.tag.WifiHAL         u:object_r:wifi_log_prop:s0
 security.perf_harden    u:object_r:shell_prop:s0
+persist.simpleperf.profile_app_uid              u:object_r:shell_prop:s0
+persist.simpleperf.profile_app_expiration_time  u:object_r:shell_prop:s0
 security.lower_kptr_restrict u:object_r:lower_kptr_restrict_prop:s0
 service.adb.root        u:object_r:shell_prop:s0
 service.adb.tls.port    u:object_r:adbd_prop:s0
@@ -542,6 +544,7 @@
 ro.lmk.thrashing_limit_critical u:object_r:lmkd_config_prop:s0 exact int
 ro.lmk.thrashing_limit_decay    u:object_r:lmkd_config_prop:s0 exact int
 ro.lmk.use_minfree_levels       u:object_r:lmkd_config_prop:s0 exact bool
+ro.lmk.use_new_strategy         u:object_r:lmkd_config_prop:s0 exact bool
 ro.lmk.upgrade_pressure         u:object_r:lmkd_config_prop:s0 exact int
 lmkd.reinit                     u:object_r:lmkd_prop:s0 exact int
 
diff --git a/private/service_contexts b/private/service_contexts
index b9ab85d..50002d4 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -6,12 +6,15 @@
 android.hardware.gnss.IGnss/default                                  u:object_r:hal_gnss_service:s0
 android.hardware.graphics.composer3.IComposer/default                u:object_r:hal_graphics_composer_service:s0
 android.hardware.health.storage.IStorage/default                     u:object_r:hal_health_storage_service:s0
+android.hardware.health.IHealth/default                              u:object_r:hal_health_service:s0
 android.hardware.identity.IIdentityCredentialStore/default           u:object_r:hal_identity_service:s0
 android.hardware.light.ILights/default                               u:object_r:hal_light_service:s0
 android.hardware.memtrack.IMemtrack/default                          u:object_r:hal_memtrack_service:s0
+android.hardware.net.nlinterceptor.IInterceptor/default              u:object_r:hal_nlinterceptor_service:s0
 android.hardware.oemlock.IOemLock/default                            u:object_r:hal_oemlock_service:s0
 android.hardware.power.IPower/default                                u:object_r:hal_power_service:s0
 android.hardware.power.stats.IPowerStats/default                     u:object_r:hal_power_stats_service:s0
+android.hardware.radio.config.IRadioConfig/default                   u:object_r:hal_radio_service:s0
 android.hardware.rebootescrow.IRebootEscrow/default                  u:object_r:hal_rebootescrow_service:s0
 android.hardware.security.keymint.IKeyMintDevice/default             u:object_r:hal_keymint_service:s0
 android.hardware.security.keymint.IRemotelyProvisionedComponent/default u:object_r:hal_remotelyprovisionedcomponent_service:s0
@@ -25,6 +28,7 @@
 android.hardware.vibrator.IVibratorManager/default                   u:object_r:hal_vibrator_service:s0
 android.hardware.weaver.IWeaver/default                              u:object_r:hal_weaver_service:s0
 android.hardware.wifi.hostapd.IHostapd/default                       u:object_r:hal_wifi_hostapd_service:s0
+android.hardware.wifi.supplicant.ISupplicant/default                 u:object_r:hal_wifi_supplicant_service:s0
 android.frameworks.stats.IStats/default                              u:object_r:fwk_stats_service:s0
 android.system.keystore2.IKeystoreService/default                    u:object_r:keystore_service:s0
 android.system.suspend.ISystemSuspend/default                        u:object_r:hal_system_suspend_service:s0
@@ -291,6 +295,7 @@
 tracing.proxy                             u:object_r:tracingproxy_service:s0
 translation                              u:object_r:translation_service:s0
 trust                                     u:object_r:trust_service:s0
+tv_iapp                                   u:object_r:tv_iapp_service:s0
 tv_input                                  u:object_r:tv_input_service:s0
 tv_tuner_resource_mgr                     u:object_r:tv_tuner_resource_mgr_service:s0
 uce                                       u:object_r:uce_service:s0
diff --git a/private/simpleperf.te b/private/simpleperf.te
index 0639c11..9c70060 100644
--- a/private/simpleperf.te
+++ b/private/simpleperf.te
@@ -5,7 +5,16 @@
 typeattribute simpleperf coredomain;
 type simpleperf_exec, system_file_type, exec_type, file_type;
 
