Merge "Allows nfc to access vr_manager_service" am: c3f4afefdb am: f23230c88e am: e95974b024
am: cd59148309

Change-Id: If3b128bcc0dbeb043f9476c28334d83912ed53e4
diff --git a/private/app.te b/private/app.te
index 33c51fc..0bc5fdd 100644
--- a/private/app.te
+++ b/private/app.te
@@ -326,6 +326,9 @@
 
 allow appdomain cache_file:dir getattr;
 
+# Allow apps to run with asanwrapper.
+with_asan(`allow appdomain asanwrapper_exec:file rx_file_perms;')
+
 ###
 ### Neverallow rules
 ###
@@ -475,7 +478,6 @@
 neverallow appdomain kernel:system { syslog_read syslog_mod syslog_console };
 
 # SELinux is not an API for apps to use
-neverallow { appdomain -shell } selinuxfs:file no_rw_file_perms;
 neverallow { appdomain -shell } *:security { compute_av check_context };
 neverallow { appdomain -shell } *:netlink_selinux_socket *;
 
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 9c762a1..9277d41 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -166,6 +166,9 @@
   -hidl_token_hwservice # Designed for use by any domain
 }:hwservice_manager find;
 
+# SELinux is not an API for untrusted apps to use
+neverallow all_untrusted_apps selinuxfs:file no_rw_file_perms;
+
 # Restrict *Binder access from apps to HAL domains. We can only do this on full
 # Treble devices where *Binder communications between apps and HALs are tightly
 # restricted.
diff --git a/private/e2fs.te b/private/e2fs.te
new file mode 100644
index 0000000..add1cc2
--- /dev/null
+++ b/private/e2fs.te
@@ -0,0 +1,14 @@
+type e2fs, domain, coredomain;
+
+allow e2fs block_device:blk_file getattr;
+allow e2fs block_device:dir search;
+allow e2fs userdata_block_device:blk_file rw_file_perms;
+
+# access /proc/filesystems
+allow e2fs proc:file r_file_perms;
+
+# access /sys/fs/ext4/features
+allow e2fs sysfs_fs_ext4_features:file r_file_perms;
+
+# access sselinux context files
+allow e2fs file_contexts_file:file { getattr open read };
diff --git a/private/file_contexts b/private/file_contexts
index 7384ce8..73f4a7f 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -17,6 +17,8 @@
 /charger            u:object_r:rootfs:s0
 /init               u:object_r:init_exec:s0
 /sbin(/.*)?         u:object_r:rootfs:s0
+/sbin/e2fsdroid     u:object_r:e2fs_exec:s0
+/sbin/mke2fs        u:object_r:e2fs_exec:s0
 
