Merge "Add file contexts for com.android.neuralnetworks APEX package."
diff --git a/private/compat/26.0/26.0.cil b/private/compat/26.0/26.0.cil
index 3b3dae1..2d1a612 100644
--- a/private/compat/26.0/26.0.cil
+++ b/private/compat/26.0/26.0.cil
@@ -432,9 +432,6 @@
 (typeattributeset pdx_performance_dir_26_0 (pdx_performance_dir))
 (typeattributeset performanced_26_0 (performanced))
 (typeattributeset performanced_exec_26_0 (performanced_exec))
-(typeattributeset perfprofd_26_0 (perfprofd))
-(typeattributeset perfprofd_data_file_26_0 (perfprofd_data_file))
-(typeattributeset perfprofd_exec_26_0 (perfprofd_exec))
 (typeattributeset permission_service_26_0 (permission_service))
 (typeattributeset persist_debug_prop_26_0 (persist_debug_prop))
 (typeattributeset persistent_data_block_service_26_0 (persistent_data_block_service))
diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index c005a14..9ab631a 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -132,7 +132,6 @@
     perfetto_exec
     perfetto_tmpfs
     perfetto_traces_data_file
-    perfprofd_service
     property_info
     recovery_socket
     role_service
diff --git a/private/compat/27.0/27.0.cil b/private/compat/27.0/27.0.cil
index e539d3b..ab56f4e 100644
--- a/private/compat/27.0/27.0.cil
+++ b/private/compat/27.0/27.0.cil
@@ -430,9 +430,6 @@
 (expandtypeattribute (pdx_performance_dir_27_0) true)
 (expandtypeattribute (performanced_27_0) true)
 (expandtypeattribute (performanced_exec_27_0) true)
-(expandtypeattribute (perfprofd_27_0) true)
-(expandtypeattribute (perfprofd_data_file_27_0) true)
-(expandtypeattribute (perfprofd_exec_27_0) true)
 (expandtypeattribute (permission_service_27_0) true)
 (expandtypeattribute (persist_debug_prop_27_0) true)
 (expandtypeattribute (persistent_data_block_service_27_0) true)
@@ -1147,9 +1144,6 @@
 (typeattributeset pdx_performance_dir_27_0 (pdx_performance_dir))
 (typeattributeset performanced_27_0 (performanced))
 (typeattributeset performanced_exec_27_0 (performanced_exec))
-(typeattributeset perfprofd_27_0 (perfprofd))
-(typeattributeset perfprofd_data_file_27_0 (perfprofd_data_file))
-(typeattributeset perfprofd_exec_27_0 (perfprofd_exec))
 (typeattributeset permission_service_27_0 (permission_service))
 (typeattributeset persist_debug_prop_27_0 (persist_debug_prop))
 (typeattributeset persistent_data_block_service_27_0 (persistent_data_block_service))
diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil
index 7d2f8dd..a3f30d4 100644
--- a/private/compat/27.0/27.0.ignore.cil
+++ b/private/compat/27.0/27.0.ignore.cil
@@ -119,7 +119,6 @@
     perfetto_exec
     perfetto_tmpfs
     perfetto_traces_data_file
-    perfprofd_service
     property_info
     recovery_socket
     role_service
diff --git a/private/compat/28.0/28.0.cil b/private/compat/28.0/28.0.cil
index fbe8588..1a2bd43 100644
--- a/private/compat/28.0/28.0.cil
+++ b/private/compat/28.0/28.0.cil
@@ -501,10 +501,6 @@
 (expandtypeattribute (pdx_performance_dir_28_0) true)
 (expandtypeattribute (performanced_28_0) true)
 (expandtypeattribute (performanced_exec_28_0) true)
-(expandtypeattribute (perfprofd_28_0) true)
-(expandtypeattribute (perfprofd_data_file_28_0) true)
-(expandtypeattribute (perfprofd_exec_28_0) true)
-(expandtypeattribute (perfprofd_service_28_0) true)
 (expandtypeattribute (permission_service_28_0) true)
 (expandtypeattribute (persist_debug_prop_28_0) true)
 (expandtypeattribute (persistent_data_block_service_28_0) true)
@@ -1346,10 +1342,6 @@
 (typeattributeset pdx_performance_dir_28_0 (pdx_performance_dir))
 (typeattributeset performanced_28_0 (performanced))
 (typeattributeset performanced_exec_28_0 (performanced_exec))
-(typeattributeset perfprofd_28_0 (perfprofd))
-(typeattributeset perfprofd_data_file_28_0 (perfprofd_data_file))
-(typeattributeset perfprofd_exec_28_0 (perfprofd_exec))
-(typeattributeset perfprofd_service_28_0 (perfprofd_service))
 (typeattributeset permission_service_28_0 (permission_service))
 (typeattributeset persist_debug_prop_28_0 (persist_debug_prop))
 (typeattributeset persistent_data_block_service_28_0 (persistent_data_block_service))
diff --git a/private/compat/29.0/29.0.cil b/private/compat/29.0/29.0.cil
index dd52e0e..01e8605 100644
--- a/private/compat/29.0/29.0.cil
+++ b/private/compat/29.0/29.0.cil
@@ -1,5 +1,7 @@
 ;; types removed from current policy
 (type hal_wifi_offload_hwservice)
+(type perfprofd_data_file)
+(type perfprofd_service)
 
