diff --git a/prebuilts/api/29.0/public/property_contexts b/prebuilts/api/29.0/public/property_contexts
index f59b5de..3090490 100644
--- a/prebuilts/api/29.0/public/property_contexts
+++ b/prebuilts/api/29.0/public/property_contexts
@@ -145,6 +145,9 @@
 ro.url.legal u:object_r:exported3_default_prop:s0 exact string
 ro.url.legal.android_privacy u:object_r:exported3_default_prop:s0 exact string
 ro.vendor.build.security_patch u:object_r:vendor_security_patch_level_prop:s0 exact string
+ro.media.xml_variant.codecs u:object_r:media_variant_prop:s0 exact string
+ro.media.xml_variant.codecs_performance u:object_r:media_variant_prop:s0 exact string
+ro.media.xml_variant.profiles u:object_r:media_variant_prop:s0 exact string
 ro.zram.mark_idle_delay_mins u:object_r:exported3_default_prop:s0 exact int
 ro.zram.first_wb_delay_mins u:object_r:exported3_default_prop:s0 exact int
 ro.zram.periodic_wb_delay_hours u:object_r:exported3_default_prop:s0 exact int
diff --git a/private/adbd.te b/private/adbd.te
index 89fa1f9..cd3d8f3 100644
--- a/private/adbd.te
+++ b/private/adbd.te
@@ -90,6 +90,9 @@
 # Set service.adb.tls.port, persist.adb.wifi. properties
 set_prop(adbd, adbd_prop)
 
+# Allow adbd start/stop mdnsd via ctl.start
+set_prop(adbd, ctl_mdnsd_prop)
+
 # Access device logging gating property
 get_prop(adbd, device_logging_prop)
 
@@ -180,6 +183,11 @@
 
 allow adbd rootfs:dir r_dir_perms;
 
+# Allow killing child "perfetto" binary processes, which auto-transition to
+# their own domain. Allows propagating termination of "adb shell perfetto ..."
+# invocations.
+allow adbd perfetto:process signal;
+
 # Allow to pull Perfetto traces.
 allow adbd perfetto_traces_data_file:file r_file_perms;
 allow adbd perfetto_traces_data_file:dir r_dir_perms;
diff --git a/private/apexd.te b/private/apexd.te
index 9e702dd..c03790c 100644
--- a/private/apexd.te
+++ b/private/apexd.te
@@ -155,3 +155,7 @@
 
 neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:dir no_w_dir_perms;
 neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:file no_w_file_perms;
+
+# only apexd can set apexd sysprop
+set_prop(apexd, apexd_prop)
+neverallow { domain -apexd -init } apexd_prop:property_service set;
diff --git a/private/asan_extract.te b/private/asan_extract.te
index 1c20d78..69bcd50 100644
--- a/private/asan_extract.te
+++ b/private/asan_extract.te
@@ -3,6 +3,9 @@
 # Technically not a daemon but we do want the transition from init domain to
 # asan_extract to occur.
 with_asan(`
-typeattribute asan_extract coredomain;
-init_daemon_domain(asan_extract)
+  typeattribute asan_extract coredomain;
+  init_daemon_domain(asan_extract)
+
+  # We need to signal a reboot when done.
+  set_prop(asan_extract, powerctl_prop)
 ')
diff --git a/private/attributes b/private/attributes
new file mode 100644
index 0000000..e01b212
--- /dev/null
+++ b/private/attributes
@@ -0,0 +1 @@
+hal_attribute(lazy_test);
diff --git a/private/bootanim.te b/private/bootanim.te
index 20ff193..fd95e41 100644
--- a/private/bootanim.te
+++ b/private/bootanim.te
@@ -4,3 +4,6 @@
 
 # b/68864350
 dontaudit bootanim unlabeled:dir search;
+
+# Read ro.boot.bootreason b/30654343
+get_prop(bootanim, bootloader_boot_reason_prop)
diff --git a/private/bootstat.te b/private/bootstat.te
index 806144c..da3179b 100644
--- a/private/bootstat.te
+++ b/private/bootstat.te
@@ -1,3 +1,33 @@
 typeattribute bootstat coredomain;
 
 init_daemon_domain(bootstat)
+
+# Collect metrics on boot time created by init
+get_prop(bootstat, boottime_prop)
+
+# Read/Write [persist.]sys.boot.reason and ro.boot.bootreason (write if empty)
+set_prop(bootstat, bootloader_boot_reason_prop)
+set_prop(bootstat, system_boot_reason_prop)
+set_prop(bootstat, last_boot_reason_prop)
+
+neverallow {
+  domain
+  -bootanim
+  -bootstat
+  -dumpstate
+  -init
+  -recovery
+  -shell
+  -system_server
+} { bootloader_boot_reason_prop last_boot_reason_prop }:file r_file_perms;
+# ... and refine, as these components should not set the last boot reason
+neverallow { bootanim recovery } last_boot_reason_prop:file r_file_perms;
+
+neverallow {
+  domain
+  -bootstat
+  -init
+  -system_server
+} { bootloader_boot_reason_prop last_boot_reason_prop }:property_service set;
+# ... and refine ... for a ro propertly no less ... keep this _tight_
+neverallow system_server bootloader_boot_reason_prop:property_service set;
diff --git a/private/charger.te b/private/charger.te
index 65109de..13d1b14 100644
--- a/private/charger.te
+++ b/private/charger.te
@@ -1 +1,10 @@
 typeattribute charger coredomain;
+
+# charger needs to tell init to continue the boot
+# process when running in charger mode.
+set_prop(charger, system_prop)
+set_prop(charger, exported_system_prop)
+set_prop(charger, exported2_system_prop)
+set_prop(charger, exported3_system_prop)
+
+get_prop(charger, charger_prop)
diff --git a/private/compat/29.0/29.0.ignore.cil b/private/compat/29.0/29.0.ignore.cil
index 9c5deb0..c67db50 100644
--- a/private/compat/29.0/29.0.ignore.cil
+++ b/private/compat/29.0/29.0.ignore.cil
@@ -45,6 +45,7 @@
     file_integrity_service
     fwk_automotive_display_hwservice
     gmscore_app
+    gnss_device
     hal_can_bus_hwservice
     hal_can_controller_hwservice
     hal_identity_service
@@ -72,6 +73,7 @@
     mirror_data_file
     light_service
     linkerconfig_file
+    media_variant_prop
     metadata_bootstat_file
     mnt_pass_through_file
     mock_ota_prop
@@ -81,6 +83,7 @@
     prereboot_data_file
     art_apex_dir
     rebootescrow_hal_prop
+    securityfs
     service_manager_service
     service_manager_vndservice
     simpleperf
@@ -104,11 +107,11 @@
     userspace_reboot_config_prop
     userspace_reboot_exported_prop
     userspace_reboot_log_prop
+    userspace_reboot_test_prop
     vehicle_hal_prop
     tv_tuner_resource_mgr_service
     vendor_apex_file
     vendor_boringssl_self_test
-    vendor_incremental_module
     vendor_install_recovery
     vendor_install_recovery_exec
     vendor_socket_hook_prop
diff --git a/private/dhcp.te b/private/dhcp.te
index b2f8ac7..8ec9111 100644
--- a/private/dhcp.te
+++ b/private/dhcp.te
@@ -2,3 +2,6 @@
 
 init_daemon_domain(dhcp)
 type_transition dhcp system_data_file:{ dir file } dhcp_data_file;
+
+set_prop(dhcp, dhcp_prop)
+set_prop(dhcp, pan_result_prop)
diff --git a/private/domain.te b/private/domain.te
index 32b40c1..adb0218 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -101,6 +101,7 @@
     get_prop({coredomain appdomain shell}, userspace_reboot_config_prop)
     get_prop({coredomain shell}, userspace_reboot_exported_prop)
     get_prop({coredomain shell}, userspace_reboot_log_prop)
+    get_prop({coredomain shell}, userspace_reboot_test_prop)
     get_prop({domain -coredomain -appdomain}, vendor_default_prop)
 ')
 
@@ -368,3 +369,10 @@
 # This property is being removed. Remove remaining access.
 neverallow { domain -init -system_server -vendor_init } net_dns_prop:property_service set;
 neverallow { domain -dumpstate -init -system_server -vendor_init } net_dns_prop:file read;
+
+# Only core domains are allowed to access package_manager properties
+neverallow { domain -init -system_server } pm_prop:property_service set;
+neverallow { domain -coredomain } pm_prop:file no_rw_file_perms;
+
+# Do not allow reading the last boot timestamp from system properties
+neverallow { domain -init -system_server -dumpstate } firstboot_prop:file r_file_perms;
diff --git a/private/dumpstate.te b/private/dumpstate.te
index 72e508e..0eff540 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -50,6 +50,17 @@
 # For comminucating with the system process to do confirmation ui.
 binder_call(dumpstate, incidentcompanion_service)
 
+# Set properties.
+# dumpstate_prop is used to share state with the Shell app.
+set_prop(dumpstate, dumpstate_prop)
+set_prop(dumpstate, exported_dumpstate_prop)
+
+# dumpstate_options_prop is used to pass extra command-line args.
+set_prop(dumpstate, dumpstate_options_prop)
+
+# Allow dumpstate to kill vendor dumpstate service by init
+set_prop(dumpstate, ctl_dumpstate_prop)
+
 # For dumping dynamic partition information.
 set_prop(dumpstate, lpdumpd_prop)
 binder_call(dumpstate, lpdumpd)
diff --git a/private/fastbootd.te b/private/fastbootd.te
index 29a9157..49994b7 100644
--- a/private/fastbootd.te
+++ b/private/fastbootd.te
@@ -1 +1,25 @@
 typeattribute fastbootd coredomain;
+
+# The allow rules are only included in the recovery policy.
+# Otherwise fastbootd is only allowed the domain rules.
+recovery_only(`
+  # Reboot the device
+  set_prop(fastbootd, powerctl_prop)
+
+  # Read serial number of the device from system properties
+  get_prop(fastbootd, serialno_prop)
+
+  # Set sys.usb.ffs.ready.
+  set_prop(fastbootd, ffs_prop)
+  set_prop(fastbootd, exported_ffs_prop)
+
+  userdebug_or_eng(`
+    get_prop(fastbootd, persistent_properties_ready_prop)
+  ')
+
+  set_prop(fastbootd, gsid_prop)
+
+  # Determine allocation scheme (whether B partitions needs to be
+  # at the second half of super.
+  get_prop(fastbootd, virtual_ab_prop)
+')
diff --git a/private/file_contexts b/private/file_contexts
index ef4e042..f0afa95 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -95,6 +95,7 @@
 /dev/cgroup_info(/.*)?  u:object_r:cgroup_rc_file:s0
 /dev/fscklogs(/.*)?	u:object_r:fscklogs:s0
 /dev/fuse		u:object_r:fuse_device:s0
+/dev/gnss[0-9]+		u:object_r:gnss_device:s0
 /dev/graphics(/.*)?	u:object_r:graphics_device:s0
 /dev/hw_random		u:object_r:hw_random_device:s0
 /dev/hwbinder		u:object_r:hwbinder_device:s0
@@ -375,7 +376,6 @@
 /(vendor|system/vendor)/apex(/[^/]+){0,2}                      u:object_r:vendor_apex_file:s0
 /(vendor|system/vendor)/bin/misc_writer                        u:object_r:vendor_misc_writer_exec:s0
 /(vendor|system/vendor)/bin/boringssl_self_test(32|64)         u:object_r:vendor_boringssl_self_test_exec:s0
-(/vendor|system/vendor)/lib(64)?/modules/incrementalfs\.ko     u:object_r:vendor_incremental_module:s0
 
 # HAL location
 /(vendor|system/vendor)/lib(64)?/hw            u:object_r:vendor_hal_file:s0
@@ -451,6 +451,7 @@
 /(system_ext|system/system_ext)/etc/selinux/system_ext_mac_permissions\.xml u:object_r:mac_perms_file:s0
 
 /(system_ext|system/system_ext)/bin/aidl_lazy_test_server   u:object_r:aidl_lazy_test_server_exec:s0
+/(system_ext|system/system_ext)/bin/hidl_lazy_test_server   u:object_r:hidl_lazy_test_server_exec:s0
 
 #############################
 # Vendor files from /(product|system/product)/vendor_overlay
@@ -554,6 +555,7 @@
 /data/misc/stats-active-metric(/.*)? u:object_r:stats_data_file:s0
 /data/misc/stats-data(/.*)?     u:object_r:stats_data_file:s0
 /data/misc/stats-service(/.*)?  u:object_r:stats_data_file:s0
+/data/misc/stats-metadata(/.*)? u:object_r:stats_data_file:s0
 /data/misc/systemkeys(/.*)?     u:object_r:systemkeys_data_file:s0
 /data/misc/textclassifier(/.*)?       u:object_r:textclassifier_data_file:s0
 /data/misc/train-info(/.*)?     u:object_r:stats_data_file:s0
diff --git a/private/flags_health_check.te b/private/flags_health_check.te
index fb41aff..18dde09 100644
--- a/private/flags_health_check.te
+++ b/private/flags_health_check.te
@@ -1,3 +1,27 @@
 typeattribute flags_health_check coredomain;
 
 init_daemon_domain(flags_health_check)
+
+set_prop(flags_health_check, device_config_boot_count_prop)
+set_prop(flags_health_check, device_config_reset_performed_prop)
+set_prop(flags_health_check, device_config_runtime_native_boot_prop)
+set_prop(flags_health_check, device_config_runtime_native_prop)
+set_prop(flags_health_check, device_config_input_native_boot_prop)
+set_prop(flags_health_check, device_config_netd_native_prop)
+set_prop(flags_health_check, device_config_activity_manager_native_boot_prop)
+set_prop(flags_health_check, device_config_media_native_prop)
+set_prop(flags_health_check, device_config_storage_native_boot_prop)
+set_prop(flags_health_check, device_config_sys_traced_prop)
+set_prop(flags_health_check, device_config_window_manager_native_boot_prop)
+set_prop(flags_health_check, device_config_configuration_prop)
+
+# system property device_config_boot_count_prop is used for deciding when to perform server
+# configurable flags related disaster recovery. Mistakenly set up by unrelated components can, at a
+# wrong timing, trigger server configurable flag related disaster recovery, which will override
+# server configured values of all flags with default values.
+neverallow { domain -init -flags_health_check } device_config_boot_count_prop:property_service set;
+
+# system property device_config_reset_performed_prop is used for indicating whether server
+# configurable flags have been reset during booting. Mistakenly modified by unrelated components can
+# cause bad server configurable flags synced back to device.
+neverallow { domain -init -flags_health_check } device_config_reset_performed_prop:property_service set;
diff --git a/private/fs_use b/private/fs_use
index 6fcc2cc..93d7f1b 100644
--- a/private/fs_use
+++ b/private/fs_use
@@ -11,6 +11,7 @@
 fs_use_xattr overlay u:object_r:labeledfs:s0;
 fs_use_xattr erofs u:object_r:labeledfs:s0;
 fs_use_xattr incremental-fs u:object_r:labeledfs:s0;
+fs_use_xattr virtiofs u:object_r:labeledfs:s0;
 
 # Label inodes from task label.
 fs_use_task pipefs u:object_r:pipefs:s0;
diff --git a/private/gatekeeperd.te b/private/gatekeeperd.te
index 5e4d0a2..2fb88a3 100644
--- a/private/gatekeeperd.te
+++ b/private/gatekeeperd.te
@@ -1,3 +1,6 @@
 typeattribute gatekeeperd coredomain;
 
 init_daemon_domain(gatekeeperd)
+
+# For checking whether GSI is running
+get_prop(gatekeeperd, gsid_prop)
diff --git a/private/genfs_contexts b/private/genfs_contexts
index ccf6784..828929f 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -291,6 +291,8 @@
 
 genfscon debugfs /kcov								 u:object_r:debugfs_kcov:s0
 
+genfscon securityfs / u:object_r:securityfs:s0
+
 genfscon binder /binder u:object_r:binder_device:s0
 genfscon binder /hwbinder u:object_r:hwbinder_device:s0
 genfscon binder /vndbinder u:object_r:vndbinder_device:s0
diff --git a/private/hal_lazy_test.te b/private/hal_lazy_test.te
new file mode 100644
index 0000000..93cf235
--- /dev/null
+++ b/private/hal_lazy_test.te
@@ -0,0 +1,3 @@
+userdebug_or_eng(`
+  hal_attribute_hwservice(hal_lazy_test, hal_lazy_test_hwservice)
+')
diff --git a/private/healthd.te b/private/healthd.te
index 20d0791..921d33f 100644
--- a/private/healthd.te
+++ b/private/healthd.te
@@ -4,3 +4,10 @@
 
 # Allow healthd to serve health HAL
 hal_server_domain(healthd, hal_health)
+
+# Healthd needs to tell init to continue the boot
+# process when running in charger mode.
+set_prop(healthd, system_prop)
+set_prop(healthd, exported_system_prop)
+set_prop(healthd, exported2_system_prop)
+set_prop(healthd, exported3_system_prop)
diff --git a/private/hidl_lazy_test_server.te b/private/hidl_lazy_test_server.te
new file mode 100644
index 0000000..04e8c9f
--- /dev/null
+++ b/private/hidl_lazy_test_server.te
@@ -0,0 +1,8 @@
+type hidl_lazy_test_server, domain;
+type hidl_lazy_test_server_exec, exec_type, file_type, system_file_type;
+
+userdebug_or_eng(`
+  typeattribute hidl_lazy_test_server coredomain;
+  init_daemon_domain(hidl_lazy_test_server)
+  hal_server_domain(hidl_lazy_test_server, hal_lazy_test)
+')
diff --git a/private/hwservice.te b/private/hwservice.te
new file mode 100644
index 0000000..b7ba4d7
--- /dev/null
+++ b/private/hwservice.te
@@ -0,0 +1 @@
+type hal_lazy_test_hwservice, hwservice_manager_type, protected_hwservice;
diff --git a/private/hwservice_contexts b/private/hwservice_contexts
index 9c471bc..664e697 100644
--- a/private/hwservice_contexts
+++ b/private/hwservice_contexts
@@ -40,6 +40,7 @@
 android.hardware.input.classifier::IInputClassifier             u:object_r:hal_input_classifier_hwservice:s0
 android.hardware.ir::IConsumerIr                                u:object_r:hal_ir_hwservice:s0
 android.hardware.keymaster::IKeymasterDevice                    u:object_r:hal_keymaster_hwservice:s0
+android.hardware.tests.lazy::ILazy                              u:object_r:hal_lazy_test_hwservice:s0
 android.hardware.light::ILight                                  u:object_r:hal_light_hwservice:s0
 android.hardware.lowpan::ILowpanDevice                          u:object_r:hal_lowpan_hwservice:s0
 android.hardware.media.omx::IOmx                                u:object_r:hal_omx_hwservice:s0
diff --git a/private/hwservicemanager.te b/private/hwservicemanager.te
index 0705cc7..e1fde43 100644
--- a/private/hwservicemanager.te
+++ b/private/hwservicemanager.te
@@ -6,3 +6,4 @@
 add_hwservice(hwservicemanager, hidl_token_hwservice)
 
 set_prop(hwservicemanager, ctl_interface_start_prop)
+set_prop(hwservicemanager, hwservicemanager_prop)
diff --git a/private/lmkd.te b/private/lmkd.te
index a07ce87..7246051 100644
--- a/private/lmkd.te
+++ b/private/lmkd.te
@@ -1,3 +1,6 @@
 typeattribute lmkd coredomain;
 
 init_daemon_domain(lmkd)
+
+# Set sys.lmk.* properties.
+set_prop(lmkd, system_lmk_prop)
diff --git a/private/logd.te b/private/logd.te
index ca92e20..7112c4f 100644
--- a/private/logd.te
+++ b/private/logd.te
@@ -2,6 +2,9 @@
 
 init_daemon_domain(logd)
 
