diff --git a/apex/Android.bp b/apex/Android.bp
index 166c2d3..256eb3e 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -256,3 +256,24 @@
     "com.android.car.framework-file_contexts",
   ],
 }
+
+filegroup {
+  name: "com.android.supplementalprocess-file_contexts",
+  srcs: [
+    "com.android.supplementalprocess-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.auxiliary-file_contexts",
+  srcs: [
+    "com.android.auxiliary-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.ondevicepersonalization-file_contexts",
+  srcs: [
+    "com.android.ondevicepersonalization-file_contexts",
+  ],
+}
diff --git a/apex/com.android.auxiliary-file_contexts b/apex/com.android.auxiliary-file_contexts
new file mode 100644
index 0000000..9398505
--- /dev/null
+++ b/apex/com.android.auxiliary-file_contexts
@@ -0,0 +1 @@
+(/.*)?           u:object_r:system_file:s0
diff --git a/apex/com.android.ondevicepersonalization-file_contexts b/apex/com.android.ondevicepersonalization-file_contexts
new file mode 100644
index 0000000..9398505
--- /dev/null
+++ b/apex/com.android.ondevicepersonalization-file_contexts
@@ -0,0 +1 @@
+(/.*)?           u:object_r:system_file:s0
diff --git a/apex/com.android.supplementalprocess-file_contexts b/apex/com.android.supplementalprocess-file_contexts
new file mode 100644
index 0000000..9398505
--- /dev/null
+++ b/apex/com.android.supplementalprocess-file_contexts
@@ -0,0 +1 @@
+(/.*)?           u:object_r:system_file:s0
diff --git a/mac_permissions.mk b/mac_permissions.mk
index 7c478b4..2d3b9ae 100644
--- a/mac_permissions.mk
+++ b/mac_permissions.mk
@@ -22,7 +22,7 @@
 	$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_KEYS) > $@
 
 # Should be synced with keys.conf.
-all_plat_keys := platform media networkstack shared testkey
+all_plat_keys := platform supplemental_process media networkstack shared testkey
 all_plat_keys := $(all_plat_keys:%=$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))/%.x509.pem)
 
 $(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_plat_mac_perms_files)
diff --git a/private/app.te b/private/app.te
index 856f483..3049491 100644
--- a/private/app.te
+++ b/private/app.te
@@ -1,3 +1,34 @@
+# /proc/net access.
+# TODO(b/9496886) Audit access for removal.
+# proc_net access for the negated domains below is granted (or not) in their
+# individual .te files.
+r_dir_file({
+  appdomain
+  -ephemeral_app
+  -isolated_app
+  -platform_app
+  -priv_app
+  -shell
+  -supplemental_process
+  -system_app
+  -untrusted_app_all
+}, proc_net_type)
+# audit access for all these non-core app domains.
+userdebug_or_eng(`
+  auditallow {
+    appdomain
+    -ephemeral_app
+    -isolated_app
+    -platform_app
+    -priv_app
+    -shell
+    -su
+    -supplemental_process
+    -system_app
+    -untrusted_app_all
+  } proc_net_type:{ dir file lnk_file } { getattr open read };
+')
+
 # Allow apps to read the Test Harness Mode property. This property is used in
 # the implementation of ActivityManager.isDeviceInTestHarnessMode()
 get_prop(appdomain, test_harness_prop)
@@ -41,7 +72,7 @@
 dontaudit appdomain vendor_default_prop:file read;
 
 # Access to /mnt/media_rw/<vol> (limited by DAC to apps with external_storage gid)
-allow appdomain mnt_media_rw_file:dir search;
+allow { appdomain -supplemental_process } mnt_media_rw_file:dir search;
 
 neverallow appdomain system_server:udp_socket {
         accept append bind create ioctl listen lock name_bind
@@ -87,6 +118,70 @@
 allow appdomain tombstone_data_file:file { getattr read };
 neverallow appdomain tombstone_data_file:file ~{ getattr read };
 