 (expandtypeattribute (accessibility_service_29_0) true)
 (expandtypeattribute (account_service_29_0) true)
@@ -553,10 +555,6 @@
 (expandtypeattribute (perfetto_29_0) true)
 (expandtypeattribute (performanced_29_0) true)
 (expandtypeattribute (performanced_exec_29_0) true)
-(expandtypeattribute (perfprofd_29_0) true)
-(expandtypeattribute (perfprofd_data_file_29_0) true)
-(expandtypeattribute (perfprofd_exec_29_0) true)
-(expandtypeattribute (perfprofd_service_29_0) true)
 (expandtypeattribute (permissionmgr_service_29_0) true)
 (expandtypeattribute (permission_service_29_0) true)
 (expandtypeattribute (persist_debug_prop_29_0) true)
@@ -1531,10 +1529,6 @@
 (typeattributeset perfetto_29_0 (perfetto))
 (typeattributeset performanced_29_0 (performanced))
 (typeattributeset performanced_exec_29_0 (performanced_exec))
-(typeattributeset perfprofd_29_0 (perfprofd))
-(typeattributeset perfprofd_data_file_29_0 (perfprofd_data_file))
-(typeattributeset perfprofd_exec_29_0 (perfprofd_exec))
-(typeattributeset perfprofd_service_29_0 (perfprofd_service))
 (typeattributeset permissionmgr_service_29_0 (permissionmgr_service))
 (typeattributeset permission_service_29_0 (permission_service))
 (typeattributeset persist_debug_prop_29_0 (persist_debug_prop))
diff --git a/private/compat/29.0/29.0.ignore.cil b/private/compat/29.0/29.0.ignore.cil
index 30437ee..c3f4b29 100644
--- a/private/compat/29.0/29.0.ignore.cil
+++ b/private/compat/29.0/29.0.ignore.cil
@@ -6,10 +6,14 @@
 (typeattributeset new_objects
   ( new_objects
     cold_boot_done_prop
+    platform_compat_service
     ctl_apexd_prop
     device_config_sys_traced_prop
+    ota_metadata_file
     runtime_apex_dir
     system_ashmem_hwservice
+    system_group_file
+    system_passwd_file
     vendor_apex_file
     wifi_stack
     wifi_stack_service
diff --git a/private/coredomain.te b/private/coredomain.te
index 169f6b2..7ad5856 100644
--- a/private/coredomain.te
+++ b/private/coredomain.te
@@ -25,7 +25,6 @@
         -idmap
         -init
         -installd
-        userdebug_or_eng(`-perfprofd')
         userdebug_or_eng(`-heapprofd')
         -postinstall_dexopt
         -rs # spawned by appdomain, so carryover the exception above
@@ -41,7 +40,6 @@
         -idmap
         -init
         -installd
-        userdebug_or_eng(`-perfprofd')
         userdebug_or_eng(`-heapprofd')
         -postinstall_dexopt
         -rs # spawned by appdomain, so carryover the exception above
@@ -126,7 +124,6 @@
     -atrace
     -dumpstate
     -init
-    userdebug_or_eng(`-perfprofd')
     -traced_probes
     -shell
     -traceur_app
@@ -196,12 +193,10 @@
   coredomain
   -init
   -iorapd
-  -perfprofd
 } ashmem_device_service:service_manager find;
 
 binder_call({
   coredomain
   -init
   -iorapd
-  -perfprofd
 }, ashmemd)
diff --git a/private/domain.te b/private/domain.te
index 670e353..8f7a1e0 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -95,7 +95,6 @@
   userdebug_or_eng(`-incidentd')
   -storaged
   -system_server
-  userdebug_or_eng(`-perfprofd')
 } self:global_capability_class_set sys_ptrace;
 