-domain_auto_trans({ untrusted_app_all -runas_app }, simpleperf_exec, simpleperf)
+# Define apps that can be marked debuggable/profileable and be profiled by simpleperf.
+define(`simpleperf_profileable_apps', `{
+  ephemeral_app
+  isolated_app
+  platform_app
+  priv_app
+  untrusted_app_all
+}')
+
+domain_auto_trans({ simpleperf_profileable_apps -runas_app }, simpleperf_exec, simpleperf)
 
 # When running in this domain, simpleperf is scoped to profiling an individual
 # app. The necessary MAC permissions for profiling are more maintainable and
@@ -16,14 +25,19 @@
 
 # Allow ptrace attach to the target app, for reading JIT debug info (using
 # process_vm_readv) during unwinding and symbolization.
-allow simpleperf untrusted_app_all:process ptrace;
+allow simpleperf simpleperf_profileable_apps:process ptrace;
 
 # Allow using perf_event_open syscall for profiling the target app.
 allow simpleperf self:perf_event { open read write kernel };
 
 # Allow /proc/<pid> access for the target app (for example, when trying to
 # discover it by cmdline).
-r_dir_file(simpleperf, untrusted_app_all)
+r_dir_file(simpleperf, simpleperf_profileable_apps)
+
+# Allow apps signalling simpleperf domain, which is the domain that the simpleperf
+# profiler runs as when executed by the app. The signals are used to control
+# the profiler (which would be profiling the app that is sending the signal).
+allow simpleperf_profileable_apps simpleperf:process signal;
 
 # Suppress denial logspam when simpleperf is trying to find a matching process
 # by scanning /proc/<pid>/cmdline files. The /proc/<pid> directories are within
diff --git a/private/simpleperf_app_runner.te b/private/simpleperf_app_runner.te
index 17fd8cd..184a80a 100644
--- a/private/simpleperf_app_runner.te
+++ b/private/simpleperf_app_runner.te
@@ -21,7 +21,7 @@
 # simpleperf_app_runner switches to the app security context.
 selinux_check_context(simpleperf_app_runner) # validate context
 allow simpleperf_app_runner self:process setcurrent;
-allow simpleperf_app_runner untrusted_app_all:process dyntransition; # setcon
+allow simpleperf_app_runner { ephemeral_app isolated_app platform_app priv_app untrusted_app_all }:process dyntransition; # setcon
 
 # simpleperf_app_runner/libselinux needs access to seapp_contexts_file to
 # determine which domain to transition to.
diff --git a/private/statsd.te b/private/statsd.te
index 444d82e..59948ff 100644
--- a/private/statsd.te
+++ b/private/statsd.te
@@ -17,7 +17,10 @@
 allow statsd incidentd:fifo_file write;
 
 # Allow StatsCompanionService to pipe data to statsd.
-allow statsd system_server:fifo_file { read getattr };
+allow statsd system_server:fifo_file { read write getattr };
+
+# Allow Statsd to pipe data to privileged apps.
+allow statsd priv_app:fifo_file { read write getattr };
 
 # Allow statsd to retrieve SF statistics over binder
 binder_call(statsd, surfaceflinger);
diff --git a/private/surfaceflinger.te b/private/surfaceflinger.te
index e88efd0..1c7f657 100644
--- a/private/surfaceflinger.te
+++ b/private/surfaceflinger.te
@@ -19,7 +19,6 @@
 hal_client_domain(surfaceflinger, hal_omx)
 hal_client_domain(surfaceflinger, hal_configstore)
 hal_client_domain(surfaceflinger, hal_power)
-hal_client_domain(surfaceflinger, hal_bufferhub)
 allow surfaceflinger hidl_token_hwservice:hwservice_manager find;
 
 # Perform Binder IPC.
diff --git a/private/technical_debt.cil b/private/technical_debt.cil
index 9b3e3c6..4c746fb 100644
--- a/private/technical_debt.cil
+++ b/private/technical_debt.cil
@@ -59,11 +59,6 @@
 (typeattribute untrusted_app_visible_halserver)
 (typeattributeset untrusted_app_visible_halserver_violators (untrusted_app_visible_halserver))
 
