diff --git a/private/apexd.te b/private/apexd.te
index 2290878..ef08faa 100644
--- a/private/apexd.te
+++ b/private/apexd.te
@@ -40,6 +40,10 @@
 allow apexd apex_mnt_dir:dir mounton;
 # allow apexd to create symlinks in /apex
 allow apexd apex_mnt_dir:lnk_file create_file_perms;
+# allow apexd to unlink apex files in /data/apex/active
+# note that apexd won't be able to unlink files in /data/staging/session_XXXX,
+# because it doesn't have write permission for staging_data_file object.
+allow apexd staging_data_file:file unlink;
 
 # allow apexd to relabel apk_tmp_file to apex_data_file.
 # TODO(b/112669193) remove this when APEXes are staged via file descriptor
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 4ecb355..e46c4ef 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -334,3 +334,13 @@
 
 # Untrusted apps are not allowed to use cgroups.
 neverallow all_untrusted_apps cgroup:file *;
+
+# TODO(b/113362644): remove open permission from these domains.
+# Untrusted apps targetting >= Q are not allowed to open /dev/ashmem directly.
+#neverallow {
+#  all_untrusted_apps
+# TODO(b/113362644): route mediaprovider to ashmemd
+#  -mediaprovider
+#  -untrusted_app_25
+#  -untrusted_app_27
+#} ashmem_device:chr_file open;
diff --git a/private/app_zygote.te b/private/app_zygote.te
index aa5be4c..e221666 100644
--- a/private/app_zygote.te
+++ b/private/app_zygote.te
@@ -100,6 +100,7 @@
 neverallow app_zygote {
     service_manager_type
     -activity_service
+    -ashmem_device_service
     -webviewupdate_service
 }:service_manager find;
 
diff --git a/private/ashmemd.te b/private/ashmemd.te
new file mode 100644
index 0000000..08df515
--- /dev/null
+++ b/private/ashmemd.te
@@ -0,0 +1,9 @@
+typeattribute ashmemd coredomain;
+type ashmemd_exec, exec_type, file_type, system_file_type;
+
+init_daemon_domain(ashmemd)
+
+binder_use(ashmemd)
+add_service(ashmemd, ashmem_device_service)
+
+allow ashmemd ashmem_device:chr_file rw_file_perms;
diff --git a/private/compat/28.0/28.0.ignore.cil b/private/compat/28.0/28.0.ignore.cil
index 6154e3c..c989825 100644
--- a/private/compat/28.0/28.0.ignore.cil
+++ b/private/compat/28.0/28.0.ignore.cil
@@ -20,6 +20,8 @@
     app_prediction_service
     app_zygote
     app_zygote_tmpfs
+    ashmemd
+    ashmem_device_service
     biometric_service
     bpf_progs_loaded_prop
     bugreport_service
diff --git a/private/coredomain.te b/private/coredomain.te
index 9899d02..ebad8e7 100644
--- a/private/coredomain.te
+++ b/private/coredomain.te
@@ -188,3 +188,18 @@
 full_treble_only(`
   neverallow coredomain tee_device:chr_file { open read append write ioctl };
 ')
+
+# Allow access to ashmemd to request /dev/ashmem fds.
+allow {
+  coredomain
+  -init
+  -iorapd
+  -perfprofd
+} ashmem_device_service:service_manager find;
+
+binder_call({
+  coredomain
+  -init
+  -iorapd
+  -perfprofd
+}, ashmemd)
diff --git a/private/domain.te b/private/domain.te
index 39b7c75..7c074e8 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -153,9 +153,10 @@
 neverallow { domain -init -system_server -apexd } staging_data_file:dir *;
 neverallow { domain -init -system_server -apexd -kernel } staging_data_file:file *;
 neverallow { domain -init -system_server } staging_data_file:dir no_w_dir_perms;
-# apexd needs the link permission, so list every `no_w_file_perms` except for `link`.
+# apexd needs the link and unlink permissions, so list every `no_w_file_perms`
+# except for `link` and `unlink`.
 neverallow { domain -init -system_server } staging_data_file:file
-  { append create unlink relabelfrom rename setattr write no_x_file_perms };
+  { append create relabelfrom rename setattr write no_x_file_perms };
 
 neverallow {
     domain
diff --git a/private/file_contexts b/private/file_contexts
index b793e82..0c37525 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -186,6 +186,7 @@
 /system(/.*)?		u:object_r:system_file:s0
 /system/lib(64)?(/.*)?		u:object_r:system_lib_file:s0
 /system/bin/atrace	u:object_r:atrace_exec:s0
+/system/bin/ashmemd	u:object_r:ashmemd_exec:s0
 /system/bin/bcc                 u:object_r:rs_exec:s0
 /system/bin/blank_screen	u:object_r:blank_screen_exec:s0
 /system/bin/e2fsdroid		u:object_r:e2fs_exec:s0
diff --git a/private/hal_allocator_default.te b/private/hal_allocator_default.te
index 7aa28aa..9dbe923 100644
--- a/private/hal_allocator_default.te
+++ b/private/hal_allocator_default.te
@@ -3,3 +3,6 @@
 