 # Limit ability to generate hardware unique device ID attestations to priv_apps
@@ -130,7 +129,6 @@
   -app_zygote
   -dexoptanalyzer
   -installd
-  userdebug_or_eng(`-perfprofd')
   -profman
   -rs # spawned by appdomain, so carryover the exception above
   -runas
@@ -152,7 +150,6 @@
   -appdomain
   -app_zygote
   -installd
-  userdebug_or_eng(`-perfprofd')
   -rs # spawned by appdomain, so carryover the exception above
 } { privapp_data_file app_data_file }:file_class_set open;
 
@@ -261,7 +258,6 @@
   userdebug_or_eng(`llkd')
   lmkd
   netd
-  perfprofd
   postinstall_dexopt
   recovery
   rss_hwm_reset
diff --git a/private/dumpstate.te b/private/dumpstate.te
index 4f6d96a..1b0832e 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -44,7 +44,6 @@
 allow dumpstate debugfs_wakeup_sources:file r_file_perms;
 allow dumpstate dev_type:blk_file getattr;
 allow dumpstate webview_zygote:process signal;
-dontaudit dumpstate perfprofd:binder call;
 dontaudit dumpstate update_engine:binder call;
 allow dumpstate proc_net_tcp_udp:file r_file_perms;
 
diff --git a/private/file_contexts b/private/file_contexts
index 60b569d..79c3043 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -257,7 +257,6 @@
 /system/bin/pppd	u:object_r:ppp_exec:s0
 /system/bin/racoon	u:object_r:racoon_exec:s0
 /system/xbin/su		u:object_r:su_exec:s0
-/system/bin/perfprofd  u:object_r:perfprofd_exec:s0
 /system/bin/dnsmasq     u:object_r:dnsmasq_exec:s0
 /system/bin/healthd     u:object_r:healthd_exec:s0
 /system/bin/clatd	u:object_r:clatd_exec:s0
@@ -304,7 +303,9 @@
 /system/bin/hw/android\.system\.suspend@1\.0-service          u:object_r:system_suspend_exec:s0
 /system/etc/cgroups\.json               u:object_r:cgroup_desc_file:s0
 /system/etc/event-log-tags              u:object_r:system_event_log_tags_file:s0
+/system/etc/group                       u:object_r:system_group_file:s0
 /system/etc/ld\.config.*                u:object_r:system_linker_config_file:s0
+/system/etc/passwd                      u:object_r:system_passwd_file:s0
 /system/etc/seccomp_policy(/.*)?        u:object_r:system_seccomp_policy_file:s0
 /system/etc/security/cacerts(/.*)?      u:object_r:system_security_cacerts_file:s0
 /system/etc/selinux/mapping/[0-9]+\.[0-9]+\.cil       u:object_r:sepolicy_file:s0
@@ -398,6 +399,8 @@
 # Product files
 #
 /(product|system/product)(/.*)?                                 u:object_r:system_file:s0
+/(product|system/product)/etc/group                             u:object_r:system_group_file:s0
+/(product|system/product)/etc/passwd                            u:object_r:system_passwd_file:s0
 /(product|system/product)/overlay(/.*)?                         u:object_r:vendor_overlay_file:s0
 
 /(product|system/product)/etc/selinux/product_file_contexts      u:object_r:file_contexts_file:s0
@@ -411,6 +414,8 @@
 # SystemExt files
 #
 /(system_ext|system/system_ext)(/.*)?               u:object_r:system_file:s0
+/(system_ext|system/system_ext)/etc/group           u:object_r:system_group_file:s0
+/(system_ext|system/system_ext)/etc/passwd          u:object_r:system_passwd_file:s0
 /(system_ext|system/system_ext)/overlay(/.*)?       u:object_r:vendor_overlay_file:s0
 