 # For kernel modules
 /lib(/.*)?          u:object_r:rootfs:s0
@@ -458,6 +460,7 @@
 /sys/devices/virtual/block/zram\d+(/.*)?     u:object_r:sysfs_zram:s0
 /sys/devices/virtual/block/zram\d+/uevent    u:object_r:sysfs_zram_uevent:s0
 /sys/devices/virtual/misc/hw_random(/.*)?    u:object_r:sysfs_hwrandom:s0
+/sys/fs/ext4/features(/.*)?                  u:object_r:sysfs_fs_ext4_features:s0
 /sys/power/wake_lock -- u:object_r:sysfs_wake_lock:s0
 /sys/power/wake_unlock -- u:object_r:sysfs_wake_lock:s0
 /sys/kernel/uevent_helper --	u:object_r:usermodehelper:s0
@@ -492,6 +495,7 @@
 /sys/kernel(/debug)?/tracing/events/vmscan/mm_vmscan_direct_reclaim_end/enable      u:object_r:tracing_shell_writable:s0
 /sys/kernel(/debug)?/tracing/events/vmscan/mm_vmscan_kswapd_sleep/enable            u:object_r:tracing_shell_writable:s0
 /sys/kernel(/debug)?/tracing/events/vmscan/mm_vmscan_kswapd_wake/enable             u:object_r:tracing_shell_writable:s0
+/sys/kernel(/debug)?/tracing/events/lowmemorykiller/enable                          u:object_r:tracing_shell_writable:s0
 /sys/kernel(/debug)?/tracing/instances(/.*)?                                        u:object_r:debugfs_tracing_instances:s0
 /sys/kernel(/debug)?/tracing/instances/wifi/free_buffer                             u:object_r:debugfs_wifi_tracing:s0
 /sys/kernel(/debug)?/tracing/instances/wifi/trace                                   u:object_r:debugfs_wifi_tracing:s0
diff --git a/private/file_contexts_asan b/private/file_contexts_asan
index d35cd3c..0401ffe 100644
--- a/private/file_contexts_asan
+++ b/private/file_contexts_asan
@@ -3,3 +3,7 @@
 /data/asan/vendor/lib(/.*)?                u:object_r:system_file:s0
 /data/asan/vendor/lib64(/.*)?              u:object_r:system_file:s0
 /system/bin/asan_extract       u:object_r:asan_extract_exec:s0
+/system/bin/asanwrapper        u:object_r:asanwrapper_exec:s0
+/system/bin/asan/app_process   u:object_r:zygote_exec:s0
+/system/bin/asan/app_process32 u:object_r:zygote_exec:s0
+/system/bin/asan/app_process64 u:object_r:zygote_exec:s0
diff --git a/private/hwservice_contexts b/private/hwservice_contexts
index 35c95ce..397a3b1 100644
--- a/private/hwservice_contexts
+++ b/private/hwservice_contexts
@@ -26,6 +26,7 @@
 android.hardware.media.omx::IOmxStore                           u:object_r:hal_omx_hwservice:s0
 android.hardware.memtrack::IMemtrack                            u:object_r:hal_memtrack_hwservice:s0
 android.hardware.nfc::INfc                                      u:object_r:hal_nfc_hwservice:s0
+android.hardware.oemlock::IOemLock                              u:object_r:hal_oemlock_hwservice:s0
 android.hardware.power::IPower                                  u:object_r:hal_power_hwservice:s0
 android.hardware.radio.deprecated::IOemHook                     u:object_r:hal_telephony_hwservice:s0
 android.hardware.radio::IRadio                                  u:object_r:hal_telephony_hwservice:s0
@@ -39,7 +40,9 @@
 android.hardware.usb::IUsb                                      u:object_r:hal_usb_hwservice:s0
 android.hardware.vibrator::IVibrator                            u:object_r:hal_vibrator_hwservice:s0
 android.hardware.vr::IVr                                        u:object_r:hal_vr_hwservice:s0
+android.hardware.weaver::IWeaver                                u:object_r:hal_weaver_hwservice:s0
 android.hardware.wifi::IWifi                                    u:object_r:hal_wifi_hwservice:s0
+android.hardware.wifi.offload::IOffload                         u:object_r:hal_wifi_offload_hwservice:s0
 android.hardware.wifi.supplicant::ISupplicant                   u:object_r:hal_wifi_supplicant_hwservice:s0
 android.hidl.allocator::IAllocator                              u:object_r:hidl_allocator_hwservice:s0
 android.hidl.base::IBase                                        u:object_r:hidl_base_hwservice:s0
diff --git a/private/init.te b/private/init.te
index b6c49b9..afbd878 100644
--- a/private/init.te
+++ b/private/init.te
@@ -7,6 +7,7 @@
 domain_trans(init, rootfs, charger)
 domain_trans(init, rootfs, healthd)
 domain_trans(init, rootfs, slideshow)
+domain_auto_trans(init, e2fs_exec, e2fs)
 recovery_only(`
   domain_trans(init, rootfs, recovery)
 ')
diff --git a/private/isolated_app.te b/private/isolated_app.te
index 418a322..ac9dc04 100644
--- a/private/isolated_app.te
+++ b/private/isolated_app.te
@@ -62,6 +62,17 @@
 neverallow isolated_app anr_data_file:file ~{ open append };
 neverallow isolated_app anr_data_file:dir ~search;
 
