diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 4b79060..3bdbfb1 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -93,9 +93,7 @@
 # application un-installation.
 neverallow { all_untrusted_apps -mediaprovider } {
   fs_type
-  -fuse                     # sdcard
-  -sdcardfs                 # sdcard
-  -vfat
+  -sdcard_type
   file_type
   -app_data_file            # The apps sandbox itself
   -media_rw_data_file       # Internal storage. Known that apps can
diff --git a/private/audioserver.te b/private/audioserver.te
index 471fcbe..a82cfec 100644
--- a/private/audioserver.te
+++ b/private/audioserver.te
@@ -37,7 +37,9 @@
 allow audioserver scheduling_policy_service:service_manager find;
 
 # Allow read/write access to bluetooth-specific properties
+set_prop(audioserver, bluetooth_a2dp_offload_prop)
 set_prop(audioserver, bluetooth_prop)
+set_prop(audioserver, exported_bluetooth_prop)
 
 # Grant access to audio files to audioserver
 allow audioserver audio_data_file:dir ra_dir_perms;
diff --git a/private/bluetooth.te b/private/bluetooth.te
index fec9494..d419855 100644
--- a/private/bluetooth.te
+++ b/private/bluetooth.te
@@ -39,7 +39,9 @@
 allow bluetooth proc_bluetooth_writable:file rw_file_perms;
 
 # Allow write access to bluetooth specific properties
+set_prop(bluetooth, bluetooth_a2dp_offload_prop)
 set_prop(bluetooth, bluetooth_prop)
+set_prop(bluetooth, exported_bluetooth_prop)
 set_prop(bluetooth, pan_result_prop)
 
 allow bluetooth audioserver_service:service_manager find;
diff --git a/private/bug_map b/private/bug_map
index 8022d04..5e94594 100644
--- a/private/bug_map
+++ b/private/bug_map
@@ -1,7 +1,43 @@
+dexoptanalyzer apk_data_file file 77853712
+dexoptanalyzer app_data_file file 77853712
+dexoptanalyzer app_data_file lnk_file 77853712
+dexoptanalyzer system_data_file lnk_file 77853712
+dnsmasq netd fifo_file 77868789
+dnsmasq netd unix_stream_socket 77868789
+init app_data_file file 77873135
+init cache_file blk_file 77873135
+init logpersist file 77873135
+init nativetest_data_file dir 77873135
+init pstorefs dir 77873135
+init shell_data_file dir 77873135
+init shell_data_file file 77873135
+init shell_data_file lnk_file 77873135
+init shell_data_file sock_file 77873135
+init system_data_file chr_file 77873135
+mediaextractor app_data_file file 77923736
+mediaextractor radio_data_file file 77923736
+mediaprovider cache_file blk_file 77925342
+mediaprovider mnt_media_rw_file dir 77925342
+mediaprovider shell_data_file dir 77925342
+netd priv_app unix_stream_socket 77870037
+netd untrusted_app unix_stream_socket 77870037
+netd untrusted_app_25 unix_stream_socket 77870037
+netd untrusted_app_27 unix_stream_socket 77870037
 platform_app nfc_data_file dir 74331887
+postinstall postinstall capability 77958490
+postinstall_dexopt postinstall_dexopt capability 77958490
+postinstall_dexopt user_profile_data_file file 77958490
 priv_app system_data_file dir 72811052
+profman apk_data_file dir 77922323
+statsd hal_health_default binder 77919007
 storaged storaged capability 77634061
+surfaceflinger mediacodec binder 77924251
 system_server crash_dump process 73128755
+system_server logd_socket sock_file 64734187
+system_server sdcardfs file 77856826
+system_server zygote process 77856826
 untrusted_app_25 system_data_file dir 72550646
 untrusted_app_27 system_data_file dir 72550646
 usbd usbd capability 72472544
+system_server sysfs file 77816522
+zygote untrusted_app_25 process 77925912
diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index 3e22734..68d6b40 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -11,6 +11,7 @@
     blank_screen
     blank_screen_exec
     blank_screen_tmpfs
+    bluetooth_a2dp_offload_prop
     bpfloader
     bpfloader_exec
     broadcastradio_service
@@ -18,6 +19,8 @@
     crossprofileapps_service
     e2fs
     e2fs_exec
+    exfat
+    exported_bluetooth_prop
     exported_config_prop
     exported_dalvik_prop
     exported_default_prop
@@ -31,6 +34,7 @@
     exported_system_prop
     exported_system_radio_prop
     exported_vold_prop
+    exported_wifi_prop
     exported2_config_prop
     exported2_default_prop
     exported2_radio_prop
diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil
index efc0166..1eaf22a 100644
--- a/private/compat/27.0/27.0.ignore.cil
+++ b/private/compat/27.0/27.0.ignore.cil
@@ -10,10 +10,12 @@
     blank_screen_exec
     blank_screen_tmpfs
     bootloader_boot_reason_prop
+    bluetooth_a2dp_offload_prop
     bpfloader
     bpfloader_exec
     cgroup_bpf
     crossprofileapps_service
+    exfat
     exported2_config_prop
     exported2_default_prop
     exported2_radio_prop
@@ -22,6 +24,7 @@
     exported3_default_prop
     exported3_radio_prop
     exported3_system_prop
+    exported_bluetooth_prop
     exported_config_prop
     exported_dalvik_prop
     exported_default_prop
@@ -35,6 +38,7 @@
     exported_system_prop
     exported_system_radio_prop
     exported_vold_prop
+    exported_wifi_prop
     fingerprint_vendor_data_file
     fs_bpf
     hal_authsecret_hwservice
diff --git a/private/genfs_contexts b/private/genfs_contexts
index f2b9699..1d321d8 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -238,6 +238,7 @@
 
