diff --git a/Android.mk b/Android.mk
index 2a6751e..47b17a9 100644
--- a/Android.mk
+++ b/Android.mk
@@ -77,10 +77,12 @@
 $(sepolicy_policy.conf) : $(call build_policy, security_classes initial_sids access_vectors global_macros mls_macros mls policy_capabilities te_macros attributes *.te roles users initial_sid_contexts fs_use genfs_contexts port_contexts)
 	@mkdir -p $(dir $@)
 	$(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) -s $^ > $@
+	$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
 
 $(LOCAL_BUILT_MODULE) : $(sepolicy_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
 	@mkdir -p $(dir $@)
 	$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $<
+	$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $(dir $<)/$(notdir $@).dontaudit $<.dontaudit
 
 built_sepolicy := $(LOCAL_BUILT_MODULE)
 sepolicy_policy.conf :=
diff --git a/bluetooth.te b/bluetooth.te
index cd17967..31ea064 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -26,3 +26,9 @@
 # tethering
 allow bluetooth self:{ tun_socket udp_socket } { ioctl create };
 allow bluetooth efs_file:dir search;
+
+# Talk to init over the property socket.
+unix_socket_connect(bluetooth, property, init)
+
+# proc access.
+allow bluetooth proc_bluetooth_writable:file rw_file_perms;
diff --git a/device.te b/device.te
index 628d803..2aeeb16 100644
--- a/device.te
+++ b/device.te
@@ -30,8 +30,10 @@
 type kmsg_device, dev_type;
 type null_device, dev_type, mlstrustedobject;
 type random_device, dev_type;
+type sensors_device, dev_type;
 type serial_device, dev_type;
 type socket_device, dev_type;
+type timerirq_device, dev_type;
 type tty_device, dev_type;
 type urandom_device, dev_type;
 type video_device, dev_type;
@@ -46,6 +48,7 @@
 type uhid_device, dev_type;
 type tun_device, dev_type, mlstrustedobject;
 type usbaccessory_device, dev_type;
+type usb_device, dev_type;
 
 # All devices have a uart for the hci
 # attach service. The uart dev node
@@ -53,6 +56,6 @@
 # is used in per device policy
 type hci_attach_dev, dev_type;
 
-# All devices have a rpmsg device for 
+# All devices have a rpmsg device for
 # achieving remoteproc and rpmsg modules
 type rpmsg_device, dev_type;
diff --git a/file.te b/file.te
index cc196a3..a82945a 100644
--- a/file.te
+++ b/file.te
@@ -5,6 +5,7 @@
 type rootfs, fs_type;
 type proc, fs_type;
 type qtaguid_proc, fs_type, mlstrustedobject;
+type proc_bluetooth_writable, fs_type;
 type selinuxfs, fs_type;
 type cgroup, fs_type, mlstrustedobject;
 type sysfs, fs_type, mlstrustedobject;
diff --git a/file_contexts b/file_contexts
index 6501dfd..6e05edb 100644
--- a/file_contexts
+++ b/file_contexts
@@ -41,6 +41,7 @@
 /dev/block/loop[0-9]*	u:object_r:loop_device:s0
 /dev/block/ram[0-9]*	u:object_r:ram_device:s0
 /dev/block/mtdblock5	u:object_r:radio_device:s0
+/dev/bus/usb(.*)?       u:object_r:usb_device:s0
 /dev/cam		u:object_r:camera_device:s0
 /dev/console		u:object_r:console_device:s0
 /dev/cpuctl(/.*)?	u:object_r:cpuctl_device:s0
diff --git a/mediaserver.te b/mediaserver.te
index 0696331..85be2d5 100644
--- a/mediaserver.te
+++ b/mediaserver.te
@@ -49,4 +49,4 @@
 allow mediaserver qtaguid_device:chr_file r_file_perms;
 
 # Allow abstract socket connection
-allow mediaserver rild:unix_stream_socket connectto;
+allow mediaserver rild:unix_stream_socket { connectto read write setopt };
diff --git a/rild.te b/rild.te
index c331bb3..e8069bf 100644
--- a/rild.te
+++ b/rild.te
@@ -37,3 +37,5 @@
 
 # Read/Write to uart driver (for GPS)
 allow rild gps_device:chr_file rw_file_perms;
+
+allow rild tty_device:chr_file rw_file_perms;
diff --git a/system.te b/system.te
index eacd5fb..cf92bca 100644
--- a/system.te
+++ b/system.te
@@ -221,3 +221,10 @@
 allow system cache_backup_file:file { relabelto relabelfrom };
 # LocalTransport creates and relabels /cache/backup
 allow system cache_backup_file:dir { relabelto relabelfrom create_dir_perms };
+
+# Allow system to talk to usb device
+allow system usb_device:chr_file rw_file_perms;
+allow system usb_device:dir r_dir_perms;
+
+# Allow system to talk to sensors and timer irq
+allow system { sensors_device timerirq_device }:chr_file rw_file_perms;
diff --git a/zygote.te b/zygote.te
index 9707082..33e8fe8 100644
--- a/zygote.te
+++ b/zygote.te
@@ -37,3 +37,6 @@
 dontaudit zygote self:capability fsetid;
 allow zygote tmpfs:dir { write create add_name setattr mounton search };
 allow zygote tmpfs:filesystem mount;
+
+# Handle --invoke-with command when launching Zygote with a wrapper command.
+allow zygote zygote_exec:file { execute_no_trans open };