-; Apps, except isolated apps, are clients of BufferHub HAL
-; Unfortunately, we can't currently express this in module policy language:
-;     typeattribute { appdomain -isolated_app } hal_cas_client;
-(typeattributeset hal_bufferhub_client ((and (appdomain) ((not (isolated_app))))))
-
 ; Properties having both system_property_type and vendor_property_type are illegal
 ; Unfortunately, we can't currently express this in module policy language:
 ;     typeattribute { system_property_type && vendor_property_type } system_and_vendor_property_type;
diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index d6f237c..ceee544 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -171,11 +171,6 @@
   allow untrusted_app_all self:lockdown integrity;
 ')
 
-# Allow signalling simpleperf domain, which is the domain that the simpleperf
-# profiler runs as when executed by the app. The signals are used to control
-# the profiler (which would be profiling the app that is sending the signal).
-allow untrusted_app_all simpleperf:process signal;
-
 # Allow running a VM for test/demo purposes. Note that access the service is
 # still guarded with the `android.permission.MANAGE_VIRTUAL_MACHINE`
 # permission. The protection level of the permission is `signature|development`
diff --git a/private/virtualizationservice.te b/private/virtualizationservice.te
index 0b02745..1e00dcd 100644
--- a/private/virtualizationservice.te
+++ b/private/virtualizationservice.te
@@ -22,9 +22,6 @@
 # When virtualizationservice execs a file with the crosvm_exec label, run it in the crosvm domain.
 domain_auto_trans(virtualizationservice, crosvm_exec, crosvm)
 
-# Let virtualizationservice exec other files (e.g. mk_cdisk) in the same domain.
-allow virtualizationservice system_file:file execute_no_trans;
-
 # Let virtualizationservice kill crosvm.
 allow virtualizationservice crosvm:process sigkill;
 
diff --git a/public/attributes b/public/attributes
index 32fe98c..a68a6fc 100644
--- a/public/attributes
+++ b/public/attributes
@@ -7,7 +7,7 @@
 # in tools/checkfc.c
 attribute dev_type;
 
-# Attribute for block devices.
+# TODO(b/202520796) Remove this attribute once the sc-dev branch stops using it.
 attribute bdev_type;
 
 # All types used for processes.
@@ -68,7 +68,7 @@
 # All types used for sysfs files.
 attribute sysfs_type;
 
-# Attribute for /sys/class/block files.
+# TODO(b/202520796) Remove this attribute once the sc-dev branch stops using it.
 attribute sysfs_block_type;
 
 # All types use for debugfs files.
@@ -324,7 +324,6 @@
 hal_attribute(authsecret);
 hal_attribute(bluetooth);
 hal_attribute(bootctl);
-hal_attribute(bufferhub);
 hal_attribute(broadcastradio);
 hal_attribute(camera);
 hal_attribute(can_bus);
@@ -355,6 +354,7 @@
 hal_attribute(memtrack);
 hal_attribute(neuralnetworks);
 hal_attribute(nfc);
+hal_attribute(nlinterceptor);
 hal_attribute(oemlock);
 hal_attribute(omx);
 hal_attribute(power);
diff --git a/public/cameraserver.te b/public/cameraserver.te
index b7e555f..577a465 100644
--- a/public/cameraserver.te
+++ b/public/cameraserver.te
@@ -36,6 +36,9 @@
 
 allow cameraserver hidl_token_hwservice:hwservice_manager find;
 
+# Allow to talk with surfaceflinger through unix stream socket
+allow cameraserver surfaceflinger:unix_stream_socket { read write };
+
 ###
 ### neverallow rules
 ###
diff --git a/public/device.te b/public/device.te
index 1a71a40..686f955 100644
--- a/public/device.te
+++ b/public/device.te
@@ -6,18 +6,18 @@
 type binder_device, dev_type, mlstrustedobject;
 type hwbinder_device, dev_type, mlstrustedobject;
 type vndbinder_device, dev_type;
-type block_device, dev_type, bdev_type;
+type block_device, dev_type;
 type camera_device, dev_type;
-type dm_device, dev_type, bdev_type;
-type dm_user_device, dev_type, bdev_type;
+type dm_device, dev_type;
+type dm_user_device, dev_type;
 type keychord_device, dev_type;
 type loop_control_device, dev_type;
-type loop_device, dev_type, bdev_type;
+type loop_device, dev_type;
 type pmsg_device, dev_type, mlstrustedobject;
 type radio_device, dev_type;
-type ram_device, dev_type, bdev_type;
+type ram_device, dev_type;
 type rtc_device, dev_type;
-type vd_device, dev_type, bdev_type;
+type vd_device, dev_type;
 type vold_device, dev_type;
 type console_device, dev_type;
 type fscklogs, dev_type;
@@ -73,51 +73,51 @@
 type rpmsg_device, dev_type;
 