+# Access device logging gating property
+get_prop(logd, device_logging_prop)
+
 # logd is not allowed to write anywhere other than /data/misc/logd, and then
 # only on userdebug or eng builds
 neverallow logd {
diff --git a/private/mediaextractor.te b/private/mediaextractor.te
index 2e654d6..7f626c4 100644
--- a/private/mediaextractor.te
+++ b/private/mediaextractor.te
@@ -5,3 +5,5 @@
 allow mediaextractor appdomain_tmpfs:file { getattr map read write };
 allow mediaextractor mediaserver_tmpfs:file { getattr map read write };
 allow mediaextractor system_server_tmpfs:file { getattr map read write };
+
+get_prop(mediaextractor, device_config_media_native_prop)
diff --git a/private/mediaserver.te b/private/mediaserver.te
index c55e54a..32dfc00 100644
--- a/private/mediaserver.te
+++ b/private/mediaserver.te
@@ -12,3 +12,5 @@
 hal_client_domain(mediaserver, hal_codec2)
 
 allow mediaserver mediatranscoding_service:service_manager find;
+
+set_prop(mediaserver, audio_prop)
diff --git a/private/mediaswcodec.te b/private/mediaswcodec.te
index 50f5698..cef802d 100644
--- a/private/mediaswcodec.te
+++ b/private/mediaswcodec.te
@@ -2,3 +2,4 @@
 
 init_daemon_domain(mediaswcodec)
 
+get_prop(mediaswcodec, device_config_media_native_prop)
diff --git a/private/netd.te b/private/netd.te
index 41473b7..27663d3 100644
--- a/private/netd.te
+++ b/private/netd.te
@@ -17,7 +17,12 @@
 # TODO: Remove this permission when 4.9 kernel is deprecated.
 allow netd self:key_socket create;
 
+set_prop(netd, ctl_mdnsd_prop)
+set_prop(netd, netd_stable_secret_prop)
+
 get_prop(netd, bpf_progs_loaded_prop)
+get_prop(netd, hwservicemanager_prop)
+get_prop(netd, device_config_netd_native_prop)
 
 # Allow netd to write to statsd.
 unix_socket_send(netd, statsdw, statsd)
@@ -28,3 +33,11 @@
 # Allow netd to send dump info to dumpstate
 allow netd dumpstate:fd use;
 allow netd dumpstate:fifo_file { getattr write };
+
+# persist.netd.stable_secret contains RFC 7217 secret key which should never be
+# leaked to other processes. Make sure it never leaks.
+neverallow { domain -netd -init -dumpstate } netd_stable_secret_prop:file r_file_perms;
+
+# We want to ensure that no other process ever tries tampering with persist.netd.stable_secret,
+# the RFC 7217 secret key managed by netd. Doing so could compromise user privacy.
+neverallow { domain -netd -init } netd_stable_secret_prop:property_service set;
diff --git a/private/perfetto.te b/private/perfetto.te
index 2183b6d..58cfae8 100644
--- a/private/perfetto.te
+++ b/private/perfetto.te
@@ -50,6 +50,14 @@
   binder_call(perfetto, incidentd)
 ');
 
+# perfetto log formatter calls isatty() on its stderr. Denial when running
+# under adbd is harmless. Avoid generating denial logs.
+dontaudit perfetto adbd:unix_stream_socket getattr;
+dontauditxperm perfetto adbd:unix_stream_socket ioctl unpriv_tty_ioctls;
+# As above, when adbd is running in "su" domain (only the ioctl is denied in
+# practice).
+dontauditxperm perfetto su:unix_stream_socket ioctl unpriv_tty_ioctls;
+
 ###
 ### Neverallow rules
 ###
diff --git a/private/priv_app.te b/private/priv_app.te
index dd4d5c7..db28bec 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -147,11 +147,15 @@
         connect getattr read recvfrom sendto write getopt setopt };
 
 # allow apps like Phonesky to check the file signature of an apk installed on
-# the Incremental File System
-allowxperm priv_app apk_data_file:file ioctl INCFS_IOCTL_READ_SIGNATURE;
+# the Incremental File System, and fill missing blocks in the apk
+allowxperm priv_app apk_data_file:file ioctl { INCFS_IOCTL_READ_SIGNATURE INCFS_IOCTL_FILL_BLOCKS };
 
 # allow privileged data loader apps (e.g. com.android.vending) to read logs from Incremental File System
-allow priv_app incremental_control_file:file { read getattr };
+allow priv_app incremental_control_file:file { read getattr ioctl };
+
+# allow apps like Phonesky to request permission to fill blocks of an apk file
+# on the Incremental File System.
+allowxperm priv_app incremental_control_file:file ioctl INCFS_IOCTL_PERMIT_FILL;
 
 ###
 ### neverallow rules
diff --git a/private/property.te b/private/property.te
new file mode 100644
index 0000000..8a5dd26
--- /dev/null
+++ b/private/property.te
@@ -0,0 +1,338 @@
+# Properties used only in /system
+system_internal_prop(adbd_prop)
+system_internal_prop(device_config_storage_native_boot_prop)
+system_internal_prop(device_config_sys_traced_prop)
+system_internal_prop(device_config_window_manager_native_boot_prop)
+system_internal_prop(device_config_configuration_prop)
+system_internal_prop(gsid_prop)
+system_internal_prop(init_perf_lsm_hooks_prop)
+system_internal_prop(init_svc_debug_prop)
+system_internal_prop(last_boot_reason_prop)
+system_internal_prop(netd_stable_secret_prop)
+system_internal_prop(pm_prop)
+system_internal_prop(system_adbd_prop)
+system_internal_prop(traced_perf_enabled_prop)
+system_internal_prop(userspace_reboot_log_prop)
+system_internal_prop(userspace_reboot_test_prop)
+
+###
+### Neverallow rules
+###
+
+treble_sysprop_neverallow(`
+
+# TODO(b/131162102): uncomment these after assigning ownership attributes to all properties
+# neverallow domain {
+#   property_type
+#   -system_property_type
+#   -product_property_type
+#   -vendor_property_type
+# }:file no_rw_file_perms;
+
+neverallow { domain -coredomain } {
+  system_property_type
+  system_internal_property_type
+  -system_restricted_property_type
+  -system_public_property_type
+}:file no_rw_file_perms;
+
+neverallow { domain -coredomain } {
+  system_property_type
+  -system_public_property_type
+}:property_service set;
+
+# init is in coredomain, but should be able to read/write all props.
+# dumpstate is also in coredomain, but should be able to read all props.
+neverallow { coredomain -init -dumpstate } {
+  vendor_property_type
+  vendor_internal_property_type
+  -vendor_restricted_property_type
+  -vendor_public_property_type
+}:file no_rw_file_perms;
+
+neverallow { coredomain -init } {
+  vendor_property_type
+  -vendor_public_property_type
+}:property_service set;
+
+')
+
+# There is no need to perform ioctl or advisory locking operations on
+# property files. If this neverallow is being triggered, it is
+# likely that the policy is using r_file_perms directly instead of
+# the get_prop() macro.
+neverallow domain property_type:file { ioctl lock };
+
+neverallow * {
+  core_property_type
+  -audio_prop
+  -config_prop
+  -cppreopt_prop
+  -dalvik_prop
+  -debuggerd_prop
+  -debug_prop
+  -default_prop
+  -dhcp_prop
+  -dumpstate_prop
+  -ffs_prop
+  -fingerprint_prop
+  -logd_prop
+  -net_radio_prop
+  -nfc_prop
+  -ota_prop
+  -pan_result_prop
+  -persist_debug_prop
+  -powerctl_prop
+  -radio_prop
+  -restorecon_prop
+  -shell_prop
+  -system_prop
+  -system_radio_prop
+  -vold_prop
+}:file no_rw_file_perms;
+
+# sigstop property is only used for debugging; should only be set by su which is permissive
+# for userdebug/eng
+neverallow {
+  domain
+  -init
+  -vendor_init
+} ctl_sigstop_prop:property_service set;
+
+# Don't audit legacy ctl. property handling.  We only want the newer permission check to appear
+# in the audit log
+dontaudit domain {
+  ctl_bootanim_prop
+  ctl_bugreport_prop
+  ctl_console_prop
+  ctl_default_prop
+  ctl_dumpstate_prop
+  ctl_fuse_prop
+  ctl_mdnsd_prop
+  ctl_rildaemon_prop
+}:property_service set;
+
+neverallow {
+  domain
+  -init
+} init_svc_debug_prop:property_service set;
+
+neverallow {
+  domain
+  -init
+  -dumpstate
+  userdebug_or_eng(`-su')
+} init_svc_debug_prop:file no_rw_file_perms;
+
+compatible_property_only(`
+# Prevent properties from being set
+  neverallow {
+    domain
+    -coredomain
+    -appdomain
+    -vendor_init
+  } {
+    core_property_type
+    extended_core_property_type
+    exported_config_prop
+    exported_dalvik_prop
+    exported_default_prop
+    exported_dumpstate_prop
+    exported_ffs_prop
+    exported_fingerprint_prop
+    exported_system_prop
+    exported_system_radio_prop
+    exported_vold_prop
+    exported2_config_prop
+    exported2_default_prop
+    exported2_system_prop
+    exported2_vold_prop
+    exported3_default_prop
+    exported3_system_prop
+    -nfc_prop
+    -powerctl_prop
+    -radio_prop
+  }:property_service set;
+
+  neverallow {
+    domain
+    -coredomain
+    -appdomain
+    -hal_nfc_server
+  } {
+    nfc_prop
+  }:property_service set;
+
+  neverallow {
+    domain
+    -coredomain
+    -appdomain
+    -hal_telephony_server
+    -vendor_init
+  } {
+    exported_radio_prop
+    exported3_radio_prop
+  }:property_service set;
+
+  neverallow {
+    domain
+    -coredomain
+    -appdomain
+    -hal_telephony_server
+  } {
+    exported2_radio_prop
+    radio_prop
+  }:property_service set;
+
+  neverallow {
+    domain
+    -coredomain
+    -bluetooth
+    -hal_bluetooth_server
+  } {
+    bluetooth_prop
+  }:property_service set;
+
+  neverallow {
+    domain
+    -coredomain
+    -bluetooth
+    -hal_bluetooth_server
+    -vendor_init
+  } {
+    exported_bluetooth_prop
+  }:property_service set;
+
+  neverallow {
+    domain
+    -coredomain
+    -hal_camera_server
+    -cameraserver
+    -vendor_init
+  } {
+    exported_camera_prop
+  }:property_service set;
+
+  neverallow {
+    domain
+    -coredomain
+    -hal_wifi_server
+    -wificond
+  } {
+    wifi_prop
+  }:property_service set;
+
+  neverallow {
+    domain
+    -coredomain
+    -hal_wifi_server
+    -wificond
+    -vendor_init
+  } {
+    exported_wifi_prop
+  }:property_service set;
+
+# Prevent properties from being read
+  neverallow {
+    domain
+    -coredomain
+    -appdomain
+    -vendor_init
+  } {
+    core_property_type
+    extended_core_property_type
+    exported_dalvik_prop
+    exported_ffs_prop
+    exported_system_radio_prop
+    exported2_config_prop
+    exported2_system_prop
+    exported2_vold_prop
+    exported3_default_prop
+    exported3_system_prop
+    -debug_prop
+    -logd_prop
+    -nfc_prop
+    -powerctl_prop
+    -radio_prop
+  }:file no_rw_file_perms;
+
+  neverallow {
+    domain
+    -coredomain
+    -appdomain
+    -hal_nfc_server
+  } {
+    nfc_prop
+  }:file no_rw_file_perms;
+
+  neverallow {
+    domain
+    -coredomain
+    -appdomain
+    -hal_telephony_server
+  } {
+    radio_prop
+  }:file no_rw_file_perms;
+
+  neverallow {
+    domain
+    -coredomain
+    -bluetooth
+    -hal_bluetooth_server
+  } {
+    bluetooth_prop
+  }:file no_rw_file_perms;
+
+  neverallow {
+    domain
+    -coredomain
+    -hal_wifi_server
+    -wificond
+  } {
+    wifi_prop
+  }:file no_rw_file_perms;
+')
+
+compatible_property_only(`
+  # Neverallow coredomain to set vendor properties
+  neverallow {
+    coredomain
+    -init
+    -system_writes_vendor_properties_violators
+  } {
+    property_type
+    -system_property_type
+    -extended_core_property_type
+  }:property_service set;
+')
+
+neverallow {
+  -init
+  -system_server
+} {
+  userspace_reboot_log_prop
+}:property_service set;
+
+neverallow {
+  # Only allow init and system_server to set system_adbd_prop
+  -init
+  -system_server
+} {
+  system_adbd_prop
+}:property_service set;
+
+neverallow {
+  # Only allow init and adbd to set adbd_prop
+  -init
+  -adbd
+} {
+  adbd_prop
+}:property_service set;
+
+neverallow {
+  # Only allow init and shell to set userspace_reboot_test_prop
+  -init
+  -shell
+} {
+  userspace_reboot_test_prop
+}:property_service set;
diff --git a/private/property_contexts b/private/property_contexts
index 9175d10..c8e743c 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -91,6 +91,7 @@
 sys.boot.reason.last    u:object_r:last_boot_reason_prop:s0
 pm.                     u:object_r:pm_prop:s0
 test.sys.boot.reason    u:object_r:test_boot_reason_prop:s0
+test.userspace_reboot.requested u:object_r:userspace_reboot_test_prop:s0
 sys.lmk.                u:object_r:system_lmk_prop:s0
 sys.trace.              u:object_r:system_trace_prop:s0
 