 #############################
@@ -513,7 +518,6 @@
 /data/misc/zoneinfo(/.*)?       u:object_r:zoneinfo_data_file:s0
 /data/misc/vold(/.*)?           u:object_r:vold_data_file:s0
 /data/misc/iorapd(/.*)?         u:object_r:iorapd_data_file:s0
-/data/misc/perfprofd(/.*)?      u:object_r:perfprofd_data_file:s0
 /data/misc/update_engine(/.*)?  u:object_r:update_engine_data_file:s0
 /data/misc/update_engine_log(/.*)?  u:object_r:update_engine_log_data_file:s0
 /data/system/dropbox(/.*)?      u:object_r:dropbox_data_file:s0
@@ -632,6 +636,7 @@
 /metadata/vold(/.*)?      u:object_r:vold_metadata_file:s0
 /metadata/gsi(/.*)?       u:object_r:gsi_metadata_file:s0
 /metadata/password_slots(/.*)?    u:object_r:password_slot_metadata_file:s0
+/metadata/ota(/.*)?       u:object_r:ota_metadata_file:s0
 
 #############################
 # asec containers
diff --git a/private/file_contexts_asan b/private/file_contexts_asan
index bd841a3..b37f086 100644
--- a/private/file_contexts_asan
+++ b/private/file_contexts_asan
@@ -4,6 +4,8 @@
 /data/asan/vendor/lib64(/.*)?              u:object_r:system_lib_file:s0
 /data/asan/odm/lib(/.*)?                   u:object_r:system_lib_file:s0
 /data/asan/odm/lib64(/.*)?                 u:object_r:system_lib_file:s0
+/data/asan/product/lib(/.*)?               u:object_r:system_lib_file:s0
+/data/asan/product/lib64(/.*)?             u:object_r:system_lib_file:s0
 /system/asan.options           u:object_r:system_asan_options_file:s0
 /system/bin/asan_extract       u:object_r:asan_extract_exec:s0
 /system/bin/asanwrapper        u:object_r:asanwrapper_exec:s0
diff --git a/private/gsid.te b/private/gsid.te
index 73b93fc..305b1c2 100644
--- a/private/gsid.te
+++ b/private/gsid.te
@@ -17,6 +17,20 @@
 allow gsid self:global_capability_class_set sys_admin;
 dontaudit gsid self:global_capability_class_set dac_override;
 
+# On FBE devices (not using dm-default-key), gsid will use loop devices to map
+# images rather than device-mapper.
+allow gsid loop_control_device:chr_file rw_file_perms;
+allow gsid loop_device:blk_file rw_file_perms;
+allowxperm gsid loop_device:blk_file ioctl {
+  LOOP_GET_STATUS64
+  LOOP_SET_STATUS64
+  LOOP_SET_FD
+  LOOP_SET_BLOCK_SIZE
+  LOOP_SET_DIRECT_IO
+  LOOP_CLR_FD
+  BLKFLSBUF
+};
+
 # libfiemap_writer uses sysfs to derive the bottom of a device-mapper stacking.
 # This requires traversing /sys/block/dm-N/slaves/* and reading the list of
 # file names.
@@ -83,7 +97,7 @@
 #   booted         - An empty file that, if exists, indicates that a GSI is
 #                    currently running.
 #
-allow gsid metadata_file:dir search;
+allow gsid metadata_file:dir { search getattr };
 allow gsid gsi_metadata_file:dir rw_dir_perms;
 allow gsid gsi_metadata_file:file create_file_perms;
 
diff --git a/private/linkerconfig.te b/private/linkerconfig.te
index 8acd734..01a9fbf 100644
--- a/private/linkerconfig.te
+++ b/private/linkerconfig.te
@@ -7,4 +7,7 @@
 allow linkerconfig linkerconfig_file:dir rw_dir_perms;
 allow linkerconfig linkerconfig_file:file create_file_perms;
 