 genfscon inotifyfs / u:object_r:inotify:s0
 genfscon vfat / u:object_r:vfat:s0
+genfscon exfat / u:object_r:exfat:s0
 genfscon debugfs / u:object_r:debugfs:s0
 genfscon fuse / u:object_r:fuse:s0
 genfscon configfs / u:object_r:configfs:s0
diff --git a/private/platform_app.te b/private/platform_app.te
index 80b20e1..f60597a 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -34,8 +34,8 @@
 # Direct access to vold-mounted storage under /mnt/media_rw
 # This is a performance optimization that allows platform apps to bypass the FUSE layer
 allow platform_app mnt_media_rw_file:dir r_dir_perms;
-allow platform_app vfat:dir create_dir_perms;
-allow platform_app vfat:file create_file_perms;
+allow platform_app sdcard_type:dir create_dir_perms;
+allow platform_app sdcard_type:file create_file_perms;
 
 # com.android.systemui
 allow platform_app rootfs:dir getattr;
diff --git a/private/priv_app.te b/private/priv_app.te
index 0841c41..99397a5 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -149,6 +149,7 @@
 dontaudit priv_app sysfs:dir read;
 dontaudit priv_app sysfs_android_usb:file read;
 dontaudit priv_app wifi_prop:file read;
+dontaudit priv_app { wifi_prop exported_wifi_prop }:file read;
 
 # allow privileged apps to use UDP sockets provided by the system server but not
 # modify them other than to connect
diff --git a/private/system_app.te b/private/system_app.te
index b2f8376..eb7e050 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -31,9 +31,11 @@
 allow system_app icon_file:file r_file_perms;
 