@@ -246,3 +247,578 @@
 # by devices with video decoding pipelines long enough to overflow the default
 # history size.
 ro.lib_gui.frame_event_history_size u:object_r:bq_config_prop:s0
+
+# vendor-init-readable
+persist.radio.airplane_mode_on u:object_r:exported2_radio_prop:s0 exact bool
+
+# vendor-init-settable
+af.fast_track_multiplier u:object_r:exported3_default_prop:s0 exact int
+
+audio.camerasound.force         u:object_r:exported_audio_prop:s0 exact bool
+audio.deep_buffer.media         u:object_r:exported3_default_prop:s0 exact bool
+audio.offload.video             u:object_r:exported3_default_prop:s0 exact bool
+audio.offload.min.duration.secs u:object_r:exported3_default_prop:s0 exact int
+
+camera.disable_zsl_mode u:object_r:exported3_default_prop:s0 exact bool
+camera.fifo.disable     u:object_r:exported3_default_prop:s0 exact int
+
+dalvik.vm.appimageformat                    u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.backgroundgctype                  u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.boot-dex2oat-cpu-set              u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.boot-dex2oat-threads              u:object_r:exported_dalvik_prop:s0 exact int
+dalvik.vm.boot-image                        u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.checkjni                          u:object_r:exported_dalvik_prop:s0 exact bool
+dalvik.vm.dex2oat-Xms                       u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.dex2oat-Xmx                       u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.dex2oat-cpu-set                   u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.dex2oat-filter                    u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.dex2oat-flags                     u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.dex2oat-threads                   u:object_r:exported_dalvik_prop:s0 exact int
+dalvik.vm.dexopt.secondary                  u:object_r:exported_dalvik_prop:s0 exact bool
+dalvik.vm.execution-mode                    u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.extra-opts                        u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.foreground-heap-growth-multiplier u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.gctype                            u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.heapgrowthlimit                   u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.heapmaxfree                       u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.heapminfree                       u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.heapsize                          u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.heapstartsize                     u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.heaptargetutilization             u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.hot-startup-method-samples        u:object_r:exported_dalvik_prop:s0 exact int
+dalvik.vm.image-dex2oat-Xms                 u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.image-dex2oat-Xmx                 u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.image-dex2oat-cpu-set             u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.image-dex2oat-filter              u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.image-dex2oat-flags               u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.image-dex2oat-threads             u:object_r:exported_dalvik_prop:s0 exact int
+dalvik.vm.isa.arm.features                  u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.isa.arm.variant                   u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.isa.arm64.features                u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.isa.arm64.variant                 u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.isa.mips.features                 u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.isa.mips.variant                  u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.isa.mips64.features               u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.isa.mips64.variant                u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.isa.unknown.features              u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.isa.unknown.variant               u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.isa.x86.features                  u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.isa.x86.variant                   u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.isa.x86_64.features               u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.isa.x86_64.variant                u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.jitinitialsize                    u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.jitmaxsize                        u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.jitprithreadweight                u:object_r:exported_dalvik_prop:s0 exact int
+dalvik.vm.jitthreshold                      u:object_r:exported_dalvik_prop:s0 exact int
+dalvik.vm.jittransitionweight               u:object_r:exported_dalvik_prop:s0 exact int
+dalvik.vm.jniopts                           u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.lockprof.threshold                u:object_r:exported_dalvik_prop:s0 exact int
+dalvik.vm.method-trace                      u:object_r:exported_dalvik_prop:s0 exact bool
+dalvik.vm.method-trace-file                 u:object_r:exported_dalvik_prop:s0 exact string
+dalvik.vm.method-trace-file-siz             u:object_r:exported_dalvik_prop:s0 exact int
+dalvik.vm.method-trace-stream               u:object_r:exported_dalvik_prop:s0 exact bool
+dalvik.vm.profilesystemserver               u:object_r:exported_dalvik_prop:s0 exact bool
+dalvik.vm.profilebootclasspath              u:object_r:exported_dalvik_prop:s0 exact bool
+dalvik.vm.usejit                            u:object_r:exported_dalvik_prop:s0 exact bool
+dalvik.vm.usejitprofiles                    u:object_r:exported_dalvik_prop:s0 exact bool
+dalvik.vm.zygote.max-boot-retry             u:object_r:exported_dalvik_prop:s0 exact int
+
+drm.service.enabled u:object_r:exported3_default_prop:s0 exact bool
+
+keyguard.no_require_sim u:object_r:exported3_default_prop:s0 exact bool
+
+media.recorder.show_manufacturer_and_model u:object_r:exported3_default_prop:s0 exact bool
+
+media.stagefright.cache-params               u:object_r:exported3_default_prop:s0 exact string
+media.stagefright.thumbnail.prefer_hw_codecs u:object_r:exported3_default_prop:s0 exact bool
+
+persist.bluetooth.a2dp_offload.cap             u:object_r:bluetooth_a2dp_offload_prop:s0 exact string
+persist.bluetooth.a2dp_offload.disabled        u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
+persist.bluetooth.bluetooth_audio_hal.disabled u:object_r:bluetooth_audio_hal_prop:s0 exact bool
+persist.bluetooth.btsnoopenable                u:object_r:exported_bluetooth_prop:s0 exact bool
+
+persist.config.calibration_fac u:object_r:exported3_default_prop:s0 exact string
+
+persist.dbg.volte_avail_ovr u:object_r:exported3_default_prop:s0 exact int
+persist.dbg.vt_avail_ovr    u:object_r:exported3_default_prop:s0 exact int
+persist.dbg.wfc_avail_ovr   u:object_r:exported3_default_prop:s0 exact int
+
+persist.radio.multisim.config u:object_r:exported3_radio_prop:s0 exact string
+
+persist.sys.dalvik.vm.lib.2     u:object_r:exported2_system_prop:s0 exact string
+persist.sys.media.avsync        u:object_r:exported2_system_prop:s0 exact bool
+persist.sys.hdmi.keep_awake     u:object_r:exported2_system_prop:s0 exact bool
+persist.sys.sf.color_mode       u:object_r:exported2_system_prop:s0 exact int
+persist.sys.sf.color_saturation u:object_r:exported2_system_prop:s0 exact string
+persist.sys.sf.native_mode      u:object_r:exported2_system_prop:s0 exact int
+
+pm.dexopt.ab-ota                        u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.bg-dexopt                     u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.boot                          u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.disable_bg_dexopt             u:object_r:exported_pm_prop:s0 exact bool
+pm.dexopt.downgrade_after_inactive_days u:object_r:exported_pm_prop:s0 exact int
+pm.dexopt.first-boot                    u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.inactive                      u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.install                       u:object_r:exported_pm_prop:s0 exact string
+pm.dexopt.shared                        u:object_r:exported_pm_prop:s0 exact string
+
+ro.af.client_heap_size_kbyte u:object_r:exported3_default_prop:s0 exact int
+
+ro.apk_verity.mode u:object_r:apk_verity_prop:s0 exact int
+
+ro.audio.monitorRotation u:object_r:exported3_default_prop:s0 exact bool
+
+ro.bluetooth.a2dp_offload.supported u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
+
+ro.boot.vendor.overlay.theme u:object_r:exported_overlay_prop:s0 exact string
+ro.boot.wificountrycode      u:object_r:exported3_default_prop:s0 exact string
+
+ro.bt.bdaddr_path u:object_r:exported_bluetooth_prop:s0 exact string
+
+ro.camera.notify_nfc    u:object_r:exported3_default_prop:s0 exact int
+ro.camera.enableLazyHal u:object_r:exported3_default_prop:s0 exact bool
+
+ro.com.android.dataroaming     u:object_r:exported3_default_prop:s0 exact bool
+ro.com.android.prov_mobiledata u:object_r:exported3_default_prop:s0 exact bool
+
+ro.config.alarm_alert        u:object_r:exported2_config_prop:s0 exact string
+ro.config.media_vol_steps    u:object_r:exported2_config_prop:s0 exact int
+ro.config.notification_sound u:object_r:exported2_config_prop:s0 exact string
+ro.config.per_app_memcg      u:object_r:exported3_default_prop:s0 exact bool
+ro.config.ringtone           u:object_r:exported2_config_prop:s0 exact string
+
+ro.control_privapp_permissions u:object_r:exported3_default_prop:s0 exact string
+
+ro.cp_system_other_odex u:object_r:exported3_default_prop:s0 exact int
+
+ro.crypto.allow_encrypt_override     u:object_r:exported2_vold_prop:s0 exact bool
+ro.crypto.fde_algorithm              u:object_r:exported2_vold_prop:s0 exact string
+ro.crypto.fde_sector_size            u:object_r:exported2_vold_prop:s0 exact int
+ro.crypto.scrypt_params              u:object_r:exported2_vold_prop:s0 exact string
+ro.crypto.set_dun                    u:object_r:exported2_vold_prop:s0 exact bool
+ro.crypto.volume.contents_mode       u:object_r:exported2_vold_prop:s0 exact string
+ro.crypto.volume.filenames_mode      u:object_r:exported2_vold_prop:s0 exact string
+ro.crypto.volume.metadata.encryption u:object_r:exported2_vold_prop:s0 exact string
+ro.crypto.volume.metadata.method     u:object_r:exported2_vold_prop:s0 exact string
+ro.crypto.volume.options             u:object_r:exported2_vold_prop:s0 exact string
+
+ro.dalvik.vm.native.bridge u:object_r:exported_dalvik_prop:s0 exact string
+
+ro.enable_boot_charger_mode u:object_r:exported3_default_prop:s0 exact bool
+
+ro.gfx.driver.0        u:object_r:exported3_default_prop:s0 exact string
+ro.gfx.angle.supported u:object_r:exported3_default_prop:s0 exact bool
+
+ro.hdmi.device_type     u:object_r:exported3_default_prop:s0 exact string
+ro.hdmi.wake_on_hotplug u:object_r:exported3_default_prop:s0 exact bool
+
+ro.lmk.critical                 u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.critical_upgrade         u:object_r:exported3_default_prop:s0 exact bool
+ro.lmk.debug                    u:object_r:exported3_default_prop:s0 exact bool
+ro.lmk.downgrade_pressure       u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.kill_heaviest_task       u:object_r:exported3_default_prop:s0 exact bool
+ro.lmk.kill_timeout_ms          u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.low                      u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.medium                   u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.psi_partial_stall_ms     u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.psi_complete_stall_ms    u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.swap_free_low_percentage u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.thrashing_limit          u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.thrashing_limit_decay    u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.use_minfree_levels       u:object_r:exported3_default_prop:s0 exact bool
+ro.lmk.upgrade_pressure         u:object_r:exported3_default_prop:s0 exact int
+
+ro.media.xml_variant.codecs             u:object_r:media_variant_prop:s0 exact string
+ro.media.xml_variant.codecs_performance u:object_r:media_variant_prop:s0 exact string
+ro.media.xml_variant.profiles           u:object_r:media_variant_prop:s0 exact string
+
+ro.minui.default_rotation u:object_r:exported3_default_prop:s0 exact string
+ro.minui.overscan_percent u:object_r:exported3_default_prop:s0 exact int
+ro.minui.pixel_format     u:object_r:exported3_default_prop:s0 exact string
+
+ro.oem_unlock_supported u:object_r:exported3_default_prop:s0 exact int
+
+ro.opengles.version u:object_r:exported3_default_prop:s0 exact int
+
+ro.radio.noril u:object_r:exported3_default_prop:s0 exact string
+
+ro.rebootescrow.device u:object_r:rebootescrow_hal_prop:s0 exact string
+
+ro.retaildemo.video_path u:object_r:exported3_default_prop:s0 exact string
+
+ro.statsd.enable u:object_r:exported3_default_prop:s0 exact bool
+
+ro.sf.disable_triple_buffer u:object_r:exported3_default_prop:s0 exact bool
+ro.sf.lcd_density           u:object_r:exported3_default_prop:s0 exact int
+
+ro.storage_manager.enabled u:object_r:exported3_default_prop:s0 exact bool
+
+ro.telephony.call_ring.multiple u:object_r:exported3_default_prop:s0 exact bool
+ro.telephony.default_cdma_sub   u:object_r:exported3_default_prop:s0 exact int
+ro.telephony.default_network    u:object_r:exported3_default_prop:s0 exact string
+
+ro.vehicle.hal u:object_r:vehicle_hal_prop:s0 exact string
+
+ro.vendor.build.security_patch u:object_r:vendor_security_patch_level_prop:s0 exact string
+
+ro.zram.mark_idle_delay_mins    u:object_r:exported3_default_prop:s0 exact int
+ro.zram.first_wb_delay_mins     u:object_r:exported3_default_prop:s0 exact int
+ro.zram.periodic_wb_delay_hours u:object_r:exported3_default_prop:s0 exact int
+
+ro.zygote u:object_r:exported3_default_prop:s0 exact string
+
+sendbug.preferred.domain u:object_r:exported3_default_prop:s0 exact string
+
+sys.usb.controller      u:object_r:exported2_system_prop:s0 exact string
+sys.usb.ffs.max_read    u:object_r:exported_ffs_prop:s0 exact int
+sys.usb.ffs.max_write   u:object_r:exported_ffs_prop:s0 exact int
+sys.usb.ffs.ready       u:object_r:exported_ffs_prop:s0 exact bool
+sys.usb.mtp.device_type u:object_r:exported2_system_prop:s0 exact int
+sys.usb.ffs.mtp.ready   u:object_r:exported_ffs_prop:s0 exact bool
+sys.usb.state           u:object_r:exported2_system_prop:s0 exact string
+
+telephony.lteOnCdmaDevice u:object_r:exported3_default_prop:s0 exact int
+
+tombstoned.max_tombstone_count u:object_r:exported3_default_prop:s0 exact int
+
+vold.post_fs_data_done u:object_r:exported2_vold_prop:s0 exact int
+
+vts.native_server.on u:object_r:exported3_default_prop:s0 exact bool
+
+wlan.driver.status u:object_r:exported_wifi_prop:s0 exact enum ok unloaded
+
+zram.force_writeback u:object_r:exported3_default_prop:s0 exact bool
+
+# vendor-init-readable
+apexd.status u:object_r:apexd_prop:s0 exact enum starting activated ready
+
+dev.bootcomplete u:object_r:exported3_system_prop:s0 exact bool
+
+persist.sys.device_provisioned  u:object_r:exported3_system_prop:s0 exact string
+persist.sys.theme               u:object_r:theme_prop:s0 exact string
+persist.sys.usb.usbradio.config u:object_r:exported3_system_prop:s0 exact string
+
+sys.boot_completed      u:object_r:exported3_system_prop:s0 exact bool
+sys.retaildemo.enabled  u:object_r:exported3_system_prop:s0 exact int
+sys.user.0.ce_available u:object_r:exported3_system_prop:s0 exact bool
+sys.vdso                u:object_r:exported3_system_prop:s0 exact string
+
+# vendor-init-settable
+persist.sys.zram_enabled u:object_r:exported2_system_prop:s0 exact bool
+
+sys.usb.config   u:object_r:exported_system_radio_prop:s0 exact string
+sys.usb.configfs u:object_r:exported_system_radio_prop:s0 exact int
+
+# public-readable
+aac_drc_boost            u:object_r:exported2_default_prop:s0 exact int
+aac_drc_cut              u:object_r:exported2_default_prop:s0 exact int
+aac_drc_enc_target_level u:object_r:exported2_default_prop:s0 exact int
+aac_drc_heavy            u:object_r:exported2_default_prop:s0 exact int
+aac_drc_reference_level  u:object_r:exported2_default_prop:s0 exact int
+
+build.version.extensions. u:object_r:module_sdkextensions_prop:s0 prefix int
+
+ro.aac_drc_effect_type u:object_r:exported2_default_prop:s0 exact int
+
+drm.64bit.enabled u:object_r:exported2_default_prop:s0 exact bool
+
+dumpstate.dry_run u:object_r:exported_dumpstate_prop:s0 exact bool
+dumpstate.unroot  u:object_r:exported_dumpstate_prop:s0 exact bool
+
+hal.instrumentation.enable u:object_r:exported2_default_prop:s0 exact bool
+
+init.svc.bugreport      u:object_r:exported2_default_prop:s0 exact string
+init.svc.console        u:object_r:exported2_default_prop:s0 exact string
+init.svc.dumpstatez     u:object_r:exported2_default_prop:s0 exact string
+init.svc.mediadrm       u:object_r:exported2_default_prop:s0 exact string
+init.svc.surfaceflinger u:object_r:exported2_default_prop:s0 exact string
+init.svc.tombstoned     u:object_r:exported2_default_prop:s0 exact string
+init.svc.zygote         u:object_r:exported2_default_prop:s0 exact string
+
+libc.debug.malloc.options u:object_r:exported2_default_prop:s0 exact string
+libc.debug.malloc.program u:object_r:exported2_default_prop:s0 exact string
+libc.debug.hooks.enable   u:object_r:exported2_default_prop:s0 exact string
+
+net.redirect_socket_calls.hooked u:object_r:socket_hook_prop:s0 exact bool
+
+persist.sys.locale       u:object_r:exported_system_prop:s0 exact string
+persist.sys.timezone     u:object_r:exported_system_prop:s0 exact string
+persist.sys.test_harness u:object_r:test_harness_prop:s0 exact bool
+
+ro.adb.secure u:object_r:exported_secure_prop:s0 exact bool
+
+ro.arch u:object_r:exported2_default_prop:s0 exact string
+
+ro.audio.ignore_effects u:object_r:exported2_default_prop:s0 exact bool
+
+ro.baseband u:object_r:exported2_default_prop:s0 exact string
+
+ro.boot.avb_version                 u:object_r:exported2_default_prop:s0 exact string
+ro.boot.baseband                    u:object_r:exported2_default_prop:s0 exact string
+ro.boot.bootdevice                  u:object_r:exported2_default_prop:s0 exact string
+ro.boot.bootloader                  u:object_r:exported2_default_prop:s0 exact string
+ro.boot.boottime                    u:object_r:exported2_default_prop:s0 exact string
+ro.boot.console                     u:object_r:exported2_default_prop:s0 exact string
+ro.boot.hardware                    u:object_r:exported2_default_prop:s0 exact string
+ro.boot.hardware.color              u:object_r:exported2_default_prop:s0 exact string
+ro.boot.hardware.sku                u:object_r:exported2_default_prop:s0 exact string
+ro.boot.keymaster                   u:object_r:exported2_default_prop:s0 exact string
+ro.boot.mode                        u:object_r:exported2_default_prop:s0 exact string
+ro.boot.vbmeta.avb_version          u:object_r:exported2_default_prop:s0 exact string
+ro.boot.verifiedbootstate           u:object_r:exported2_default_prop:s0 exact string
+ro.boot.veritymode                  u:object_r:exported2_default_prop:s0 exact string
+ro.boot.dynamic_partitions          u:object_r:exported_default_prop:s0 exact string
+ro.boot.dynamic_partitions_retrofit u:object_r:exported_default_prop:s0 exact string
+
+ro.bootloader u:object_r:exported2_default_prop:s0 exact string
+
+ro.build.date                        u:object_r:exported2_default_prop:s0 exact string
+ro.build.date.utc                    u:object_r:exported2_default_prop:s0 exact int
+ro.build.description                 u:object_r:exported2_default_prop:s0 exact string
+ro.build.display.id                  u:object_r:exported2_default_prop:s0 exact string
+ro.build.fingerprint                 u:object_r:exported_fingerprint_prop:s0 exact string
+ro.build.host                        u:object_r:exported2_default_prop:s0 exact string
+ro.build.id                          u:object_r:exported2_default_prop:s0 exact string
+ro.build.product                     u:object_r:exported2_default_prop:s0 exact string
+ro.build.system_root_image           u:object_r:exported2_default_prop:s0 exact bool
+ro.build.tags                        u:object_r:exported2_default_prop:s0 exact string
+ro.build.user                        u:object_r:exported2_default_prop:s0 exact string
+ro.build.version.base_os             u:object_r:exported2_default_prop:s0 exact string
+ro.build.version.codename            u:object_r:exported2_default_prop:s0 exact string
+ro.build.version.incremental         u:object_r:exported2_default_prop:s0 exact string
+ro.build.version.preview_sdk         u:object_r:exported2_default_prop:s0 exact int
+ro.build.version.release             u:object_r:exported2_default_prop:s0 exact string
+ro.build.version.release_or_codename u:object_r:exported2_default_prop:s0 exact string
+ro.build.version.sdk                 u:object_r:exported2_default_prop:s0 exact int
+ro.build.version.security_patch      u:object_r:exported2_default_prop:s0 exact string
+
+ro.crypto.state u:object_r:exported_vold_prop:s0 exact enum encrypted unencrypted unsupported
+ro.crypto.type  u:object_r:exported_vold_prop:s0 exact enum block file none
+
+ro.debuggable u:object_r:exported2_default_prop:s0 exact int
+
+ro.hardware u:object_r:exported2_default_prop:s0 exact string
+
+ro.product.brand        u:object_r:exported2_default_prop:s0 exact string
+ro.product.cpu.abi      u:object_r:exported2_default_prop:s0 exact string
+ro.product.cpu.abilist  u:object_r:exported2_default_prop:s0 exact string
+ro.product.device       u:object_r:exported2_default_prop:s0 exact string
+ro.product.manufacturer u:object_r:exported2_default_prop:s0 exact string
+ro.product.model        u:object_r:exported2_default_prop:s0 exact string
+ro.product.name         u:object_r:exported2_default_prop:s0 exact string
+
+ro.property_service.version u:object_r:exported2_default_prop:s0 exact int
+
+ro.revision u:object_r:exported2_default_prop:s0 exact string
+
+ro.secure u:object_r:exported_secure_prop:s0 exact int
+
+ro.vendor.redirect_socket_calls u:object_r:vendor_socket_hook_prop:s0 exact bool
+
+service.bootanim.exit u:object_r:exported_system_prop:s0 exact int
+
+sys.boot_from_charger_mode            u:object_r:exported_system_prop:s0 exact int
+sys.init.userspace_reboot.in_progress u:object_r:userspace_reboot_exported_prop:s0 exact bool
+sys.use_memfd                         u:object_r:use_memfd_prop:s0 exact bool
+
+vold.decrypt u:object_r:exported_vold_prop:s0 exact string
+
+# vendor-init-settable|public-readable
+aaudio.hw_burst_min_usec     u:object_r:exported_default_prop:s0 exact int
+aaudio.minimum_sleep_usec    u:object_r:exported_default_prop:s0 exact int
+aaudio.mixer_bursts          u:object_r:exported_default_prop:s0 exact int
+aaudio.mmap_exclusive_policy u:object_r:exported_default_prop:s0 exact int
+aaudio.mmap_policy           u:object_r:exported_default_prop:s0 exact int
+aaudio.wakeup_delay_usec     u:object_r:exported_default_prop:s0 exact int
+
+config.disable_cameraservice u:object_r:exported_camera_prop:s0 exact bool
+
+gsm.sim.operator.numeric u:object_r:exported_radio_prop:s0 exact string
+
+media.mediadrmservice.enable u:object_r:exported_default_prop:s0 exact bool
+
+persist.rcs.supported u:object_r:exported_default_prop:s0 exact int
+
+rcs.publish.status u:object_r:exported_radio_prop:s0 exact string
+
+ro.bionic.2nd_arch        u:object_r:cpu_variant_prop:s0 exact string
+ro.bionic.2nd_cpu_variant u:object_r:cpu_variant_prop:s0 exact string
+ro.bionic.arch            u:object_r:cpu_variant_prop:s0 exact string
+ro.bionic.cpu_variant     u:object_r:cpu_variant_prop:s0 exact string
+
+ro.board.platform u:object_r:exported_default_prop:s0 exact string
+
+ro.boot.fake_battery         u:object_r:exported_default_prop:s0 exact int
+ro.boot.hardware.revision    u:object_r:exported_default_prop:s0 exact string
+ro.boot.product.hardware.sku u:object_r:exported_default_prop:s0 exact string
+ro.boot.product.vendor.sku   u:object_r:exported_default_prop:s0 exact string
+ro.boot.slot_suffix          u:object_r:exported_default_prop:s0 exact string
+
+ro.bootimage.build.date        u:object_r:exported_default_prop:s0 exact string
+ro.bootimage.build.date.utc    u:object_r:exported_default_prop:s0 exact int
+ro.bootimage.build.fingerprint u:object_r:exported_default_prop:s0 exact string
+
+ro.boringcrypto.hwrand u:object_r:exported_default_prop:s0 exact bool
+
+ro.build.ab_update         u:object_r:exported_default_prop:s0 exact string
+ro.build.expect.baseband   u:object_r:exported_default_prop:s0 exact string
+ro.build.expect.bootloader u:object_r:exported_default_prop:s0 exact string
+
+ro.carrier u:object_r:exported_default_prop:s0 exact string
+
+ro.config.low_ram           u:object_r:exported_config_prop:s0 exact bool
+ro.config.vc_call_vol_steps u:object_r:exported_config_prop:s0 exact int
+
+ro.frp.pst u:object_r:exported_default_prop:s0 exact string
+
+ro.hardware.activity_recognition u:object_r:exported_default_prop:s0 exact string
+ro.hardware.audio                u:object_r:exported_default_prop:s0 exact string
+ro.hardware.audio.a2dp           u:object_r:exported_default_prop:s0 exact string
+ro.hardware.audio.hearing_aid    u:object_r:exported_default_prop:s0 exact string
+ro.hardware.audio.primary        u:object_r:exported_default_prop:s0 exact string
+ro.hardware.audio.usb            u:object_r:exported_default_prop:s0 exact string
+ro.hardware.audio_policy         u:object_r:exported_default_prop:s0 exact string
+ro.hardware.bootctrl             u:object_r:exported_default_prop:s0 exact string
+ro.hardware.camera               u:object_r:exported_default_prop:s0 exact string
+ro.hardware.consumerir           u:object_r:exported_default_prop:s0 exact string
+ro.hardware.context_hub          u:object_r:exported_default_prop:s0 exact string
+ro.hardware.egl                  u:object_r:exported_default_prop:s0 exact string
+ro.hardware.fingerprint          u:object_r:exported_default_prop:s0 exact string
+ro.hardware.flp                  u:object_r:exported_default_prop:s0 exact string
+ro.hardware.gatekeeper           u:object_r:exported_default_prop:s0 exact string
+ro.hardware.gps                  u:object_r:exported_default_prop:s0 exact string
+ro.hardware.gralloc              u:object_r:exported_default_prop:s0 exact string
+ro.hardware.hdmi_cec             u:object_r:exported_default_prop:s0 exact string
+ro.hardware.hwcomposer           u:object_r:exported_default_prop:s0 exact string
+ro.hardware.input                u:object_r:exported_default_prop:s0 exact string
+ro.hardware.keystore             u:object_r:exported_default_prop:s0 exact string
+ro.hardware.keystore_desede      u:object_r:exported_default_prop:s0 exact string
+ro.hardware.lights               u:object_r:exported_default_prop:s0 exact string
+ro.hardware.local_time           u:object_r:exported_default_prop:s0 exact string
+ro.hardware.memtrack             u:object_r:exported_default_prop:s0 exact string
+ro.hardware.nfc                  u:object_r:exported_default_prop:s0 exact string
+ro.hardware.nfc_nci              u:object_r:exported_default_prop:s0 exact string
+ro.hardware.nfc_tag              u:object_r:exported_default_prop:s0 exact string
+ro.hardware.nvram                u:object_r:exported_default_prop:s0 exact string
+ro.hardware.power                u:object_r:exported_default_prop:s0 exact string
+ro.hardware.radio                u:object_r:exported_default_prop:s0 exact string
+ro.hardware.sensors              u:object_r:exported_default_prop:s0 exact string
+ro.hardware.sound_trigger        u:object_r:exported_default_prop:s0 exact string
+ro.hardware.thermal              u:object_r:exported_default_prop:s0 exact string
+ro.hardware.tv_input             u:object_r:exported_default_prop:s0 exact string
+ro.hardware.type                 u:object_r:exported_default_prop:s0 exact string
+ro.hardware.vehicle              u:object_r:exported_default_prop:s0 exact string
+ro.hardware.vibrator             u:object_r:exported_default_prop:s0 exact string
+ro.hardware.virtual_device       u:object_r:exported_default_prop:s0 exact string
+ro.hardware.vulkan               u:object_r:exported_default_prop:s0 exact string
+
+ro.hwui.use_vulkan u:object_r:exported_default_prop:s0 exact bool
+
+ro.kernel.qemu             u:object_r:exported_default_prop:s0 exact bool
+ro.kernel.qemu.            u:object_r:exported_default_prop:s0
+ro.kernel.android.bootanim u:object_r:exported_default_prop:s0 exact int
+
+ro.odm.build.date                u:object_r:exported_default_prop:s0 exact string
+ro.odm.build.date.utc            u:object_r:exported_default_prop:s0 exact int
+ro.odm.build.fingerprint         u:object_r:exported_default_prop:s0 exact string
+ro.odm.build.version.incremental u:object_r:exported_default_prop:s0 exact string
+
+ro.oem.key1 u:object_r:exported_default_prop:s0 exact string
+
+ro.product.board               u:object_r:exported_default_prop:s0 exact string
+ro.product.cpu.abilist32       u:object_r:exported_default_prop:s0 exact string
+ro.product.cpu.abilist64       u:object_r:exported_default_prop:s0 exact string
+ro.product.first_api_level     u:object_r:exported_default_prop:s0 exact int
+ro.product.odm.brand           u:object_r:exported_default_prop:s0 exact string
+ro.product.odm.device          u:object_r:exported_default_prop:s0 exact string
+ro.product.odm.manufacturer    u:object_r:exported_default_prop:s0 exact string
+ro.product.odm.model           u:object_r:exported_default_prop:s0 exact string
+ro.product.odm.name            u:object_r:exported_default_prop:s0 exact string
+ro.product.vendor.brand        u:object_r:exported_default_prop:s0 exact string
+ro.product.vendor.device       u:object_r:exported_default_prop:s0 exact string
+ro.product.vendor.manufacturer u:object_r:exported_default_prop:s0 exact string
+ro.product.vendor.model        u:object_r:exported_default_prop:s0 exact string
+ro.product.vendor.name         u:object_r:exported_default_prop:s0 exact string
+ro.product.vndk.version        u:object_r:vndk_prop:s0 exact string
+
+ro.telephony.iwlan_operation_mode u:object_r:exported_radio_prop:s0 exact enum default legacy AP-assisted
+
+ro.vendor.build.date                u:object_r:exported_default_prop:s0 exact string
+ro.vendor.build.date.utc            u:object_r:exported_default_prop:s0 exact int
+ro.vendor.build.fingerprint         u:object_r:exported_default_prop:s0 exact string
+ro.vendor.build.version.incremental u:object_r:exported_default_prop:s0 exact string
+
+ro.vndk.lite    u:object_r:vndk_prop:s0 exact bool
+ro.vndk.version u:object_r:vndk_prop:s0 exact string
+
+ro.vts.coverage u:object_r:exported_default_prop:s0 exact int
+
+wifi.active.interface     u:object_r:exported_wifi_prop:s0 exact string
+wifi.concurrent.interface u:object_r:exported_default_prop:s0 exact string
+wifi.direct.interface     u:object_r:exported_default_prop:s0 exact string
+wifi.interface            u:object_r:exported_default_prop:s0 exact string
+
+ro.apex.updatable u:object_r:exported_default_prop:s0 exact bool
+
+ro.init.userspace_reboot.is_supported u:object_r:userspace_reboot_config_prop:s0 exact bool
+
+# public-readable
+ro.boot.revision u:object_r:exported2_default_prop:s0 exact string
+
+ro.bootmode u:object_r:exported2_default_prop:s0 exact string
+
+ro.build.type u:object_r:exported2_default_prop:s0 exact string
+
+sys.shutdown.requested u:object_r:exported_system_prop:s0 exact string
+
+# Using Sysprop as API. So the ro.surface_flinger.* are guaranteed to be API-stable
+ro.surface_flinger.default_composition_dataspace          u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.default_composition_pixel_format       u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.force_hwc_copy_for_virtual_displays    u:object_r:exported_default_prop:s0 exact bool
+ro.surface_flinger.has_HDR_display                        u:object_r:exported_default_prop:s0 exact bool
+ro.surface_flinger.has_wide_color_display                 u:object_r:exported_default_prop:s0 exact bool
+ro.surface_flinger.max_frame_buffer_acquired_buffers      u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.max_graphics_height                    u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.max_graphics_width                     u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.max_virtual_display_dimension          u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.primary_display_orientation            u:object_r:exported_default_prop:s0 exact enum ORIENTATION_0 ORIENTATION_180 ORIENTATION_270 ORIENTATION_90
+ro.surface_flinger.present_time_offset_from_vsync_ns      u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.running_without_sync_framework         u:object_r:exported_default_prop:s0 exact bool
+ro.surface_flinger.start_graphics_allocator_service       u:object_r:exported_default_prop:s0 exact bool
+ro.surface_flinger.use_color_management                   u:object_r:exported_default_prop:s0 exact bool
+ro.surface_flinger.use_context_priority                   u:object_r:exported_default_prop:s0 exact bool
+ro.surface_flinger.use_vr_flinger                         u:object_r:exported_default_prop:s0 exact bool
+ro.surface_flinger.vsync_event_phase_offset_ns            u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.vsync_sf_event_phase_offset_ns         u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.wcg_composition_dataspace              u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.wcg_composition_pixel_format           u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.display_primary_red                    u:object_r:exported_default_prop:s0 exact string
+ro.surface_flinger.display_primary_green                  u:object_r:exported_default_prop:s0 exact string
+ro.surface_flinger.display_primary_blue                   u:object_r:exported_default_prop:s0 exact string
+ro.surface_flinger.display_primary_white                  u:object_r:exported_default_prop:s0 exact string
+ro.surface_flinger.protected_contents                     u:object_r:exported_default_prop:s0 exact bool
+ro.surface_flinger.set_idle_timer_ms                      u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.set_touch_timer_ms                     u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.set_display_power_timer_ms             u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.support_kernel_idle_timer              u:object_r:exported_default_prop:s0 exact bool
+ro.surface_flinger.use_smart_90_for_video                 u:object_r:exported_default_prop:s0 exact bool
+ro.surface_flinger.use_content_detection_for_refresh_rate u:object_r:exported_default_prop:s0 exact bool
+ro.surface_flinger.color_space_agnostic_dataspace         u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.refresh_rate_switching                 u:object_r:exported_default_prop:s0 exact bool
+
+# Binder cache properties.  These are world-readable
+cache_key.app_inactive                   u:object_r:binder_cache_system_server_prop:s0
+cache_key.is_compat_change_enabled       u:object_r:binder_cache_system_server_prop:s0
+cache_key.get_packages_for_uid           u:object_r:binder_cache_system_server_prop:s0
+cache_key.has_system_feature             u:object_r:binder_cache_system_server_prop:s0
+cache_key.is_interactive                 u:object_r:binder_cache_system_server_prop:s0
+cache_key.is_power_save_mode             u:object_r:binder_cache_system_server_prop:s0
+cache_key.is_user_unlocked               u:object_r:binder_cache_system_server_prop:s0
+cache_key.volume_list                    u:object_r:binder_cache_system_server_prop:s0
+cache_key.display_info                   u:object_r:binder_cache_system_server_prop:s0
+cache_key.location_enabled               u:object_r:binder_cache_system_server_prop:s0
+cache_key.package_info                   u:object_r:binder_cache_system_server_prop:s0
+
+cache_key.bluetooth.                     u:object_r:binder_cache_bluetooth_server_prop:s0 prefix string
+cache_key.system_server.                 u:object_r:binder_cache_system_server_prop:s0 prefix string
+cache_key.telephony.                     u:object_r:binder_cache_telephony_server_prop:s0 prefix string
diff --git a/private/radio.te b/private/radio.te
index 17a4fdd..db9820d 100644
--- a/private/radio.te
+++ b/private/radio.te
@@ -4,6 +4,16 @@
 
