diff --git a/private/app_neverallows.te b/private/app_neverallows.te
new file mode 100644
index 0000000..6928cd6
--- /dev/null
+++ b/private/app_neverallows.te
@@ -0,0 +1,96 @@
+###
+### neverallow rules for untrusted app domains
+###
+
+# Receive or send uevent messages.
+neverallow { untrusted_app ephemeral_app isolated_app } domain:netlink_kobject_uevent_socket *;
+
+# Receive or send generic netlink messages
+neverallow { untrusted_app ephemeral_app isolated_app } domain:netlink_socket *;
+
+# Too much leaky information in debugfs. It's a security
+# best practice to ensure these files aren't readable.
+neverallow { untrusted_app ephemeral_app isolated_app } debugfs_type:file read;
+
+# Do not allow untrusted apps to register services.
+# Only trusted components of Android should be registering
+# services.
+neverallow { untrusted_app ephemeral_app isolated_app } service_manager_type:service_manager add;
+
+# Do not allow untrusted apps to connect to the property service
+# or set properties. b/10243159
+neverallow { untrusted_app ephemeral_app isolated_app } property_socket:sock_file write;
+neverallow { untrusted_app ephemeral_app isolated_app } init:unix_stream_socket connectto;
+neverallow { untrusted_app ephemeral_app isolated_app } property_type:property_service set;
+
+# Do not allow untrusted apps to be assigned mlstrustedsubject.
+# This would undermine the per-user isolation model being
+# enforced via levelFrom=user in seapp_contexts and the mls
+# constraints.  As there is no direct way to specify a neverallow
+# on attribute assignment, this relies on the fact that fork
+# permission only makes sense within a domain (hence should
+# never be granted to any other domain within mlstrustedsubject)
+# and an untrusted app is allowed fork permission to itself.
+neverallow { untrusted_app ephemeral_app isolated_app } mlstrustedsubject:process fork;
+
+# Do not allow untrusted apps to hard link to any files.
+# In particular, if an untrusted app links to other app data
+# files, installd will not be able to guarantee the deletion
+# of the linked to file. Hard links also contribute to security
+# bugs, so we want to ensure untrusted apps never have this
+# capability.
+neverallow { untrusted_app ephemeral_app isolated_app } file_type:file link;
+
+# Do not allow untrusted apps to access network MAC address file
+neverallow { untrusted_app ephemeral_app isolated_app } sysfs_mac_address:file no_rw_file_perms;
+
+# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
+# ioctl permission, or 3. disallow the socket class.
+neverallowxperm { untrusted_app ephemeral_app isolated_app } domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
+neverallow { untrusted_app ephemeral_app isolated_app } *:{ netlink_route_socket netlink_selinux_socket } ioctl;
+neverallow { untrusted_app ephemeral_app isolated_app } *:{
+  socket netlink_socket packet_socket key_socket appletalk_socket
+  netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket
+  netlink_xfrm_socket netlink_audit_socket netlink_ip6fw_socket
+  netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
+  netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
+  netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
+  netlink_rdma_socket netlink_crypto_socket
+} *;
+
+# Do not allow untrusted apps access to /cache
+neverallow { untrusted_app ephemeral_app isolated_app } { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
+neverallow { untrusted_app ephemeral_app isolated_app } { cache_file cache_recovery_file }:file ~{ read getattr };
+
+# Do not allow untrusted apps to create/unlink files outside of its sandbox,
+# internal storage or sdcard.
+# World accessible data locations allow application to fill the device
+# with unaccounted for data. This data will not get removed during
+# application un-installation.
+neverallow { untrusted_app ephemeral_app isolated_app } {
+  fs_type
+  -fuse                     # sdcard
+  -sdcardfs                 # sdcard
+  -vfat
+  file_type
+  -app_data_file            # The apps sandbox itself
+  -media_rw_data_file       # Internal storage. Known that apps can
+                            # leave artfacts here after uninstall.
+  -user_profile_data_file   # Access to profile files
+  -user_profile_foreign_dex_data_file   # Access to profile files
+  userdebug_or_eng(`
+    -method_trace_data_file # only on ro.debuggable=1
+    -coredump_file          # userdebug/eng only
+  ')
+}:dir_file_class_set { create unlink };
+
+# Do not allow untrusted apps to directly open tun_device
+neverallow { untrusted_app ephemeral_app isolated_app } tun_device:chr_file open;
+
+# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
+neverallow { untrusted_app ephemeral_app isolated_app } anr_data_file:file ~{ open append };
+neverallow { untrusted_app ephemeral_app isolated_app } anr_data_file:dir ~search;
+
+# Avoid reads from generically labeled /proc files
+# Create a more specific label if needed
+neverallow { untrusted_app ephemeral_app isolated_app } proc:file { no_rw_file_perms no_x_file_perms };
diff --git a/private/ephemeral_app.te b/private/ephemeral_app.te
index 3e58ccf..b4a2181 100644
--- a/private/ephemeral_app.te
+++ b/private/ephemeral_app.te
@@ -14,14 +14,6 @@
 net_domain(ephemeral_app)
 app_domain(ephemeral_app)
 
