diff --git a/build/soong/Android.bp b/build/soong/Android.bp
index 0abfdf6..3f2e2df 100644
--- a/build/soong/Android.bp
+++ b/build/soong/Android.bp
@@ -47,5 +47,6 @@
         "service_fuzzer_bindings.go",
         "validate_bindings.go",
     ],
+    testSrcs: ["selinux_test.go"],
     pluginFor: ["soong_build"],
 }
diff --git a/build/soong/flags.go b/build/soong/flags.go
index b1aebac..c7aeb32 100644
--- a/build/soong/flags.go
+++ b/build/soong/flags.go
@@ -15,22 +15,141 @@
 package selinux
 
 import (
+	"maps"
+
 	"android/soong/android"
+
+	"github.com/google/blueprint"
 )
 
+var (
+	flagsDepTag      = dependencyTag{name: "flags"}
+	buildFlagsDepTag = dependencyTag{name: "build_flags"}
+)
+
+func init() {
+	ctx := android.InitRegistrationContext
+	ctx.RegisterModuleType("se_flags", flagsFactory)
+	ctx.RegisterModuleType("se_flags_collector", flagsCollectorFactory)
+}
+
 type flagsProperties struct {
-	// List of flags to be passed to M4 macro.
+	// List of build time flags for flag-guarding.
 	Flags []string
+
+	// List of se_flags_collector modules to export flags to.
+	Export_to []string
+}
+
+type flagsModule struct {
+	android.ModuleBase
+	properties flagsProperties
+}
+
+type flagsInfo struct {
+	Flags []string
+}
+
+var flagsProviderKey = blueprint.NewProvider[flagsInfo]()
+
+// se_flags contains a list of build time flags for sepolicy.  Build time flags are defined under
+// .scl files (e.g. build/release/build_flags.scl). By importing flags with se_flags modules,
+// sepolicy rules can be guarded by `is_flag_enabled` / `is_flag_disabled` macro.
+//
+// For example, an Android.bp file could have:
+//
+//	se_flags {
+//		name: "aosp_selinux_flags",
+//		flags: ["RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT"],
+//		export_to: ["all_selinux_flags"],
+//	}
+//
+// And then one could flag-guard .te file rules:
+//
+//	is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
+//		type vfio_handler, domain, coredomain;
+//		binder_use(vfio_handler)
+//	')
+//
+// or contexts entries:
+//
+//	is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
+//		android.system.virtualizationservice_internal.IVfioHandler u:object_r:vfio_handler_service:s0
+//	')
+func flagsFactory() android.Module {
+	module := &flagsModule{}
+	module.AddProperties(&module.properties)
+	android.InitAndroidModule(module)
+	return module
+}
+
+func (f *flagsModule) DepsMutator(ctx android.BottomUpMutatorContext) {
+	// dep se_flag_collector -> se_flags
+	for _, export := range f.properties.Export_to {
+		ctx.AddReverseDependency(ctx.Module(), flagsDepTag, export)
+	}
+}
+
+func (f *flagsModule) GenerateAndroidBuildActions(ctx android.ModuleContext) {
+	android.SetProvider(ctx, flagsProviderKey, flagsInfo{
+		Flags: f.properties.Flags,
+	})
+}
+
+type buildFlagsInfo struct {
+	BuildFlags map[string]string
+}
+
+var buildFlagsProviderKey = blueprint.NewProvider[buildFlagsInfo]()
+
+type flagsCollectorModule struct {
+	android.ModuleBase
+	buildFlags map[string]string
+}
+
+// se_flags_collector module collects flags from exported se_flags modules (see export_to property
+// of se_flags modules), and then converts them into build-time flags.  It will be used to generate
+// M4 macros to flag-guard sepolicy.
+func flagsCollectorFactory() android.Module {
+	module := &flagsCollectorModule{}
+	android.InitAndroidModule(module)
+	return module
+}
+
+func (f *flagsCollectorModule) GenerateAndroidBuildActions(ctx android.ModuleContext) {
+	var flags []string
+	ctx.VisitDirectDepsWithTag(flagsDepTag, func(m android.Module) {
+		if dep, ok := android.OtherModuleProvider(ctx, m, flagsProviderKey); ok {
+			flags = append(flags, dep.Flags...)
+		} else {
+			ctx.ModuleErrorf("unknown dependency %q", ctx.OtherModuleName(m))
+		}
+	})
+	buildFlags := make(map[string]string)
+	for _, flag := range android.SortedUniqueStrings(flags) {
+		if val, ok := ctx.Config().GetBuildFlag(flag); ok {
+			buildFlags[flag] = val
+		}
+	}
+	android.SetProvider(ctx, buildFlagsProviderKey, buildFlagsInfo{
+		BuildFlags: buildFlags,
+	})
+}
+
+type flaggableModuleProperties struct {
+	// List of se_flag_collector modules to be passed to M4 macro.
+	Build_flags []string
 }
 