 read_runtime_log_tags(radio)
 
+# Property service
+set_prop(radio, radio_prop)
+set_prop(radio, exported_radio_prop)
+set_prop(radio, exported2_radio_prop)
+set_prop(radio, exported3_radio_prop)
+set_prop(radio, net_radio_prop)
+
+# ctl interface
+set_prop(radio, ctl_rildaemon_prop)
+
 # Telephony code contains time / time zone detection logic so it reads the associated properties.
 get_prop(radio, time_prop)
 
@@ -20,3 +30,7 @@
 set_prop(radio, binder_cache_telephony_server_prop);
 neverallow { domain -radio -init }
     binder_cache_telephony_server_prop:property_service set;
+
+# allow sending pulled atoms to statsd
+binder_call(radio, statsd)
+
diff --git a/private/recovery.te b/private/recovery.te
index 2a7fdc7..eee1698 100644
--- a/private/recovery.te
+++ b/private/recovery.te
@@ -1 +1,24 @@
 typeattribute recovery coredomain;
+
+# The allow rules are only included in the recovery policy.
+# Otherwise recovery is only allowed the domain rules.
+recovery_only(`
+  # Reboot the device
+  set_prop(recovery, powerctl_prop)
+
+  # Read serial number of the device from system properties
+  get_prop(recovery, serialno_prop)
+
+  # Set sys.usb.ffs.ready when starting minadbd for sideload.
+  set_prop(recovery, ffs_prop)
+  set_prop(recovery, exported_ffs_prop)
+
+  # Set sys.usb.config when switching into fastboot.
+  set_prop(recovery, system_radio_prop)
+  set_prop(recovery, exported_system_radio_prop)
+
+  # Read ro.boot.bootreason
+  get_prop(recovery, bootloader_boot_reason_prop)
+
+  set_prop(recovery, gsid_prop)
+')
diff --git a/private/service_contexts b/private/service_contexts
index db2a62a..5e9b212 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -107,7 +107,6 @@
 ims                                       u:object_r:radio_service:s0
 imms                                      u:object_r:imms_service:s0
 incremental                               u:object_r:incremental_service:s0
-incremental_service                       u:object_r:incremental_service:s0
 ipsec                                     u:object_r:ipsec_service:s0
 ircsmessage                               u:object_r:radio_service:s0
 iris                                      u:object_r:iris_service:s0
diff --git a/private/shell.te b/private/shell.te
index 2c69f95..63757eb 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -1,3 +1,4 @@
+
 typeattribute shell coredomain;
 
 # allow shell input injection
@@ -73,6 +74,10 @@
 set_prop(shell, lpdumpd_prop);
 binder_call(shell, lpdumpd)
 
+# Allow shell to set and read value of properties used for CTS tests of
+# userspace reboot
+set_prop(shell, userspace_reboot_test_prop)
+
 # Allow shell to get encryption policy of /data/local/tmp/, for CTS
 allowxperm shell shell_data_file:dir ioctl {
   FS_IOC_GET_ENCRYPTION_POLICY
@@ -86,3 +91,52 @@
 # not the whole system.
 allow shell self:perf_event { open read write kernel };
 neverallow shell self:perf_event ~{ open read write kernel };
+
+# Set properties.
+set_prop(shell, shell_prop)
+set_prop(shell, ctl_bugreport_prop)
+set_prop(shell, ctl_dumpstate_prop)
+set_prop(shell, dumpstate_prop)
+set_prop(shell, exported_dumpstate_prop)
+set_prop(shell, debug_prop)
+set_prop(shell, powerctl_prop)
+set_prop(shell, log_tag_prop)
+set_prop(shell, wifi_log_prop)
+# Allow shell to start/stop traced via the persist.traced.enable
+# property (which also takes care of /data/misc initialization).
+set_prop(shell, traced_enabled_prop)
+# adjust is_loggable properties
+userdebug_or_eng(`set_prop(shell, log_prop)')
+# logpersist script
+userdebug_or_eng(`set_prop(shell, logpersistd_logging_prop)')
+# Allow shell to start/stop heapprofd via the persist.heapprofd.enable
+# property.
+set_prop(shell, heapprofd_enabled_prop)
+# Allow shell to start/stop traced_perf via the persist.traced_perf.enable
+# property.
+set_prop(shell, traced_perf_enabled_prop)
+# Allow shell to start/stop gsid via ctl.start|stop|restart gsid.
+set_prop(shell, ctl_gsid_prop)
+# Allow shell to enable Dynamic System Update
+set_prop(shell, dynamic_system_prop)
+# Allow shell to mock an OTA using persist.pm.mock-upgrade
+set_prop(shell, mock_ota_prop)
+
+# Read device's serial number from system properties
+get_prop(shell, serialno_prop)
+
+# Allow shell to read the vendor security patch level for CTS
+get_prop(shell, vendor_security_patch_level_prop)
+
+# Read state of logging-related properties
+get_prop(shell, device_logging_prop)
+
+# Read state of boot reason properties
+get_prop(shell, bootloader_boot_reason_prop)
+get_prop(shell, last_boot_reason_prop)
+get_prop(shell, system_boot_reason_prop)
+
+# Allow reading the outcome of perf_event_open LSM support test for CTS.
+get_prop(shell, init_perf_lsm_hooks_prop)
+
+userdebug_or_eng(`set_prop(shell, persist_debug_prop)')
diff --git a/private/system_server.te b/private/system_server.te
index 7c24598..e586f51 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -24,12 +24,12 @@
 # For Incremental Service to check if incfs is available
 allow system_server proc_filesystems:file r_file_perms;
 
-# To create files on Incremental File System
+# To create files and get permission to fill blocks on Incremental File System
 allow system_server incremental_control_file:file { ioctl r_file_perms };
-allowxperm system_server incremental_control_file:file ioctl INCFS_IOCTL_CREATE_FILE;
+allowxperm system_server incremental_control_file:file ioctl { INCFS_IOCTL_CREATE_FILE INCFS_IOCTL_PERMIT_FILL };
 
-# To get signature of an APK installed on Incremental File System
-allowxperm system_server apk_data_file:file ioctl INCFS_IOCTL_READ_SIGNATURE;
+# To get signature of an APK installed on Incremental File System and fill in data blocks
+allowxperm system_server apk_data_file:file ioctl { INCFS_IOCTL_READ_SIGNATURE INCFS_IOCTL_FILL_BLOCKS };
 
 # For art.
 allow system_server dalvikcache_data_file:dir r_dir_perms;
@@ -302,6 +302,7 @@
   hal_codec2_server
   hal_face_server
   hal_fingerprint_server
+  hal_gnss_server
   hal_graphics_allocator_server
   hal_graphics_composer_server
   hal_health_server
diff --git a/private/system_server_startup.te b/private/system_server_startup.te
index f1427a9..902941e 100644
--- a/private/system_server_startup.te
+++ b/private/system_server_startup.te
@@ -7,13 +7,6 @@
 allow system_server_startup self:process execmem;
 allow system_server_startup system_server_startup_tmpfs:file { execute read write open map };
 
-# Allow to pick up integrity-checked artifacts from the dalvik cache.
-allow system_server_startup dalvikcache_data_file:dir r_dir_perms;
-allow system_server_startup dalvikcache_data_file:file { r_file_perms execute };
-
-# While doing the above, will touch the apex mount dir.
-allow system_server_startup mnt_expand_file:dir getattr;
-
 # Allow system_server_startup to run setcon() and enter the
 # system_server domain
 allow system_server_startup self:process setcurrent;
diff --git a/private/traceur_app.te b/private/traceur_app.te
index 94841df..b7e58ba 100644
--- a/private/traceur_app.te
+++ b/private/traceur_app.te
@@ -20,3 +20,8 @@
 unix_socket_connect(traceur_app, traced_consumer, traced)
 
 dontaudit traceur_app debugfs_tracing_debug:file audit_access;
+
+# Allow Traceur to enable traced if necessary.
+set_prop(traceur_app, traced_enabled_prop)
+
+set_prop(traceur_app, debug_prop)
diff --git a/private/ueventd.te b/private/ueventd.te
index 1bd6773..8bcdbf9 100644
--- a/private/ueventd.te
+++ b/private/ueventd.te
@@ -1,3 +1,7 @@
 typeattribute ueventd coredomain;
 
 tmpfs_domain(ueventd)
+
+# ueventd can set properties, particularly it sets ro.cold_boot_done to signal
+# to init that cold boot has completed.
+set_prop(ueventd, cold_boot_done_prop)
diff --git a/private/uncrypt.te b/private/uncrypt.te
index e4e9224..1a94cd1 100644
--- a/private/uncrypt.te
+++ b/private/uncrypt.te
@@ -1,3 +1,6 @@
 typeattribute uncrypt coredomain;
 
 init_daemon_domain(uncrypt)
+
+# Set a property to reboot the device.
+set_prop(uncrypt, powerctl_prop)
diff --git a/private/update_engine.te b/private/update_engine.te
index e4e7009..a76ab49 100644
--- a/private/update_engine.te
+++ b/private/update_engine.te
@@ -5,3 +5,9 @@
 # Allow to talk to gsid.
 allow update_engine gsi_service:service_manager find;
 binder_call(update_engine, gsid)
+
+# Allow to start gsid service.
+set_prop(update_engine, ctl_gsid_prop)
+
+# Allow to set the OTA related properties, e.g. ota.warm_reset.
+set_prop(update_engine, ota_prop)
diff --git a/private/update_verifier.te b/private/update_verifier.te
index 1b934d9..5e1b27b 100644
--- a/private/update_verifier.te
+++ b/private/update_verifier.te
@@ -1,3 +1,9 @@
 typeattribute update_verifier coredomain;
 
 init_daemon_domain(update_verifier)
+
+# Allow update_verifier to reboot the device.
+set_prop(update_verifier, powerctl_prop)
+
+# Allow to set the OTA related properties e.g. ota.warm_reset.
+set_prop(update_verifier, ota_prop)
diff --git a/private/usbd.te b/private/usbd.te
index 13a0ad7..42f2324 100644
--- a/private/usbd.te
+++ b/private/usbd.te
@@ -10,3 +10,6 @@
 
 # start adbd during boot if adb is enabled
 set_prop(usbd, ctl_default_prop)
+
+# Start/stop adbd via ctl.start adbd
+set_prop(usbd, ctl_adbd_prop)
diff --git a/private/vold.te b/private/vold.te
index dea24a5..19d74b1 100644
--- a/private/vold.te
+++ b/private/vold.te
@@ -17,3 +17,13 @@
 # from accidentally writing when the mount point isn't present.
 type_transition vold storage_file:dir storage_stub_file;
 type_transition vold mnt_media_rw_file:dir mnt_media_rw_stub_file;
+
+# Property Service
+set_prop(vold, vold_prop)
+set_prop(vold, exported_vold_prop)
+set_prop(vold, exported2_vold_prop)
+set_prop(vold, powerctl_prop)
+set_prop(vold, ctl_fuse_prop)
+set_prop(vold, restorecon_prop)
+set_prop(vold, ota_prop)
+set_prop(vold, boottime_prop)
diff --git a/private/wificond.te b/private/wificond.te
index cc76447..7bffaba 100644
--- a/private/wificond.te
+++ b/private/wificond.te
@@ -1,4 +1,10 @@
 typeattribute wificond coredomain;
 
+set_prop(wificond, exported_wifi_prop)
+set_prop(wificond, wifi_prop)
+set_prop(wificond, ctl_default_prop)
+
+get_prop(wificond, hwservicemanager_prop)
+
 init_daemon_domain(wificond)
 hal_client_domain(wificond, hal_wifi_offload)
diff --git a/private/zygote.te b/private/zygote.te
index f9e5476..5f08f8d 100644
--- a/private/zygote.te
+++ b/private/zygote.te
@@ -187,12 +187,19 @@
 # ingore spurious denials
 dontaudit zygote self:global_capability_class_set sys_resource;
 