 # Partition layout block device
-type root_block_device, dev_type, bdev_type;
+type root_block_device, dev_type;
 
 # factory reset protection block device
-type frp_block_device, dev_type, bdev_type;
+type frp_block_device, dev_type;
 
 # System block device mounted on /system.
 # Documented at https://source.android.com/devices/bootloader/partitions-images
-type system_block_device, dev_type, bdev_type;
+type system_block_device, dev_type;
 
 # Recovery block device.
 # Documented at https://source.android.com/devices/bootloader/partitions-images
-type recovery_block_device, dev_type, bdev_type;
+type recovery_block_device, dev_type;
 
 # boot block device.
 # Documented at https://source.android.com/devices/bootloader/partitions-images
-type boot_block_device, dev_type, bdev_type;
+type boot_block_device, dev_type;
 
 # Userdata block device mounted on /data.
 # Documented at https://source.android.com/devices/bootloader/partitions-images
-type userdata_block_device, dev_type, bdev_type;
+type userdata_block_device, dev_type;
 
 # Cache block device mounted on /cache.
 # Documented at https://source.android.com/devices/bootloader/partitions-images
-type cache_block_device, dev_type, bdev_type;
+type cache_block_device, dev_type;
 
 # Block device for any swap partition.
-type swap_block_device, dev_type, bdev_type;
+type swap_block_device, dev_type;
 
 # Metadata block device used for encryption metadata.
 # Assign this type to the partition specified by the encryptable=
 # mount option in your fstab file in the entry for userdata.
 # Documented at https://source.android.com/devices/bootloader/partitions-images
-type metadata_block_device, dev_type, bdev_type;
+type metadata_block_device, dev_type;
 
 # The 'misc' partition used by recovery and A/B.
 # Documented at https://source.android.com/devices/bootloader/partitions-images
-type misc_block_device, dev_type, bdev_type;
+type misc_block_device, dev_type;
 
 # 'super' partition to be used for logical partitioning.
-type super_block_device, super_block_device_type, dev_type, bdev_type;
+type super_block_device, super_block_device_type, dev_type;
 
 # sdcard devices; normally vold uses the vold_block_device label and creates a
 # separate device node. gsid, however, accesses the original devide node
 # created through uevents, so we use a separate label.
-type sdcard_block_device, dev_type, bdev_type;
+type sdcard_block_device, dev_type;
 
 # Userdata device file for filesystem tunables
 type userdata_sysdev, dev_type;
diff --git a/public/domain.te b/public/domain.te
index 95b59d8..e7853ec 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -1350,11 +1350,10 @@
   -coredomain
 } mnt_product_file:dir *;
 
-# Platform must not have access to sysfs_batteryinfo, but should do it via health HAL and healthd
+# Platform must not have access to sysfs_batteryinfo, but should do it via health HAL
 full_treble_only(`
   neverallow {
     coredomain
-    -healthd
     -shell
     # For access to block device information under /sys/class/block.
     -apexd
diff --git a/public/file.te b/public/file.te
index 0b94e2e..bfc20d4 100644
--- a/public/file.te
+++ b/public/file.te
@@ -25,6 +25,7 @@
 type proc_bootconfig, fs_type, proc_type;
 type proc_buddyinfo, fs_type, proc_type;
 type proc_cmdline, fs_type, proc_type;
+type proc_cpu_alignment, fs_type, proc_type;
 type proc_cpuinfo, fs_type, proc_type;
 type proc_dirty, fs_type, proc_type;
 type proc_diskstats, fs_type, proc_type;
@@ -88,11 +89,10 @@
 type sysfs_android_usb, fs_type, sysfs_type;
 type sysfs_uio, sysfs_type, fs_type;
 type sysfs_batteryinfo, fs_type, sysfs_type;
-type sysfs_block, fs_type, sysfs_type, sysfs_block_type;
 type sysfs_bluetooth_writable, fs_type, sysfs_type, mlstrustedobject;
 type sysfs_devfreq_cur, fs_type, sysfs_type;
 type sysfs_devfreq_dir, fs_type, sysfs_type;
-type sysfs_devices_block, fs_type, sysfs_type, sysfs_block_type;
+type sysfs_devices_block, fs_type, sysfs_type;
 type sysfs_dm, fs_type, sysfs_type;
 type sysfs_dm_verity, fs_type, sysfs_type;
 type sysfs_dma_heap, fs_type, sysfs_type;
@@ -565,9 +565,6 @@
 # vendor service_contexts file
 type vendor_service_contexts_file, vendor_file_type, file_type;
 