 # Write to properties
+set_prop(system_app, bluetooth_a2dp_offload_prop)
 set_prop(system_app, bluetooth_prop)
 set_prop(system_app, debug_prop)
 set_prop(system_app, system_prop)
+set_prop(system_app, exported_bluetooth_prop)
 set_prop(system_app, exported_system_prop)
 set_prop(system_app, exported2_system_prop)
 set_prop(system_app, exported3_system_prop)
diff --git a/private/vold_prepare_subdirs.te b/private/vold_prepare_subdirs.te
index af1f442..89b1528 100644
--- a/private/vold_prepare_subdirs.te
+++ b/private/vold_prepare_subdirs.te
@@ -7,12 +7,14 @@
 allow vold_prepare_subdirs vold:fd use;
 allow vold_prepare_subdirs vold:fifo_file { read write };
 allow vold_prepare_subdirs file_contexts_file:file r_file_perms;
-allow vold_prepare_subdirs self:global_capability_class_set { chown dac_override };
+allow vold_prepare_subdirs self:global_capability_class_set { chown dac_override fowner };
 allow vold_prepare_subdirs self:process setfscreate;
 allow vold_prepare_subdirs {
   system_data_file
   vendor_data_file
-}:dir { open read write add_name remove_name };
-allow vold_prepare_subdirs vold_data_file:dir { create open read write search getattr setattr remove_name rmdir };
+}:dir { open read write add_name remove_name rmdir relabelfrom };
+allow vold_prepare_subdirs system_data_file:file { getattr unlink };
+allow vold_prepare_subdirs vold_data_file:dir { create open read write search getattr setattr remove_name rmdir relabelto };
 allow vold_prepare_subdirs vold_data_file:file { getattr unlink };
-allow vold_prepare_subdirs storaged_data_file:dir create_dir_perms;
+allow vold_prepare_subdirs storaged_data_file:dir { create_dir_perms relabelto };
+allow vold_prepare_subdirs storaged_data_file:file getattr;
diff --git a/private/webview_zygote.te b/private/webview_zygote.te
index c9a401a..c41f9cb 100644
--- a/private/webview_zygote.te
+++ b/private/webview_zygote.te
@@ -131,4 +131,8 @@
 
 # Do not allow access to Bluetooth-related system properties.
 # neverallow rules for Bluetooth-related data files are listed above.
-neverallow webview_zygote bluetooth_prop:file create_file_perms;
+neverallow webview_zygote {
+  bluetooth_a2dp_offload_prop
+  bluetooth_prop
+  exported_bluetooth_prop
+}:file create_file_perms;
diff --git a/private/zygote.te b/private/zygote.te
index 0a1a7c6..4f26bd0 100644
--- a/private/zygote.te
+++ b/private/zygote.te
@@ -136,4 +136,8 @@
 }:file no_x_file_perms;
 
 # Do not allow access to Bluetooth-related system properties and files
-neverallow zygote bluetooth_prop:file create_file_perms;
+neverallow zygote {
+  bluetooth_a2dp_offload_prop
+  bluetooth_prop
+  exported_bluetooth_prop
+}:file create_file_perms;
diff --git a/public/app.te b/public/app.te
index 4eeede9..b5e77c1 100644
--- a/public/app.te
+++ b/public/app.te
@@ -250,19 +250,12 @@
 allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:lnk_file r_file_perms;
 
 # Read/write visible storage
-allow { appdomain -isolated_app -ephemeral_app } fuse:dir create_dir_perms;
-allow { appdomain -isolated_app -ephemeral_app } fuse:file create_file_perms;
-allow { appdomain -isolated_app -ephemeral_app } sdcardfs:dir create_dir_perms;
-allow { appdomain -isolated_app -ephemeral_app } sdcardfs:file create_file_perms;
+allow { appdomain -isolated_app -ephemeral_app } sdcard_type:dir create_dir_perms;
+allow { appdomain -isolated_app -ephemeral_app } sdcard_type:file create_file_perms;
 # This should be removed if sdcardfs is modified to alter the secontext for its
 # accesses to the underlying FS.
-allow { appdomain -isolated_app -ephemeral_app } { media_rw_data_file vfat }:dir create_dir_perms;
-allow { appdomain -isolated_app -ephemeral_app } { media_rw_data_file vfat }:file create_file_perms;
-
-# Access OBBs (vfat images) mounted by vold (b/17633509)
-# File write access allowed for FDs returned through Storage Access Framework
-allow { appdomain -isolated_app -ephemeral_app } vfat:dir r_dir_perms;
-allow { appdomain -isolated_app -ephemeral_app } vfat:file rw_file_perms;
+allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:dir create_dir_perms;
+allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:file create_file_perms;
 