+# Ignore spurious denials calling access() on fuse
+# TODO(b/151316657): avoid the denials
+dontaudit zygote media_rw_data_file:dir setattr;
+
 # Allow zygote to use ashmem fds from system_server.
 allow zygote system_server:fd use;
 
 # Send unsolicited message to system_server
 unix_socket_send(zygote, system_unsolzygote, system_server)
 
+# Allow zygote to access media_variant_prop for static initialization
+get_prop(zygote, media_variant_prop)
+
 ###
 ### neverallow rules
 ###
diff --git a/public/adbd.te b/public/adbd.te
index 4a1f633..68a176c 100644
--- a/public/adbd.te
+++ b/public/adbd.te
@@ -6,6 +6,3 @@
 # Only init is allowed to enter the adbd domain via exec()
 neverallow { domain -init } adbd:process transition;
 neverallow * adbd:process dyntransition;
-
-# Allow adbd start/stop mdnsd via ctl.start
-set_prop(adbd, ctl_mdnsd_prop)
diff --git a/public/apexd.te b/public/apexd.te
index 93c257f..429791f 100644
--- a/public/apexd.te
+++ b/public/apexd.te
@@ -4,12 +4,8 @@
 
 binder_use(apexd)
 add_service(apexd, apex_service)
-set_prop(apexd, apexd_prop)
 
 neverallow { domain -init -apexd -system_server } apex_service:service_manager find;
 neverallow { domain -init -apexd -system_server -servicemanager } apexd:binder call;
 
 neverallow { domain userdebug_or_eng(`-crash_dump') } apexd:process ptrace;
-
-# only apexd can set apexd sysprop
-neverallow { domain -apexd -init } apexd_prop:property_service set;
diff --git a/public/asan_extract.te b/public/asan_extract.te
index 15c5a09..22da8c1 100644
--- a/public/asan_extract.te
+++ b/public/asan_extract.te
@@ -30,7 +30,4 @@
 
   # Restorecon will actually already try to run with sanitized libraries (libpackagelistparser).
   allow asan_extract system_data_file:file execute;
-
-  # We need to signal a reboot when done.
-  set_prop(asan_extract, powerctl_prop)
 ')
diff --git a/public/bootanim.te b/public/bootanim.te
index e8cb98b..eb3eba5 100644
--- a/public/bootanim.te
+++ b/public/bootanim.te
@@ -36,7 +36,3 @@
 
 # System file accesses.
 allow bootanim system_file:dir r_dir_perms;
-
-# Read ro.boot.bootreason b/30654343
-get_prop(bootanim, bootloader_boot_reason_prop)
-
diff --git a/public/bootstat.te b/public/bootstat.te
index 6143a7d..5079c28 100644
--- a/public/bootstat.te
+++ b/public/bootstat.te
@@ -8,13 +8,6 @@
 allow bootstat bootstat_data_file:dir rw_dir_perms;
 allow bootstat bootstat_data_file:file create_file_perms;
 
-# Collect metrics on boot time created by init
-get_prop(bootstat, boottime_prop)
-
-# Read/Write [persist.]sys.boot.reason and ro.boot.bootreason (write if empty)
-set_prop(bootstat, bootloader_boot_reason_prop)
-set_prop(bootstat, system_boot_reason_prop)
-set_prop(bootstat, last_boot_reason_prop)
 allow bootstat metadata_file:dir search;
 allow bootstat metadata_bootstat_file:dir rw_dir_perms;
 allow bootstat metadata_bootstat_file:file create_file_perms;
@@ -32,30 +25,6 @@
 # Allow bootstat write to statsd.
 unix_socket_send(bootstat, statsdw, statsd)
 
-# ToDo: end
-
-neverallow {
-  domain
-  -bootanim
-  -bootstat
-  -dumpstate
-  -init
-  -recovery
-  -shell
-  -system_server
-} { bootloader_boot_reason_prop last_boot_reason_prop }:file r_file_perms;
-# ... and refine, as these components should not set the last boot reason
-neverallow { bootanim recovery } last_boot_reason_prop:file r_file_perms;
-
-neverallow {
-  domain
-  -bootstat
-  -init
-  -system_server
-} { bootloader_boot_reason_prop last_boot_reason_prop }:property_service set;
-# ... and refine ... for a ro propertly no less ... keep this _tight_
-neverallow system_server bootloader_boot_reason_prop:property_service set;
-
 neverallow {
   domain
   -bootstat
diff --git a/public/charger.te b/public/charger.te
index 4b341ea..f57853a 100644
--- a/public/charger.te
+++ b/public/charger.te
@@ -36,13 +36,4 @@
 allow charger tty_device:chr_file rw_file_perms;
 allow charger proc_sysrq:file rw_file_perms;
 
-# charger needs to tell init to continue the boot
-# process when running in charger mode.
-set_prop(charger, system_prop)
-set_prop(charger, exported_system_prop)
-set_prop(charger, exported2_system_prop)
-set_prop(charger, exported3_system_prop)
-
-get_prop(charger, charger_prop)
-
 hal_client_domain(charger, hal_health)
diff --git a/public/device.te b/public/device.te
index 32563d6..43d6322 100644
--- a/public/device.te
+++ b/public/device.te
@@ -52,6 +52,7 @@
 type usbaccessory_device, dev_type, mlstrustedobject;
 type usb_device, dev_type, mlstrustedobject;
 type usb_serial_device, dev_type;
+type gnss_device, dev_type;
 type properties_device, dev_type;
 type properties_serial, dev_type;
 type property_info, dev_type;
diff --git a/public/dhcp.te b/public/dhcp.te
index 4f2369d..67fd038 100644
--- a/public/dhcp.te
+++ b/public/dhcp.te
@@ -17,9 +17,6 @@
 # For /proc/sys/net/ipv4/conf/*/promote_secondaries
 allow dhcp proc_net_type:file write;
 
-set_prop(dhcp, dhcp_prop)
-set_prop(dhcp, pan_result_prop)
-
 allow dhcp dhcp_data_file:dir create_dir_perms;
 allow dhcp dhcp_data_file:file create_file_perms;
 
diff --git a/public/domain.te b/public/domain.te
index 1b7d4fb..7bee8ec 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -533,10 +533,6 @@
     neverallow { domain -init -vendor_init } vendor_default_prop:property_service set;
 ')
 
-# Only core domains are allowed to access package_manager properties
-neverallow { domain -init -system_server } pm_prop:property_service set;
-neverallow { domain -coredomain } pm_prop:file no_rw_file_perms;
-
 compatible_property_only(`
     neverallow { domain -init -system_server -vendor_init } exported_pm_prop:property_service set;
     neverallow { domain -coredomain -vendor_init } exported_pm_prop:file no_rw_file_perms;
@@ -562,9 +558,6 @@
   -vendor_init
 } serialno_prop:file r_file_perms;
 
-# Do not allow reading the last boot timestamp from system properties
-neverallow { domain -init -system_server -dumpstate } firstboot_prop:file r_file_perms;
-
 neverallow {
   domain
   -init
@@ -997,6 +990,7 @@
     -system_executes_vendor_violators
     -traced_perf # library/binary access for symbolization
     -ueventd # reads /vendor/ueventd.rc
+    -vold # loads incremental fs driver
   } {
     vendor_file_type
     -same_process_hal_file
@@ -1010,7 +1004,6 @@
     -vendor_overlay_file
     -vendor_public_lib_file
     -vendor_task_profiles_file
-    -vendor_incremental_module
     -vndk_sp_file
   }:file *;
 ')
diff --git a/public/dumpstate.te b/public/dumpstate.te
index 1e895e4..5f27d32 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -258,13 +258,6 @@
 
 allow dumpstate devpts:chr_file rw_file_perms;
 
-# Set properties.
-# dumpstate_prop is used to share state with the Shell app.
-set_prop(dumpstate, dumpstate_prop)
-set_prop(dumpstate, exported_dumpstate_prop)
-# dumpstate_options_prop is used to pass extra command-line args.
-set_prop(dumpstate, dumpstate_options_prop)
-
 # Read any system properties
 get_prop(dumpstate, property_type)
 
@@ -329,9 +322,6 @@
 allow hal_rebootescrow_server dumpstate:fifo_file write;
 allow hal_rebootescrow_server dumpstate:fd use;
 
-# Allow dumpstate to kill vendor dumpstate service by init
-set_prop(dumpstate, ctl_dumpstate_prop)
-
 #Access /data/misc/snapshotctl_log
 allow dumpstate snapshotctl_log_data_file:dir r_dir_perms;
 allow dumpstate snapshotctl_log_data_file:file r_file_perms;
diff --git a/public/fastbootd.te b/public/fastbootd.te
index a0152d4..bb18637 100644
--- a/public/fastbootd.te
+++ b/public/fastbootd.te
@@ -23,22 +23,12 @@
 
   allow fastbootd device:dir r_dir_perms;
 
-  # Reboot the device
-  set_prop(fastbootd, powerctl_prop)
-
-  # Read serial number of the device from system properties
-  get_prop(fastbootd, serialno_prop)
-
   # For dev/block/by-name dir
   allow fastbootd block_device:dir r_dir_perms;
 
   # Needed for DM_DEV_CREATE ioctl call
   allow fastbootd self:capability sys_admin;
 
-  # Set sys.usb.ffs.ready.
-  set_prop(fastbootd, ffs_prop)
-  set_prop(fastbootd, exported_ffs_prop)
-
   unix_socket_connect(fastbootd, recovery, recovery)
 
   # Required for flashing
@@ -106,18 +96,12 @@
     }:{ file lnk_file } unlink;
     allow fastbootd tmpfs:dir rw_dir_perms;
     allow fastbootd labeledfs:filesystem { mount unmount };
-    get_prop(fastbootd, persistent_properties_ready_prop)
   ')
 
   # Allow using libfiemap/gsid directly (no binder in recovery).
-  set_prop(fastbootd, gsid_prop)
   allow fastbootd gsi_metadata_file:dir search;
   allow fastbootd ota_metadata_file:dir rw_dir_perms;
   allow fastbootd ota_metadata_file:file create_file_perms;
-
-  # Determine allocation scheme (whether B partitions needs to be
-  # at the second half of super.
-  get_prop(fastbootd, virtual_ab_prop)
 ')
 
 ###
diff --git a/public/file.te b/public/file.te
index 1cc34f5..462e71d 100644
--- a/public/file.te
+++ b/public/file.te
@@ -137,6 +137,7 @@
 type debugfs_tracing_instances, fs_type, debugfs_type;
 type debugfs_wakeup_sources, fs_type, debugfs_type;
 type debugfs_wifi_tracing, fs_type, debugfs_type;
+type securityfs, fs_type;
 
 type pstorefs, fs_type;
 type functionfs, fs_type, mlstrustedobject;
@@ -210,8 +211,6 @@
 # Type for all vendor public libraries. These libs should only be exposed to
 # apps. ABI stability of these libs is vendor's responsibility.
 type vendor_public_lib_file, vendor_file_type, file_type;
-# Default type for incremental file system driver
-type vendor_incremental_module, vendor_file_type, file_type;
 
 # Input configuration
 type vendor_keylayout_file, vendor_file_type, file_type;
diff --git a/public/flags_health_check.te b/public/flags_health_check.te
index 6315d44..25a7768 100644
--- a/public/flags_health_check.te
+++ b/public/flags_health_check.te
@@ -2,33 +2,9 @@
 type flags_health_check, domain, coredomain;
 type flags_health_check_exec, system_file_type, exec_type, file_type;
 
-set_prop(flags_health_check, device_config_boot_count_prop)
-set_prop(flags_health_check, device_config_reset_performed_prop)
-set_prop(flags_health_check, device_config_runtime_native_boot_prop)
-set_prop(flags_health_check, device_config_runtime_native_prop)
-set_prop(flags_health_check, device_config_input_native_boot_prop)
-set_prop(flags_health_check, device_config_netd_native_prop)
-set_prop(flags_health_check, device_config_activity_manager_native_boot_prop)
-set_prop(flags_health_check, device_config_media_native_prop)
-set_prop(flags_health_check, device_config_storage_native_boot_prop)
-set_prop(flags_health_check, device_config_sys_traced_prop)
-set_prop(flags_health_check, device_config_window_manager_native_boot_prop)
-set_prop(flags_health_check, device_config_configuration_prop)
-
 allow flags_health_check server_configurable_flags_data_file:dir rw_dir_perms;
 allow flags_health_check server_configurable_flags_data_file:file create_file_perms;
 
-# system property device_config_boot_count_prop is used for deciding when to perform server
-# configurable flags related disaster recovery. Mistakenly set up by unrelated components can, at a
-# wrong timing, trigger server configurable flag related disaster recovery, which will override
-# server configured values of all flags with default values.
-neverallow { domain -init -flags_health_check } device_config_boot_count_prop:property_service set;
-
-# system property device_config_reset_performed_prop is used for indicating whether server
-# configurable flags have been reset during booting. Mistakenly modified by unrelated components can
-# cause bad server configurable flags synced back to device.
-neverallow { domain -init -flags_health_check } device_config_reset_performed_prop:property_service set;
-
 # server_configurable_flags_data_file is used for storing whether server configurable flags which
 # have been reset during current booting. Mistakenly modified by unrelated components can
 # cause bad server configurable flags synced back to device.
diff --git a/public/gatekeeperd.te b/public/gatekeeperd.te
index dc46d07..e1739c2 100644
--- a/public/gatekeeperd.te
+++ b/public/gatekeeperd.te
@@ -35,7 +35,4 @@
 # For hardware properties retrieval
 allow gatekeeperd hardware_properties_service:service_manager find;
 
-# For checking whether GSI is running
-get_prop(gatekeeperd, gsid_prop)
-
 r_dir_file(gatekeeperd, cgroup)
diff --git a/public/hal_codec2.te b/public/hal_codec2.te
index 60cd3b0..8c7816a 100644
--- a/public/hal_codec2.te
+++ b/public/hal_codec2.te
@@ -1,3 +1,6 @@
+get_prop(hal_codec2_client, media_variant_prop)
+get_prop(hal_codec2_server, media_variant_prop)
+
 binder_call(hal_codec2_client, hal_codec2_server)
 binder_call(hal_codec2_server, hal_codec2_client)
 
diff --git a/public/hal_neuralnetworks.te b/public/hal_neuralnetworks.te
index 1ef6cad..f8d6ff5 100644
--- a/public/hal_neuralnetworks.te
+++ b/public/hal_neuralnetworks.te
@@ -5,6 +5,8 @@
 hal_attribute_hwservice(hal_neuralnetworks, hal_neuralnetworks_hwservice)
 allow hal_neuralnetworks hidl_memory_hwservice:hwservice_manager find;
 allow hal_neuralnetworks hal_allocator:fd use;
+allow hal_neuralnetworks hal_graphics_mapper_hwservice:hwservice_manager find;
+allow hal_neuralnetworks hal_graphics_allocator:fd use;
 
 # Allow NN HAL service to use a client-provided fd residing in /data/data/.
 allow hal_neuralnetworks_server app_data_file:file { read write getattr map };
@@ -13,6 +15,9 @@
 # Allow NN HAL service to use a client-provided fd residing in /data/local/tmp/.
 allow hal_neuralnetworks_server shell_data_file:file { read write getattr map };
 
+# Allow NN HAL service to read a client-provided ION memory fd.
+allow hal_neuralnetworks_server ion_device:chr_file r_file_perms;
+
 # Allow NN HAL client to check the ro.nnapi.extensions.deny_on_product
 # property to determine whether to deny NNAPI extensions use for apps
 # on product partition (apps in GSI are not allowed to use NNAPI extensions).
diff --git a/public/hal_omx.te b/public/hal_omx.te
index 707cae8..8e74383 100644
--- a/public/hal_omx.te
+++ b/public/hal_omx.te
@@ -22,6 +22,9 @@
 
 allow hal_omx_client hidl_token_hwservice:hwservice_manager find;
 
+get_prop(hal_omx_client, media_variant_prop)
+get_prop(hal_omx_server, media_variant_prop)
+
 binder_call(hal_omx_client, hal_omx_server)
 binder_call(hal_omx_server, hal_omx_client)
 
diff --git a/public/healthd.te b/public/healthd.te
index 7ea23e1..8673846 100644
--- a/public/healthd.te
+++ b/public/healthd.te
@@ -47,10 +47,3 @@
 allow healthd tty_device:chr_file rw_file_perms;
 allow healthd ashmem_device:chr_file execute;
 allow healthd proc_sysrq:file rw_file_perms;
-
-# Healthd needs to tell init to continue the boot
-# process when running in charger mode.
-set_prop(healthd, system_prop)
-set_prop(healthd, exported_system_prop)
-set_prop(healthd, exported2_system_prop)
-set_prop(healthd, exported3_system_prop)
diff --git a/public/hwservicemanager.te b/public/hwservicemanager.te
index 7f03815..7ec1872 100644
--- a/public/hwservicemanager.te
+++ b/public/hwservicemanager.te
@@ -10,8 +10,6 @@
 # to do this is granted in the hwbinder_use macro.
 allow hwservicemanager self:binder set_context_mgr;
 
-set_prop(hwservicemanager, hwservicemanager_prop)
-
 # Scan through /system/lib64/hw looking for installed HALs
 allow hwservicemanager system_file:dir r_dir_perms;
 
diff --git a/public/ioctl_defines b/public/ioctl_defines
index 4eeeb4e..4cc3bba 100644
--- a/public/ioctl_defines
+++ b/public/ioctl_defines
@@ -1057,6 +1057,8 @@
 define(`IMSETDEVNAME', `0x80184947')
 define(`INCFS_IOCTL_CREATE_FILE', `0x0000671e')
 define(`INCFS_IOCTL_READ_SIGNATURE', `0x0000671f')
+define(`INCFS_IOCTL_FILL_BLOCKS', `0x00006720')
+define(`INCFS_IOCTL_PERMIT_FILL', `0x00006721')
 define(`IOCTL_EVTCHN_BIND_INTERDOMAIN', `0x00084501')
 define(`IOCTL_EVTCHN_BIND_UNBOUND_PORT', `0x00044502')
 define(`IOCTL_EVTCHN_BIND_VIRQ', `0x00044500')
diff --git a/public/lmkd.te b/public/lmkd.te
index b852f44..7c1e741 100644
--- a/public/lmkd.te
+++ b/public/lmkd.te
@@ -36,9 +36,6 @@
 allow lmkd proc_zoneinfo:file r_file_perms;
 allow lmkd proc_vmstat:file r_file_perms;
 
-# Set sys.lmk.* properties.
-set_prop(lmkd, system_lmk_prop)
-
 # live lock watchdog process allowed to look through /proc/
 allow lmkd domain:dir { search open read };
 allow lmkd domain:file { open read };
diff --git a/public/logd.te b/public/logd.te
index 57e29d9..f8dd164 100644
--- a/public/logd.te
+++ b/public/logd.te
@@ -23,9 +23,6 @@
 ')
 allow logd runtime_event_log_tags_file:file rw_file_perms;
 
-# Access device logging gating property
-get_prop(logd, device_logging_prop)
-
 r_dir_file(logd, domain)
 
 allow logd kernel:system syslog_mod;
diff --git a/public/mediaextractor.te b/public/mediaextractor.te
index 4bedb0f..4bee4f8 100644
--- a/public/mediaextractor.te
+++ b/public/mediaextractor.te
@@ -37,8 +37,6 @@
 # scan extractor library directory to dynamically load extractors
 allow mediaextractor system_file:dir { read open };
 
-get_prop(mediaextractor, device_config_media_native_prop)
-
 ###
 ### neverallow rules
 ###
diff --git a/public/mediaserver.te b/public/mediaserver.te
index 02a0eb0..832eaa3 100644
--- a/public/mediaserver.te
+++ b/public/mediaserver.te
@@ -34,8 +34,6 @@
 allow mediaserver video_device:dir r_dir_perms;
 allow mediaserver video_device:chr_file rw_file_perms;
 
-set_prop(mediaserver, audio_prop)
-
 # Read resources from open apk files passed over Binder.
 allow mediaserver apk_data_file:file { read getattr };
 allow mediaserver asec_apk_file:file { read getattr };
diff --git a/public/mediaswcodec.te b/public/mediaswcodec.te
index 2acdeea..992baab 100644
--- a/public/mediaswcodec.te
+++ b/public/mediaswcodec.te
@@ -11,8 +11,6 @@
 hal_client_domain(mediaswcodec, hal_allocator)
 hal_client_domain(mediaswcodec, hal_graphics_allocator)
 