+# Allow linkerconfig to log to the kernel.
+allow linkerconfig kmsg_device:chr_file w_file_perms;
+
 neverallow { domain -init -linkerconfig } linkerconfig_exec:file no_x_file_perms;
diff --git a/private/perfprofd.te b/private/perfprofd.te
deleted file mode 100644
index 94a7c1d..0000000
--- a/private/perfprofd.te
+++ /dev/null
@@ -1,29 +0,0 @@
-typeattribute perfprofd coredomain;
-
-userdebug_or_eng(`
-  init_daemon_domain(perfprofd)
-')
-
-neverallow {
-  domain
-  userdebug_or_eng(`
-    -statsd
-    -system_server
-    -system_suspend_server
-    -hal_health_server
-    -hwservicemanager
-  ')
-} perfprofd:binder call;
-
-neverallow perfprofd {
-  domain
-  userdebug_or_eng(`
-    -servicemanager
-    -statsd
-    -su
-    -system_server
-    -system_suspend_server
-    -hal_health_server
-    -hwservicemanager
-  ')
-}:binder call;
diff --git a/private/priv_app.te b/private/priv_app.te
index 35ad8c2..5768f00 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -83,14 +83,6 @@
 # b/18504118: Allow reads from /data/anr/traces.txt
 allow priv_app anr_data_file:file r_file_perms;
 
-# Allow GMS core to access perfprofd output, which is stored
-# in /data/misc/perfprofd/. GMS core will need to list all
-# data stored in that directory to process them one by one.
-userdebug_or_eng(`
-  allow priv_app perfprofd_data_file:file r_file_perms;
-  allow priv_app perfprofd_data_file:dir r_dir_perms;
-')
-
 # For AppFuse.
 allow priv_app vold:fd use;
 allow priv_app fuse_device:chr_file { read write };
diff --git a/private/property_contexts b/private/property_contexts
index 520383d..14fe3de 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -107,7 +107,6 @@
 
 # ctl properties
 ctl.bootanim            u:object_r:ctl_bootanim_prop:s0
-ctl.android.hardware.dumpstate u:object_r:ctl_dumpstate_prop:s0
 ctl.dumpstate           u:object_r:ctl_dumpstate_prop:s0
 ctl.fuse_               u:object_r:ctl_fuse_prop:s0
 ctl.mdnsd               u:object_r:ctl_mdnsd_prop:s0
@@ -139,6 +138,9 @@
 # Restrict access to stopping apexd.
 ctl.stop$apexd          u:object_r:ctl_apexd_prop:s0
 
+# Restrict access to restart dumpstate
+ctl.interface_restart$android.hardware.dumpstate u:object_r:ctl_dumpstate_prop:s0
+
 # NFC properties
 nfc.                    u:object_r:nfc_prop:s0
 
diff --git a/private/service_contexts b/private/service_contexts
index 49bdb29..8dc3fc2 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -32,6 +32,7 @@
 clipboard                                 u:object_r:clipboard_service:s0
 com.android.net.IProxyService             u:object_r:IProxyService_service:s0
 companiondevice                           u:object_r:companion_device_service:s0
+platform_compat                           u:object_r:platform_compat_service:s0
 connectivity                              u:object_r:connectivity_service:s0
 connmetrics                               u:object_r:connmetrics_service:s0
 consumer_ir                               u:object_r:consumer_ir_service:s0
@@ -139,7 +140,6 @@
 overlay                                   u:object_r:overlay_service:s0
 package                                   u:object_r:package_service:s0
 package_native                            u:object_r:package_native_service:s0
-perfprofd                                 u:object_r:perfprofd_service:s0
 permission                                u:object_r:permission_service:s0
 permissionmgr                             u:object_r:permissionmgr_service:s0
 persistent_data_block                     u:object_r:persistent_data_block_service:s0
diff --git a/private/system_server.te b/private/system_server.te
index df87794..1f8945b 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -202,9 +202,6 @@
 binder_call(system_server, vold)
 binder_call(system_server, wificond)
 binder_call(system_server, wpantund)
-userdebug_or_eng(`
-  binder_call(system_server, perfprofd)
-')
 binder_service(system_server)
 
 # Use HALs
@@ -432,12 +429,6 @@
 allow system_server perfetto_traces_data_file:file read;
 allow system_server perfetto:fd use;
 
-# Allow dropbox to read /data/misc/perfprofd. Only the fd is sent over binder.
-userdebug_or_eng(`
-  allow system_server perfprofd_data_file:file { getattr read };
-  allow system_server perfprofd:fd use;
-')
-
 # Manage /data/backup.
 allow system_server backup_data_file:dir create_dir_perms;
 allow system_server backup_data_file:file create_file_perms;
@@ -736,9 +727,6 @@
 allow system_server update_engine_service:service_manager find;
 allow system_server vold_service:service_manager find;
 allow system_server wificond_service:service_manager find;
-userdebug_or_eng(`
-  allow system_server perfprofd_service:service_manager find;
-')
 
 add_service(system_server, batteryproperties_service)
 
diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index 3c20c08..de047da 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -104,14 +104,6 @@
 # Allow untrusted apps to interact with gpuservice
 binder_call(untrusted_app_all, gpuservice)
 