 type flaggableModule interface {
 	android.Module
 	flagModuleBase() *flaggableModuleBase
+	flagDeps(ctx android.BottomUpMutatorContext)
 	getBuildFlags(ctx android.ModuleContext) map[string]string
 }
 
 type flaggableModuleBase struct {
-	properties flagsProperties
+	properties flaggableModuleProperties
 }
 
 func initFlaggableModule(m flaggableModule) {
@@ -42,13 +161,19 @@
 	return f
 }
 
+func (f *flaggableModuleBase) flagDeps(ctx android.BottomUpMutatorContext) {
+	ctx.AddDependency(ctx.Module(), buildFlagsDepTag, f.properties.Build_flags...)
+}
+
 // getBuildFlags returns a map from flag names to flag values.
 func (f *flaggableModuleBase) getBuildFlags(ctx android.ModuleContext) map[string]string {
 	ret := make(map[string]string)
-	for _, flag := range android.SortedUniqueStrings(f.properties.Flags) {
-		if val, ok := ctx.Config().GetBuildFlag(flag); ok {
-			ret[flag] = val
+	ctx.VisitDirectDepsWithTag(buildFlagsDepTag, func(m android.Module) {
+		if dep, ok := android.OtherModuleProvider(ctx, m, buildFlagsProviderKey); ok {
+			maps.Copy(ret, dep.BuildFlags)
+		} else {
+			ctx.PropertyErrorf("build_flags", "unknown dependency %q", ctx.OtherModuleName(m))
 		}
-	}
+	})
 	return ret
 }
diff --git a/build/soong/policy.go b/build/soong/policy.go
index 9d87275..cbcc57a 100644
--- a/build/soong/policy.go
+++ b/build/soong/policy.go
@@ -129,7 +129,7 @@
 	c := &policyConfDefaults{}
 	c.AddProperties(
 		&policyConfProperties{},
-		&flagsProperties{},
+		&flaggableModuleProperties{},
 	)
 	android.InitDefaultsModule(c)
 	return c
@@ -270,6 +270,10 @@
 	return conf
 }
 
+func (c *policyConf) DepsMutator(ctx android.BottomUpMutatorContext) {
+	c.flagDeps(ctx)
+}
+
 func (c *policyConf) GenerateAndroidBuildActions(ctx android.ModuleContext) {
 	if !c.installable() {
 		c.SkipInstall()
diff --git a/build/soong/selinux_contexts.go b/build/soong/selinux_contexts.go
index 5cc9c70..1282b90 100644
--- a/build/soong/selinux_contexts.go
+++ b/build/soong/selinux_contexts.go
@@ -110,6 +110,8 @@
 }
 