+# Execute the shell or other system executables.
+allow { appdomain -ephemeral_app -supplemental_process } shell_exec:file rx_file_perms;
+allow { appdomain -ephemeral_app -supplemental_process } toolbox_exec:file rx_file_perms;
+not_full_treble(`allow { appdomain -ephemeral_app -supplemental_process } vendor_file:file x_file_perms;')
+
+# Allow apps access to /vendor/app except for privileged
+# apps which cannot be in /vendor.
+r_dir_file({ appdomain -ephemeral_app -supplemental_process }, vendor_app_file)
+allow { appdomain -ephemeral_app -supplemental_process } vendor_app_file:file execute;
+
+# Perform binder IPC to supplemental process.
+binder_call(appdomain, supplemental_process)
+
+# Allow access to external storage; we have several visible mount points under /storage
+# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary
+allow { appdomain -isolated_app -ephemeral_app -supplemental_process } storage_file:dir r_dir_perms;
+allow { appdomain -isolated_app -ephemeral_app -supplemental_process } storage_file:lnk_file r_file_perms;
+allow { appdomain -isolated_app -ephemeral_app -supplemental_process } mnt_user_file:dir r_dir_perms;
+allow { appdomain -isolated_app -ephemeral_app -supplemental_process } mnt_user_file:lnk_file r_file_perms;
+
+# Read/write visible storage
+allow { appdomain -isolated_app -ephemeral_app -supplemental_process } { sdcard_type fuse }:dir create_dir_perms;
+allow { appdomain -isolated_app -ephemeral_app -supplemental_process } { sdcard_type fuse }:file create_file_perms;
+# This should be removed if sdcardfs is modified to alter the secontext for its
+# accesses to the underlying FS.
+allow { appdomain -isolated_app -ephemeral_app -supplemental_process } media_rw_data_file:dir create_dir_perms;
+allow { appdomain -isolated_app -ephemeral_app -supplemental_process } media_rw_data_file:file create_file_perms;
+
+# Allow apps to use the USB Accessory interface.
+# http://developer.android.com/guide/topics/connectivity/usb/accessory.html
+#
+# USB devices are first opened by the system server (USBDeviceManagerService)
+# and the file descriptor is passed to the right Activity via binder.
+allow { appdomain -isolated_app -ephemeral_app -supplemental_process } usb_device:chr_file { read write getattr ioctl };
+allow { appdomain -isolated_app -ephemeral_app -supplemental_process } usbaccessory_device:chr_file { read write getattr };
+
+#logd access
+control_logd({ appdomain -ephemeral_app -supplemental_process })
+
+# application inherit logd write socket (urge is to deprecate this long term)
+allow { appdomain -isolated_app -ephemeral_app -supplemental_process } keystore:keystore_key { get_state get insert delete exist list sign verify };
+allow { appdomain -isolated_app -ephemeral_app -supplemental_process } keystore:keystore2_key { delete use get_info rebind update };
+
+allow { appdomain -isolated_app -ephemeral_app -supplemental_process } keystore_maintenance_service:service_manager find;
+allow { appdomain -isolated_app -ephemeral_app -supplemental_process } keystore:keystore2 get_state;
+
+use_keystore({ appdomain -isolated_app -ephemeral_app -supplemental_process })
+
+use_credstore({ appdomain -isolated_app -ephemeral_app -supplemental_process })
+
+# For app fuse.
+pdx_client({ appdomain -isolated_app -ephemeral_app -supplemental_process }, display_client)
+pdx_client({ appdomain -isolated_app -ephemeral_app -supplemental_process }, display_manager)
+pdx_client({ appdomain -isolated_app -ephemeral_app -supplemental_process }, display_vsync)
+pdx_client({ appdomain -isolated_app -ephemeral_app -supplemental_process }, performance_client)
+# Apps do not directly open the IPC socket for bufferhubd.
+pdx_use({ appdomain -isolated_app -ephemeral_app -supplemental_process }, bufferhub_client)
+
+# Apps receive an open tun fd from the framework for
+# device traffic. Do not allow untrusted app to directly open tun_device
+allow { appdomain -isolated_app -ephemeral_app -supplemental_process } tun_device:chr_file { read write getattr append ioctl };
+allowxperm { appdomain -isolated_app -ephemeral_app -supplemental_process } tun_device:chr_file ioctl TUNGETIFF;
+
+
 # WebView and other application-specific JIT compilers
 allow appdomain self:process execmem;
 
@@ -110,11 +205,11 @@
 allow appdomain dalvikcache_data_file:file r_file_perms;
 