-# Allow GMS core to access perfprofd output, which is stored
-# in /data/misc/perfprofd/. GMS core will need to list all
-# data stored in that directory to process them one by one.
-userdebug_or_eng(`
-  allow untrusted_app_all perfprofd_data_file:file r_file_perms;
-  allow untrusted_app_all perfprofd_data_file:dir r_dir_perms;
-')
-
 # gdbserver for ndk-gdb ptrace attaches to app process.
 allow untrusted_app_all self:process ptrace;
 
diff --git a/public/domain.te b/public/domain.te
index b620ec1..e12c224 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -141,10 +141,12 @@
 allow domain system_file:lnk_file { getattr read };
 
 # Global access to /system/etc/security/cacerts/*, /system/etc/seccomp_policy/*, /system/lib[64]/*,
-# linker and its config.
+# /(system|product|system_ext)/etc/(group|passwd), linker and its config.
 allow domain system_seccomp_policy_file:file r_file_perms;
 # cacerts are accessible from public Java API.
 allow domain system_security_cacerts_file:file r_file_perms;
+allow domain system_group_file:file r_file_perms;
+allow domain system_passwd_file:file r_file_perms;
 allow domain system_linker_exec:file { execute read open getattr map };
 allow domain system_linker_config_file:file r_file_perms;
 allow domain system_lib_file:file { execute read open getattr map };
@@ -998,7 +1000,6 @@
     -crash_dump
     -init # starts vendor executables
     -kernel # loads /vendor/firmware
-    userdebug_or_eng(`-perfprofd')
     userdebug_or_eng(`-heapprofd')
     -shell
     -system_executes_vendor_violators
@@ -1038,10 +1039,12 @@
     -netutils_wrapper_exec
     -property_contexts_file
     -system_event_log_tags_file
+    -system_group_file
     -system_lib_file
     with_asan(`-system_asan_options_file')
     -system_linker_exec
     -system_linker_config_file
+    -system_passwd_file
     -system_seccomp_policy_file
     -system_security_cacerts_file
     -system_zoneinfo_file
@@ -1323,7 +1326,6 @@
     -crash_dump
     -init
     -kernel
-    -perfprofd
     -heapprofd
     -ueventd
   } vendor_file:file { no_w_file_perms no_x_file_perms open };
diff --git a/public/file.te b/public/file.te
index c78ddd5..1fd00a4 100644
--- a/public/file.te
+++ b/public/file.te
@@ -152,10 +152,14 @@
 type system_lib_file, system_file_type, file_type;
 # system libraries that are available only to bootstrap processes
 type system_bootstrap_lib_file, system_file_type, file_type;
+# Default type for the group file /system/etc/group.
+type system_group_file, system_file_type, file_type;
 # Default type for linker executable /system/bin/linker[64].
 type system_linker_exec, system_file_type, file_type;
 # Default type for linker config /system/etc/ld.config.*.
 type system_linker_config_file, system_file_type, file_type;
+# Default type for the passwd file /system/etc/passwd.
+type system_passwd_file, system_file_type, file_type;
 # Default type for linker config /system/etc/seccomp_policy/*.
 type system_seccomp_policy_file, system_file_type, file_type;
 # Default type for cacerts in /system/etc/security/cacerts/*.
@@ -212,6 +216,8 @@
 type password_slot_metadata_file, file_type;
 # APEX files within /metadata
 type apex_metadata_file, file_type;
+# libsnapshot files within /metadata
+type ota_metadata_file, file_type;
 