+# Isolated apps must not be permitted to use HwBinder
+neverallow isolated_app hwbinder_device:chr_file *;
+neverallow isolated_app *:hwservice_manager *;
+
+# Isolated apps must not be permitted to use VndBinder
+neverallow isolated_app vndbinder_device:chr_file *;
+
+# Isolated apps must not be permitted to perform actions on Binder and VndBinder service_manager
+# except the find actions for services whitelisted below.
+neverallow isolated_app *:service_manager ~find;
+
 # b/17487348
 # Isolated apps can only access three services,
 # activity_service, display_service and webviewupdate_service.
diff --git a/private/priv_app.te b/private/priv_app.te
index 109c869..9603180 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -108,6 +108,9 @@
 # Allow privileged apps (e.g. GMS core) to generate unique hardware IDs
 allow priv_app keystore:keystore_key gen_unique_id;
 
+# Allow GMS core to access /sys/fs/selinux/policyvers for compatibility check
+allow priv_app selinuxfs:file r_file_perms;
+
 read_runtime_log_tags(priv_app)
 
 ###
diff --git a/private/property_contexts b/private/property_contexts
index 4c27b35..2315034 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -111,6 +111,3 @@
 
 # hwservicemanager properties
 hwservicemanager.       u:object_r:hwservicemanager_prop:s0
-
-# ASAN install trigger
-asan.restore_reboot  u:object_r:asan_reboot_prop:s0
diff --git a/private/system_server.te b/private/system_server.te
index 05e4773..c51c040 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -17,11 +17,11 @@
 
 # For art.
 allow system_server dalvikcache_data_file:dir r_dir_perms;
-allow system_server dalvikcache_data_file:file { r_file_perms execute };
-userdebug_or_eng(`
-  # Report dalvikcache_data_file:file execute violations.
-  auditallow system_server dalvikcache_data_file:file execute;
-')
+allow system_server dalvikcache_data_file:file r_file_perms;
+
+# When running system server under --invoke-with, we'll try to load the boot image under the
+# system server domain, following links to the system partition.
+with_asan(`allow system_server dalvikcache_data_file:lnk_file r_file_perms;')
 
 # /data/resource-cache
 allow system_server resourcecache_data_file:file r_file_perms;
@@ -660,10 +660,12 @@
 allow system_server debugfs_tracing_instances:dir search;
 allow system_server debugfs_wifi_tracing:file rw_file_perms;
 
-# allow system_server to exec shell on ASAN builds. Needed to run
+# allow system_server to exec shell, asanwrapper & zygote(app_process) on ASAN builds. Needed to run
 # asanwrapper.
 with_asan(`
   allow system_server shell_exec:file rx_file_perms;
+  allow system_server asanwrapper_exec:file rx_file_perms;
+  allow system_server zygote_exec:file rx_file_perms;
 ')
 
 ###
@@ -691,7 +693,7 @@
   file_type
   -toolbox_exec
   -logcat_exec
-  with_asan(`-shell_exec')
+  with_asan(`-shell_exec -asanwrapper_exec -zygote_exec')
 }:file execute_no_trans;
 
 # Ensure that system_server doesn't perform any domain transitions other than
diff --git a/public/asan_extract.te b/public/asan_extract.te
index 6d0de6c..46b7557 100644
--- a/public/asan_extract.te
+++ b/public/asan_extract.te
@@ -31,6 +31,10 @@
   # Restorecon will actually already try to run with sanitized libraries (libpackagelistparser).
   allow asan_extract system_data_file:file execute;
 
+  # TODO - remove (b/38241921):
   # We use asan.restore_reboot to signal a reboot is required.
   set_prop(asan_extract, asan_reboot_prop)
+
+  # We need to signal a reboot when done
+  set_prop(asan_extract, powerctl_prop)
 ')
diff --git a/public/attributes b/public/attributes
index 90740d4..2b28cf0 100644
--- a/public/attributes
+++ b/public/attributes
@@ -160,116 +160,225 @@
 attribute halserverdomain;
 # All HAL clients
 attribute halclientdomain;
+expandattribute halclientdomain true;
 