 func (m *selinuxContextsModule) DepsMutator(ctx android.BottomUpMutatorContext) {
+	m.flagDeps(ctx)
+
 	if m.deps != nil {
 		m.deps(ctx)
 	}
@@ -182,7 +184,7 @@
 	m.AddProperties(
 		&selinuxContextsProperties{},
 		&seappProperties{},
-		&flagsProperties{},
+		&flaggableModuleProperties{},
 	)
 	android.InitDefaultsModule(m)
 	return m
diff --git a/build/soong/selinux_test.go b/build/soong/selinux_test.go
new file mode 100644
index 0000000..dd980a5
--- /dev/null
+++ b/build/soong/selinux_test.go
@@ -0,0 +1,96 @@
+// Copyright 2024 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package selinux
+
+import (
+	"os"
+	"reflect"
+	"testing"
+
+	"android/soong/android"
+)
+
+func TestMain(m *testing.M) {
+	os.Exit(m.Run())
+}
+
+var prepareForTest = android.GroupFixturePreparers(
+	android.FixtureModifyProductVariables(func(variables android.FixtureProductVariables) {
+		buildFlags := make(map[string]string)
+		buildFlags["RELEASE_FLAGS_BAR"] = "true"
+		buildFlags["RELEASE_FLAGS_FOO1"] = "false"
+		// "RELEASE_FLAGS_FOO2" is missing
+		buildFlags["RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT"] = "true"
+		variables.BuildFlags = buildFlags
+	}),
+	android.FixtureRegisterWithContext(func(ctx android.RegistrationContext) {
+		ctx.RegisterModuleType("se_flags", flagsFactory)
+		ctx.RegisterModuleType("se_flags_collector", flagsCollectorFactory)
+	}),
+)
+
+func TestFlagCollector(t *testing.T) {
+	t.Parallel()
+
+	ctx := android.GroupFixturePreparers(
+		prepareForTest,
+		android.FixtureAddTextFile("package_bar/Android.bp", `
+			se_flags {
+				name: "se_flags_bar",
+				flags: ["RELEASE_FLAGS_BAR"],
+				export_to: ["se_flags_collector"],
+			}
+			`),
+		android.FixtureAddTextFile("package_foo/Android.bp", `
+			se_flags {
+				name: "se_flags_foo",
+				flags: ["RELEASE_FLAGS_FOO1", "RELEASE_FLAGS_FOO2"],
+				export_to: ["se_flags_collector"],
+			}
+			`),
+		android.FixtureAddTextFile("system/sepolicy/Android.bp", `
+			se_flags {
+				name: "se_flags",
+				flags: ["RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT"],
+				export_to: ["se_flags_collector"],
+			}
+			se_flags_collector {
+				name: "se_flags_collector",
+			}
+			`),
+	).RunTest(t).TestContext
+
+	collectorModule := ctx.ModuleForTests("se_flags_collector", "").Module()
+	collectorData, ok := android.OtherModuleProvider(ctx.OtherModuleProviderAdaptor(), collectorModule, buildFlagsProviderKey)
+	if !ok {
+		t.Errorf("se_flags_collector must provide buildFlags")
+		return
+	}
+
+	actual := flagsToM4Macros(collectorData.BuildFlags)
+	expected := []string{
+		"-D target_flag_RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT=true",
+		"-D target_flag_RELEASE_FLAGS_BAR=true",
+		"-D target_flag_RELEASE_FLAGS_FOO1=false",
+	}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("M4 macros were not exported correctly"+
+			"\nactual:   %v"+
+			"\nexpected: %v",
+			actual,
+			expected,
+		)
+	}
+}
diff --git a/build/soong/service_fuzzer_bindings.go b/build/soong/service_fuzzer_bindings.go
index 726f0ab..b6ee9dc 100644
--- a/build/soong/service_fuzzer_bindings.go
+++ b/build/soong/service_fuzzer_bindings.go
@@ -186,6 +186,7 @@
 		"android.hardware.security.keymint.IRemotelyProvisionedComponent/avf": EXCEPTION_NO_FUZZER,
 		"android.system.virtualizationservice":                            EXCEPTION_NO_FUZZER,
 		"android.system.virtualizationservice_internal.IVfioHandler":      EXCEPTION_NO_FUZZER,
+		"android.system.virtualizationmaintenance":                        EXCEPTION_NO_FUZZER,
 		"ambient_context":                                                 EXCEPTION_NO_FUZZER,
 		"app_binding":                                                     EXCEPTION_NO_FUZZER,
 		"app_hibernation":                                                 EXCEPTION_NO_FUZZER,
diff --git a/contexts/plat_file_contexts_test b/contexts/plat_file_contexts_test
index 841233f..c799171 100644
--- a/contexts/plat_file_contexts_test
+++ b/contexts/plat_file_contexts_test
@@ -654,6 +654,9 @@
 