 # Type for /dev/cpu_variant:.*.
 type dev_cpu_variant, file_type;
@@ -351,7 +357,6 @@
 type zoneinfo_data_file, file_type, data_file_type, core_data_file_type;
 type vold_data_file, file_type, data_file_type, core_data_file_type;
 type iorapd_data_file, file_type, data_file_type, core_data_file_type;
-type perfprofd_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
 type tee_data_file, file_type, data_file_type;
 type update_engine_data_file, file_type, data_file_type, core_data_file_type;
 type update_engine_log_data_file, file_type, data_file_type, core_data_file_type;
diff --git a/public/perfprofd.te b/public/perfprofd.te
deleted file mode 100644
index 47dfbf2..0000000
--- a/public/perfprofd.te
+++ /dev/null
@@ -1,121 +0,0 @@
-# perfprofd - perf profile collection daemon
-type perfprofd, domain;
-type perfprofd_exec, system_file_type, exec_type, file_type;
-
-userdebug_or_eng(`
-
-  typeattribute perfprofd coredomain;
-  typeattribute perfprofd mlstrustedsubject;
-
-  # perfprofd access to sysfs directory structure.
-  allow perfprofd sysfs_type:dir search;
-
-  # perfprofd needs to control CPU hot-plug in order to avoid kernel
-  # perfevents problems in cases where CPU goes on/off during measurement;
-  # this means read access to /sys/devices/system/cpu/possible
-  # and read/write access to /sys/devices/system/cpu/cpu*/online
-  allow perfprofd sysfs_devices_system_cpu:file rw_file_perms;
-
-  # perfprofd checks for the existence of and then invokes simpleperf;
-  # simpleperf retains perfprofd domain after exec
-  allow perfprofd system_file:file rx_file_perms;
-
-  # perfprofd reads a config file from /data/data/com.google.android.gms/files
-  allow perfprofd { privapp_data_file app_data_file }:file r_file_perms;
-  allow perfprofd { privapp_data_file app_data_file }:dir search;
-  allow perfprofd self:global_capability_class_set { dac_override dac_read_search };
-
-  # perfprofd opens a file for writing in /data/misc/perfprofd
-  allow perfprofd perfprofd_data_file:file create_file_perms;
-  allow perfprofd perfprofd_data_file:dir rw_dir_perms;
-
-  # perfprofd uses the system log
-  read_logd(perfprofd);
-  write_logd(perfprofd);
-
-  # perfprofd inspects /sys/power/wake_unlock
-  wakelock_use(perfprofd);
-
-  # perfprofd looks at thermals.
-  allow perfprofd sysfs_thermal:dir r_dir_perms;
-
-  # perfprofd gets charging status.
-  hal_client_domain(perfprofd, hal_health)
-
-  # simpleperf reads kernel notes.
-  allow perfprofd sysfs_kernel_notes:file r_file_perms;
-
-  # Simpleperf & perfprofd query a range of proc stats.
-  allow perfprofd proc_loadavg:file r_file_perms;
-  allow perfprofd proc_stat:file r_file_perms;
-  allow perfprofd proc_modules:file r_file_perms;
-
-  # simpleperf writes to perf_event_paranoid under /proc.
-  allow perfprofd proc_perf:file write;
-
-  # Simpleperf: kptr_restrict. This would be required to dump kernel symbols.
-  dontaudit perfprofd proc_security:file *;
-
-  # simpleperf uses ioctl() to turn on kernel perf events measurements
-  allow perfprofd self:global_capability_class_set sys_admin;
-
-  # simpleperf needs to examine /proc to collect task/thread info
-  r_dir_file(perfprofd, domain)
-
-  # simpleperf needs to access /proc/<pid>/exec
-  allow perfprofd self:global_capability_class_set { sys_resource sys_ptrace };
-  neverallow perfprofd domain:process ptrace;
-
-  # simpleperf needs open/read any file that turns up in a profile
-  # to see whether it has a build ID
-  allow perfprofd exec_type:file r_file_perms;
-  # App & ART artifacts.
-  r_dir_file(perfprofd, apk_data_file)
-  r_dir_file(perfprofd, dalvikcache_data_file)
-  # Vendor libraries.
-  r_dir_file(perfprofd, vendor_file)
-  # Vendor apps.
-  r_dir_file(perfprofd, vendor_app_file)
-  # SP HAL files.
-  r_dir_file(perfprofd, same_process_hal_file)
-
-  # simpleperf will set security.perf_harden to enable access to perf_event_open()
-  set_prop(perfprofd, shell_prop)
-
-  # simpleperf examines debugfs on startup to collect tracepoint event types
-  r_dir_file(perfprofd, debugfs_tracing)
-  r_dir_file(perfprofd, debugfs_tracing_debug)
-
-  # simpleperf is going to execute "sleep"
-  allow perfprofd toolbox_exec:file rx_file_perms;
-  # simpleperf is going to execute "mv" on a temp file
-  allow perfprofd shell_exec:file rx_file_perms;
-
-  # needed for simpleperf on some kernels
-  allow perfprofd self:global_capability_class_set ipc_lock;
-
-  # simpleperf attempts to put a temp file into /data/local/tmp. Do not allow,
-  # use the fallback cwd code, do not spam the log. But ensure this is correctly
-  # removed at some point. b/70232908.
-  dontaudit perfprofd shell_data_file:dir *;
-  dontaudit perfprofd shell_data_file:file *;
-
-  # Allow perfprofd to publish a binder service and make binder calls.
-  binder_use(perfprofd)
-  add_service(perfprofd, perfprofd_service)
-
-  # Use devpts for streams from cmd.
-  #
-  # This is normally granted to binderservicedomain, but this service
-  # has tighter restrictions on the callers (see below), so must enable
-  # this manually.
-  allow perfprofd devpts:chr_file rw_file_perms;
-
-  # Use socket & pipe supplied by su, for cmd perfprofd dump.
-  allow perfprofd su:unix_stream_socket { read write getattr sendto };
-  allow perfprofd su:fifo_file r_file_perms;
-
-  # Allow perfprofd to submit to dropbox.
-  allow perfprofd dropbox_service:service_manager find;
-  binder_call(perfprofd, system_server)
-')
diff --git a/public/service.te b/public/service.te
index 0a50eb7..c195b69 100644
--- a/public/service.te
+++ b/public/service.te
@@ -25,7 +25,6 @@
 type mediadrmserver_service,    service_manager_type;
 type netd_service,              service_manager_type;
 type nfc_service,               service_manager_type;
-type perfprofd_service,         service_manager_type;
 type radio_service,             service_manager_type;
 type secure_element_service,    service_manager_type;
 type storaged_service,          service_manager_type;
@@ -96,6 +95,7 @@
 type ethernet_service, app_api_service, system_server_service, service_manager_type;
 type biometric_service, app_api_service, system_server_service, service_manager_type;
 type bugreport_service, system_api_service, system_server_service, service_manager_type;
+type platform_compat_service, system_server_service, service_manager_type;
 type face_service, app_api_service, system_server_service, service_manager_type;
 type fingerprint_service, app_api_service, system_server_service, service_manager_type;
 type gfxinfo_service, system_api_service, system_server_service, service_manager_type;
diff --git a/public/statsd.te b/public/statsd.te
index 089cae9..435bbdf 100644
--- a/public/statsd.te
+++ b/public/statsd.te
@@ -27,9 +27,6 @@
 binder_call(statsd, appdomain)
 binder_call(statsd, healthd)
 binder_call(statsd, incidentd)
-userdebug_or_eng(`
-  binder_call(statsd, perfprofd)
-')
 binder_call(statsd, system_server)
 
