diff --git a/prebuilts/api/30.0/private/app.te b/prebuilts/api/30.0/private/app.te
index a03bcb0..9964605 100644
--- a/prebuilts/api/30.0/private/app.te
+++ b/prebuilts/api/30.0/private/app.te
@@ -35,3 +35,6 @@
     { domain -appdomain -crash_dump -rs }:process { transition };
 neverallow { appdomain -shell userdebug_or_eng(`-su') }
     { domain -appdomain }:process { dyntransition };
+
+# Don't allow regular apps access to storage configuration properties.
+neverallow { appdomain -mediaprovider_app } storage_config_prop:file no_rw_file_perms;
diff --git a/prebuilts/api/30.0/private/compat/29.0/29.0.ignore.cil b/prebuilts/api/30.0/private/compat/29.0/29.0.ignore.cil
index 0a9da30..53b4e71 100644
--- a/prebuilts/api/30.0/private/compat/29.0/29.0.ignore.cil
+++ b/prebuilts/api/30.0/private/compat/29.0/29.0.ignore.cil
@@ -44,6 +44,7 @@
     device_config_configuration_prop
     emergency_affordance_service
     exported_camera_prop
+    fastbootd_protocol_prop
     file_integrity_service
     fwk_automotive_display_hwservice
     gmscore_app
diff --git a/prebuilts/api/30.0/private/mediaprovider_app.te b/prebuilts/api/30.0/private/mediaprovider_app.te
index 0b1047a..335c1b6 100644
--- a/prebuilts/api/30.0/private/mediaprovider_app.te
+++ b/prebuilts/api/30.0/private/mediaprovider_app.te
@@ -40,3 +40,6 @@
 };
 
 allow mediaprovider_app proc_filesystems:file r_file_perms;
+
+#Allow MediaProvider to see if sdcardfs is in use
+get_prop(mediaprovider_app, storage_config_prop)
diff --git a/prebuilts/api/30.0/private/property_contexts b/prebuilts/api/30.0/private/property_contexts
index a117fcc..1a5471f 100644
--- a/prebuilts/api/30.0/private/property_contexts
+++ b/prebuilts/api/30.0/private/property_contexts
@@ -97,6 +97,9 @@
 sys.lmk.                u:object_r:system_lmk_prop:s0
 sys.trace.              u:object_r:system_trace_prop:s0
 
+# Fastbootd protocol control property
+fastbootd.protocol    u:object_r:fastbootd_protocol_prop:s0 exact enum usb tcp
+
 # Boolean property set by system server upon boot indicating
 # if device is fully owned by organization instead of being
 # a personal device.
diff --git a/prebuilts/api/30.0/public/app.te b/prebuilts/api/30.0/public/app.te
index 9c635aa..e5b9fd6 100644
--- a/prebuilts/api/30.0/public/app.te
+++ b/prebuilts/api/30.0/public/app.te
@@ -566,10 +566,6 @@
   -system_app
 } { bluetooth_audio_hal_prop bluetooth_a2dp_offload_prop bluetooth_prop exported_bluetooth_prop }:file create_file_perms;
 
-
-# Don't allow apps access to storage configuration properties.
-neverallow appdomain storage_config_prop:file no_rw_file_perms;
-
 # Apps cannot access proc_uid_time_in_state
 neverallow appdomain proc_uid_time_in_state:file *;
 
diff --git a/prebuilts/api/30.0/public/bootanim.te b/prebuilts/api/30.0/public/bootanim.te
index e8cb98b..bd2bec6 100644
--- a/prebuilts/api/30.0/public/bootanim.te
+++ b/prebuilts/api/30.0/public/bootanim.te
@@ -23,6 +23,7 @@
 
 allow bootanim audioserver_service:service_manager find;
 allow bootanim surfaceflinger_service:service_manager find;
+allow bootanim surfaceflinger:unix_stream_socket { read write };
 
 # Allow access to ion memory allocation device
 allow bootanim ion_device:chr_file rw_file_perms;
diff --git a/prebuilts/api/30.0/public/fastbootd.te b/prebuilts/api/30.0/public/fastbootd.te
index f10e649..8787817 100644
--- a/prebuilts/api/30.0/public/fastbootd.te
+++ b/prebuilts/api/30.0/public/fastbootd.te
@@ -120,6 +120,14 @@
   # Determine allocation scheme (whether B partitions needs to be
   # at the second half of super.
   get_prop(fastbootd, virtual_ab_prop)
+
+  # Needed for TCP protocol
+  allow fastbootd node:tcp_socket node_bind;
+  allow fastbootd port:tcp_socket name_bind;
+  allow fastbootd self:tcp_socket { create_socket_perms_no_ioctl listen accept };
+
+  # Get fastbootd protocol property
+  get_prop(fastbootd, fastbootd_protocol_prop)
 ')
 