 # Read the /sdcard and /mnt/sdcard symlinks
-allow { appdomain -isolated_app } rootfs:lnk_file r_file_perms;
-allow { appdomain -isolated_app } tmpfs:lnk_file r_file_perms;
+allow { appdomain -isolated_app -supplemental_process } rootfs:lnk_file r_file_perms;
+allow { appdomain -isolated_app -supplemental_process } tmpfs:lnk_file r_file_perms;
 
 # Search /storage/emulated tmpfs mount.
-allow appdomain tmpfs:dir r_dir_perms;
+allow { appdomain -supplemental_process } tmpfs:dir r_dir_perms;
 
 # Notify zygote of the wrapped process PID when using --invoke-with.
 allow appdomain zygote:fifo_file write;
@@ -148,11 +243,11 @@
 allow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown };
 
 # App sandbox file accesses.
-allow { appdomain -isolated_app -mlstrustedsubject } { app_data_file privapp_data_file }:dir create_dir_perms;
-allow { appdomain -isolated_app -mlstrustedsubject } { app_data_file privapp_data_file }:file create_file_perms;
+allow { appdomain -isolated_app -mlstrustedsubject -supplemental_process } { app_data_file privapp_data_file }:dir create_dir_perms;
+allow { appdomain -isolated_app -mlstrustedsubject -supplemental_process } { app_data_file privapp_data_file }:file create_file_perms;
 
 # Access via already open fds is ok even for mlstrustedsubject.
-allow { appdomain -isolated_app } { app_data_file privapp_data_file system_app_data_file }:file { getattr map read write };
+allow { appdomain -isolated_app -supplemental_process } { app_data_file privapp_data_file system_app_data_file }:file { getattr map read write };
 
 # Traverse into expanded storage
 allow appdomain mnt_expand_file:dir r_dir_perms;
@@ -169,11 +264,7 @@
 allow appdomain oemfs:dir r_dir_perms;
 allow appdomain oemfs:file rx_file_perms;
 
-# Execute the shell or other system executables.
-allow { appdomain -ephemeral_app } shell_exec:file rx_file_perms;
-allow { appdomain -ephemeral_app } toolbox_exec:file rx_file_perms;
 allow appdomain system_file:file x_file_perms;
-not_full_treble(`allow { appdomain -ephemeral_app } vendor_file:file x_file_perms;')
 
 # Renderscript needs the ability to read directories on /system
 allow appdomain system_file:dir r_dir_perms;
@@ -189,11 +280,6 @@
     allow { appdomain -isolated_app } vendor_file:dir { open read };
 ')
 
-# Allow apps access to /vendor/app except for privileged
-# apps which cannot be in /vendor.
-r_dir_file({ appdomain -ephemeral_app }, vendor_app_file)
-allow { appdomain -ephemeral_app } vendor_app_file:file execute;
-
 # Allow apps access to /vendor/overlay
 r_dir_file(appdomain, vendor_overlay_file)
 
@@ -264,35 +350,6 @@
   allow appdomain heapdump_data_file:file append;
 ')
 
-# /proc/net access.
-# TODO(b/9496886) Audit access for removal.
-# proc_net access for the negated domains below is granted (or not) in their
-# individual .te files.
-r_dir_file({
-  appdomain
-  -ephemeral_app
-  -isolated_app
-  -platform_app
-  -priv_app
-  -shell
-  -system_app
-  -untrusted_app_all
-}, proc_net_type)
-# audit access for all these non-core app domains.
-userdebug_or_eng(`
-  auditallow {
-    appdomain
-    -ephemeral_app
-    -isolated_app
-    -platform_app
-    -priv_app
-    -shell
-    -su
-    -system_app
-    -untrusted_app_all
-  } proc_net_type:{ dir file lnk_file } { getattr open read };
-')
-
 # Grant GPU access to all processes started by Zygote.
 # They need that to render the standard UI.
 allow { appdomain -isolated_app } gpu_device:chr_file rw_file_perms;
@@ -327,34 +384,11 @@
 allow appdomain system_data_file:file { getattr read map };
 
 # Allow read/stat of /data/media files passed by Binder or local socket IPC.
-allow { appdomain -isolated_app } media_rw_data_file:file { read getattr };
+allow { appdomain -isolated_app -supplemental_process } media_rw_data_file:file { read getattr };
 
 # Read and write /data/data/com.android.providers.telephony files passed over Binder.
 allow { appdomain -isolated_app } radio_data_file:file { read write getattr };
 