-# nonplat service_contexts file (only accessible on non full-treble devices)
-type nonplat_service_contexts_file, vendor_file_type, file_type;
-
 # hwservice_contexts file
 type hwservice_contexts_file, system_file_type, file_type;
 
diff --git a/public/fwk_bufferhub.te b/public/fwk_bufferhub.te
deleted file mode 100644
index 03486bd..0000000
--- a/public/fwk_bufferhub.te
+++ /dev/null
@@ -1,4 +0,0 @@
-binder_call(hal_bufferhub_client, hal_bufferhub_server)
-binder_call(hal_bufferhub_server, hal_bufferhub_client)
-
-hal_attribute_hwservice(hal_bufferhub, fwk_bufferhub_hwservice)
diff --git a/public/hal_health.te b/public/hal_health.te
index dc7d083..e2a6a60 100644
--- a/public/hal_health.te
+++ b/public/hal_health.te
@@ -3,6 +3,7 @@
 binder_call(hal_health_server, hal_health_client)
 
 hal_attribute_hwservice(hal_health, hal_health_hwservice)
+hal_attribute_service(hal_health, hal_health_service)
 
 # Common rules for a health service.
 
diff --git a/public/hal_neverallows.te b/public/hal_neverallows.te
index 3254f11..e77ea9d 100644
--- a/public/hal_neverallows.te
+++ b/public/hal_neverallows.te
@@ -8,7 +8,10 @@
   -hal_wifi_hostapd_server
   -hal_wifi_supplicant_server
   -hal_telephony_server
+  -hal_uwb_server
+  # TODO(b/196225233): Remove hal_uwb_vendor_server
   -hal_uwb_vendor_server
+  -hal_nlinterceptor_server
 } self:global_capability_class_set { net_admin net_raw };
 
 # Unless a HAL's job is to communicate over the network, or control network
@@ -26,7 +29,10 @@
   -hal_wifi_hostapd_server
   -hal_wifi_supplicant_server
   -hal_telephony_server
+  -hal_uwb_server
+  # TODO(b/196225233): Remove hal_uwb_vendor_server
   -hal_uwb_vendor_server
+  -hal_nlinterceptor_server
 } domain:{ udp_socket rawip_socket } *;
 
 neverallow {
@@ -38,6 +44,7 @@
   -hal_wifi_hostapd_server
   -hal_wifi_supplicant_server
   -hal_telephony_server
+  -hal_nlinterceptor_server
 } {
   domain
   userdebug_or_eng(`-su')
diff --git a/public/hal_nlinterceptor.te b/public/hal_nlinterceptor.te
new file mode 100644
index 0000000..2076de8
--- /dev/null
+++ b/public/hal_nlinterceptor.te
@@ -0,0 +1,8 @@
+binder_call(hal_nlinterceptor_client, hal_nlinterceptor_server)
+
+hal_attribute_service(hal_nlinterceptor, hal_nlinterceptor_service)
+binder_call(hal_nlinterceptor, servicemanager)
+
+allow hal_nlinterceptor self:global_capability_class_set net_admin;
+allow hal_nlinterceptor self:netlink_generic_socket create_socket_perms_no_ioctl;
+allow hal_nlinterceptor self:netlink_route_socket { nlmsg_readpriv nlmsg_write };
diff --git a/public/hal_telephony.te b/public/hal_telephony.te
index cb21715..e21796a 100644
--- a/public/hal_telephony.te
+++ b/public/hal_telephony.te
@@ -3,6 +3,7 @@
 binder_call(hal_telephony_server, hal_telephony_client)
 
 hal_attribute_hwservice(hal_telephony, hal_telephony_hwservice)
+hal_attribute_service(hal_telephony, hal_radio_service)
 
 allowxperm hal_telephony_server self:udp_socket ioctl priv_sock_ioctls;
 
diff --git a/public/hal_wifi_supplicant.te b/public/hal_wifi_supplicant.te
index f7c444e..b4ff7aa 100644
--- a/public/hal_wifi_supplicant.te
+++ b/public/hal_wifi_supplicant.te
@@ -3,6 +3,9 @@
 binder_call(hal_wifi_supplicant_server, hal_wifi_supplicant_client)
 
 hal_attribute_hwservice(hal_wifi_supplicant, hal_wifi_supplicant_hwservice)
+hal_attribute_service(hal_wifi_supplicant, hal_wifi_supplicant_service)
+
+binder_call(hal_wifi_supplicant_server, servicemanager)
 