 type hal_allocator_default_exec, system_file_type, exec_type, file_type;
 init_daemon_domain(hal_allocator_default)
+
+# To talk to ashmemd
+binder_use(hal_allocator_default)
diff --git a/private/isolated_app.te b/private/isolated_app.te
index 017f46b..8a0f96b 100644
--- a/private/isolated_app.te
+++ b/private/isolated_app.te
@@ -90,10 +90,12 @@
 
 # b/17487348
 # Isolated apps can only access three services,
-# activity_service, display_service and webviewupdate_service.
+# activity_service, display_service, webviewupdate_service, and
+# ashmem_device_service.
 neverallow isolated_app {
     service_manager_type
     -activity_service
+    -ashmem_device_service
     -display_service
     -webviewupdate_service
 }:service_manager find;
diff --git a/private/seapp_contexts b/private/seapp_contexts
index ae07a96..964f47d 100644
--- a/private/seapp_contexts
+++ b/private/seapp_contexts
@@ -1,3 +1,7 @@
+# The entries in this file define how security contexts for apps are determined.
+# Each entry lists input selectors, used to match the app, and outputs which are
+# used to determine the security contexts for matching apps.
+#
 # Input selectors:
 #       isSystemServer (boolean)
 #       isEphemeralApp (boolean)
@@ -10,57 +14,93 @@
 #       isPrivApp (boolean)
 #       minTargetSdkVersion (unsigned integer)
 #       fromRunAs (boolean)
-# isSystemServer=true can only be used once.
+#
+# All specified input selectors in an entry must match (i.e. logical AND).
+# An unspecified string or boolean selector with no default will match any
+# value.
+# A user, name, or path string selector that ends in * will perform a prefix
+# match.
+# String matching is case-insensitive.
+# See external/selinux/libselinux/src/android/android_platform.c,
+# seapp_context_lookup().
+#
+# isSystemServer=true only matches the system server.
 # An unspecified isSystemServer defaults to false.
 # isEphemeralApp=true will match apps marked by PackageManager as Ephemeral
 # isV2App=true will match apps in the v2 app sandbox.
 # isOwner=true will only match for the owner/primary user.
-# isOwner=false will only match for secondary users.
-# If unspecified, the entry can match either case.
-# An unspecified string selector will match any value.
-# A user string selector that ends in * will perform a prefix match.
-# user=_app will match any regular app UID.
-# user=_isolated will match any isolated service UID.
+# user=_app will match any regular app process.
+# user=_isolated will match any isolated service process.
+# Other values of user are matched against the name associated with the process
+# UID.
+# seinfo= matches aginst the seinfo tag for the app, determined from
+# mac_permissions.xml files.
+# The ':' character is reserved and may not be used in seinfo.
+# name= matches against the package name of the app.
+# path= matches against the directory path when labeling app directories.
 # isPrivApp=true will only match for applications preinstalled in
 #       /system/priv-app.
 # minTargetSdkVersion will match applications with a targetSdkVersion
 #       greater than or equal to the specified value. If unspecified,
 #       it has a default value of 0.
-# fromRunAs=true means the setcontext request is from run-as. Default is false.
-# All specified input selectors in an entry must match (i.e. logical AND).
-# Matching is case-insensitive.
+# fromRunAs=true means the process being labeled is started by run-as. Default
+# is false.
 #
-# Precedence rules (see external/selinux/libselinux/src/android/android.c seapp_context_cmp()):
+# Precedence: entries are compared using the following rules, in the order shown
+# (see external/selinux/libselinux/src/android/android_platform.c,
+# seapp_context_cmp()).
 #       (1) isSystemServer=true before isSystemServer=false.
-#       (2) Specified isEphemeralApp= before unspecified isEphemeralApp= boolean.
+#       (2) Specified isEphemeralApp= before unspecified isEphemeralApp=
+#             boolean.
 #       (3) Specified isV2App= before unspecified isV2App= boolean.
 #       (4) Specified isOwner= before unspecified isOwner= boolean.
-#       (5) Specified user= string before unspecified user= string.
-#       (6) Fixed user= string before user= prefix (i.e. ending in *).
-#       (7) Longer user= prefix before shorter user= prefix.
-#       (8) Specified seinfo= string before unspecified seinfo= string.
-#           ':' character is reserved and may not be used.
-#       (9) Specified name= string before unspecified name= string.
-#       (10) Specified path= string before unspecified path= string.