-get_prop(mediaswcodec, device_config_media_native_prop)
-
 crash_dump_fallback(mediaswcodec)
 
 # mediaswcodec_server should never execute any executable without a
diff --git a/public/netd.te b/public/netd.te
index 8005406..a020a57 100644
--- a/public/netd.te
+++ b/public/netd.te
@@ -81,9 +81,6 @@
 # Allow netd to spawn dnsmasq in it's own domain
 allow netd dnsmasq:process signal;
 
-set_prop(netd, ctl_mdnsd_prop)
-set_prop(netd, netd_stable_secret_prop)
-
 # Allow netd to publish a binder service and make binder calls.
 binder_use(netd)
 add_service(netd, netd_service)
@@ -113,8 +110,6 @@
 # Allow netd to register as hal server.
 add_hwservice(netd, system_net_netd_hwservice)
 hwbinder_use(netd)
-get_prop(netd, hwservicemanager_prop)
-get_prop(netd, device_config_netd_native_prop)
 
 ###
 ### Neverallow rules
@@ -157,14 +152,6 @@
 neverallow { appdomain -network_stack } netd:binder call;
 neverallow netd { appdomain -network_stack userdebug_or_eng(`-su') }:binder call;
 
-# persist.netd.stable_secret contains RFC 7217 secret key which should never be
-# leaked to other processes. Make sure it never leaks.
-neverallow { domain -netd -init -dumpstate } netd_stable_secret_prop:file r_file_perms;
-
-# We want to ensure that no other process ever tries tampering with persist.netd.stable_secret,
-# the RFC 7217 secret key managed by netd. Doing so could compromise user privacy.
-neverallow { domain -netd -init } netd_stable_secret_prop:property_service set;
-
 # If an already existing file is opened with O_CREATE, the kernel might generate
 # a false report of a create denial. Silence these denials and make sure that
 # inappropriate permissions are not granted.
diff --git a/public/property.te b/public/property.te
index cfaa190..b0199d9 100644
--- a/public/property.te
+++ b/public/property.te
@@ -1,4 +1,8 @@
 # Properties used only in /system
+#
+# DO NOT ADD system_internal_prop here.
+# Instead, add to private/property.te.
+# TODO(b/150331497): move these to private/property.te
 system_internal_prop(apexd_prop)
 system_internal_prop(bootloader_boot_reason_prop)
 system_internal_prop(device_config_activity_manager_native_boot_prop)
@@ -9,21 +13,7 @@
 system_internal_prop(device_config_reset_performed_prop)
 system_internal_prop(device_config_runtime_native_boot_prop)
 system_internal_prop(device_config_runtime_native_prop)
-system_internal_prop(device_config_storage_native_boot_prop)
-system_internal_prop(device_config_sys_traced_prop)
-system_internal_prop(device_config_window_manager_native_boot_prop)
-system_internal_prop(device_config_configuration_prop)
 system_internal_prop(firstboot_prop)
-system_internal_prop(gsid_prop)
-system_internal_prop(init_perf_lsm_hooks_prop)
-system_internal_prop(init_svc_debug_prop)
-system_internal_prop(last_boot_reason_prop)
-system_internal_prop(netd_stable_secret_prop)
-system_internal_prop(pm_prop)
-system_internal_prop(userspace_reboot_log_prop)
-system_internal_prop(system_adbd_prop)
-system_internal_prop(adbd_prop)
-system_internal_prop(traced_perf_enabled_prop)
 
 compatible_property_only(`
     # DO NOT ADD ANY PROPERTIES HERE
@@ -116,6 +106,7 @@
 system_vendor_config_prop(exported_config_prop)
 system_vendor_config_prop(exported_default_prop)
 system_vendor_config_prop(exported3_default_prop)
+system_vendor_config_prop(media_variant_prop)
 system_vendor_config_prop(userspace_reboot_config_prop)
 system_vendor_config_prop(vehicle_hal_prop)
 system_vendor_config_prop(vendor_security_patch_level_prop)
@@ -242,54 +233,6 @@
 
 allow property_type tmpfs:filesystem associate;
 
