diff --git a/apex/Android.bp b/apex/Android.bp
index 6caeb0c..2ae2905 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -133,6 +133,13 @@
 }
 
 filegroup {
+  name: "com.android.telephony-file_contexts",
+  srcs: [
+    "com.android.telephony-file_contexts",
+  ],
+}
+
+filegroup {
   name: "com.android.tzdata-file_contexts",
   srcs: [
     "com.android.tzdata-file_contexts",
diff --git a/private/gmscore_app.te b/private/gmscore_app.te
index 461928d..38238c8 100644
--- a/private/gmscore_app.te
+++ b/private/gmscore_app.te
@@ -124,3 +124,8 @@
 allow gmscore_app ota_package_file:dir rw_dir_perms;
 allow gmscore_app ota_package_file:file create_file_perms;
 
+# Used by Finsky / Android "Verify Apps" functionality when
+# running "adb install foo.apk".
+allow gmscore_app shell_data_file:file r_file_perms;
+allow gmscore_app shell_data_file:dir r_dir_perms;
+
diff --git a/private/platform_app.te b/private/platform_app.te
index 45de3cb..9e26d7a 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -76,7 +76,7 @@
 binder_call(platform_app, gpuservice)
 
 # Allow platform apps to log via statsd.
-binder_call(platform_app statsd)
+binder_call(platform_app, statsd)
 
 # Access to /data/preloads
 allow platform_app preloads_data_file:file r_file_perms;
diff --git a/private/priv_app.te b/private/priv_app.te
index 8a0a94f..3263877 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -80,6 +80,11 @@
 # running "adb install foo.apk".
 allow priv_app shell_data_file:file r_file_perms;
 allow priv_app shell_data_file:dir r_dir_perms;
+# b/142672293: No other priv-app should need this allow rule now that GMS core runs in its own domain.
+userdebug_or_eng(`
+  auditallow priv_app shell_data_file:file r_file_perms;
+  auditallow priv_app shell_data_file:dir r_dir_perms;
+')
 
 # Allow traceur to pass file descriptors through a content provider to betterbug
 allow priv_app trace_data_file:file { getattr read };
diff --git a/private/service.te b/private/service.te
index 7ac7988..6c17521 100644
--- a/private/service.te
+++ b/private/service.te
@@ -4,4 +4,5 @@
 type incidentcompanion_service,     system_api_service, system_server_service, service_manager_type;
 type stats_service,                 service_manager_type;
 type statscompanion_service,        system_server_service, service_manager_type;
+type statsmanager_service,          system_api_service, system_server_service, service_manager_type;
 type uce_service,                   service_manager_type;
diff --git a/private/service_contexts b/private/service_contexts
index 908ff68..a3680d3 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -189,6 +189,7 @@
 slice                                     u:object_r:slice_service:s0
 stats                                     u:object_r:stats_service:s0
 statscompanion                            u:object_r:statscompanion_service:s0
+statsmanager                              u:object_r:statsmanager_service:s0
 soundtrigger                              u:object_r:voiceinteraction_service:s0
 soundtrigger_middleware                   u:object_r:soundtrigger_middleware_service:s0
 statusbar                                 u:object_r:statusbar_service:s0
diff --git a/private/statsd.te b/private/statsd.te
index 9d250bd..a55c42d 100644
--- a/private/statsd.te
+++ b/private/statsd.te
@@ -3,8 +3,6 @@
 
 init_daemon_domain(statsd)
 
-binder_call(statsd, statscompanion_service)
-
 # Allow to exec the perfetto cmdline client and pass it the trace config on
 # stdint through a pipe. It allows statsd to  capture traces and hand them
 # to Android dropbox.