 # HALs
 attribute hal_allocator;
+expandattribute hal_allocator true;
 attribute hal_allocator_client;
+expandattribute hal_allocator_client true;
 attribute hal_allocator_server;
+expandattribute hal_allocator_server true;
 attribute hal_audio;
+expandattribute hal_audio true;
 attribute hal_audio_client;
+expandattribute hal_audio_client true;
 attribute hal_audio_server;
+expandattribute hal_audio_server true;
 attribute hal_bluetooth;
+expandattribute hal_bluetooth true;
 attribute hal_bluetooth_client;
+expandattribute hal_bluetooth_client true;
 attribute hal_bluetooth_server;
+expandattribute hal_bluetooth_server true;
 attribute hal_bootctl;
+expandattribute hal_bootctl true;
 attribute hal_bootctl_client;
+expandattribute hal_bootctl_client true;
 attribute hal_bootctl_server;
+expandattribute hal_bootctl_server true;
 attribute hal_camera;
+expandattribute hal_camera true;
 attribute hal_camera_client;
+expandattribute hal_camera_client true;
 attribute hal_camera_server;
+expandattribute hal_camera_server true;
 attribute hal_configstore;
+expandattribute hal_configstore true;
 attribute hal_configstore_client;
+expandattribute hal_configstore_client true;
 attribute hal_configstore_server;
+expandattribute hal_configstore_server true;
 attribute hal_contexthub;
+expandattribute hal_contexthub true;
 attribute hal_contexthub_client;
+expandattribute hal_contexthub_client true;
 attribute hal_contexthub_server;
+expandattribute hal_contexthub_server true;
 attribute hal_drm;
+expandattribute hal_drm true;
 attribute hal_drm_client;
+expandattribute hal_drm_client true;
 attribute hal_drm_server;
+expandattribute hal_drm_server true;
 attribute hal_dumpstate;
+expandattribute hal_dumpstate true;
 attribute hal_dumpstate_client;
+expandattribute hal_dumpstate_client true;
 attribute hal_dumpstate_server;
+expandattribute hal_dumpstate_server true;
 attribute hal_fingerprint;
+expandattribute hal_fingerprint true;
 attribute hal_fingerprint_client;
+expandattribute hal_fingerprint_client true;
 attribute hal_fingerprint_server;
+expandattribute hal_fingerprint_server true;
 attribute hal_gatekeeper;
+expandattribute hal_gatekeeper true;
 attribute hal_gatekeeper_client;
+expandattribute hal_gatekeeper_client true;
 attribute hal_gatekeeper_server;
+expandattribute hal_gatekeeper_server true;
 attribute hal_gnss;
+expandattribute hal_gnss true;
 attribute hal_gnss_client;
+expandattribute hal_gnss_client true;
 attribute hal_gnss_server;
+expandattribute hal_gnss_server true;
 attribute hal_graphics_allocator;
+expandattribute hal_graphics_allocator true;
 attribute hal_graphics_allocator_client;
+expandattribute hal_graphics_allocator_client true;
 attribute hal_graphics_allocator_server;
+expandattribute hal_graphics_allocator_server true;
 attribute hal_graphics_composer;
+expandattribute hal_graphics_composer true;
 attribute hal_graphics_composer_client;
+expandattribute hal_graphics_composer_client true;
 attribute hal_graphics_composer_server;
+expandattribute hal_graphics_composer_server true;
 attribute hal_health;
+expandattribute hal_health true;
 attribute hal_health_client;
+expandattribute hal_health_client true;
 attribute hal_health_server;
+expandattribute hal_health_server true;
 attribute hal_ir;
+expandattribute hal_ir true;
 attribute hal_ir_client;
+expandattribute hal_ir_client true;
 attribute hal_ir_server;
+expandattribute hal_ir_server true;
 attribute hal_keymaster;
+expandattribute hal_keymaster true;
 attribute hal_keymaster_client;
+expandattribute hal_keymaster_client true;
 attribute hal_keymaster_server;
+expandattribute hal_keymaster_server true;
 attribute hal_light;
+expandattribute hal_light true;
 attribute hal_light_client;
+expandattribute hal_light_client true;
 attribute hal_light_server;