-###
-### Neverallow rules
-###
-
-treble_sysprop_neverallow(`
-
-# TODO(b/131162102): uncomment these after assigning ownership attributes to all properties
-# neverallow domain {
-#   property_type
-#   -system_property_type
-#   -product_property_type
-#   -vendor_property_type
-# }:file no_rw_file_perms;
-
-neverallow { domain -coredomain } {
-  system_property_type
-  system_internal_property_type
-  -system_restricted_property_type
-  -system_public_property_type
-}:file no_rw_file_perms;
-
-neverallow { domain -coredomain } {
-  system_property_type
-  -system_public_property_type
-}:property_service set;
-
-# init is in coredomain, but should be able to read/write all props.
-# dumpstate is also in coredomain, but should be able to read all props.
-neverallow { coredomain -init -dumpstate } {
-  vendor_property_type
-  vendor_internal_property_type
-  -vendor_restricted_property_type
-  -vendor_public_property_type
-}:file no_rw_file_perms;
-
-neverallow { coredomain -init } {
-  vendor_property_type
-  -vendor_public_property_type
-}:property_service set;
-
-')
-
-# There is no need to perform ioctl or advisory locking operations on
-# property files. If this neverallow is being triggered, it is
-# likely that the policy is using r_file_perms directly instead of
-# the get_prop() macro.
-neverallow domain property_type:file { ioctl lock };
-
 # core_property_type should not be used for new properties or
 # device specific properties. Properties with this attribute
 # are readable to everyone, which is overly broad and should
@@ -321,269 +264,3 @@
 typeattribute system_prop        core_property_type;
 typeattribute system_radio_prop  core_property_type;
 typeattribute vold_prop          core_property_type;
-
-neverallow * {
-  core_property_type
-  -audio_prop
-  -config_prop
-  -cppreopt_prop
-  -dalvik_prop
-  -debuggerd_prop
-  -debug_prop
-  -default_prop
-  -dhcp_prop
-  -dumpstate_prop
-  -ffs_prop
-  -fingerprint_prop
-  -logd_prop
-  -net_radio_prop
-  -nfc_prop
-  -ota_prop
-  -pan_result_prop
-  -persist_debug_prop
-  -powerctl_prop
-  -radio_prop
-  -restorecon_prop
-  -shell_prop
-  -system_prop
-  -system_radio_prop
-  -vold_prop
-}:file no_rw_file_perms;
-
-# sigstop property is only used for debugging; should only be set by su which is permissive
-# for userdebug/eng
-neverallow {
-  domain
-  -init
-  -vendor_init
-} ctl_sigstop_prop:property_service set;
-
-# Don't audit legacy ctl. property handling.  We only want the newer permission check to appear
-# in the audit log
-dontaudit domain {
-  ctl_bootanim_prop
-  ctl_bugreport_prop
-  ctl_console_prop
-  ctl_default_prop
-  ctl_dumpstate_prop
-  ctl_fuse_prop
-  ctl_mdnsd_prop
-  ctl_rildaemon_prop
-}:property_service set;
-
-neverallow {
-  domain
-  -init
-} init_svc_debug_prop:property_service set;
-
-neverallow {
-  domain
-  -init
-  -dumpstate
-  userdebug_or_eng(`-su')
-} init_svc_debug_prop:file no_rw_file_perms;
-
-compatible_property_only(`
-# Prevent properties from being set
-  neverallow {
-    domain
-    -coredomain
-    -appdomain
-    -vendor_init
-  } {
-    core_property_type
-    extended_core_property_type
-    exported_config_prop
-    exported_dalvik_prop
-    exported_default_prop
-    exported_dumpstate_prop
-    exported_ffs_prop
-    exported_fingerprint_prop
-    exported_system_prop
-    exported_system_radio_prop
-    exported_vold_prop
-    exported2_config_prop
-    exported2_default_prop
-    exported2_system_prop
-    exported2_vold_prop
-    exported3_default_prop
-    exported3_system_prop
-    -nfc_prop
-    -powerctl_prop
-    -radio_prop
-  }:property_service set;
-
-  neverallow {
-    domain
-    -coredomain
-    -appdomain
-    -hal_nfc_server
-  } {
-    nfc_prop
-  }:property_service set;
-
-  neverallow {
-    domain
-    -coredomain
-    -appdomain
-    -hal_telephony_server
-    -vendor_init
-  } {
-    exported_radio_prop
-    exported3_radio_prop
-  }:property_service set;
-
-  neverallow {
-    domain
-    -coredomain
-    -appdomain
-    -hal_telephony_server
-  } {
-    exported2_radio_prop
-    radio_prop
-  }:property_service set;
-
-  neverallow {
-    domain
-    -coredomain
-    -bluetooth
-    -hal_bluetooth_server
-  } {
-    bluetooth_prop
-  }:property_service set;
-
-  neverallow {
-    domain
-    -coredomain
-    -bluetooth
-    -hal_bluetooth_server
-    -vendor_init
-  } {
-    exported_bluetooth_prop
-  }:property_service set;
-
-  neverallow {
-    domain
-    -coredomain
-    -hal_camera_server
-    -cameraserver
-    -vendor_init
-  } {
-    exported_camera_prop
-  }:property_service set;
-
-  neverallow {
-    domain
-    -coredomain
-    -hal_wifi_server
-    -wificond
-  } {
-    wifi_prop
-  }:property_service set;
-
-  neverallow {
-    domain
-    -coredomain
-    -hal_wifi_server
-    -wificond
-    -vendor_init
-  } {
-    exported_wifi_prop
-  }:property_service set;
-
-# Prevent properties from being read
-  neverallow {
-    domain
-    -coredomain
-    -appdomain
-    -vendor_init
-  } {
-    core_property_type
-    extended_core_property_type
-    exported_dalvik_prop
-    exported_ffs_prop
-    exported_system_radio_prop
-    exported2_config_prop
-    exported2_system_prop
-    exported2_vold_prop
-    exported3_default_prop
-    exported3_system_prop
-    -debug_prop
-    -logd_prop
-    -nfc_prop
-    -powerctl_prop
-    -radio_prop
-  }:file no_rw_file_perms;
-
-  neverallow {
-    domain
-    -coredomain
-    -appdomain
-    -hal_nfc_server
-  } {
-    nfc_prop
-  }:file no_rw_file_perms;
-
-  neverallow {
-    domain
-    -coredomain
-    -appdomain
-    -hal_telephony_server
-  } {
-    radio_prop
-  }:file no_rw_file_perms;
-
-  neverallow {
-    domain
-    -coredomain
-    -bluetooth
-    -hal_bluetooth_server
-  } {
-    bluetooth_prop
-  }:file no_rw_file_perms;
-
-  neverallow {
-    domain
-    -coredomain
-    -hal_wifi_server
-    -wificond
-  } {
-    wifi_prop
-  }:file no_rw_file_perms;
-')
-
-compatible_property_only(`
-  # Neverallow coredomain to set vendor properties
-  neverallow {
-    coredomain
-    -init
-    -system_writes_vendor_properties_violators
-  } {
-    property_type
-    -system_property_type
-    -extended_core_property_type
-  }:property_service set;
-')
-
-neverallow {
-  -init
-  -system_server
-} {
-  userspace_reboot_log_prop
-}:property_service set;
-
-neverallow {
-  # Only allow init and system_server to set system_adbd_prop
-  -init
-  -system_server
-} {
-  system_adbd_prop
-}:property_service set;
-
-neverallow {
-  # Only allow init and adbd to set adbd_prop
-  -init
-  -adbd
-} {
-  adbd_prop
-}:property_service set;
diff --git a/public/property_contexts b/public/property_contexts
deleted file mode 100644
index 6e91c0a..0000000
--- a/public/property_contexts
+++ /dev/null
@@ -1,455 +0,0 @@
-# vendor-init-readable
-persist.radio.airplane_mode_on u:object_r:exported2_radio_prop:s0 exact int
-
-# vendor-init-settable
-af.fast_track_multiplier u:object_r:exported3_default_prop:s0 exact int
-audio.camerasound.force u:object_r:exported_audio_prop:s0 exact bool
-audio.deep_buffer.media u:object_r:exported3_default_prop:s0 exact bool
-audio.offload.video u:object_r:exported3_default_prop:s0 exact bool
-audio.offload.min.duration.secs u:object_r:exported3_default_prop:s0 exact int
-camera.disable_zsl_mode u:object_r:exported3_default_prop:s0 exact bool
-camera.fifo.disable u:object_r:exported3_default_prop:s0 exact int
-dalvik.vm.appimageformat u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.backgroundgctype u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.boot-dex2oat-cpu-set u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.boot-dex2oat-threads u:object_r:exported_dalvik_prop:s0 exact int
-dalvik.vm.boot-image u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.checkjni u:object_r:exported_dalvik_prop:s0 exact bool
-dalvik.vm.dex2oat-Xms u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.dex2oat-Xmx u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.dex2oat-cpu-set u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.dex2oat-filter u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.dex2oat-flags u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.dex2oat-threads u:object_r:exported_dalvik_prop:s0 exact int
-dalvik.vm.dexopt.secondary u:object_r:exported_dalvik_prop:s0 exact bool
-dalvik.vm.execution-mode u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.extra-opts u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.foreground-heap-growth-multiplier u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.gctype u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.heapgrowthlimit u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.heapmaxfree u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.heapminfree u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.heapsize u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.heapstartsize u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.heaptargetutilization u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.hot-startup-method-samples u:object_r:exported_dalvik_prop:s0 exact int
-dalvik.vm.image-dex2oat-Xms u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.image-dex2oat-Xmx u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.image-dex2oat-cpu-set u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.image-dex2oat-filter u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.image-dex2oat-flags u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.image-dex2oat-threads u:object_r:exported_dalvik_prop:s0 exact int
-dalvik.vm.isa.arm.features u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.isa.arm.variant u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.isa.arm64.features u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.isa.arm64.variant u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.isa.mips.features u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.isa.mips.variant u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.isa.mips64.features u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.isa.mips64.variant u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.isa.unknown.features u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.isa.unknown.variant u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.isa.x86.features u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.isa.x86.variant u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.isa.x86_64.features u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.isa.x86_64.variant u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.jitinitialsize u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.jitmaxsize u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.jitprithreadweight u:object_r:exported_dalvik_prop:s0 exact int
-dalvik.vm.jitthreshold u:object_r:exported_dalvik_prop:s0 exact int
-dalvik.vm.jittransitionweight u:object_r:exported_dalvik_prop:s0 exact int
-dalvik.vm.jniopts u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.lockprof.threshold u:object_r:exported_dalvik_prop:s0 exact int
-dalvik.vm.method-trace u:object_r:exported_dalvik_prop:s0 exact bool
-dalvik.vm.method-trace-file u:object_r:exported_dalvik_prop:s0 exact string
-dalvik.vm.method-trace-file-siz u:object_r:exported_dalvik_prop:s0 exact int
-dalvik.vm.method-trace-stream u:object_r:exported_dalvik_prop:s0 exact bool
-dalvik.vm.profilesystemserver u:object_r:exported_dalvik_prop:s0 exact bool
-dalvik.vm.profilebootclasspath u:object_r:exported_dalvik_prop:s0 exact bool
-dalvik.vm.usejit u:object_r:exported_dalvik_prop:s0 exact bool
-dalvik.vm.usejitprofiles u:object_r:exported_dalvik_prop:s0 exact bool
-dalvik.vm.zygote.max-boot-retry u:object_r:exported_dalvik_prop:s0 exact int
-drm.service.enabled u:object_r:exported3_default_prop:s0 exact bool
-keyguard.no_require_sim u:object_r:exported3_default_prop:s0 exact bool
-media.recorder.show_manufacturer_and_model u:object_r:exported3_default_prop:s0 exact bool
-media.stagefright.cache-params u:object_r:exported3_default_prop:s0 exact string
-media.stagefright.thumbnail.prefer_hw_codecs u:object_r:exported3_default_prop:s0 exact bool
-persist.bluetooth.a2dp_offload.cap u:object_r:bluetooth_a2dp_offload_prop:s0 exact string
-persist.bluetooth.a2dp_offload.disabled u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
-persist.bluetooth.bluetooth_audio_hal.disabled u:object_r:bluetooth_audio_hal_prop:s0 exact bool
-persist.bluetooth.btsnoopenable u:object_r:exported_bluetooth_prop:s0 exact bool
-persist.config.calibration_fac u:object_r:exported3_default_prop:s0 exact string
-persist.dbg.volte_avail_ovr u:object_r:exported3_default_prop:s0 exact int
-persist.dbg.vt_avail_ovr u:object_r:exported3_default_prop:s0 exact int
-persist.dbg.wfc_avail_ovr u:object_r:exported3_default_prop:s0 exact int
-persist.radio.multisim.config u:object_r:exported3_radio_prop:s0 exact string
-persist.sys.dalvik.vm.lib.2 u:object_r:exported2_system_prop:s0 exact string
-persist.sys.media.avsync u:object_r:exported2_system_prop:s0 exact bool
-persist.sys.hdmi.keep_awake u:object_r:exported2_system_prop:s0 exact bool
-persist.sys.sf.color_mode u:object_r:exported2_system_prop:s0 exact int
-persist.sys.sf.color_saturation u:object_r:exported2_system_prop:s0 exact string
-persist.sys.sf.native_mode u:object_r:exported2_system_prop:s0 exact int
-pm.dexopt.ab-ota u:object_r:exported_pm_prop:s0 exact string
-pm.dexopt.bg-dexopt u:object_r:exported_pm_prop:s0 exact string
-pm.dexopt.boot u:object_r:exported_pm_prop:s0 exact string
-pm.dexopt.disable_bg_dexopt u:object_r:exported_pm_prop:s0 exact bool
-pm.dexopt.downgrade_after_inactive_days u:object_r:exported_pm_prop:s0 exact int
-pm.dexopt.first-boot u:object_r:exported_pm_prop:s0 exact string
-pm.dexopt.inactive u:object_r:exported_pm_prop:s0 exact string
-pm.dexopt.install u:object_r:exported_pm_prop:s0 exact string
-pm.dexopt.shared u:object_r:exported_pm_prop:s0 exact string
-ro.af.client_heap_size_kbyte u:object_r:exported3_default_prop:s0 exact int
-ro.apk_verity.mode u:object_r:apk_verity_prop:s0 exact int
-ro.audio.monitorRotation u:object_r:exported3_default_prop:s0 exact bool
-ro.bluetooth.a2dp_offload.supported u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
-ro.boot.vendor.overlay.theme u:object_r:exported_overlay_prop:s0 exact string
-ro.boot.wificountrycode u:object_r:exported3_default_prop:s0 exact string
-ro.bt.bdaddr_path u:object_r:exported_bluetooth_prop:s0 exact string
-ro.camera.notify_nfc u:object_r:exported3_default_prop:s0 exact int
-ro.camera.enableLazyHal u:object_r:exported3_default_prop:s0 exact bool
-ro.com.android.dataroaming u:object_r:exported3_default_prop:s0 exact bool
-ro.com.android.prov_mobiledata u:object_r:exported3_default_prop:s0 exact bool
-ro.config.alarm_alert u:object_r:exported2_config_prop:s0 exact string
-ro.config.media_vol_steps u:object_r:exported2_config_prop:s0 exact int
-ro.config.notification_sound u:object_r:exported2_config_prop:s0 exact string
-ro.config.per_app_memcg u:object_r:exported3_default_prop:s0 exact bool
-ro.config.ringtone u:object_r:exported2_config_prop:s0 exact string
-ro.control_privapp_permissions u:object_r:exported3_default_prop:s0 exact string
-ro.cp_system_other_odex u:object_r:exported3_default_prop:s0 exact int
-ro.crypto.allow_encrypt_override u:object_r:exported2_vold_prop:s0 exact bool
-ro.crypto.fde_algorithm u:object_r:exported2_vold_prop:s0 exact string
-ro.crypto.fde_sector_size u:object_r:exported2_vold_prop:s0 exact int
-ro.crypto.scrypt_params u:object_r:exported2_vold_prop:s0 exact string
-ro.crypto.set_dun u:object_r:exported2_vold_prop:s0 exact bool
-ro.crypto.volume.contents_mode u:object_r:exported2_vold_prop:s0 exact string
-ro.crypto.volume.filenames_mode u:object_r:exported2_vold_prop:s0 exact string
-ro.crypto.volume.metadata.encryption u:object_r:exported2_vold_prop:s0 exact string
-ro.crypto.volume.metadata.method u:object_r:exported2_vold_prop:s0 exact string
-ro.crypto.volume.options u:object_r:exported2_vold_prop:s0 exact string
-ro.dalvik.vm.native.bridge u:object_r:exported_dalvik_prop:s0 exact string
-ro.enable_boot_charger_mode u:object_r:exported3_default_prop:s0 exact bool
-ro.gfx.driver.0 u:object_r:exported3_default_prop:s0 exact string
-ro.gfx.angle.supported u:object_r:exported3_default_prop:s0 exact bool
-ro.hdmi.device_type u:object_r:exported3_default_prop:s0 exact string
-ro.hdmi.wake_on_hotplug u:object_r:exported3_default_prop:s0 exact bool
-ro.lmk.critical u:object_r:exported3_default_prop:s0 exact int
-ro.lmk.critical_upgrade u:object_r:exported3_default_prop:s0 exact bool
-ro.lmk.debug u:object_r:exported3_default_prop:s0 exact bool
-ro.lmk.downgrade_pressure u:object_r:exported3_default_prop:s0 exact int
-ro.lmk.kill_heaviest_task u:object_r:exported3_default_prop:s0 exact bool
-ro.lmk.kill_timeout_ms u:object_r:exported3_default_prop:s0 exact int
-ro.lmk.low u:object_r:exported3_default_prop:s0 exact int
-ro.lmk.medium u:object_r:exported3_default_prop:s0 exact int
-ro.lmk.psi_partial_stall_ms u:object_r:exported3_default_prop:s0 exact int
-ro.lmk.psi_complete_stall_ms u:object_r:exported3_default_prop:s0 exact int
-ro.lmk.swap_free_low_percentage u:object_r:exported3_default_prop:s0 exact int
-ro.lmk.thrashing_limit u:object_r:exported3_default_prop:s0 exact int
-ro.lmk.thrashing_limit_decay u:object_r:exported3_default_prop:s0 exact int
-ro.lmk.use_minfree_levels u:object_r:exported3_default_prop:s0 exact bool
-ro.lmk.upgrade_pressure u:object_r:exported3_default_prop:s0 exact int
-ro.minui.default_rotation u:object_r:exported3_default_prop:s0 exact string
-ro.minui.overscan_percent u:object_r:exported3_default_prop:s0 exact int
-ro.minui.pixel_format u:object_r:exported3_default_prop:s0 exact string
-ro.oem_unlock_supported u:object_r:exported3_default_prop:s0 exact int
-ro.opengles.version u:object_r:exported3_default_prop:s0 exact int
-ro.radio.noril u:object_r:exported3_default_prop:s0 exact string
-ro.rebootescrow.device u:object_r:rebootescrow_hal_prop:s0 exact string
-ro.retaildemo.video_path u:object_r:exported3_default_prop:s0 exact string
-ro.statsd.enable u:object_r:exported3_default_prop:s0 exact bool
-ro.sf.disable_triple_buffer u:object_r:exported3_default_prop:s0 exact bool
-ro.sf.lcd_density u:object_r:exported3_default_prop:s0 exact int
-ro.storage_manager.enabled u:object_r:exported3_default_prop:s0 exact bool
-ro.telephony.call_ring.multiple u:object_r:exported3_default_prop:s0 exact bool
-ro.telephony.default_cdma_sub u:object_r:exported3_default_prop:s0 exact int
-ro.telephony.default_network u:object_r:exported3_default_prop:s0 exact string
-ro.vehicle.hal u:object_r:vehicle_hal_prop:s0 exact string
-ro.vendor.build.security_patch u:object_r:vendor_security_patch_level_prop:s0 exact string
-ro.zram.mark_idle_delay_mins u:object_r:exported3_default_prop:s0 exact int
-ro.zram.first_wb_delay_mins u:object_r:exported3_default_prop:s0 exact int
-ro.zram.periodic_wb_delay_hours u:object_r:exported3_default_prop:s0 exact int
-ro.zygote u:object_r:exported3_default_prop:s0 exact string
-sendbug.preferred.domain u:object_r:exported3_default_prop:s0 exact string
-sys.usb.controller u:object_r:exported2_system_prop:s0 exact string
-sys.usb.ffs.max_read u:object_r:exported_ffs_prop:s0 exact int
-sys.usb.ffs.max_write u:object_r:exported_ffs_prop:s0 exact int
-sys.usb.ffs.ready u:object_r:exported_ffs_prop:s0 exact bool
-sys.usb.mtp.device_type u:object_r:exported2_system_prop:s0 exact int
-sys.usb.ffs.mtp.ready u:object_r:exported_ffs_prop:s0 exact bool
-sys.usb.state u:object_r:exported2_system_prop:s0 exact string
-telephony.lteOnCdmaDevice u:object_r:exported3_default_prop:s0 exact int
-tombstoned.max_tombstone_count u:object_r:exported3_default_prop:s0 exact int
-vold.post_fs_data_done u:object_r:exported2_vold_prop:s0 exact int
-vts.native_server.on u:object_r:exported3_default_prop:s0 exact bool
-wlan.driver.status u:object_r:exported_wifi_prop:s0 exact enum ok unloaded
-zram.force_writeback u:object_r:exported3_default_prop:s0 exact bool
-
-# vendor-init-readable
-apexd.status u:object_r:apexd_prop:s0 exact enum starting activated ready
-dev.bootcomplete u:object_r:exported3_system_prop:s0 exact bool
-persist.sys.device_provisioned u:object_r:exported3_system_prop:s0 exact string
-persist.sys.theme u:object_r:theme_prop:s0 exact string
-persist.sys.usb.usbradio.config u:object_r:exported3_system_prop:s0 exact string
-sys.boot_completed u:object_r:exported3_system_prop:s0 exact bool
-sys.retaildemo.enabled u:object_r:exported3_system_prop:s0 exact int
-sys.user.0.ce_available u:object_r:exported3_system_prop:s0 exact bool
-sys.vdso u:object_r:exported3_system_prop:s0 exact string
-
-# vendor-init-settable
-persist.sys.zram_enabled u:object_r:exported2_system_prop:s0 exact bool
-sys.usb.config u:object_r:exported_system_radio_prop:s0 exact string
-sys.usb.configfs u:object_r:exported_system_radio_prop:s0 exact int
-
-# public-readable
-aac_drc_boost u:object_r:exported2_default_prop:s0 exact int
-aac_drc_cut u:object_r:exported2_default_prop:s0 exact int
-aac_drc_enc_target_level u:object_r:exported2_default_prop:s0 exact int
-aac_drc_heavy u:object_r:exported2_default_prop:s0 exact int
-aac_drc_reference_level u:object_r:exported2_default_prop:s0 exact int
-build.version.extensions. u:object_r:module_sdkextensions_prop:s0 prefix int
-ro.aac_drc_effect_type u:object_r:exported2_default_prop:s0 exact int
-drm.64bit.enabled u:object_r:exported2_default_prop:s0 exact bool
-dumpstate.dry_run u:object_r:exported_dumpstate_prop:s0 exact bool
-dumpstate.unroot u:object_r:exported_dumpstate_prop:s0 exact bool
-hal.instrumentation.enable u:object_r:exported2_default_prop:s0 exact bool
-init.svc.bugreport u:object_r:exported2_default_prop:s0 exact string
-init.svc.console u:object_r:exported2_default_prop:s0 exact string
-init.svc.dumpstatez u:object_r:exported2_default_prop:s0 exact string
-init.svc.mediadrm u:object_r:exported2_default_prop:s0 exact string
-init.svc.surfaceflinger u:object_r:exported2_default_prop:s0 exact string
-init.svc.tombstoned u:object_r:exported2_default_prop:s0 exact string
-init.svc.zygote u:object_r:exported2_default_prop:s0 exact string
-libc.debug.malloc.options u:object_r:exported2_default_prop:s0 exact string
-libc.debug.malloc.program u:object_r:exported2_default_prop:s0 exact string
-libc.debug.hooks.enable u:object_r:exported2_default_prop:s0 exact string
-net.redirect_socket_calls.hooked u:object_r:socket_hook_prop:s0 exact bool
-persist.sys.locale u:object_r:exported_system_prop:s0 exact string
-persist.sys.timezone u:object_r:exported_system_prop:s0 exact string
-persist.sys.test_harness u:object_r:test_harness_prop:s0 exact bool
-ro.adb.secure u:object_r:exported_secure_prop:s0 exact int
-ro.arch u:object_r:exported2_default_prop:s0 exact string
-ro.audio.ignore_effects u:object_r:exported2_default_prop:s0 exact bool
-ro.baseband u:object_r:exported2_default_prop:s0 exact string
-ro.boot.avb_version u:object_r:exported2_default_prop:s0 exact string
-ro.boot.baseband u:object_r:exported2_default_prop:s0 exact string
-ro.boot.bootdevice u:object_r:exported2_default_prop:s0 exact string
-ro.boot.bootloader u:object_r:exported2_default_prop:s0 exact string
-ro.boot.boottime u:object_r:exported2_default_prop:s0 exact string
-ro.boot.console u:object_r:exported2_default_prop:s0 exact string
-ro.boot.hardware u:object_r:exported2_default_prop:s0 exact string
-ro.boot.hardware.color u:object_r:exported2_default_prop:s0 exact string
-ro.boot.hardware.sku u:object_r:exported2_default_prop:s0 exact string
-ro.boot.keymaster u:object_r:exported2_default_prop:s0 exact string
-ro.boot.mode u:object_r:exported2_default_prop:s0 exact string
-ro.boot.vbmeta.avb_version u:object_r:exported2_default_prop:s0 exact string
-ro.boot.verifiedbootstate u:object_r:exported2_default_prop:s0 exact string
-ro.boot.veritymode u:object_r:exported2_default_prop:s0 exact string
-ro.boot.dynamic_partitions u:object_r:exported_default_prop:s0 exact string
-ro.boot.dynamic_partitions_retrofit u:object_r:exported_default_prop:s0 exact string
-ro.bootloader u:object_r:exported2_default_prop:s0 exact string
-ro.build.date u:object_r:exported2_default_prop:s0 exact string
-ro.build.date.utc u:object_r:exported2_default_prop:s0 exact int
-ro.build.description u:object_r:exported2_default_prop:s0 exact string
-ro.build.display.id u:object_r:exported2_default_prop:s0 exact string
-ro.build.fingerprint u:object_r:exported_fingerprint_prop:s0 exact string
-ro.build.host u:object_r:exported2_default_prop:s0 exact string
-ro.build.id u:object_r:exported2_default_prop:s0 exact string
-ro.build.product u:object_r:exported2_default_prop:s0 exact string
-ro.build.system_root_image u:object_r:exported2_default_prop:s0 exact bool
-ro.build.tags u:object_r:exported2_default_prop:s0 exact string
-ro.build.user u:object_r:exported2_default_prop:s0 exact string
-ro.build.version.base_os u:object_r:exported2_default_prop:s0 exact string
-ro.build.version.codename u:object_r:exported2_default_prop:s0 exact string
-ro.build.version.incremental u:object_r:exported2_default_prop:s0 exact string
-ro.build.version.preview_sdk u:object_r:exported2_default_prop:s0 exact int
-ro.build.version.release u:object_r:exported2_default_prop:s0 exact string
-ro.build.version.release_or_codename u:object_r:exported2_default_prop:s0 exact string
-ro.build.version.sdk u:object_r:exported2_default_prop:s0 exact int
-ro.build.version.security_patch u:object_r:exported2_default_prop:s0 exact string
-ro.crypto.state u:object_r:exported_vold_prop:s0 exact string
-ro.crypto.type u:object_r:exported_vold_prop:s0 exact string
-ro.debuggable u:object_r:exported2_default_prop:s0 exact int
-ro.hardware u:object_r:exported2_default_prop:s0 exact string
-ro.product.brand u:object_r:exported2_default_prop:s0 exact string
-ro.product.cpu.abi u:object_r:exported2_default_prop:s0 exact string
-ro.product.cpu.abilist u:object_r:exported2_default_prop:s0 exact string
-ro.product.device u:object_r:exported2_default_prop:s0 exact string
-ro.product.manufacturer u:object_r:exported2_default_prop:s0 exact string
-ro.product.model u:object_r:exported2_default_prop:s0 exact string
-ro.product.name u:object_r:exported2_default_prop:s0 exact string
-ro.property_service.version u:object_r:exported2_default_prop:s0 exact int
-ro.revision u:object_r:exported2_default_prop:s0 exact string
-ro.secure u:object_r:exported_secure_prop:s0 exact int
-ro.vendor.redirect_socket_calls u:object_r:vendor_socket_hook_prop:s0 exact bool
-service.bootanim.exit u:object_r:exported_system_prop:s0 exact int
-sys.boot_from_charger_mode u:object_r:exported_system_prop:s0 exact int
-sys.init.userspace_reboot.in_progress u:object_r:userspace_reboot_exported_prop:s0 exact bool
-sys.use_memfd u:object_r:use_memfd_prop:s0 exact bool
-vold.decrypt u:object_r:exported_vold_prop:s0 exact string
-
-# vendor-init-settable|public-readable
-aaudio.hw_burst_min_usec u:object_r:exported_default_prop:s0 exact int
-aaudio.minimum_sleep_usec u:object_r:exported_default_prop:s0 exact int
-aaudio.mixer_bursts u:object_r:exported_default_prop:s0 exact int
-aaudio.mmap_exclusive_policy u:object_r:exported_default_prop:s0 exact int
-aaudio.mmap_policy u:object_r:exported_default_prop:s0 exact int
-aaudio.wakeup_delay_usec u:object_r:exported_default_prop:s0 exact int
-config.disable_cameraservice u:object_r:exported_camera_prop:s0 exact bool
-gsm.sim.operator.numeric u:object_r:exported_radio_prop:s0 exact string
-media.mediadrmservice.enable u:object_r:exported_default_prop:s0 exact bool
-persist.rcs.supported u:object_r:exported_default_prop:s0 exact int
-rcs.publish.status u:object_r:exported_radio_prop:s0 exact string
-ro.bionic.2nd_arch u:object_r:cpu_variant_prop:s0 exact string
-ro.bionic.2nd_cpu_variant u:object_r:cpu_variant_prop:s0 exact string
-ro.bionic.arch u:object_r:cpu_variant_prop:s0 exact string
-ro.bionic.cpu_variant u:object_r:cpu_variant_prop:s0 exact string
-ro.board.platform u:object_r:exported_default_prop:s0 exact string
-ro.boot.fake_battery u:object_r:exported_default_prop:s0 exact int
-ro.boot.hardware.revision u:object_r:exported_default_prop:s0 exact string
-ro.boot.product.hardware.sku u:object_r:exported_default_prop:s0 exact string
-ro.boot.product.vendor.sku u:object_r:exported_default_prop:s0 exact string
-ro.boot.slot_suffix u:object_r:exported_default_prop:s0 exact string
-ro.bootimage.build.date u:object_r:exported_default_prop:s0 exact string
-ro.bootimage.build.date.utc u:object_r:exported_default_prop:s0 exact int
-ro.bootimage.build.fingerprint u:object_r:exported_default_prop:s0 exact string
-ro.boringcrypto.hwrand u:object_r:exported_default_prop:s0 exact bool
-ro.build.ab_update u:object_r:exported_default_prop:s0 exact string
-ro.build.expect.baseband u:object_r:exported_default_prop:s0 exact string
-ro.build.expect.bootloader u:object_r:exported_default_prop:s0 exact string
-ro.carrier u:object_r:exported_default_prop:s0 exact string
-ro.config.low_ram u:object_r:exported_config_prop:s0 exact bool
-ro.config.vc_call_vol_steps u:object_r:exported_config_prop:s0 exact int
-ro.frp.pst u:object_r:exported_default_prop:s0 exact string
-ro.hardware.activity_recognition u:object_r:exported_default_prop:s0 exact string
-ro.hardware.audio u:object_r:exported_default_prop:s0 exact string
-ro.hardware.audio.a2dp u:object_r:exported_default_prop:s0 exact string
-ro.hardware.audio.hearing_aid u:object_r:exported_default_prop:s0 exact string
-ro.hardware.audio.primary u:object_r:exported_default_prop:s0 exact string
-ro.hardware.audio.usb u:object_r:exported_default_prop:s0 exact string
-ro.hardware.audio_policy u:object_r:exported_default_prop:s0 exact string
-ro.hardware.bootctrl u:object_r:exported_default_prop:s0 exact string
-ro.hardware.camera u:object_r:exported_default_prop:s0 exact string
-ro.hardware.consumerir u:object_r:exported_default_prop:s0 exact string
-ro.hardware.context_hub u:object_r:exported_default_prop:s0 exact string
-ro.hardware.egl u:object_r:exported_default_prop:s0 exact string
-ro.hardware.fingerprint u:object_r:exported_default_prop:s0 exact string
-ro.hardware.flp u:object_r:exported_default_prop:s0 exact string
-ro.hardware.gatekeeper u:object_r:exported_default_prop:s0 exact string
-ro.hardware.gps u:object_r:exported_default_prop:s0 exact string
-ro.hardware.gralloc u:object_r:exported_default_prop:s0 exact string
-ro.hardware.hdmi_cec u:object_r:exported_default_prop:s0 exact string
-ro.hardware.hwcomposer u:object_r:exported_default_prop:s0 exact string
-ro.hardware.input u:object_r:exported_default_prop:s0 exact string
-ro.hardware.keystore u:object_r:exported_default_prop:s0 exact string
-ro.hardware.keystore_desede u:object_r:exported_default_prop:s0 exact string
-ro.hardware.lights u:object_r:exported_default_prop:s0 exact string
-ro.hardware.local_time u:object_r:exported_default_prop:s0 exact string
-ro.hardware.memtrack u:object_r:exported_default_prop:s0 exact string
-ro.hardware.nfc u:object_r:exported_default_prop:s0 exact string
-ro.hardware.nfc_nci u:object_r:exported_default_prop:s0 exact string
-ro.hardware.nfc_tag u:object_r:exported_default_prop:s0 exact string
-ro.hardware.nvram u:object_r:exported_default_prop:s0 exact string
-ro.hardware.power u:object_r:exported_default_prop:s0 exact string
-ro.hardware.radio u:object_r:exported_default_prop:s0 exact string
-ro.hardware.sensors u:object_r:exported_default_prop:s0 exact string
-ro.hardware.sound_trigger u:object_r:exported_default_prop:s0 exact string
-ro.hardware.thermal u:object_r:exported_default_prop:s0 exact string
-ro.hardware.tv_input u:object_r:exported_default_prop:s0 exact string
-ro.hardware.type u:object_r:exported_default_prop:s0 exact string
-ro.hardware.vehicle u:object_r:exported_default_prop:s0 exact string
-ro.hardware.vibrator u:object_r:exported_default_prop:s0 exact string
-ro.hardware.virtual_device u:object_r:exported_default_prop:s0 exact string
-ro.hardware.vulkan u:object_r:exported_default_prop:s0 exact string
-ro.hwui.use_vulkan u:object_r:exported_default_prop:s0 exact bool
-ro.kernel.qemu u:object_r:exported_default_prop:s0 exact bool
-ro.kernel.qemu. u:object_r:exported_default_prop:s0
-ro.kernel.android.bootanim u:object_r:exported_default_prop:s0 exact int
-ro.odm.build.date u:object_r:exported_default_prop:s0 exact string
-ro.odm.build.date.utc u:object_r:exported_default_prop:s0 exact int
-ro.odm.build.fingerprint u:object_r:exported_default_prop:s0 exact string
-ro.odm.build.version.incremental u:object_r:exported_default_prop:s0 exact string
-ro.oem.key1 u:object_r:exported_default_prop:s0 exact string
-ro.product.board u:object_r:exported_default_prop:s0 exact string
-ro.product.cpu.abilist32 u:object_r:exported_default_prop:s0 exact string
-ro.product.cpu.abilist64 u:object_r:exported_default_prop:s0 exact string
-ro.product.first_api_level u:object_r:exported_default_prop:s0 exact int
-ro.product.odm.brand u:object_r:exported_default_prop:s0 exact string
-ro.product.odm.device u:object_r:exported_default_prop:s0 exact string
-ro.product.odm.manufacturer u:object_r:exported_default_prop:s0 exact string
-ro.product.odm.model u:object_r:exported_default_prop:s0 exact string
-ro.product.odm.name u:object_r:exported_default_prop:s0 exact string
-ro.product.vendor.brand u:object_r:exported_default_prop:s0 exact string
-ro.product.vendor.device u:object_r:exported_default_prop:s0 exact string
-ro.product.vendor.manufacturer u:object_r:exported_default_prop:s0 exact string
-ro.product.vendor.model u:object_r:exported_default_prop:s0 exact string
-ro.product.vendor.name u:object_r:exported_default_prop:s0 exact string
-ro.product.vndk.version u:object_r:vndk_prop:s0 exact string
-ro.telephony.iwlan_operation_mode u:object_r:exported_radio_prop:s0 exact enum default legacy AP-assisted
-ro.vendor.build.date u:object_r:exported_default_prop:s0 exact string
-ro.vendor.build.date.utc u:object_r:exported_default_prop:s0 exact int
-ro.vendor.build.fingerprint u:object_r:exported_default_prop:s0 exact string
-ro.vendor.build.version.incremental u:object_r:exported_default_prop:s0 exact string
-ro.vndk.lite u:object_r:vndk_prop:s0 exact bool
-ro.vndk.version u:object_r:vndk_prop:s0 exact string
-ro.vts.coverage u:object_r:exported_default_prop:s0 exact int
-wifi.active.interface u:object_r:exported_wifi_prop:s0 exact string
-wifi.concurrent.interface u:object_r:exported_default_prop:s0 exact string
-wifi.direct.interface u:object_r:exported_default_prop:s0 exact string
-wifi.interface u:object_r:exported_default_prop:s0 exact string
-ro.apex.updatable u:object_r:exported_default_prop:s0 exact bool
-ro.init.userspace_reboot.is_supported u:object_r:userspace_reboot_config_prop:s0 exact bool
-
-# public-readable
-ro.boot.revision u:object_r:exported2_default_prop:s0 exact string
-ro.bootmode u:object_r:exported2_default_prop:s0 exact string
-ro.build.type u:object_r:exported2_default_prop:s0 exact string
-sys.shutdown.requested u:object_r:exported_system_prop:s0 exact string
-
-# Using Sysprop as API. So the ro.surface_flinger.* are guaranteed to be API-stable
-ro.surface_flinger.default_composition_dataspace u:object_r:exported_default_prop:s0 exact int
-ro.surface_flinger.default_composition_pixel_format u:object_r:exported_default_prop:s0 exact int
-ro.surface_flinger.force_hwc_copy_for_virtual_displays u:object_r:exported_default_prop:s0 exact bool
-ro.surface_flinger.has_HDR_display u:object_r:exported_default_prop:s0 exact bool
-ro.surface_flinger.has_wide_color_display u:object_r:exported_default_prop:s0 exact bool
-ro.surface_flinger.max_frame_buffer_acquired_buffers u:object_r:exported_default_prop:s0 exact int
-ro.surface_flinger.max_virtual_display_dimension u:object_r:exported_default_prop:s0 exact int
-ro.surface_flinger.primary_display_orientation u:object_r:exported_default_prop:s0 exact string
-ro.surface_flinger.present_time_offset_from_vsync_ns u:object_r:exported_default_prop:s0 exact int
-ro.surface_flinger.running_without_sync_framework u:object_r:exported_default_prop:s0 exact bool
-ro.surface_flinger.start_graphics_allocator_service u:object_r:exported_default_prop:s0 exact bool
-ro.surface_flinger.use_color_management u:object_r:exported_default_prop:s0 exact bool
-ro.surface_flinger.use_context_priority u:object_r:exported_default_prop:s0 exact bool
-ro.surface_flinger.use_vr_flinger u:object_r:exported_default_prop:s0 exact bool
-ro.surface_flinger.vsync_event_phase_offset_ns u:object_r:exported_default_prop:s0 exact int
-ro.surface_flinger.vsync_sf_event_phase_offset_ns u:object_r:exported_default_prop:s0 exact int
-ro.surface_flinger.wcg_composition_dataspace u:object_r:exported_default_prop:s0 exact int
-ro.surface_flinger.wcg_composition_pixel_format u:object_r:exported_default_prop:s0 exact int
-ro.surface_flinger.display_primary_red u:object_r:exported_default_prop:s0 exact string
-ro.surface_flinger.display_primary_green u:object_r:exported_default_prop:s0 exact string
-ro.surface_flinger.display_primary_blue u:object_r:exported_default_prop:s0 exact string
-ro.surface_flinger.display_primary_white u:object_r:exported_default_prop:s0 exact string
-ro.surface_flinger.protected_contents u:object_r:exported_default_prop:s0 exact bool
-ro.surface_flinger.set_idle_timer_ms u:object_r:exported_default_prop:s0 exact int
-ro.surface_flinger.set_touch_timer_ms u:object_r:exported_default_prop:s0 exact int
-ro.surface_flinger.set_display_power_timer_ms u:object_r:exported_default_prop:s0 exact int
-ro.surface_flinger.support_kernel_idle_timer u:object_r:exported_default_prop:s0 exact bool
-ro.surface_flinger.use_smart_90_for_video u:object_r:exported_default_prop:s0 exact bool
-ro.surface_flinger.use_content_detection_for_refresh_rate u:object_r:exported_default_prop:s0 exact bool
-ro.surface_flinger.color_space_agnostic_dataspace u:object_r:exported_default_prop:s0 exact int
-ro.surface_flinger.refresh_rate_switching u:object_r:exported_default_prop:s0 exact bool
-
-# Binder cache properties.  These are world-readable
-cache_key.app_inactive                   u:object_r:binder_cache_system_server_prop:s0
-cache_key.is_compat_change_enabled       u:object_r:binder_cache_system_server_prop:s0
-cache_key.get_packages_for_uid           u:object_r:binder_cache_system_server_prop:s0
-cache_key.has_system_feature             u:object_r:binder_cache_system_server_prop:s0
-cache_key.is_interactive                 u:object_r:binder_cache_system_server_prop:s0
-cache_key.is_power_save_mode             u:object_r:binder_cache_system_server_prop:s0
-cache_key.is_user_unlocked               u:object_r:binder_cache_system_server_prop:s0
-cache_key.volume_list                    u:object_r:binder_cache_system_server_prop:s0
-cache_key.display_info                   u:object_r:binder_cache_system_server_prop:s0
-cache_key.location_enabled               u:object_r:binder_cache_system_server_prop:s0
-cache_key.package_info                   u:object_r:binder_cache_system_server_prop:s0
-
-cache_key.bluetooth.                     u:object_r:binder_cache_bluetooth_server_prop:s0 prefix string
-cache_key.system_server.                 u:object_r:binder_cache_system_server_prop:s0 prefix string
-cache_key.telephony.                     u:object_r:binder_cache_telephony_server_prop:s0 prefix string
diff --git a/public/radio.te b/public/radio.te
index 34eaf83..6ec0086 100644
--- a/public/radio.te
+++ b/public/radio.te
@@ -16,16 +16,6 @@
 allow radio net_data_file:dir search;
 allow radio net_data_file:file r_file_perms;
 