 ###
diff --git a/prebuilts/api/30.0/public/property.te b/prebuilts/api/30.0/public/property.te
index 316d3c6..a81b6b4 100644
--- a/prebuilts/api/30.0/public/property.te
+++ b/prebuilts/api/30.0/public/property.te
@@ -14,6 +14,7 @@
 system_internal_prop(device_config_window_manager_native_boot_prop)
 system_internal_prop(device_config_configuration_prop)
 system_internal_prop(firstboot_prop)
+system_internal_prop(fastbootd_protocol_prop)
 system_internal_prop(gsid_prop)
 system_internal_prop(init_perf_lsm_hooks_prop)
 system_internal_prop(init_svc_debug_prop)
diff --git a/prebuilts/api/30.0/public/property_contexts b/prebuilts/api/30.0/public/property_contexts
index dc9657d..003a4f0 100644
--- a/prebuilts/api/30.0/public/property_contexts
+++ b/prebuilts/api/30.0/public/property_contexts
@@ -73,6 +73,7 @@
 drm.service.enabled u:object_r:exported3_default_prop:s0 exact bool
 external_storage.projid.enabled u:object_r:storage_config_prop:s0 exact bool
 external_storage.casefold.enabled u:object_r:storage_config_prop:s0 exact bool
+external_storage.sdcardfs.enabled u:object_r:storage_config_prop:s0 exact bool
 keyguard.no_require_sim u:object_r:exported3_default_prop:s0 exact bool
 media.recorder.show_manufacturer_and_model u:object_r:exported3_default_prop:s0 exact bool
 media.stagefright.cache-params u:object_r:exported3_default_prop:s0 exact string
diff --git a/prebuilts/api/30.0/public/recovery.te b/prebuilts/api/30.0/public/recovery.te
index 16b670f..63a9cea 100644
--- a/prebuilts/api/30.0/public/recovery.te
+++ b/prebuilts/api/30.0/public/recovery.te
@@ -154,6 +154,15 @@
 
   # Allow mounting /metadata for writing update states
   allow recovery metadata_file:dir { getattr mounton };
+
+  # These are needed to allow recovery to manage network
+  allow recovery self:netlink_route_socket { create write read nlmsg_readpriv nlmsg_read };
+  allow recovery self:global_capability_class_set net_admin;
+  allow recovery self:tcp_socket { create ioctl };
+  allowxperm recovery self:tcp_socket ioctl { SIOCGIFFLAGS SIOCSIFFLAGS };
+
+  # Set fastbootd protocol property
+  set_prop(recovery, fastbootd_protocol_prop)
 ')
 
 ###
diff --git a/private/app.te b/private/app.te
index a03bcb0..9964605 100644
--- a/private/app.te
+++ b/private/app.te
@@ -35,3 +35,6 @@
     { domain -appdomain -crash_dump -rs }:process { transition };
 neverallow { appdomain -shell userdebug_or_eng(`-su') }
     { domain -appdomain }:process { dyntransition };
+
+# Don't allow regular apps access to storage configuration properties.
+neverallow { appdomain -mediaprovider_app } storage_config_prop:file no_rw_file_perms;
diff --git a/private/compat/29.0/29.0.ignore.cil b/private/compat/29.0/29.0.ignore.cil
index 0a9da30..53b4e71 100644
--- a/private/compat/29.0/29.0.ignore.cil
+++ b/private/compat/29.0/29.0.ignore.cil
@@ -44,6 +44,7 @@
     device_config_configuration_prop
     emergency_affordance_service
     exported_camera_prop
+    fastbootd_protocol_prop
     file_integrity_service
     fwk_automotive_display_hwservice
     gmscore_app
diff --git a/private/mediaprovider_app.te b/private/mediaprovider_app.te
index 0b1047a..335c1b6 100644
--- a/private/mediaprovider_app.te
+++ b/private/mediaprovider_app.te
@@ -40,3 +40,6 @@
 };
 
 allow mediaprovider_app proc_filesystems:file r_file_perms;
+
+#Allow MediaProvider to see if sdcardfs is in use
+get_prop(mediaprovider_app, storage_config_prop)
diff --git a/private/property_contexts b/private/property_contexts
index a117fcc..1a5471f 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -97,6 +97,9 @@
 sys.lmk.                u:object_r:system_lmk_prop:s0
 sys.trace.              u:object_r:system_trace_prop:s0
 