 # in addition to ioctls allowlisted for all domains, grant hal_wifi_supplicant priv_sock_ioctls.
 allowxperm hal_wifi_supplicant self:udp_socket ioctl priv_sock_ioctls;
diff --git a/public/healthd.te b/public/healthd.te
index 05acb84..c5dcfb7 100644
--- a/public/healthd.te
+++ b/public/healthd.te
@@ -1,50 +1,4 @@
 # healthd - battery/charger monitoring service daemon
+# healthd is removed. The type is kept for backwards compatibility.
+
 type healthd, domain;
-type healthd_exec, system_file_type, exec_type, file_type;
-
-# Write to /dev/kmsg
-allow healthd kmsg_device:chr_file rw_file_perms;
-
-# Read access to pseudo filesystems.
-allow healthd sysfs_type:dir search;
-# Allow to read /sys/class/power_supply directory.
-allow healthd sysfs:dir r_dir_perms;
-r_dir_file(healthd, rootfs)
-r_dir_file(healthd, cgroup)
-r_dir_file(healthd, cgroup_v2)
-
-allow healthd self:global_capability_class_set { sys_tty_config };
-allow healthd self:global_capability_class_set sys_boot;
-dontaudit healthd self:global_capability_class_set sys_resource;
-
-allow healthd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
-
-wakelock_use(healthd)
-
-hal_client_domain(healthd, hal_health)
-
-# Read/write to /sys/power/state
-allow healthd sysfs_power:file rw_file_perms;
-
-# TODO: added to match above sysfs rule. Remove me?
-allow healthd sysfs_usb:file write;
-
-r_dir_file(healthd, sysfs_batteryinfo)
-
-###
-### healthd: charger mode
-###
-
-# Read /sys/fs/pstore/console-ramoops
-# Don't worry about overly broad permissions for now, as there's
-# only one file in /sys/fs/pstore
-allow healthd pstorefs:dir r_dir_perms;
-allow healthd pstorefs:file r_file_perms;
-
-allow healthd graphics_device:dir r_dir_perms;
-allow healthd graphics_device:chr_file rw_file_perms;
-allow healthd input_device:dir r_dir_perms;
-allow healthd input_device:chr_file r_file_perms;
-allow healthd tty_device:chr_file rw_file_perms;
-allow healthd ashmem_device:chr_file execute;
-allow healthd proc_sysrq:file rw_file_perms;
diff --git a/public/init.te b/public/init.te
index 193941a..8799134 100644
--- a/public/init.te
+++ b/public/init.te
@@ -371,6 +371,7 @@
 
 allow init {
   proc_abi
+  proc_cpu_alignment
   proc_dirty
   proc_hostname
   proc_hung_task
diff --git a/public/iorapd.te b/public/iorapd.te
index b772af8..8fded0c 100644
--- a/public/iorapd.te
+++ b/public/iorapd.te
@@ -27,9 +27,6 @@
 allow iorapd dumpstate:fd use;
 allow iorapd dumpstate:fifo_file write;
 
-# talk to batteryservice
-binder_call(iorapd, healthd)
-
 # TODO: does each of the service_manager allow finds above need the binder_call?
 