-#       (11) Specified isPrivApp= before unspecified isPrivApp= boolean.
-#       (12) Higher value of minTargetSdkVersion= before lower value of minTargetSdkVersion=
-#              integer. Note that minTargetSdkVersion= defaults to 0 if unspecified.
-#       (13) fromRunAs=true before fromRunAs=false.
+#       (5) Specified user= string before unspecified user= string;
+#             more specific user= string before less specific user= string.
+#       (6) Specified seinfo= string before unspecified seinfo= string.
+#       (7) Specified name= string before unspecified name= string;
+#             more specific name= string before less specific name= string.
+#       (8) Specified path= string before unspecified path= string.
+#             more specific name= string before less specific name= string.
+#       (9) Specified isPrivApp= before unspecified isPrivApp= boolean.
+#       (10) Higher value of minTargetSdkVersion= before lower value of
+#              minTargetSdkVersion= integer. Note that minTargetSdkVersion=
+#              defaults to 0 if unspecified.
+#       (11) fromRunAs=true before fromRunAs=false.
+# (A fixed selector is more specific than a prefix, i.e. ending in *, and a
+# longer prefix is more specific than a shorter prefix.)
+# Apps are checked against entries in precedence order until the first match,
+# regardless of their order in this file.
+#
+# Duplicate entries, i.e. with identical input selectors, are not allowed.
 #
 # Outputs:
 #       domain (string)
 #       type (string)
 #       levelFrom (string; one of none, all, app, or user)
 #       level (string)
-# Only entries that specify domain= will be used for app process labeling.
-# Only entries that specify type= will be used for app directory labeling.
+#
+# domain= determines the label to be used for the app process; entries
+# without domain= are ignored for this purpose.
+# type= specifies the label to be used for the app data directory; entries
+# without type= are ignored for this purpose.
+# levelFrom and level are used to determine the level (sensitivity + categories)
+# for MLS/MCS.
+# levelFrom=none omits the level.
+# levelFrom=app determines the level from the process UID.
+# levelFrom=user determines the level from the user ID.
+# levelFrom=all determines the level from both UID and user ID.
+# 
 # levelFrom=user is only supported for _app or _isolated UIDs.
 # levelFrom=app or levelFrom=all is only supported for _app UIDs.
 # level may be used to specify a fixed level for any UID.
 #
+# For backwards compatibility levelFromUid=true is equivalent to levelFrom=app
+# and levelFromUid=false is equivalent to levelFrom=none.
+#
 #
 # Neverallow Assertions
-# Additional compile time assertion checks can be added as well. The assertion
+# Additional compile time assertion checks for the rules in this file can be
+# added as well. The assertion
 # rules are lines beginning with the keyword neverallow. Full support for PCRE
 # regular expressions exists on all input and output selectors. Neverallow
 # rules are never output to the built seapp_contexts file. Like all keywords,
diff --git a/private/service.te b/private/service.te
index 89664e4..1bec3ce 100644
--- a/private/service.te
+++ b/private/service.te
@@ -1,3 +1,4 @@
+type ashmem_device_service,         app_api_service, service_manager_type;
 type dynamic_android_service,       system_api_service, system_server_service, service_manager_type;
 type gsi_service,                   service_manager_type;
 type incidentcompanion_service,     system_api_service, system_server_service, service_manager_type;
diff --git a/private/service_contexts b/private/service_contexts
index 650b62e..1462033 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -10,6 +10,7 @@
 app_binding                               u:object_r:app_binding_service:s0
 app_prediction                            u:object_r:app_prediction_service:s0
 apexservice                               u:object_r:apex_service:s0
+ashmem_device_service                     u:object_r:ashmem_device_service:s0
 gsiservice                                u:object_r:gsi_service:s0
 appops                                    u:object_r:appops_service:s0
 appwidget                                 u:object_r:appwidget_service:s0
diff --git a/private/system_server.te b/private/system_server.te
index 98ae7f8..2cf5ea7 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -53,6 +53,12 @@
 allowxperm system_server self:udp_socket ioctl priv_sock_ioctls;
 bluetooth_domain(system_server)
 
