diff --git a/private/gmscore_app.te b/private/gmscore_app.te
index 8795798..cd05a65 100644
--- a/private/gmscore_app.te
+++ b/private/gmscore_app.te
@@ -149,6 +149,9 @@
 # b/186488185: Allow GMSCore to read dck properties
 get_prop(gmscore_app, dck_prop)
 
+# Allow GMSCore to read RKP properties for the purpose of GTS testing.
+get_prop(gmscore_app, remote_prov_prop)
+
 # Do not allow getting permission-protected network information from sysfs.
 neverallow gmscore_app sysfs_net:file *;
 
diff --git a/private/isolated_compute_app.te b/private/isolated_compute_app.te
index 536261f..bde6195 100644
--- a/private/isolated_compute_app.te
+++ b/private/isolated_compute_app.te
@@ -20,11 +20,18 @@
 allow isolated_compute_app content_capture_service:service_manager find;
 allow isolated_compute_app device_state_service:service_manager find;
 allow isolated_compute_app speech_recognition_service:service_manager find;
+allow isolated_compute_app mediaserver_service:service_manager find;
 
 # Enable access to hardware services for camera functionalilites
 hal_client_domain(isolated_compute_app, hal_allocator)
 hwbinder_use(isolated_compute_app)
 
+allow isolated_compute_app dmabuf_system_heap_device:chr_file r_file_perms;
+
+# Allow access to network sockets received over IPC. New socket creation is not
+# permitted.
+allow isolated_compute_app { ephemeral_app priv_app untrusted_app_all }:{ tcp_socket udp_socket } { rw_socket_perms_no_ioctl };
+
 #####
 ##### Neverallow
 #####
diff --git a/private/technical_debt.cil b/private/technical_debt.cil
index 069bb10..27ea187 100644
--- a/private/technical_debt.cil
+++ b/private/technical_debt.cil
@@ -14,11 +14,11 @@
 
 ; Apps, except isolated apps, are clients of OMX-related services
 ; Unfortunately, we can't currently express this in module policy language:
-(typeattributeset hal_omx_client ((and (appdomain) ((not (isolated_app_all))))))
+(typeattributeset hal_omx_client ((and (appdomain) ((not (isolated_app))))))
 
 ; Apps, except isolated apps, are clients of Codec2-related services
 ; Unfortunately, we can't currently express this in module policy language:
-(typeattributeset hal_codec2_client ((and (appdomain) ((not (isolated_app_all))))))
+(typeattributeset hal_codec2_client ((and (appdomain) ((not (isolated_app))))))
 
 ; Apps, except isolated apps and SDK sandboxes, are clients of Drm-related services
 ; Unfortunately, we can't currently express this in module policy language:
diff --git a/public/hal_fingerprint.te b/public/hal_fingerprint.te
index 444cfda..29abe4f 100644
--- a/public/hal_fingerprint.te
+++ b/public/hal_fingerprint.te
@@ -5,7 +5,7 @@
 hal_attribute_hwservice(hal_fingerprint, hal_fingerprint_hwservice)
 hal_attribute_service(hal_fingerprint, hal_fingerprint_service)
 
-binder_call(hal_fingerprint_server, servicemanager)
+binder_use(hal_fingerprint_server)
 
 # For memory allocation
 allow hal_fingerprint ion_device:chr_file r_file_perms;
diff --git a/public/su.te b/public/su.te
index 3473e74..bcdc322 100644
--- a/public/su.te
+++ b/public/su.te
@@ -31,7 +31,7 @@
   dontaudit su domain:socket_class_set *;
   dontaudit su domain:ipc_class_set *;
   dontaudit su domain:key *;
-  dontaudit su fs_type:filesystem *;
+  dontaudit su {fs_type fusefs_type}:filesystem *;
   dontaudit su {fs_type dev_type file_type}:dir_file_class_set *;
   dontaudit su node_type:node *;
   dontaudit su node_type:{ tcp_socket udp_socket rawip_socket } *;