-# Allow access to external storage; we have several visible mount points under /storage
-# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary
-allow { appdomain -isolated_app -ephemeral_app } storage_file:dir r_dir_perms;
-allow { appdomain -isolated_app -ephemeral_app } storage_file:lnk_file r_file_perms;
-allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:dir r_dir_perms;
-allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:lnk_file r_file_perms;
-
-# Read/write visible storage
-allow { appdomain -isolated_app -ephemeral_app } { sdcard_type fuse }:dir create_dir_perms;
-allow { appdomain -isolated_app -ephemeral_app } { sdcard_type fuse }:file create_file_perms;
-# This should be removed if sdcardfs is modified to alter the secontext for its
-# accesses to the underlying FS.
-allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:dir create_dir_perms;
-allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:file create_file_perms;
-
-# Allow apps to use the USB Accessory interface.
-# http://developer.android.com/guide/topics/connectivity/usb/accessory.html
-#
-# USB devices are first opened by the system server (USBDeviceManagerService)
-# and the file descriptor is passed to the right Activity via binder.
-allow { appdomain -isolated_app -ephemeral_app } usb_device:chr_file { read write getattr ioctl };
-allow { appdomain -isolated_app -ephemeral_app } usbaccessory_device:chr_file { read write getattr };
-
 # For art.
 allow appdomain dalvikcache_data_file:file execute;
 allow appdomain dalvikcache_data_file:lnk_file r_file_perms;
@@ -373,20 +407,9 @@
 
 # logd access
 read_logd(appdomain)
-control_logd({ appdomain -ephemeral_app })
-# application inherit logd write socket (urge is to deprecate this long term)
+
 allow appdomain zygote:unix_dgram_socket write;
 
-allow { appdomain -isolated_app -ephemeral_app } keystore:keystore_key { get_state get insert delete exist list sign verify };
-allow { appdomain -isolated_app -ephemeral_app } keystore:keystore2_key { delete use get_info rebind update };
-
-allow { appdomain -isolated_app -ephemeral_app } keystore_maintenance_service:service_manager find;
-allow { appdomain -isolated_app -ephemeral_app } keystore:keystore2 get_state;
-
-use_keystore({ appdomain -isolated_app -ephemeral_app })
-
-use_credstore({ appdomain -isolated_app -ephemeral_app })
-
 allow appdomain console_device:chr_file { read write };
 
 # only allow unprivileged socket ioctl commands
@@ -416,13 +439,6 @@
 # For app fuse.
 allow appdomain app_fuse_file:file { getattr read append write map };
 
-pdx_client({ appdomain -isolated_app -ephemeral_app }, display_client)
-pdx_client({ appdomain -isolated_app -ephemeral_app }, display_manager)
-pdx_client({ appdomain -isolated_app -ephemeral_app }, display_vsync)
-pdx_client({ appdomain -isolated_app -ephemeral_app }, performance_client)
-# Apps do not directly open the IPC socket for bufferhubd.
-pdx_use({ appdomain -isolated_app -ephemeral_app }, bufferhub_client)
-
 ###
 ### CTS-specific rules
 ###
@@ -432,11 +448,6 @@
 allow appdomain runas_exec:file getattr;
 # Others are either allowed elsewhere or not desired.
 