 # Allow apps to use the USB Accessory interface.
 # http://developer.android.com/guide/topics/connectivity/usb/accessory.html
@@ -557,7 +550,7 @@
   appdomain
   -bluetooth
   -system_app
-} bluetooth_prop:file create_file_perms;
+} { bluetooth_a2dp_offload_prop bluetooth_prop exported_bluetooth_prop }:file create_file_perms;
 
 # Apps cannot access proc_uid_time_in_state
 neverallow appdomain proc_uid_time_in_state:file *;
diff --git a/public/domain.te b/public/domain.te
index 4f02623..2856f2c 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -560,7 +560,7 @@
 } serialno_prop:file r_file_perms;
 
 # Do not allow reading the last boot timestamp from system properties
-neverallow { domain -init -system_server } firstboot_prop:file r_file_perms;
+neverallow { domain -init -system_server -dumpstate } firstboot_prop:file r_file_perms;
 
 neverallow {
   domain
@@ -600,6 +600,7 @@
   -init
   -uncrypt
   -update_engine
+  -vendor_init
   -vold
   -recovery
   -ueventd
@@ -1119,6 +1120,7 @@
   -system_app
   -init
   -installd # for relabelfrom and unlink, check for this in explicit neverallow
+  -vold_prepare_subdirs # For unlink
   with_asan(`-asan_extract')
 } system_data_file:file no_w_file_perms;
 # do not grant anything greater than r_file_perms and relabelfrom unlink
diff --git a/public/dumpstate.te b/public/dumpstate.te
index 0fad5e1..8807157 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -232,16 +232,8 @@
 # dumpstate_options_prop is used to pass extra command-line args.
 set_prop(dumpstate, dumpstate_options_prop)
 
-# Read device's serial number from system properties
-get_prop(dumpstate, serialno_prop)
-
-# Read state of logging-related properties
-get_prop(dumpstate, device_logging_prop)
-
-# Read state of boot reason properties
-get_prop(dumpstate, bootloader_boot_reason_prop)
-get_prop(dumpstate, last_boot_reason_prop)
-get_prop(dumpstate, system_boot_reason_prop)
+# Read any system properties
+get_prop(dumpstate, property_type)
 
 # Access to /data/media.
 # This should be removed if sdcardfs is modified to alter the secontext for its
diff --git a/public/file.te b/public/file.te
index c10058e..5a5ee80 100644
--- a/public/file.te
+++ b/public/file.te
@@ -108,6 +108,7 @@
 type fuse, sdcard_type, fs_type, mlstrustedobject;
 type sdcardfs, sdcard_type, fs_type, mlstrustedobject;
 type vfat, sdcard_type, fs_type, mlstrustedobject;
+type exfat, sdcard_type, fs_type, mlstrustedobject;
 type debugfs, fs_type, debugfs_type;
 type debugfs_mmc, fs_type, debugfs_type;
 type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject;
diff --git a/public/hal_audio.te b/public/hal_audio.te
index 8d9d932..037066e 100644
--- a/public/hal_audio.te
+++ b/public/hal_audio.te
@@ -34,3 +34,5 @@
 
 # Only audio HAL may directly access the audio hardware
 neverallow { halserverdomain -hal_audio_server } audio_device:chr_file *;
+
+get_prop(hal_audio, bluetooth_a2dp_offload_prop)
diff --git a/public/hal_bluetooth.te b/public/hal_bluetooth.te
index 461523b..373dbec 100644
--- a/public/hal_bluetooth.te
+++ b/public/hal_bluetooth.te
@@ -21,7 +21,9 @@
 allow hal_bluetooth self:global_capability2_class_set wake_alarm;
 