 /oem                                                              oemfs
 /oem/does_not_exist                                               oemfs
+/oem/media/bootanimation.zip                                      bootanim_oem_file
+/oem/media/shutdownanimation.zip                                  bootanim_oem_file
+/oem/media/userspace-reboot.zip                                   bootanim_oem_file
 /oem/overlay                                                      vendor_overlay_file
 /oem/overlay/does_not_exist                                       vendor_overlay_file
 
@@ -993,10 +996,12 @@
 /data/misc/odsign/test                                            odsign_data_file
 /data/misc/odsign/metrics                                         odsign_metrics_file
 /data/misc/odsign/metrics/test                                    odsign_metrics_file
-/data/misc/perfetto-traces/bugreport                             perfetto_traces_bugreport_data_file
-/data/misc/perfetto-traces/bugreport/test                        perfetto_traces_bugreport_data_file
+/data/misc/perfetto-traces/bugreport                              perfetto_traces_bugreport_data_file
+/data/misc/perfetto-traces/bugreport/test                         perfetto_traces_bugreport_data_file
 /data/misc/perfetto-traces                                        perfetto_traces_data_file
 /data/misc/perfetto-traces/test                                   perfetto_traces_data_file
+/data/misc/perfetto-traces/profiling                              perfetto_traces_profiling_data_file
+/data/misc/perfetto-traces/profiling/test                         perfetto_traces_profiling_data_file
 /data/misc/perfetto-configs                                       perfetto_configs_data_file
 /data/misc/perfetto-configs/test                                  perfetto_configs_data_file
 /data/misc/prereboot                                              prereboot_data_file
diff --git a/flagging/Android.bp b/flagging/Android.bp
index 55e116b..bdd0481 100644
--- a/flagging/Android.bp
+++ b/flagging/Android.bp
@@ -12,24 +12,34 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// This file contains a list of flags for sepolicy.
+// This module contains a list of build time flags (defined on AOSP) for sepolicy.
+// Additional se_flags modules can be added anywhere for additional flags.
+se_flags {
+    name: "aosp_selinux_flags",
+    flags: [
+        "RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT",
+        "RELEASE_AVF_ENABLE_LLPVM_CHANGES",
+        "RELEASE_HARDWARE_BLUETOOTH_RANGING_SERVICE",
+    ],
+    export_to: ["all_selinux_flags"],
+}
+
+// se_flags_collector collects flags from exported se_flags modules and converts it to build flags.
+se_flags_collector {
+    name: "all_selinux_flags",
+}
+
 se_policy_conf_defaults {
     name: "se_policy_conf_flags_defaults",
     srcs: [":sepolicy_flagging_macros"],
-    flags: [
-        "RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT",
-        "RELEASE_HARDWARE_BLUETOOTH_RANGING_SERVICE",
-    ],
+    build_flags: ["all_selinux_flags"],
 }
 
 contexts_defaults {
     name: "contexts_flags_defaults",
     srcs: [":sepolicy_flagging_macros"],
     neverallow_files: [":sepolicy_flagging_macros"], // for seapp_contexts
-    flags: [
-        "RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT",
-        "RELEASE_HARDWARE_BLUETOOTH_RANGING_SERVICE",
-    ],
+    build_flags: ["all_selinux_flags"],
 }
 
 filegroup {
diff --git a/private/app_zygote.te b/private/app_zygote.te
index e3869cd..b51f633 100644
--- a/private/app_zygote.te
+++ b/private/app_zygote.te
@@ -93,6 +93,10 @@
 # Allow app_zygote to access odsign verification status
 get_prop(app_zygote, odsign_prop)
 