-# Apps receive an open tun fd from the framework for
-# device traffic. Do not allow untrusted app to directly open tun_device
-allow { appdomain -isolated_app -ephemeral_app } tun_device:chr_file { read write getattr append ioctl };
-allowxperm { appdomain -isolated_app -ephemeral_app } tun_device:chr_file ioctl TUNGETIFF;
-
 # Connect to adbd and use a socket transferred from it.
 # This is used for e.g. adb backup/restore.
 allow appdomain adbd:unix_stream_socket connectto;
diff --git a/private/compat/31.0/31.0.ignore.cil b/private/compat/31.0/31.0.ignore.cil
index 29378d4..286f408 100644
--- a/private/compat/31.0/31.0.ignore.cil
+++ b/private/compat/31.0/31.0.ignore.cil
@@ -9,6 +9,7 @@
     artd_service
     attestation_verification_service
     camera2_extensions_prop
+    communal_service
     device_config_nnapi_native_prop
     dice_maintenance_service
     dice_node_service
@@ -41,6 +42,7 @@
     proc_watermark_scale_factor
     untrusted_app_30
     proc_vendor_sched
+    supplemental_process_service
     sysfs_fs_fuse_bpf
     sysfs_vendor_sched
     tv_iapp_service
diff --git a/private/domain.te b/private/domain.te
index 988bd56..5019952 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -610,3 +610,22 @@
   userdebug_or_eng(`-virtualizationservice')
   userdebug_or_eng(`-crosvm')
 } shell_data_file:file open;
+
+# respect system_app sandboxes
+neverallow {
+  domain
+  -appdomain
+  -system_server #populate com.android.providers.settings/databases/settings.db.
+  -installd # creation of app sandbox
+  -iorap_inode2filename
+  -traced_probes # resolve inodes for i/o tracing.
+                 # only needs open and read, the rest is neverallow in
+                 # traced_probes.te.
+} system_app_data_file:dir_file_class_set { create unlink open };
+neverallow {
+  isolated_app
+  ephemeral_app
+  priv_app
+  supplemental_process
+  untrusted_app_all
+} system_app_data_file:dir_file_class_set { create unlink open };
diff --git a/private/gmscore_app.te b/private/gmscore_app.te
index a05f3de..89ad6c3 100644
--- a/private/gmscore_app.te
+++ b/private/gmscore_app.te
@@ -11,8 +11,6 @@
 can_profile_perf(gmscore_app)
 
 allow gmscore_app sysfs_type:dir search;
-# Read access to /sys/class/net/wlan*/address
-r_dir_file(gmscore_app, sysfs_net)
 # Read access to /sys/block/zram*/mm_stat
 r_dir_file(gmscore_app, sysfs_zram)
 
@@ -65,6 +63,8 @@
 dontaudit gmscore_app sysfs_android_usb:file r_file_perms;
 dontaudit gmscore_app sysfs_dm:file r_file_perms;
 dontaudit gmscore_app sysfs_loop:file r_file_perms;
+dontaudit gmscore_app sysfs_net:file r_file_perms;
+dontaudit gmscore_app sysfs_net:dir r_dir_perms;
 dontaudit gmscore_app { wifi_prop wifi_hal_prop }:file r_file_perms;
 dontaudit gmscore_app mirror_data_file:dir search;
 dontaudit gmscore_app mnt_vendor_file:dir search;
@@ -153,3 +153,24 @@
 
 # b/186488185: Allow GMSCore to read dck properties
 get_prop(gmscore_app, dck_prop)
+
+# Do not allow getting permission-protected network information from sysfs.
+neverallow gmscore_app sysfs_net:file *;
+
+# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
+# ioctl permission, or 3. disallow the socket class.
+neverallowxperm gmscore_app domain:{ icmp_socket rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
+neverallow gmscore_app *:{ netlink_route_socket netlink_selinux_socket } ioctl;
+neverallow gmscore_app *:{
+  socket netlink_socket packet_socket key_socket appletalk_socket
+  netlink_tcpdiag_socket netlink_nflog_socket
+  netlink_xfrm_socket netlink_audit_socket
+  netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
+  netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
+  netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
+  netlink_rdma_socket netlink_crypto_socket sctp_socket
+  ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket
+  atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket
+  bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
+  alg_socket nfc_socket kcm_socket qipcrtr_socket smc_socket xdp_socket
+} *;
diff --git a/private/isolated_app.te b/private/isolated_app.te
index 800775b..1fc9f00 100644
--- a/private/isolated_app.te
+++ b/private/isolated_app.te
@@ -136,7 +136,7 @@
 # excluding unix_stream_socket and unix_dgram_socket.
 # Many of these are socket families which have never and will never
 # be compiled into the Android kernel.
-neverallow isolated_app { self ephemeral_app priv_app untrusted_app_all }:{
+neverallow isolated_app { self ephemeral_app priv_app supplemental_process untrusted_app_all }:{
   socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket
   key_socket appletalk_socket netlink_route_socket
   netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket
diff --git a/private/keys.conf b/private/keys.conf
index 362e73d..cc4e1f3 100644
--- a/private/keys.conf
+++ b/private/keys.conf
@@ -11,6 +11,9 @@
 [@PLATFORM]
 ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/platform.x509.pem
 