 # iorapd temporarily changes its priority when running benchmarks
@@ -87,7 +84,6 @@
 neverallow { domain -dumpstate -system_server -iorapd } iorapd_service:service_manager find;
 neverallow iorapd {
   domain
-  -healthd
   -servicemanager
   -system_server
   userdebug_or_eng(`-su')
diff --git a/public/keystore.te b/public/keystore.te
index b7d5090..9535491 100644
--- a/public/keystore.te
+++ b/public/keystore.te
@@ -43,3 +43,7 @@
 
 # TODO(b/186868271): Remove the crash dump exception soon-ish (maybe by May 14, 2021?)
 neverallow { domain userdebug_or_eng(`-crash_dump') } keystore:process ptrace;
+
+# The software KeyMint implementation used in km_compat needs
+# to read the vendor security patch level.
+get_prop(keystore, vendor_security_patch_level_prop);
diff --git a/public/property.te b/public/property.te
index de61748..f73a408 100644
--- a/public/property.te
+++ b/public/property.te
@@ -64,7 +64,6 @@
 system_restricted_prop(bq_config_prop)
 system_restricted_prop(build_bootimage_prop)
 system_restricted_prop(build_prop)
-system_restricted_prop(charger_status_prop)
 system_restricted_prop(device_config_nnapi_native_prop)
 system_restricted_prop(device_config_runtime_native_boot_prop)
 system_restricted_prop(device_config_runtime_native_prop)
@@ -180,6 +179,7 @@
 system_public_prop(bluetooth_a2dp_offload_prop)
 system_public_prop(bluetooth_audio_hal_prop)
 system_public_prop(bluetooth_prop)
+system_public_prop(charger_status_prop)
 system_public_prop(ctl_default_prop)
 system_public_prop(ctl_interface_start_prop)
 system_public_prop(ctl_start_prop)
diff --git a/public/service.te b/public/service.te
index a821941..19f7aaa 100644
--- a/public/service.te
+++ b/public/service.te
@@ -219,6 +219,7 @@
 type timezonedetector_service, app_api_service, system_server_service, service_manager_type;
 type translation_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type trust_service, app_api_service, system_server_service, service_manager_type;
+type tv_iapp_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type tv_input_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type tv_tuner_resource_mgr_service, app_api_service, system_server_service, service_manager_type;
 type uimode_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
@@ -248,6 +249,7 @@
 type tethering_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type emergency_affordance_service, system_server_service, service_manager_type;
 type hal_wifi_hostapd_service, vendor_service, protected_service, service_manager_type;
+type hal_wifi_supplicant_service, vendor_service, protected_service, service_manager_type;
 
 ###
 ### HAL Services
@@ -261,6 +263,7 @@
 type hal_fingerprint_service, vendor_service, protected_service, service_manager_type;
 type hal_gnss_service, vendor_service, protected_service, service_manager_type;
 type hal_graphics_composer_service, vendor_service, protected_service, service_manager_type;
+type hal_health_service, vendor_service, protected_service, service_manager_type;
 type hal_health_storage_service, vendor_service, protected_service, service_manager_type;
 type hal_identity_service, vendor_service, protected_service, service_manager_type;
 type hal_keymint_service, vendor_service, protected_service, service_manager_type;
@@ -276,10 +279,12 @@
 type hal_secureclock_service, vendor_service, protected_service, service_manager_type;
 type hal_sharedsecret_service, vendor_service, protected_service, service_manager_type;
 type hal_system_suspend_service, protected_service, service_manager_type;
+type hal_radio_service, vendor_service, protected_service, service_manager_type;
 type hal_tv_tuner_service, vendor_service, protected_service, service_manager_type;
 type hal_uwb_service, vendor_service, protected_service, service_manager_type;
 type hal_vibrator_service, vendor_service, protected_service, service_manager_type;
 type hal_weaver_service, vendor_service, protected_service, service_manager_type;
+type hal_nlinterceptor_service, vendor_service, protected_service, service_manager_type;
 
 ###
 ### Neverallow rules
diff --git a/public/servicemanager.te b/public/servicemanager.te
index 63fc227..a085a61 100644
--- a/public/servicemanager.te
+++ b/public/servicemanager.te
@@ -22,7 +22,7 @@
 allow servicemanager vendor_service_contexts_file:file r_file_perms;
 
 # nonplat_service_contexts only accessible on non full-treble devices
-not_full_treble(`allow servicemanager nonplat_service_contexts_file:file r_file_perms;')
+not_full_treble(`allow servicemanager vendor_service_contexts_file:file r_file_perms;')
 
 add_service(servicemanager, service_manager_service)
 allow servicemanager dumpstate:fd use;
diff --git a/public/shell.te b/public/shell.te
index 5fd9079..7751d63 100644
--- a/public/shell.te
+++ b/public/shell.te
@@ -157,9 +157,6 @@
 allow shell sysfs_batteryinfo:dir r_dir_perms;
 allow shell sysfs_batteryinfo:file r_file_perms;
 