+# /data/resource-cache
+allow app_zygote resourcecache_data_file:file r_file_perms;
+allow app_zygote resourcecache_data_file:dir r_dir_perms;
+
 #####
 ##### Neverallow
 #####
diff --git a/private/compat/34.0/34.0.cil b/private/compat/34.0/34.0.cil
index 595d53e..7d80433 100644
--- a/private/compat/34.0/34.0.cil
+++ b/private/compat/34.0/34.0.cil
@@ -2099,7 +2099,7 @@
 (typeattributeset null_device_34_0 (null_device))
 (typeattributeset oem_lock_service_34_0 (oem_lock_service))
 (typeattributeset oem_unlock_prop_34_0 (oem_unlock_prop))
-(typeattributeset oemfs_34_0 (oemfs))
+(typeattributeset oemfs_34_0 (oemfs bootanim_oem_file))
 (typeattributeset ondevicepersonalization_system_service_34_0 (ondevicepersonalization_system_service))
 (typeattributeset ota_data_file_34_0 (ota_data_file))
 (typeattributeset ota_metadata_file_34_0 (ota_metadata_file))
diff --git a/private/domain.te b/private/domain.te
index 90e319f..59e30c8 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -179,6 +179,35 @@
 # Allow all processes to connect to PRNG seeder daemon.
 unix_socket_connect(domain, prng_seeder, prng_seeder)
 
+# Allow calls to system(3), popen(3), ...
+allow {
+  domain
+  # Except domains that explicitly neverallow it.
+  -kernel
+  -init
+  -vendor_init
+  -app_zygote
+  -webview_zygote
+  -system_server
+  -artd
+  -audioserver
+  -cameraserver
+  -mediadrmserver
+  -mediaextractor
+  -mediametrics
+  -mediaserver
+  -mediatuner
+  -mediatranscoding
+  -ueventd
+  -hal_audio_server
+  -hal_camera_server
+  -hal_cas_server
+  -hal_codec2_server
+  -hal_configstore_server
+  -hal_drm_server
+  -hal_omx_server
+} {shell_exec toolbox_exec}:file rx_file_perms;
+
 # No domains other than a select few can access the misc_block_device. This
 # block device is reserved for OTA use.
 # Do not assert this rule on userdebug/eng builds, due to some devices using
diff --git a/private/file.te b/private/file.te
index 450fe2c..24c118a 100644
--- a/private/file.te
+++ b/private/file.te
@@ -25,6 +25,9 @@
 # /data/misc/perfetto-traces/bugreport for perfetto traces for bugreports.
 type perfetto_traces_bugreport_data_file, file_type, data_file_type, core_data_file_type;
 
+# /data/misc/perfetto-traces/profiling for perfetto traces from profiling apis.
+type perfetto_traces_profiling_data_file, file_type, data_file_type, core_data_file_type;
+
 # /data/misc/perfetto-configs for perfetto configs
 type perfetto_configs_data_file, file_type, data_file_type, core_data_file_type;
 
diff --git a/private/file_contexts b/private/file_contexts
index b5a3f66..b9d661a 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -458,6 +458,9 @@
 
 /oem(/.*)?              u:object_r:oemfs:s0
 /oem/overlay(/.*)?      u:object_r:vendor_overlay_file:s0
+/oem/media/bootanimation.zip            u:object_r:bootanim_oem_file:s0
+/oem/media/shutdownanimation.zip        u:object_r:bootanim_oem_file:s0
+/oem/media/userspace-reboot.zip         u:object_r:bootanim_oem_file:s0
 