+[@SUPPLEMENTAL_PROCESS]
+ALL : $MAINLINE_SEPOLICY_DEV_CERTIFICATES/supplemental_process.x509.pem
+
 [@MEDIA]
 ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/media.x509.pem
 
diff --git a/private/mac_permissions.xml b/private/mac_permissions.xml
index 7fc37c1..0e77637 100644
--- a/private/mac_permissions.xml
+++ b/private/mac_permissions.xml
@@ -51,6 +51,11 @@
       <seinfo value="platform" />
     </signer>
 
+    <!-- Supplemental process key -->
+    <signer signature="@SUPPLEMENTAL_PROCESS" >
+      <seinfo value="supplemental_process" />
+    </signer>
+
     <!-- Media key in AOSP -->
     <signer signature="@MEDIA" >
       <seinfo value="media" />
diff --git a/private/net.te b/private/net.te
new file mode 100644
index 0000000..3e20274
--- /dev/null
+++ b/private/net.te
@@ -0,0 +1,18 @@
+# Bind to ports.
+allow {netdomain -ephemeral_app -supplemental_process} node_type:{ icmp_socket rawip_socket tcp_socket udp_socket } node_bind;
+allow {netdomain -ephemeral_app -supplemental_process} port_type:udp_socket name_bind;
+allow {netdomain -ephemeral_app -supplemental_process} port_type:tcp_socket name_bind;
+
+# b/141455849 gate RTM_GETLINK with a new permission nlmsg_readpriv and block access from
+# untrusted_apps.
+# b/171572148 gate RTM_GETNEIGH{TBL} with a new permission nlmsg_getneigh and block access from
+# untrusted_apps. Some untrusted apps (e.g. untrusted_app_25-30) are granted access elsewhere
+# to avoid app-compat breakage.
+allow {
+  netdomain
+  -ephemeral_app
+  -mediaprovider
+  -supplemental_process
+  -untrusted_app_all
+} self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh };
+
diff --git a/private/priv_app.te b/private/priv_app.te
index c7d6ab1..9d7a0f6 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -107,16 +107,11 @@
 }:file r_file_perms;
 
 allow priv_app sysfs_type:dir search;
-# Read access to /sys/class/net/wlan*/address
-r_dir_file(priv_app, sysfs_net)
 # Read access to /sys/block/zram*/mm_stat
 r_dir_file(priv_app, sysfs_zram)
 
 r_dir_file(priv_app, rootfs)
 
-# access the mac address
-allowxperm priv_app self:udp_socket ioctl SIOCGIFHWADDR;
-
 # Allow com.android.vending to communicate with statsd.
 binder_call(priv_app, statsd)
 
@@ -270,5 +265,26 @@
 # Do not follow untrusted app provided symlinks
 neverallow priv_app app_data_file:lnk_file { open read getattr };
 
-# Allow reporting off body events to keystore.
+# Do not allow getting permission-protected network information from sysfs.
+neverallow priv_app sysfs_net:file *;
+
+# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
+# ioctl permission, or 3. disallow the socket class.
+neverallowxperm priv_app domain:{ icmp_socket rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
+neverallow priv_app *:{ netlink_route_socket netlink_selinux_socket } ioctl;
+neverallow priv_app *:{
+  socket netlink_socket packet_socket key_socket appletalk_socket
+  netlink_tcpdiag_socket netlink_nflog_socket
+  netlink_xfrm_socket netlink_audit_socket
+  netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
+  netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
+  netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
+  netlink_rdma_socket netlink_crypto_socket sctp_socket
+  ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket
+  atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket
+  bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
+  alg_socket nfc_socket kcm_socket qipcrtr_socket smc_socket xdp_socket
+} *;
+
+# Allow priv apps to report off body events to keystore2.
 allow priv_app keystore:keystore2 report_off_body;
diff --git a/private/seapp_contexts b/private/seapp_contexts
index 5cf0711..d6664ff 100644
--- a/private/seapp_contexts
+++ b/private/seapp_contexts
@@ -137,6 +137,9 @@
 