+expandattribute hal_light_server true;
 attribute hal_memtrack;
+expandattribute hal_memtrack true;
 attribute hal_memtrack_client;
+expandattribute hal_memtrack_client true;
 attribute hal_memtrack_server;
+expandattribute hal_memtrack_server true;
 attribute hal_nfc;
+expandattribute hal_nfc true;
 attribute hal_nfc_client;
+expandattribute hal_nfc_client true;
 attribute hal_nfc_server;
+expandattribute hal_nfc_server true;
 attribute hal_oemlock;
+expandattribute hal_oemlock true;
 attribute hal_oemlock_client;
+expandattribute hal_oemlock_client true;
 attribute hal_oemlock_server;
+expandattribute hal_oemlock_server true;
 attribute hal_power;
+expandattribute hal_power true;
 attribute hal_power_client;
+expandattribute hal_power_client true;
 attribute hal_power_server;
+expandattribute hal_power_server true;
 attribute hal_sensors;
+expandattribute hal_sensors true;
 attribute hal_sensors_client;
+expandattribute hal_sensors_client true;
 attribute hal_sensors_server;
+expandattribute hal_sensors_server true;
 attribute hal_telephony;
+expandattribute hal_telephony true;
 attribute hal_telephony_client;
+expandattribute hal_telephony_client true;
 attribute hal_telephony_server;
+expandattribute hal_telephony_server true;
 attribute hal_tetheroffload;
+expandattribute hal_tetheroffload true;
 attribute hal_tetheroffload_client;
+expandattribute hal_tetheroffload_client true;
 attribute hal_tetheroffload_server;
+expandattribute hal_tetheroffload_server true;
 attribute hal_thermal;
+expandattribute hal_thermal true;
 attribute hal_thermal_client;
+expandattribute hal_thermal_client true;
 attribute hal_thermal_server;
+expandattribute hal_thermal_server true;
 attribute hal_tv_cec;
+expandattribute hal_tv_cec true;
 attribute hal_tv_cec_client;
+expandattribute hal_tv_cec_client true;
 attribute hal_tv_cec_server;
+expandattribute hal_tv_cec_server true;
 attribute hal_tv_input;
+expandattribute hal_tv_input true;
 attribute hal_tv_input_client;
+expandattribute hal_tv_input_client true;
 attribute hal_tv_input_server;
+expandattribute hal_tv_input_server true;
 attribute hal_usb;
+expandattribute hal_usb true;
 attribute hal_usb_client;
+expandattribute hal_usb_client true;
 attribute hal_usb_server;
+expandattribute hal_usb_server true;
 attribute hal_vibrator;
+expandattribute hal_vibrator true;
 attribute hal_vibrator_client;
+expandattribute hal_vibrator_client true;
 attribute hal_vibrator_server;
+expandattribute hal_vibrator_server true;
 attribute hal_vr;
+expandattribute hal_vr true;
 attribute hal_vr_client;
+expandattribute hal_vr_client true;
 attribute hal_vr_server;
+expandattribute hal_vr_server true;
 attribute hal_weaver;
+expandattribute hal_weaver true;
 attribute hal_weaver_client;
+expandattribute hal_weaver_client true;
 attribute hal_weaver_server;
+expandattribute hal_weaver_server true;
 attribute hal_wifi;
+expandattribute hal_wifi true;
 attribute hal_wifi_client;
+expandattribute hal_wifi_client true;
 attribute hal_wifi_server;
+expandattribute hal_wifi_server true;
 attribute hal_wifi_keystore;
+expandattribute hal_wifi_keystore true;
 attribute hal_wifi_keystore_client;
+expandattribute hal_wifi_keystore_client true;
 attribute hal_wifi_keystore_server;
+expandattribute hal_wifi_keystore_server true;
 attribute hal_wifi_offload;
+expandattribute hal_wifi_offload true;
 attribute hal_wifi_offload_client;
+expandattribute hal_wifi_offload_client true;
 attribute hal_wifi_offload_server;
+expandattribute hal_wifi_offload_server true;
 attribute hal_wifi_supplicant;
+expandattribute hal_wifi_supplicant true;
 attribute hal_wifi_supplicant_client;
+expandattribute hal_wifi_supplicant_client true;
 attribute hal_wifi_supplicant_server;
+expandattribute hal_wifi_supplicant_server true;
 