-# Property service
-set_prop(radio, radio_prop)
-set_prop(radio, exported_radio_prop)
-set_prop(radio, exported2_radio_prop)
-set_prop(radio, exported3_radio_prop)
-set_prop(radio, net_radio_prop)
-
-# ctl interface
-set_prop(radio, ctl_rildaemon_prop)
-
 add_service(radio, radio_service)
 allow radio audioserver_service:service_manager find;
 allow radio cameraserver_service:service_manager find;
diff --git a/public/recovery.te b/public/recovery.te
index 3bac03d..fd3c82a 100644
--- a/public/recovery.te
+++ b/public/recovery.te
@@ -108,23 +108,6 @@
   # Read files on /oem.
   r_dir_file(recovery, oemfs);
 
-  # Reboot the device
-  set_prop(recovery, powerctl_prop)
-
-  # Read serial number of the device from system properties
-  get_prop(recovery, serialno_prop)
-
-  # Set sys.usb.ffs.ready when starting minadbd for sideload.
-  set_prop(recovery, ffs_prop)
-  set_prop(recovery, exported_ffs_prop)
-
-  # Set sys.usb.config when switching into fastboot.
-  set_prop(recovery, system_radio_prop)
-  set_prop(recovery, exported_system_radio_prop)
-
-  # Read ro.boot.bootreason
-  get_prop(recovery, bootloader_boot_reason_prop)
-
   # Use setfscreatecon() to label files for OTA updates.
   allow recovery self:process setfscreate;
 
@@ -144,10 +127,12 @@
   allowxperm recovery super_block_device_type:blk_file ioctl { BLKIOMIN BLKALIGNOFF };
 
   # Allow using libfiemap/gsid directly (no binder in recovery).
-  set_prop(recovery, gsid_prop)
   allow recovery gsi_metadata_file:dir search;
   allow recovery ota_metadata_file:dir rw_dir_perms;
   allow recovery ota_metadata_file:file create_file_perms;
+
+  # Allow mounting /metadata for writing update states
+  allow recovery metadata_file:dir { getattr mounton };
 ')
 
 ###
diff --git a/public/shell.te b/public/shell.te
index 79d5c89..712307f 100644
--- a/public/shell.te
+++ b/public/shell.te
@@ -58,60 +58,12 @@
 
 r_dir_file(shell, apk_data_file)
 
-# Set properties.
-set_prop(shell, shell_prop)
-set_prop(shell, ctl_bugreport_prop)
-set_prop(shell, ctl_dumpstate_prop)
-set_prop(shell, dumpstate_prop)
-set_prop(shell, exported_dumpstate_prop)
-set_prop(shell, debug_prop)
-set_prop(shell, powerctl_prop)
-set_prop(shell, log_tag_prop)
-set_prop(shell, wifi_log_prop)
-# Allow shell to start/stop traced via the persist.traced.enable
-# property (which also takes care of /data/misc initialization).
-set_prop(shell, traced_enabled_prop)
-# adjust is_loggable properties
-userdebug_or_eng(`set_prop(shell, log_prop)')
-# logpersist script
-userdebug_or_eng(`set_prop(shell, logpersistd_logging_prop)')
-# Allow shell to start/stop heapprofd via the persist.heapprofd.enable
-# property.
-set_prop(shell, heapprofd_enabled_prop)
-# Allow shell to start/stop traced_perf via the persist.traced_perf.enable
-# property.
-set_prop(shell, traced_perf_enabled_prop)
-# Allow shell to start/stop gsid via ctl.start|stop|restart gsid.
-set_prop(shell, ctl_gsid_prop)
-# Allow shell to enable Dynamic System Update
-set_prop(shell, dynamic_system_prop)
-# Allow shell to mock an OTA using persist.pm.mock-upgrade
-set_prop(shell, mock_ota_prop)
-
 userdebug_or_eng(`
   # "systrace --boot" support - allow boottrace service to run
   allow shell boottrace_data_file:dir rw_dir_perms;
   allow shell boottrace_data_file:file create_file_perms;
-  set_prop(shell, persist_debug_prop)
 ')
 
-# Read device's serial number from system properties
-get_prop(shell, serialno_prop)
-
-# Allow shell to read the vendor security patch level for CTS
-get_prop(shell, vendor_security_patch_level_prop)
-
-# Read state of logging-related properties
-get_prop(shell, device_logging_prop)
-
-# Read state of boot reason properties
-get_prop(shell, bootloader_boot_reason_prop)
-get_prop(shell, last_boot_reason_prop)
-get_prop(shell, system_boot_reason_prop)
-
-# Allow reading the outcome of perf_event_open LSM support test for CTS.
-get_prop(shell, init_perf_lsm_hooks_prop)
-
 # allow shell access to services
 allow shell servicemanager:service_manager list;
 # don't allow shell to access GateKeeper service
diff --git a/public/te_macros b/public/te_macros
index a9dea92..5afb791 100644
--- a/public/te_macros
+++ b/public/te_macros
@@ -767,6 +767,11 @@
   allow $1 traced:fd use;
   allow $1 traced_tmpfs:file { read write getattr map };
   unix_socket_connect($1, traced_producer, traced)
+
+  # Also allow the service to use the producer file descriptors. This is
+  # necessary when the producer is creating the shared memory, as it will be
+  # passed to the service as a file descriptor (obtained from memfd_create).
+  allow traced $1:fd use;
 ')
 
 ###########################################
diff --git a/public/traceur_app.te b/public/traceur_app.te
index 7e2cc84..ce9b844 100644
--- a/public/traceur_app.te
+++ b/public/traceur_app.te
@@ -3,11 +3,6 @@
 allow traceur_app servicemanager:service_manager list;
 allow traceur_app hwservicemanager:hwservice_manager list;
 
-# Allow Traceur to enable traced if necessary.
-set_prop(traceur_app, traced_enabled_prop)
-
-set_prop(traceur_app, debug_prop)
-
 allow traceur_app {
   service_manager_type
   -apex_service
diff --git a/public/ueventd.te b/public/ueventd.te
index fc503b8..1d75080 100644
--- a/public/ueventd.te
+++ b/public/ueventd.te
@@ -59,10 +59,6 @@
 allow ueventd system_bootstrap_lib_file:dir r_dir_perms;
 allow ueventd system_bootstrap_lib_file:file { execute read open getattr map };
 
-# ueventd can set properties, particularly it sets ro.cold_boot_done to signal
-# to init that cold boot has completed.
-set_prop(ueventd, cold_boot_done_prop)
-
 # Allow ueventd to run shell scripts from vendor
 allow ueventd vendor_shell_exec:file execute;
 
diff --git a/public/uncrypt.te b/public/uncrypt.te
index 28dc3f2..75765f3 100644
--- a/public/uncrypt.te
+++ b/public/uncrypt.te
@@ -22,9 +22,6 @@
 # Write to /dev/socket/uncrypt
 unix_socket_connect(uncrypt, uncrypt, uncrypt)
 
-# Set a property to reboot the device.
-set_prop(uncrypt, powerctl_prop)
-
 # Raw writes to block device
 allow uncrypt self:global_capability_class_set sys_rawio;
 allow uncrypt misc_block_device:blk_file w_file_perms;
diff --git a/public/update_engine.te b/public/update_engine.te
index 078e494..ba2f3cf 100644
--- a/public/update_engine.te
+++ b/public/update_engine.te
@@ -63,12 +63,6 @@
 # read directories on /system and /vendor
 allow update_engine system_file:dir r_dir_perms;
 
-# Allow to start gsid service.
-set_prop(update_engine, ctl_gsid_prop)
-
-# Allow to set the OTA related properties, e.g. ota.warm_reset.
-set_prop(update_engine, ota_prop)
-
 # update_engine tries to determine the parent path for all devices (e.g.
 # /dev/block/by-name) by reading the default fstab and looking for the misc
 # device. ReadDefaultFstab() checks whether a GSI is running by checking
diff --git a/public/update_verifier.te b/public/update_verifier.te
index f881aeb..68b43f0 100644
--- a/public/update_verifier.te
+++ b/public/update_verifier.te
@@ -24,12 +24,6 @@
 # Write to kernel message.
 allow update_verifier kmsg_device:chr_file { getattr w_file_perms };
 
-# Allow update_verifier to reboot the device.
-set_prop(update_verifier, powerctl_prop)
-
-# Allow to set the OTA related properties e.g. ota.warm_reset.
-set_prop(update_verifier, ota_prop)
-
 # Use Boot Control HAL
 hal_client_domain(update_verifier, hal_bootctl)
 
diff --git a/public/usbd.te b/public/usbd.te
index 991e7be..6f34954 100644
--- a/public/usbd.te
+++ b/public/usbd.te
@@ -1,5 +1,2 @@
 type usbd, domain;
 type usbd_exec, system_file_type, exec_type, file_type;
-
-# Start/stop adbd via ctl.start adbd
-set_prop(usbd, ctl_adbd_prop)
diff --git a/public/vold.te b/public/vold.te
index e17113d..400e32a 100644
--- a/public/vold.te
+++ b/public/vold.te
@@ -52,11 +52,6 @@
   FS_IOC_REMOVE_ENCRYPTION_KEY
 };
 
-# Allow to load incremental file system driver
-allow vold self:capability sys_module;
-allow vold vendor_incremental_module:file r_file_perms;
-allow vold vendor_incremental_module:system module_load;
-
 # Only vold and init should ever set file-based encryption policies.
 neverallowxperm {
   domain
@@ -196,16 +191,6 @@
 # Set scheduling policy of kernel processes
 allow vold kernel:process setsched;
 
-# Property Service
-set_prop(vold, vold_prop)
-set_prop(vold, exported_vold_prop)
-set_prop(vold, exported2_vold_prop)
-set_prop(vold, powerctl_prop)
-set_prop(vold, ctl_fuse_prop)
-set_prop(vold, restorecon_prop)
-set_prop(vold, ota_prop)
-set_prop(vold, boottime_prop)
-
 # ASEC
 allow vold asec_image_file:file create_file_perms;
 allow vold asec_image_file:dir rw_dir_perms;
diff --git a/public/wificond.te b/public/wificond.te
index af29511..a36afb1 100644
--- a/public/wificond.te
+++ b/public/wificond.te
@@ -8,10 +8,6 @@
 
 add_service(wificond, wificond_service)
 
-set_prop(wificond, exported_wifi_prop)
-set_prop(wificond, wifi_prop)
-set_prop(wificond, ctl_default_prop)
-
 # create sockets to set interfaces up and down
 allow wificond self:udp_socket create_socket_perms;
 # setting interface state up/down is a privileged ioctl
@@ -33,7 +29,6 @@
 
 #### Offer the Wifi Keystore HwBinder service ###
 hwbinder_use(wificond)
-get_prop(wificond, hwservicemanager_prop)
 typeattribute wificond wifi_keystore_service_server;
 add_hwservice(wificond, system_wifi_keystore_hwservice)
 
diff --git a/vendor/file_contexts b/vendor/file_contexts
index 94b8095..4fdc737 100644
--- a/vendor/file_contexts
+++ b/vendor/file_contexts
@@ -10,7 +10,7 @@
 /(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.[0-9]+-service      u:object_r:hal_bluetooth_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.[0-9]+-service\.btlinux    u:object_r:hal_bluetooth_btlinux_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service u:object_r:hal_fingerprint_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.face@1\.1-service\.example u:object_r:hal_face_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.face@1\.[0-9]+-service\.example u:object_r:hal_face_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.boot@1\.[0-9]+-service      u:object_r:hal_bootctl_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.broadcastradio@\d+\.\d+-service u:object_r:hal_broadcastradio_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-service_64       u:object_r:hal_camera_default_exec:s0
@@ -25,7 +25,7 @@
 /(vendor|system/vendor)/bin/hw/android\.hardware\.drm@1\.0-service-lazy       u:object_r:hal_drm_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.cas@1\.[0-2]-service            u:object_r:hal_cas_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.cas@1\.[0-2]-service-lazy       u:object_r:hal_cas_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.dumpstate@1\.0-service\.example      u:object_r:hal_dumpstate_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.dumpstate@1\.[0-1]-service\.example      u:object_r:hal_dumpstate_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.gatekeeper@1\.0-service     u:object_r:hal_gatekeeper_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.gnss@[0-9]\.[0-9]-service   u:object_r:hal_gnss_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.allocator@2\.0-service   u:object_r:hal_graphics_allocator_default_exec:s0
diff --git a/vendor/hal_can_socketcan.te b/vendor/hal_can_socketcan.te
index afa1311..7498788 100644
--- a/vendor/hal_can_socketcan.te
+++ b/vendor/hal_can_socketcan.te
@@ -25,6 +25,8 @@
 # Un-publishing ICanBus interfaces
 allow hal_can_socketcan hidl_manager_hwservice:hwservice_manager find;
 
+allow hal_can_socketcan sysfs:dir r_dir_perms;
+
 allow hal_can_socketcan usb_serial_device:chr_file { ioctl read write open };
 allowxperm hal_can_socketcan usb_serial_device:chr_file ioctl {
     TCGETS
diff --git a/vendor/hal_gnss_default.te b/vendor/hal_gnss_default.te
index 92af53b..cea362f 100644
--- a/vendor/hal_gnss_default.te
+++ b/vendor/hal_gnss_default.te
@@ -3,3 +3,5 @@
 
 type hal_gnss_default_exec, exec_type, vendor_file_type, file_type;
 init_daemon_domain(hal_gnss_default)
+
+allow hal_gnss_default gnss_device:chr_file rw_file_perms;