 isSystemServer=true domain=system_server_startup
 
+# supplemental_process must run in the supplemental_process domain
+neverallow name=com.android.supplemental.process domain=((?!supplemental_process).)*
+
 user=_app seinfo=platform name=com.android.traceur domain=traceur_app type=app_data_file levelFrom=all
 user=_app isPrivApp=true name=com.android.remoteprovisioner domain=remote_prov_app type=app_data_file levelFrom=all
 user=system seinfo=platform domain=system_app type=system_app_data_file
@@ -171,3 +174,4 @@
 user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user
 user=_app minTargetSdkVersion=28 fromRunAs=true domain=runas_app levelFrom=all
 user=_app fromRunAs=true domain=runas_app levelFrom=user
+user=_app seinfo=supplemental_process name=com.android.supplemental.process domain=supplemental_process type=app_data_file levelFrom=user
diff --git a/private/service.te b/private/service.te
index cd2cec6..1f407a6 100644
--- a/private/service.te
+++ b/private/service.te
@@ -1,6 +1,7 @@
 type ambient_context_service,       app_api_service, system_server_service, service_manager_type;
 type attention_service,             system_server_service, service_manager_type;
 type compos_service,                service_manager_type;
+type communal_service,      app_api_service, system_server_service, service_manager_type;
 type dynamic_system_service,        system_api_service, system_server_service, service_manager_type;
 type gsi_service,                   service_manager_type;
 type incidentcompanion_service,     app_api_service, system_api_service, system_server_service, service_manager_type;
diff --git a/private/service_contexts b/private/service_contexts
index 4fb4b29..9424355 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -131,6 +131,7 @@
 cloudsearch_service                       u:object_r:cloudsearch_service:s0
 com.android.net.IProxyService             u:object_r:IProxyService_service:s0
 companiondevice                           u:object_r:companion_device_service:s0
+communal                                  u:object_r:communal_service:s0
 platform_compat                           u:object_r:platform_compat_service:s0
 platform_compat_native                    u:object_r:platform_compat_service:s0
 connectivity                              u:object_r:connectivity_service:s0
@@ -323,6 +324,7 @@
 storaged                                  u:object_r:storaged_service:s0
 storaged_pri                              u:object_r:storaged_service:s0
 storagestats                              u:object_r:storagestats_service:s0
+supplemental_process                      u:object_r:supplemental_process_service:s0
 SurfaceFlinger                            u:object_r:surfaceflinger_service:s0
 SurfaceFlingerAIDL                        u:object_r:surfaceflinger_service:s0
 suspend_control                           u:object_r:system_suspend_control_service:s0
diff --git a/private/supplemental_process.te b/private/supplemental_process.te
new file mode 100644
index 0000000..1670fa4
--- /dev/null
+++ b/private/supplemental_process.te
@@ -0,0 +1,83 @@
+###
+### Supplemental Process.
+###
+### This file defines the security policy for the supplemental process.
+
+type supplemental_process, domain;
+
+typeattribute supplemental_process coredomain;
+
+net_domain(supplemental_process)
+app_domain(supplemental_process)
+
+# Allow finding services. This is different from ephemeral_app policy.
+# Adding services manually to the allowlist is preferred hence app_api_service is not used.
+allow supplemental_process activity_service:service_manager find;
+allow supplemental_process activity_task_service:service_manager find;
+allow supplemental_process audio_service:service_manager find;
+# Audit the access to signal that we are still investigating whether supplemental_process
+# should have access to audio_service
+# TODO(b/211632068): remove this line
+auditallow supplemental_process audio_service:service_manager find;
+allow supplemental_process hint_service:service_manager find;
+allow supplemental_process surfaceflinger_service:service_manager find;
+allow supplemental_process trust_service:service_manager find;
+allow supplemental_process uimode_service:service_manager find;
+allow supplemental_process webviewupdate_service:service_manager find;
+
+# Write app-specific trace data to the Perfetto traced damon. This requires
+# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
+perfetto_producer(supplemental_process)
+
+# Allow profiling if the app opts in by being marked profileable/debuggable.
+can_profile_heap(supplemental_process)
+can_profile_perf(supplemental_process)
+
+# allow supplemental processes to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow supplemental_process system_server:udp_socket {
+        connect getattr read recvfrom sendto write getopt setopt };
+
+###
+### neverallow rules
+###
+
+neverallow supplemental_process { app_data_file privapp_data_file }:file { execute execute_no_trans };
+
+# Receive or send uevent messages.
+neverallow supplemental_process domain:netlink_kobject_uevent_socket *;
+
+# Receive or send generic netlink messages
+neverallow supplemental_process domain:netlink_socket *;
+
+# Too much leaky information in debugfs. It's a security
+# best practice to ensure these files aren't readable.
+neverallow supplemental_process debugfs:file read;
+
+# execute gpu_device
+neverallow supplemental_process gpu_device:chr_file execute;
+
+# access files in /sys with the default sysfs label
+neverallow supplemental_process sysfs:file *;
+
+# Avoid reads from generically labeled /proc files
+# Create a more specific label if needed
+neverallow supplemental_process proc:file { no_rw_file_perms no_x_file_perms };
+
+# Directly access external storage
+neverallow supplemental_process { sdcard_type media_rw_data_file }:file {open create};
+neverallow supplemental_process { sdcard_type media_rw_data_file }:dir search;
+
+# Avoid reads to proc_net, it contains too much device wide information about
+# ongoing connections.
+neverallow supplemental_process proc_net:file no_rw_file_perms;
+
+# Supplemental process doesn't have its own private app data directory
+neverallow supplemental_process { app_data_file privapp_data_file }:dir no_rw_file_perms;
+neverallow supplemental_process { app_data_file privapp_data_file }:file no_rw_file_perms;
+
+# Supplemental process doesn't have any access to external storage
+neverallow supplemental_process { media_rw_data_file }:dir no_rw_file_perms;
+neverallow supplemental_process { media_rw_data_file }:file no_rw_file_perms;
+
+neverallow { supplemental_process } tmpfs:dir no_rw_file_perms;
diff --git a/public/domain.te b/public/domain.te
index 2be67f5..4c8173d 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -1129,24 +1129,6 @@
 # to installd
 neverallow installd system_data_file:file ~{ r_file_perms relabelfrom unlink };
 