 # Allow write access to bluetooth-specific properties
+set_prop(hal_bluetooth, bluetooth_a2dp_offload_prop)
 set_prop(hal_bluetooth, bluetooth_prop)
+set_prop(hal_bluetooth, exported_bluetooth_prop)
 
 # /proc access (bluesleep etc.).
 allow hal_bluetooth proc_bluetooth_writable:file rw_file_perms;
diff --git a/public/hal_configstore.te b/public/hal_configstore.te
index d5f2ef6..c8051e1 100644
--- a/public/hal_configstore.te
+++ b/public/hal_configstore.te
@@ -49,7 +49,14 @@
 }:{ file fifo_file sock_file } *;
 
 # Should never need sdcard access
-neverallow hal_configstore_server { fuse sdcardfs vfat }:file *;
+neverallow hal_configstore_server {
+    sdcard_type
+    fuse sdcardfs vfat exfat        # manual expansion for completeness
+}:dir ~getattr;
+neverallow hal_configstore_server {
+    sdcard_type
+    fuse sdcardfs vfat exfat        # manual expansion for completeness
+}:file *;
 
 # Do not permit access to service_manager and vndservice_manager
 neverallow hal_configstore_server *:service_manager *;
diff --git a/public/hal_telephony.te b/public/hal_telephony.te
index 31859aa..5f8cc41 100644
--- a/public/hal_telephony.te
+++ b/public/hal_telephony.te
@@ -21,7 +21,6 @@
 allow hal_telephony_server vendor_shell_exec:file rx_file_perms;
 allow hal_telephony_server bluetooth_efs_file:file r_file_perms;
 allow hal_telephony_server bluetooth_efs_file:dir r_dir_perms;
-allow hal_telephony_server sdcard_type:dir r_dir_perms;
 
 # property service
 set_prop(hal_telephony_server, radio_prop)
diff --git a/public/hal_wifi.te b/public/hal_wifi.te
index 78823d0..7cea7c7 100644
--- a/public/hal_wifi.te
+++ b/public/hal_wifi.te
@@ -8,6 +8,7 @@
 r_dir_file(hal_wifi, proc_net)
 r_dir_file(hal_wifi, sysfs_type)
 
+set_prop(hal_wifi, exported_wifi_prop)
 set_prop(hal_wifi, wifi_prop)
 
 # allow hal wifi set interfaces up and down
diff --git a/public/lmkd.te b/public/lmkd.te
index 5b6a708..472946e 100644
--- a/public/lmkd.te
+++ b/public/lmkd.te
@@ -43,6 +43,9 @@
 # reboot because orderly shutdown may not be possible.
 allow lmkd proc_sysrq:file rw_file_perms;
 
+# Read /proc/meminfo
+allow lmkd proc_meminfo:file r_file_perms;
+
 ### neverallow rules
 
 # never honor LD_PRELOAD
diff --git a/public/netd.te b/public/netd.te
index 545ad7c..7262072 100644
--- a/public/netd.te
+++ b/public/netd.te
@@ -141,7 +141,7 @@
 
 # persist.netd.stable_secret contains RFC 7217 secret key which should never be
 # leaked to other processes. Make sure it never leaks.
-neverallow { domain -netd -init } netd_stable_secret_prop:file r_file_perms;
+neverallow { domain -netd -init -dumpstate } netd_stable_secret_prop:file r_file_perms;
 