 # The precompiled monolithic sepolicy will be under /odm only when
 # BOARD_USES_ODMIMAGE is true: a separate odm.img is built.
@@ -658,9 +661,10 @@
 /data/misc/odrefresh(/.*)?      u:object_r:odrefresh_data_file:s0
 /data/misc/odsign(/.*)?         u:object_r:odsign_data_file:s0
 /data/misc/odsign/metrics(/.*)? u:object_r:odsign_metrics_file:s0
-/data/misc/perfetto-traces(/.*)?          u:object_r:perfetto_traces_data_file:s0
-/data/misc/perfetto-traces/bugreport(.*)? u:object_r:perfetto_traces_bugreport_data_file:s0
-/data/misc/perfetto-configs(/.*)?         u:object_r:perfetto_configs_data_file:s0
+/data/misc/perfetto-traces(/.*)?           u:object_r:perfetto_traces_data_file:s0
+/data/misc/perfetto-traces/bugreport(.*)?  u:object_r:perfetto_traces_bugreport_data_file:s0
+/data/misc/perfetto-traces/profiling(/.*)? u:object_r:perfetto_traces_profiling_data_file:s0
+/data/misc/perfetto-configs(/.*)?          u:object_r:perfetto_configs_data_file:s0
 /data/misc/uprobestats-configs(/.*)?      u:object_r:uprobestats_configs_data_file:s0
 /data/misc/prereboot(/.*)?      u:object_r:prereboot_data_file:s0
 /data/misc/profcollectd(/.*)?   u:object_r:profcollectd_data_file:s0
diff --git a/private/mediaprovider_app.te b/private/mediaprovider_app.te
index 7ad8feb..064d0d9 100644
--- a/private/mediaprovider_app.te
+++ b/private/mediaprovider_app.te
@@ -73,3 +73,6 @@
 # bpfprog access for FUSE BPF
 allow mediaprovider_app fs_bpf:file read;
 allow mediaprovider_app bpfloader:bpf { map_read map_write prog_run };
+
+# boot animations on oem are stored with specific label
+allow mediaprovider_app bootanim_oem_file:file r_file_perms;
diff --git a/private/perfetto.te b/private/perfetto.te
index aae61a6..d0088ef 100644
--- a/private/perfetto.te
+++ b/private/perfetto.te
@@ -26,6 +26,10 @@
 allow perfetto perfetto_traces_bugreport_data_file:file create_file_perms;
 allow perfetto perfetto_traces_bugreport_data_file:dir rw_dir_perms;
 
+# Allow to write and unlink traces into /data/misc/perfetto-traces/profiling.
+allow perfetto perfetto_traces_profiling_data_file:dir rw_dir_perms;
+allow perfetto perfetto_traces_profiling_data_file:file create_file_perms;
+
 # Allow perfetto to access the proxy service for reporting traces.
 allow perfetto tracingproxy_service:service_manager find;
 binder_use(perfetto)
@@ -86,6 +90,7 @@
   -dumpstate # For attaching traces to bugreports.
   -incidentd # For receiving reported traces. TODO(lalitm): remove this.
   -priv_app  # For stating traces for bug-report UI.
+  -system_server # For accessing traces started by profiling apis.
 } perfetto_traces_data_file:dir *;
 neverallow {
   domain
@@ -122,14 +127,20 @@
   -vendor_data_file
   -perfetto_traces_data_file
   -perfetto_traces_bugreport_data_file
+  -perfetto_traces_profiling_data_file
   -perfetto_configs_data_file
   with_native_coverage(`-method_trace_data_file')
 }:dir *;
-neverallow perfetto { system_data_file -perfetto_traces_data_file }:dir ~{ getattr search };
+neverallow perfetto {
+  system_data_file
+  -perfetto_traces_data_file
+  -perfetto_traces_profiling_data_file
+}:dir ~{ getattr search };
 neverallow perfetto {
   data_file_type
   -perfetto_traces_data_file
   -perfetto_traces_bugreport_data_file
+  -perfetto_traces_profiling_data_file
   -perfetto_configs_data_file
   with_native_coverage(`-method_trace_data_file')
 }:file ~write;
diff --git a/private/service.te b/private/service.te
index 36d6ccf..c4e7cbc 100644
--- a/private/service.te
+++ b/private/service.te
@@ -26,6 +26,9 @@
 is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
     type vfio_handler_service,          service_manager_type;
 ')
+is_flag_enabled(RELEASE_AVF_ENABLE_LLPVM_CHANGES, `
+    type virtualization_maintenance_service, service_manager_type;
+')
 
 type uce_service,                   service_manager_type;
 type wearable_sensing_service,      app_api_service, system_server_service, service_manager_type;
diff --git a/private/service_contexts b/private/service_contexts
index 82af95e..3138d90 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -165,6 +165,9 @@
 is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
     android.system.virtualizationservice_internal.IVfioHandler u:object_r:vfio_handler_service:s0
 ')
+is_flag_enabled(RELEASE_AVF_ENABLE_LLPVM_CHANGES, `
+    android.system.virtualizationmaintenance u:object_r:virtualization_maintenance_service:s0
+')
 ambient_context                           u:object_r:ambient_context_service:s0
 app_binding                               u:object_r:app_binding_service:s0
 app_hibernation                           u:object_r:app_hibernation_service:s0
diff --git a/private/system_server.te b/private/system_server.te
index b58315d..5b0caaa 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -582,6 +582,11 @@
 domain_auto_trans(system_server, perfetto_exec, perfetto);
 allow system_server perfetto:fifo_file { read write };
 