-# respect system_app sandboxes
-neverallow {
-  domain
-  -appdomain # finer-grained rules for appdomain are listed below
-  -system_server #populate com.android.providers.settings/databases/settings.db.
-  -installd # creation of app sandbox
-  -iorap_inode2filename
-  -traced_probes # resolve inodes for i/o tracing.
-                 # only needs open and read, the rest is neverallow in
-                 # traced_probes.te.
-} system_app_data_file:dir_file_class_set { create unlink open };
-neverallow {
-  isolated_app
-  untrusted_app_all # finer-grained rules for appdomain are listed below
-  ephemeral_app
-  priv_app
-} system_app_data_file:dir_file_class_set { create unlink open };
-
 #
 # Only these domains should transition to shell domain. This domain is
 # permissible for the "shell user". If you need a process to exec a shell
diff --git a/public/net.te b/public/net.te
index 714bcde..31c9c45 100644
--- a/public/net.te
+++ b/public/net.te
@@ -13,23 +13,8 @@
 
 # Connect to ports.
 allow netdomain port_type:tcp_socket name_connect;
-# Bind to ports.
-allow {netdomain -ephemeral_app} node_type:{ icmp_socket rawip_socket tcp_socket udp_socket } node_bind;
-allow {netdomain -ephemeral_app} port_type:udp_socket name_bind;
-allow {netdomain -ephemeral_app} port_type:tcp_socket name_bind;
 # See changes to the routing table.
 allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read };
-# b/141455849 gate RTM_GETLINK with a new permission nlmsg_readpriv and block access from
-# untrusted_apps.
-# b/171572148 gate RTM_GETNEIGH{TBL} with a new permission nlmsg_getneigh and block access from
-# untrusted_apps. Some untrusted apps (e.g. untrusted_app_25-30) are granted access elsewhere
-# to avoid app-compat breakage.
-allow {
-  netdomain
-  -ephemeral_app
-  -mediaprovider
-  -untrusted_app_all
-} self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh };
 
 # Talks to netd via dnsproxyd socket.
 unix_socket_connect(netdomain, dnsproxyd, netd)
diff --git a/public/service.te b/public/service.te
index 8c4ae56..70d07e7 100644
--- a/public/service.te
+++ b/public/service.te
@@ -211,6 +211,7 @@
 type smartspace_service, app_api_service, system_server_service, service_manager_type;
 type statusbar_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type storagestats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type supplemental_process_service, app_api_service, system_server_service, service_manager_type;
 type system_config_service, system_api_service, system_server_service, service_manager_type;
 type system_server_dumper_service, system_api_service, system_server_service, service_manager_type;
 type system_update_service, system_server_service, service_manager_type;