+# Allow setup of tcp keepalive offload. This gives system_server the permission to
+# call ioctl on app domains' tcp sockets. Additional ioctl commands still need to
+# be granted individually, except for a small set of safe values whitelisted in
+# public/domain.te.
+allow system_server appdomain:tcp_socket ioctl;
+
 # These are the capabilities assigned by the zygote to the
 # system server.
 allow system_server self:global_capability_class_set {
diff --git a/private/untrusted_app_25.te b/private/untrusted_app_25.te
index 7cccbac..5e669c7 100644
--- a/private/untrusted_app_25.te
+++ b/private/untrusted_app_25.te
@@ -56,3 +56,7 @@
 # allowed for targetApi<=28 for compat reasons.
 allow untrusted_app_25 dex2oat_exec:file rx_file_perms;
 userdebug_or_eng(`auditallow untrusted_app_25 dex2oat_exec:file rx_file_perms;')
+
+# The ability to talk to /dev/ashmem directly. targetApi>=29 must use
+# ASharedMemory instead.
+allow untrusted_app_25 ashmem_device:chr_file rw_file_perms;
diff --git a/private/untrusted_app_27.te b/private/untrusted_app_27.te
index 0c9c684..7427b68 100644
--- a/private/untrusted_app_27.te
+++ b/private/untrusted_app_27.te
@@ -36,3 +36,7 @@
 # allowed for targetApi<=28 for compat reasons.
 allow untrusted_app_27 dex2oat_exec:file rx_file_perms;
 userdebug_or_eng(`auditallow untrusted_app_27 dex2oat_exec:file rx_file_perms;')
+
+# The ability to talk to /dev/ashmem directly. targetApi>=29 must use
+# ASharedMemory instead.
+allow untrusted_app_27 ashmem_device:chr_file rw_file_perms;
diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index 2c44627..2d07ecd 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -176,3 +176,9 @@
   allow untrusted_app_all debugfs_kcov:file rw_file_perms;
   allowxperm untrusted_app_all debugfs_kcov:file ioctl { KCOV_INIT_TRACE KCOV_ENABLE KCOV_DISABLE };
 ')
+
+# Allow access to ashmemd to request /dev/ashmem fds.
+binder_call(untrusted_app_all, ashmemd)
+
+# TODO(b/113362644): audit apps directly using /dev/ashmem and emit error
+# message with info on how to fix that.
diff --git a/private/webview_zygote.te b/private/webview_zygote.te
index f9deff0..95affef 100644
--- a/private/webview_zygote.te
+++ b/private/webview_zygote.te
@@ -111,6 +111,7 @@
 neverallow webview_zygote {
     service_manager_type
     -activity_service
+    -ashmem_device_service
     -webviewupdate_service
 }:service_manager find;
 
diff --git a/public/app.te b/public/app.te
index 75f521e..ee9b8cf 100644
--- a/public/app.te
+++ b/public/app.te
@@ -357,6 +357,8 @@
 allow appdomain system_server_tmpfs:file { getattr map read write };
 allow appdomain zygote_tmpfs:file { map read };
 
+# Allow vendor apps access to ashmemd to request /dev/ashmem fds.
+binder_call({ appdomain -coredomain }, ashmemd)
 
 ###
 ### Neverallow rules
diff --git a/public/ashmemd.te b/public/ashmemd.te
new file mode 100644
index 0000000..542f093
--- /dev/null
+++ b/public/ashmemd.te
@@ -0,0 +1 @@
+type ashmemd, domain;
diff --git a/public/domain.te b/public/domain.te
index bc50d60..265e4ab 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -64,7 +64,19 @@
 allow domain owntty_device:chr_file rw_file_perms;
 allow domain null_device:chr_file rw_file_perms;
 allow domain zero_device:chr_file rw_file_perms;
-allow domain ashmem_device:chr_file rw_file_perms;
+allow {
+  domain
+  # TODO(b/113362644): route coredomain to ashmemd
+  #-coredomain
+  -ephemeral_app
+  # TODO(b/113362644): remove open permission from these domains.
+  #-isolated_app
+  #-untrusted_app_all
+} ashmem_device:chr_file rw_file_perms;
+
+# Allow using fds to /dev/ashmem.
+allow domain ashmemd:fd use;
+
 # /dev/binder can be accessed by non-vendor domains and by apps
 allow {
   coredomain
diff --git a/public/installd.te b/public/installd.te
index ccf28ec..e767b25 100644
--- a/public/installd.te
+++ b/public/installd.te
@@ -166,4 +166,10 @@
 # only system_server, installd and dumpstate may interact with installd over binder
 neverallow { domain -system_server -dumpstate -installd } installd_service:service_manager find;
 neverallow { domain -system_server -dumpstate } installd:binder call;
-neverallow installd { domain -system_server -servicemanager userdebug_or_eng(`-su') }:binder call;
+neverallow installd {
+    domain
+    -ashmemd
+    -system_server
+    -servicemanager
+    userdebug_or_eng(`-su')
+}:binder call;
diff --git a/public/vold.te b/public/vold.te
index 14286c4..41df2b1 100644
--- a/public/vold.te
+++ b/public/vold.te
@@ -285,6 +285,7 @@
 neverallow { domain -system_server -vdc -vold } vold_service:service_manager find;
 neverallow vold {
   domain
+  -ashmemd
   -hal_health_storage_server
   -hal_keymaster_server
   -hal_system_suspend_server