+# Allow system server to manage perfetto traces for ProfilingService.
+allow system_server perfetto_traces_profiling_data_file:dir rw_dir_perms;
+allow system_server perfetto_traces_profiling_data_file:file { rw_file_perms unlink };
+allow system_server perfetto_traces_data_file:dir search;
+
 # Manage /data/backup.
 allow system_server backup_data_file:dir create_dir_perms;
 allow system_server backup_data_file:file create_file_perms;
@@ -982,6 +987,9 @@
 allow system_server surfaceflinger_service:service_manager find;
 allow system_server update_engine_service:service_manager find;
 allow system_server virtual_camera_service:service_manager find;
+is_flag_enabled(RELEASE_AVF_ENABLE_LLPVM_CHANGES, `
+    allow system_server virtualization_maintenance_service:service_manager find;
+')
 allow system_server vold_service:service_manager find;
 allow system_server wifinl80211_service:service_manager find;
 allow system_server logd_service:service_manager find;
@@ -1299,6 +1307,9 @@
 neverallow system_server { domain -clatd -crash_dump -perfetto }:process transition;
 neverallow system_server *:process dyntransition;
 
+# Ensure that system_server doesn't access anything but search in perfetto_traces_data_file:dir.
+neverallow system_server perfetto_traces_data_file:dir ~search;
+
 # Only allow crash_dump to connect to system_ndebug_socket.
 neverallow { domain -init -system_server -crash_dump } system_ndebug_socket:sock_file { open write };
 
diff --git a/private/vfio_handler.te b/private/vfio_handler.te
index 963809e..fd6499d 100644
--- a/private/vfio_handler.te
+++ b/private/vfio_handler.te
@@ -31,7 +31,4 @@
     # Allow vfio_handler to search /dev/block for accessing dtbo.img
     allow vfio_handler block_device:dir search;
     allow vfio_handler dtbo_block_device:blk_file r_file_perms;
-
-    # Only vfio_handler can add vfio_handler_service
-    neverallow { domain -vfio_handler } vfio_handler_service:service_manager add;
 ') # is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT)
diff --git a/private/virtualizationservice.te b/private/virtualizationservice.te
index 972f376..ee288f2 100644
--- a/private/virtualizationservice.te
+++ b/private/virtualizationservice.te
@@ -12,8 +12,11 @@
 # Let the virtualizationservice domain use Binder.
 binder_use(virtualizationservice)
 
-# Let the virtualizationservice domain register the virtualization_service with ServiceManager.
+# Register our services with ServiceManager.
 add_service(virtualizationservice, virtualization_service)
+is_flag_enabled(RELEASE_AVF_ENABLE_LLPVM_CHANGES, `
+    add_service(virtualizationservice, virtualization_maintenance_service)
+')
 
 is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
     # Let virtualizationservice find and communicate with vfio_handler.
@@ -33,6 +36,9 @@
 binder_call(virtualizationservice, remote_provisioning_service)
 allow virtualizationservice remote_provisioning_service:service_manager find;
 
+# Allow virtualizationservice to manage VM secrets via Secretkeeper.
+hal_client_domain(virtualizationservice, hal_secretkeeper)
+
 # Let virtualizationservice remove memlock rlimit of virtualizationmanager. This is necessary
 # to mlock VM memory and page tables.
 allow virtualizationservice self:capability sys_resource;
@@ -56,8 +62,9 @@
 virtualizationservice_use(virtualizationservice)
 