 # We want to ensure that no other process ever tries tampering with persist.netd.stable_secret,
 # the RFC 7217 secret key managed by netd. Doing so could compromise user privacy.
diff --git a/public/property.te b/public/property.te
index 6fa85dc..8045368 100644
--- a/public/property.te
+++ b/public/property.te
@@ -1,5 +1,6 @@
 type audio_prop, property_type, core_property_type;
 type boottime_prop, property_type;
+type bluetooth_a2dp_offload_prop, property_type;
 type bluetooth_prop, property_type;
 type bootloader_boot_reason_prop, property_type;
 type config_prop, property_type, core_property_type;
@@ -56,6 +57,7 @@
 type vendor_security_patch_level_prop, property_type;
 
 # Properties for whitelisting
+type exported_bluetooth_prop, property_type;
 type exported_config_prop, property_type;
 type exported_dalvik_prop, property_type;
 type exported_default_prop, property_type;
@@ -68,6 +70,7 @@
 type exported_system_prop, property_type;
 type exported_system_radio_prop, property_type;
 type exported_vold_prop, property_type;
+type exported_wifi_prop, property_type;
 type exported2_config_prop, property_type;
 type exported2_default_prop, property_type;
 type exported2_radio_prop, property_type;
diff --git a/public/property_contexts b/public/property_contexts
index 48e91a7..3c900d1 100644
--- a/public/property_contexts
+++ b/public/property_contexts
@@ -61,6 +61,8 @@
 drm.service.enabled u:object_r:exported3_default_prop:s0 exact bool
 keyguard.no_require_sim u:object_r:exported3_default_prop:s0 exact bool
 media.recorder.show_manufacturer_and_model u:object_r:exported3_default_prop:s0 exact bool
+persist.bluetooth.a2dp_offload.cap u:object_r:bluetooth_a2dp_offload_prop:s0 exact string
+persist.bluetooth.a2dp_offload.enable u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
 persist.config.calibration_fac u:object_r:exported3_default_prop:s0 exact string
 persist.dbg.volte_avail_ovr u:object_r:exported3_default_prop:s0 exact int
 persist.dbg.vt_avail_ovr u:object_r:exported3_default_prop:s0 exact int
@@ -68,7 +70,8 @@
 persist.radio.multisim.config u:object_r:exported3_radio_prop:s0 exact string
 persist.sys.dalvik.vm.lib.2 u:object_r:exported2_system_prop:s0 exact string
 persist.sys.sf.color_saturation u:object_r:exported2_system_prop:s0 exact string
-persist.sys.sf.native_mode u:object_r:exported2_system_prop:s0 exact bool
+persist.sys.sf.native_mode u:object_r:exported2_system_prop:s0 exact int
+persist.vendor.bluetooth.a2dp_offload.enable u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
 pm.dexopt.ab-ota u:object_r:exported_pm_prop:s0 exact string
 pm.dexopt.bg-dexopt u:object_r:exported_pm_prop:s0 exact string
 pm.dexopt.boot u:object_r:exported_pm_prop:s0 exact string
@@ -77,6 +80,7 @@
 ro.audio.monitorRotation u:object_r:exported3_default_prop:s0 exact bool
 ro.boot.vendor.overlay.theme u:object_r:exported_overlay_prop:s0 exact string
 ro.boot.wificountrycode u:object_r:exported3_default_prop:s0 exact string
+ro.bt.bdaddr_path u:object_r:exported_bluetooth_prop:s0 exact string
 ro.camera.notify_nfc u:object_r:exported3_default_prop:s0 exact int
 ro.com.android.dataroaming u:object_r:exported3_default_prop:s0 exact bool
 ro.com.android.prov_mobiledata u:object_r:exported3_default_prop:s0 exact bool
@@ -113,8 +117,11 @@
 telephony.lteOnCdmaDevice u:object_r:exported3_default_prop:s0 exact int
 tombstoned.max_tombstone_count u:object_r:exported3_default_prop:s0 exact int
 vold.post_fs_data_done u:object_r:exported2_vold_prop:s0 exact int
+wlan.driver.status u:object_r:exported_wifi_prop:s0 exact enum ok unloaded
 