 # Allow statsd to interact with gpuservice
@@ -44,9 +41,6 @@
 allow statsd {
   app_api_service
   incident_service
-  userdebug_or_eng(`
-    perfprofd_service
-  ')
   system_api_service
 }:service_manager find;
 
diff --git a/public/vendor_init.te b/public/vendor_init.te
index c439ffd..3312ff8 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -51,6 +51,7 @@
   -system_file_type
   -mnt_product_file
   -password_slot_metadata_file
+  -ota_metadata_file
   -unlabeled
   -vendor_file_type
   -vold_metadata_file
@@ -65,6 +66,7 @@
   -core_data_file_type
   -exec_type
   -password_slot_metadata_file
+  -ota_metadata_file
   -runtime_event_log_tags_file
   -system_file_type
   -unlabeled
@@ -79,6 +81,7 @@
   -core_data_file_type
   -exec_type
   -password_slot_metadata_file
+  -ota_metadata_file
   -system_file_type
   -unlabeled
   -vendor_file_type
@@ -93,6 +96,7 @@
   -core_data_file_type
   -exec_type
   -password_slot_metadata_file
+  -ota_metadata_file
   -system_file_type
   -unlabeled
   -vendor_file_type
@@ -107,6 +111,7 @@
   -exec_type
   -mnt_product_file
   -password_slot_metadata_file
+  -ota_metadata_file
   -system_file_type
   -vendor_file_type
   -vold_metadata_file