 # Allow virtualizationservice to read and write in the apex data directory
-# /data/misc/apexdata/com.android.virt
-allow virtualizationservice apex_module_data_file:dir search;
+# /data/misc/apexdata/com.android.virt. Also allow checking of the parent directory
+# (needed for SQLite database creation).
+allow virtualizationservice apex_module_data_file:dir { search getattr };
 allow virtualizationservice apex_virt_data_file:dir create_dir_perms;
 allow virtualizationservice apex_virt_data_file:file create_file_perms;
 
diff --git a/private/webview_zygote.te b/private/webview_zygote.te
index 0556950..1e32c1f 100644
--- a/private/webview_zygote.te
+++ b/private/webview_zygote.te
@@ -93,6 +93,10 @@
 # Allow webview_zygote to access odsign verification status
 get_prop(zygote, odsign_prop)
 
+# /data/resource-cache
+allow webview_zygote resourcecache_data_file:file r_file_perms;
+allow webview_zygote resourcecache_data_file:dir r_dir_perms;
+
 #####
 ##### Neverallow
 #####
diff --git a/public/bootanim.te b/public/bootanim.te
index a9616b7..239393c 100644
--- a/public/bootanim.te
+++ b/public/bootanim.te
@@ -17,7 +17,9 @@
 allow bootanim sysfs_gpu:file r_file_perms;
 
 # /oem access
-r_dir_file(bootanim, oemfs);
+allow bootanim oemfs:dir r_dir_perms;
+# boot animations on oem are stored with specific label
+allow bootanim bootanim_oem_file:file r_file_perms;
 
 allow bootanim audio_device:dir r_dir_perms;
 allow bootanim audio_device:chr_file rw_file_perms;
diff --git a/public/domain.te b/public/domain.te
index e27da4f..755b4b2 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -924,6 +924,9 @@
         -crash_dump_exec
         -netutils_wrapper_exec
         userdebug_or_eng(`-tcpdump_exec')
+        # Vendor components still can invoke shell commands via /system/bin/sh
+        -shell_exec
+        -toolbox_exec
     }:file { entrypoint execute execute_no_trans };
 ')
 
@@ -1004,6 +1007,9 @@
     -task_profiles_api_file
     -task_profiles_file
     userdebug_or_eng(`-tcpdump_exec')
+    # Vendor components still can invoke shell commands via /system/bin/sh
+    -shell_exec
+    -toolbox_exec
   }:file *;
 ')
 
diff --git a/public/file.te b/public/file.te
index b887406..209fdb1 100644
--- a/public/file.te
+++ b/public/file.te
@@ -229,6 +229,8 @@
 type linkerconfig_file, file_type;
 # Control files under /data/incremental
 type incremental_control_file, file_type, data_file_type, core_data_file_type;
+# /oem/media/bootanimation.zip|shutdownanimation.zip|userspace-reboot.zip
+type bootanim_oem_file, file_type, system_file_type;
 
 # Default type for directories search for
 # HAL implementations
diff --git a/public/hal_neverallows.te b/public/hal_neverallows.te
index 621a0b8..6730c32 100644
--- a/public/hal_neverallows.te
+++ b/public/hal_neverallows.te
@@ -85,7 +85,13 @@
   halserverdomain
   -hal_dumpstate_server
   -hal_telephony_server
-} { file_type fs_type }:file execute_no_trans;
+} {
+  file_type
+  fs_type
+  # May invoke shell commands via /system/bin/sh
+  -shell_exec
+  -toolbox_exec
+}:file execute_no_trans;
 # Do not allow a process other than init to transition into a HAL domain.
 neverallow { domain -init } halserverdomain:process transition;
 # Only allow transitioning to a domain by running its executable. Do not
diff --git a/public/mediaserver.te b/public/mediaserver.te
index 367012c..9b86c86 100644
--- a/public/mediaserver.te
+++ b/public/mediaserver.te
@@ -98,6 +98,9 @@
 allow mediaserver oemfs:dir search;
 allow mediaserver oemfs:file r_file_perms;
 
+# /oem boot animation file
+allow mediaserver bootanim_oem_file:file r_file_perms;
+
 # /vendor apk access
 allow mediaserver vendor_app_file:file { read map getattr };