 # vendor-init-readable|vendor-init-actionable
+dev.bootcomplete u:object_r:exported3_system_prop:s0 exact bool
+sys.boot_completed u:object_r:exported3_system_prop:s0 exact bool
 sys.retaildemo.enabled u:object_r:exported3_system_prop:s0 exact int
 
 # vendor-init-settable|vendor-init-actionable
diff --git a/public/tombstoned.te b/public/tombstoned.te
index cf3ddcb..1dfcf50 100644
--- a/public/tombstoned.te
+++ b/public/tombstoned.te
@@ -19,4 +19,4 @@
 # Changes for the new stack dumping mechanism. Each trace goes into a
 # separate file, and these files are managed by tombstoned.
 allow tombstoned anr_data_file:dir rw_dir_perms;
-allow tombstoned anr_data_file:file { getattr open create };
+allow tombstoned anr_data_file:file { create getattr open unlink };
diff --git a/public/vendor_init.te b/public/vendor_init.te
index dee2006..362244e 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -146,6 +146,9 @@
 # Vendor init can perform operations on trusted and security Extended Attributes
 allow vendor_init self:global_capability_class_set sys_admin;
 
+# Raw writes to misc block device
+allow vendor_init misc_block_device:blk_file w_file_perms;
+
 not_compatible_property(`
     set_prop(vendor_init, {
       property_type
@@ -159,7 +162,9 @@
     })
 ')
 
+set_prop(vendor_init, bluetooth_a2dp_offload_prop)
 set_prop(vendor_init, debug_prop)
+set_prop(vendor_init, exported_bluetooth_prop)
 set_prop(vendor_init, exported_config_prop)
 set_prop(vendor_init, exported_dalvik_prop)
 set_prop(vendor_init, exported_default_prop)
@@ -168,6 +173,7 @@
 set_prop(vendor_init, exported_pm_prop)
 set_prop(vendor_init, exported_radio_prop)
 set_prop(vendor_init, exported_system_radio_prop)
+set_prop(vendor_init, exported_wifi_prop)
 set_prop(vendor_init, exported2_config_prop)
 set_prop(vendor_init, exported2_system_prop)
 set_prop(vendor_init, exported2_vold_prop)
diff --git a/public/wificond.te b/public/wificond.te
index f4990b2..96668f3 100644
--- a/public/wificond.te
+++ b/public/wificond.te
@@ -7,6 +7,7 @@
 
 add_service(wificond, wificond_service)
 
+set_prop(wificond, exported_wifi_prop)
 set_prop(wificond, wifi_prop)
 set_prop(wificond, ctl_default_prop)
 
diff --git a/vendor/file_contexts b/vendor/file_contexts
index cdaf695..90de40b 100644
--- a/vendor/file_contexts
+++ b/vendor/file_contexts
@@ -31,6 +31,8 @@
 /(vendor|system/vendor)/bin/hw/android\.hardware\.media\.omx@1\.0-service            u:object_r:mediacodec_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.power@1\.0-service          u:object_r:hal_power_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.radio\.config@1\.0-service  u:object_r:hal_radio_config_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.radio@1\.2-radio-service    u:object_r:hal_radio_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.radio@1\.2-sap-service    u:object_r:hal_radio_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.sensors@1\.0-service        u:object_r:hal_sensors_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.secure_element@1\.0-service u:object_r:hal_secure_element_default_exec:s0
 /(vendor|system/vendor)/bin/hw/rild                                           u:object_r:rild_exec:s0
diff --git a/vendor/hal_radio_default.te b/vendor/hal_radio_default.te
new file mode 100644
index 0000000..82fd40e
--- /dev/null
+++ b/vendor/hal_radio_default.te
@@ -0,0 +1,6 @@
+type hal_radio_default, domain;
+hal_server_domain(hal_radio_default, hal_telephony)
+
+type hal_radio_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_radio_default)
+