+# Fastbootd protocol control property
+fastbootd.protocol    u:object_r:fastbootd_protocol_prop:s0 exact enum usb tcp
+
 # Boolean property set by system server upon boot indicating
 # if device is fully owned by organization instead of being
 # a personal device.
diff --git a/public/app.te b/public/app.te
index 9c635aa..e5b9fd6 100644
--- a/public/app.te
+++ b/public/app.te
@@ -566,10 +566,6 @@
   -system_app
 } { bluetooth_audio_hal_prop bluetooth_a2dp_offload_prop bluetooth_prop exported_bluetooth_prop }:file create_file_perms;
 
-
-# Don't allow apps access to storage configuration properties.
-neverallow appdomain storage_config_prop:file no_rw_file_perms;
-
 # Apps cannot access proc_uid_time_in_state
 neverallow appdomain proc_uid_time_in_state:file *;
 
diff --git a/public/bootanim.te b/public/bootanim.te
index e8cb98b..bd2bec6 100644
--- a/public/bootanim.te
+++ b/public/bootanim.te
@@ -23,6 +23,7 @@
 
 allow bootanim audioserver_service:service_manager find;
 allow bootanim surfaceflinger_service:service_manager find;
+allow bootanim surfaceflinger:unix_stream_socket { read write };
 
 # Allow access to ion memory allocation device
 allow bootanim ion_device:chr_file rw_file_perms;
diff --git a/public/fastbootd.te b/public/fastbootd.te
index f10e649..8787817 100644
--- a/public/fastbootd.te
+++ b/public/fastbootd.te
@@ -120,6 +120,14 @@
   # Determine allocation scheme (whether B partitions needs to be
   # at the second half of super.
   get_prop(fastbootd, virtual_ab_prop)
+
+  # Needed for TCP protocol
+  allow fastbootd node:tcp_socket node_bind;
+  allow fastbootd port:tcp_socket name_bind;
+  allow fastbootd self:tcp_socket { create_socket_perms_no_ioctl listen accept };
+
+  # Get fastbootd protocol property
+  get_prop(fastbootd, fastbootd_protocol_prop)
 ')
 
 ###
diff --git a/public/property.te b/public/property.te
index 316d3c6..a81b6b4 100644
--- a/public/property.te
+++ b/public/property.te
@@ -14,6 +14,7 @@
 system_internal_prop(device_config_window_manager_native_boot_prop)
 system_internal_prop(device_config_configuration_prop)
 system_internal_prop(firstboot_prop)
+system_internal_prop(fastbootd_protocol_prop)
 system_internal_prop(gsid_prop)
 system_internal_prop(init_perf_lsm_hooks_prop)
 system_internal_prop(init_svc_debug_prop)
diff --git a/public/property_contexts b/public/property_contexts
index dc9657d..003a4f0 100644
--- a/public/property_contexts
+++ b/public/property_contexts
@@ -73,6 +73,7 @@
 drm.service.enabled u:object_r:exported3_default_prop:s0 exact bool
 external_storage.projid.enabled u:object_r:storage_config_prop:s0 exact bool
 external_storage.casefold.enabled u:object_r:storage_config_prop:s0 exact bool
+external_storage.sdcardfs.enabled u:object_r:storage_config_prop:s0 exact bool
 keyguard.no_require_sim u:object_r:exported3_default_prop:s0 exact bool
 media.recorder.show_manufacturer_and_model u:object_r:exported3_default_prop:s0 exact bool
 media.stagefright.cache-params u:object_r:exported3_default_prop:s0 exact string
diff --git a/public/recovery.te b/public/recovery.te
index 16b670f..63a9cea 100644
--- a/public/recovery.te
+++ b/public/recovery.te
@@ -154,6 +154,15 @@
 
   # Allow mounting /metadata for writing update states
   allow recovery metadata_file:dir { getattr mounton };
+
+  # These are needed to allow recovery to manage network
+  allow recovery self:netlink_route_socket { create write read nlmsg_readpriv nlmsg_read };
+  allow recovery self:global_capability_class_set net_admin;
+  allow recovery self:tcp_socket { create ioctl };
+  allowxperm recovery self:tcp_socket ioctl { SIOCGIFFLAGS SIOCSIFFLAGS };
+
+  # Set fastbootd protocol property
+  set_prop(recovery, fastbootd_protocol_prop)
 ')
 
 ###