 # HwBinder services offered across the core-vendor boundary
 #
diff --git a/public/domain.te b/public/domain.te
index 5a3853f..1957d1e 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -75,7 +75,7 @@
 } binder_device:chr_file rw_file_perms;
 # Devices which are not full TREBLE have fewer restrictions on access to /dev/binder
 not_full_treble(`allow { domain -hwservicemanager -vndservicemanager } binder_device:chr_file rw_file_perms;')
-allow { domain -servicemanager -vndservicemanager } hwbinder_device:chr_file rw_file_perms;
+allow { domain -servicemanager -vndservicemanager -isolated_app } hwbinder_device:chr_file rw_file_perms;
 allow domain ptmx_device:chr_file rw_file_perms;
 allow domain alarm_device:chr_file r_file_perms;
 allow domain random_device:chr_file rw_file_perms;
@@ -219,6 +219,9 @@
 # when it's not explicitly used in allow rules
 allow { domain -domain } vndservice_manager_type:service_manager { add find };
 
+# Under ASAN, processes will try to read /data, as the sanitized libraries are there.
+with_asan(`allow domain system_data_file:dir getattr;')
+
 ###
 ### neverallow rules
 ###
@@ -352,7 +355,6 @@
     -dumpstate
     -shell
     userdebug_or_eng(`-su')
-    -system_server
     -webview_zygote
     -zygote
 } {
diff --git a/public/e2fs.te b/public/e2fs.te
new file mode 100644
index 0000000..ecb25a2
--- /dev/null
+++ b/public/e2fs.te
@@ -0,0 +1 @@
+type e2fs_exec, exec_type, file_type;
diff --git a/public/file.te b/public/file.te
index 057af41..79f2c09 100644
--- a/public/file.te
+++ b/public/file.te
@@ -41,6 +41,7 @@
 type sysfs_wake_lock, fs_type, sysfs_type;
 type sysfs_mac_address, fs_type, sysfs_type;
 type sysfs_usb, sysfs_type, file_type, mlstrustedobject;
+type sysfs_fs_ext4_features, sysfs_type, fs_type;
 type configfs, fs_type;
 # /sys/devices/system/cpu
 type sysfs_devices_system_cpu, fs_type, sysfs_type;
@@ -327,6 +328,9 @@
 allow app_fuse_file app_fusefs:filesystem associate;
 allow postinstall_file self:filesystem associate;
 
+# asanwrapper (run a sanitized app_process, to be used with wrap properties)
+with_asan(`type asanwrapper_exec, exec_type, file_type;')
+
 # It's a bug to assign the file_type attribute and fs_type attribute
 # to any type. Do not allow it.
 #
diff --git a/public/hal_oemlock.te b/public/hal_oemlock.te
index dcbb964..3fb5a18 100644
--- a/public/hal_oemlock.te
+++ b/public/hal_oemlock.te
@@ -1,2 +1,5 @@
 # HwBinder IPC from client to server
-# binder_call(hal_oemlock_client, hal_oemlock_server)
+binder_call(hal_oemlock_client, hal_oemlock_server)
+
+add_hwservice(hal_oemlock_server, hal_oemlock_hwservice)
+allow hal_oemlock_client hal_oemlock_hwservice:hwservice_manager find;
diff --git a/public/hal_weaver.te b/public/hal_weaver.te
index 1910cf1..b80ba29 100644
--- a/public/hal_weaver.te
+++ b/public/hal_weaver.te
@@ -1,2 +1,5 @@
 # HwBinder IPC from client to server
-# binder_call(hal_weaver_client, hal_weaver_server)
+binder_call(hal_weaver_client, hal_weaver_server)
+
+add_hwservice(hal_weaver_server, hal_weaver_hwservice)
+allow hal_weaver_client hal_weaver_hwservice:hwservice_manager find;
diff --git a/public/hal_wifi_offload.te b/public/hal_wifi_offload.te
index dac5171..dc0cf5a 100644
--- a/public/hal_wifi_offload.te
+++ b/public/hal_wifi_offload.te
@@ -2,5 +2,8 @@
 binder_call(hal_wifi_offload_client, hal_wifi_offload_server)
 binder_call(hal_wifi_offload_server, hal_wifi_offload_client)
 