-# allow shell to list /sys/class/block/ to get storage type for CTS
-allow shell sysfs_block:dir r_dir_perms;
-
 # Allow access to ion memory allocation device.
 allow shell ion_device:chr_file rw_file_perms;
 
diff --git a/public/statsd.te b/public/statsd.te
index 670f4c7..1a09586 100644
--- a/public/statsd.te
+++ b/public/statsd.te
@@ -25,7 +25,6 @@
 
 # Allow statsd to make binder calls to any binder service.
 binder_call(statsd, appdomain)
-binder_call(statsd, healthd)
 binder_call(statsd, incidentd)
 binder_call(statsd, system_server)
 
diff --git a/public/vold.te b/public/vold.te
index af3152e..c8ff749 100644
--- a/public/vold.te
+++ b/public/vold.te
@@ -221,9 +221,6 @@
 binder_call(vold, system_server)
 allow vold permission_service:service_manager find;
 
-# talk to batteryservice
-binder_call(vold, healthd)
-
 # talk to keymaster
 hal_client_domain(vold, hal_keymaster)
 
@@ -344,7 +341,6 @@
   -hal_keymaster_server
   -system_suspend_server
   -hal_bootctl_server
-  -healthd
   -hwservicemanager
   -iorapd_service
   -keystore
diff --git a/public/wificond.te b/public/wificond.te
index 254fcbc..98db0d7 100644
--- a/public/wificond.te
+++ b/public/wificond.te
@@ -7,6 +7,7 @@
 binder_call(wificond, keystore)
 
 add_service(wificond, wifinl80211_service)
+hal_client_domain(wificond, hal_nlinterceptor)
 
 # create sockets to set interfaces up and down
 allow wificond self:udp_socket create_socket_perms;
diff --git a/tests/treble_sepolicy_tests.py b/tests/treble_sepolicy_tests.py
index 9209b66..27e92b1 100644
--- a/tests/treble_sepolicy_tests.py
+++ b/tests/treble_sepolicy_tests.py
@@ -20,7 +20,6 @@
         # TODO(b/152813275): need to avoid allowlist for rootdir
         "modprobe",
         "slideshow",
-        "healthd",
         }
 
 class scontext:
diff --git a/tools/version_policy.c b/tools/version_policy.c
index 8bb422a..3f97268 100644
--- a/tools/version_policy.c
+++ b/tools/version_policy.c
@@ -9,7 +9,6 @@
 #include <sys/stat.h>
 #include <cil/android.h>
 #include <cil/cil.h>
-#include <cil/cil_write_ast.h>
 
 void __attribute__ ((noreturn)) static usage(char *prog) {
 	printf("Usage: %s [OPTION]...\n", prog);
@@ -90,6 +89,7 @@
 	char *num = NULL;
 	char *dot;
 	char *output = NULL;
+	FILE *output_file = NULL;
 	struct cil_db *base_db = NULL;
 	struct cil_db *out_db = NULL;
 
@@ -177,11 +177,21 @@
 			goto exit;
 		}
 	}
-	rc = cil_write_ast(out_db, output);
-	if (rc != SEPOL_OK) {
+
+	output_file = fopen(output, "we");
+	if (!output_file) {
+		fprintf(stderr, "Could not open file: %s\n", output);
 		goto exit;
 	}
 
+	rc = cil_write_build_ast(output_file, out_db);
+	if (rc != SEPOL_OK) {
+		fprintf(stderr, "Failed to write AST\n");
+		goto build_err;
+	}
+
+build_err:
+	fclose(output_file);
 exit:
 	free(base);
 	free(tgt_policy);
diff --git a/vendor/file_contexts b/vendor/file_contexts
index f213e0d..e2f14da 100644
--- a/vendor/file_contexts
+++ b/vendor/file_contexts
@@ -44,6 +44,7 @@
 /(vendor|system/vendor)/bin/hw/android\.hardware\.health@1\.0-service         u:object_r:hal_health_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.health@2\.0-service         u:object_r:hal_health_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.health@2\.1-service         u:object_r:hal_health_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.health-service\.example     u:object_r:hal_health_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.health\.storage@1\.0-service       u:object_r:hal_health_storage_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.health\.storage-service\.default   u:object_r:hal_health_storage_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.identity-service.example u:object_r:hal_identity_default_exec:s0