+add_hwservice(hal_wifi_offload_server, hal_wifi_offload_hwservice)
+allow hal_wifi_offload_client hal_wifi_offload_hwservice:hwservice_manager find;
+
 r_dir_file(hal_wifi_offload, proc_net)
 r_dir_file(hal_wifi_offload, sysfs_type)
diff --git a/public/hwservice.te b/public/hwservice.te
index ca99105..c3f3077 100644
--- a/public/hwservice.te
+++ b/public/hwservice.te
@@ -22,6 +22,7 @@
 type hal_light_hwservice, hwservice_manager_type;
 type hal_memtrack_hwservice, hwservice_manager_type;
 type hal_nfc_hwservice, hwservice_manager_type;
+type hal_oemlock_hwservice, hwservice_manager_type;
 type hal_omx_hwservice, hwservice_manager_type;
 type hal_power_hwservice, hwservice_manager_type;
 type hal_renderscript_hwservice, hwservice_manager_type, same_process_hwservice;
@@ -33,7 +34,9 @@
 type hal_usb_hwservice, hwservice_manager_type;
 type hal_vibrator_hwservice, hwservice_manager_type;
 type hal_vr_hwservice, hwservice_manager_type;
+type hal_weaver_hwservice, hwservice_manager_type;
 type hal_wifi_hwservice, hwservice_manager_type;
+type hal_wifi_offload_hwservice, hwservice_manager_type;
 type hal_wifi_supplicant_hwservice, hwservice_manager_type;
 type hidl_allocator_hwservice, hwservice_manager_type, coredomain_hwservice;
 type hidl_base_hwservice, hwservice_manager_type;
diff --git a/public/property.te b/public/property.te
index d6fa868..c633dab 100644
--- a/public/property.te
+++ b/public/property.te
@@ -1,4 +1,4 @@
-type asan_reboot_prop, property_type;
+type asan_reboot_prop, property_type; # TODO - remove (b/38241921)
 type audio_prop, property_type, core_property_type;
 type boottime_prop, property_type;
 type bluetooth_prop, property_type;
diff --git a/public/recovery.te b/public/recovery.te
index 6e211ac..99d792c 100644
--- a/public/recovery.te
+++ b/public/recovery.te
@@ -75,6 +75,9 @@
   allow recovery functionfs:dir search;
   allow recovery functionfs:file rw_file_perms;
 
+  # Access to /sys/fs/selinux/policyvers for compatibility check
+  allow recovery selinuxfs:file r_file_perms;
+
   # Required to e.g. wipe userdata/cache.
   allow recovery device:dir r_dir_perms;
   allow recovery block_device:dir r_dir_perms;
diff --git a/public/ueventd.te b/public/ueventd.te
index 4c77e11..da2695f 100644
--- a/public/ueventd.te
+++ b/public/ueventd.te
@@ -30,7 +30,7 @@
 r_dir_file(ueventd, selinuxfs)
 
 # Access for /vendor/ueventd.rc and /vendor/firmware
-r_dir_file(ueventd, vendor_file)
+r_dir_file(ueventd, { vendor_file_type -vendor_app_file -vendor_overlay_file })
 
 # Get file contexts for new device nodes
 allow ueventd file_contexts_file:file r_file_perms;
diff --git a/vendor/hal_sensors_default.te b/vendor/hal_sensors_default.te
index 8379c82..7fd8f85 100644
--- a/vendor/hal_sensors_default.te
+++ b/vendor/hal_sensors_default.te
@@ -5,3 +5,6 @@
 init_daemon_domain(hal_sensors_default)
 
 allow hal_sensors_default fwk_scheduler_hwservice:hwservice_manager find;
+
+allow hal_sensors_default hal_graphics_allocator_default:fd use;
+allow hal_sensors_default ion_device:chr_file r_file_perms;