-# App sandbox file accesses.
-allow ephemeral_app ephemeral_data_file:dir create_dir_perms;
-allow ephemeral_app ephemeral_data_file:{ file sock_file fifo_file } create_file_perms;
-
-# Allow apps to read/execute installed binaries
-allow ephemeral_app ephemeral_apk_data_file:dir r_dir_perms;
-allow ephemeral_app ephemeral_apk_data_file:file { r_file_perms execute };
-
 # Allow ephemeral apps to read/write files in visible storage if provided fds
 allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr ioctl lock append};
 
@@ -36,7 +28,7 @@
 ###
 
 # Executable content should never be loaded from an ephemeral app home directory.
-neverallow ephemeral_app ephemeral_data_file:file { execute execute_no_trans };
+neverallow ephemeral_app app_data_file:file { execute execute_no_trans };
 
 # Receive or send uevent messages.
 neverallow ephemeral_app domain:netlink_kobject_uevent_socket *;
diff --git a/private/file_contexts b/private/file_contexts
index 9236bfe..0bf16c8 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -244,6 +244,7 @@
 /system/bin/hw/android\.hardware\.bluetooth@1\.0-service      u:object_r:hal_bluetooth_default_exec:s0
 /system/bin/hw/android\.hardware\.boot@1\.0-service           u:object_r:hal_boot_exec:s0
 /system/bin/hw/android\.hardware\.camera\.provider@2\.4-service          u:object_r:hal_camera_default_exec:s0
+/system/bin/hw/android\.hardware\.configstore@1\.0-service    u:object_r:hal_configstore_default_exec:s0
 /system/bin/hw/android\.hardware\.contexthub@1\.0-service     u:object_r:hal_contexthub_default_exec:s0
 /system/bin/hw/android\.hardware\.drm@1\.0-service            u:object_r:hal_drm_default_exec:s0
 /system/bin/hw/android\.hardware\.dumpstate@1\.0-service      u:object_r:hal_dumpstate_default_exec:s0
@@ -303,10 +304,6 @@
 /data/app/vmdl[^/]+\.tmp/oat(/.*)?           u:object_r:dalvikcache_data_file:s0
 /data/app-private(/.*)?               u:object_r:apk_private_data_file:s0
 /data/app-private/vmdl.*\.tmp(/.*)?   u:object_r:apk_private_tmp_file:s0
-/data/app-ephemeral(/.*)?             u:object_r:ephemeral_apk_data_file:s0
-/data/app-ephemeral/[^/]+/oat(/.*)?   u:object_r:dalvikcache_data_file:s0
-/data/app-ephemeral/vmdl[^/]+\.tmp(/.*)?           u:object_r:ephemeral_apk_tmp_file:s0
-/data/app-ephemeral/vmdl[^/]+\.tmp/oat(/.*)?           u:object_r:dalvikcache_data_file:s0
 /data/tombstones(/.*)?	u:object_r:tombstone_data_file:s0
 /data/local/tmp(/.*)?	u:object_r:shell_data_file:s0
 /data/media(/.*)?	u:object_r:media_rw_data_file:s0
diff --git a/private/hal_configstore_default.te b/private/hal_configstore_default.te
new file mode 100644
index 0000000..b3ca6c2
--- /dev/null
+++ b/private/hal_configstore_default.te
@@ -0,0 +1,5 @@
+type hal_configstore_default, domain;
+hal_impl_domain(hal_configstore_default, hal_configstore)
+
+type hal_configstore_default_exec, exec_type, file_type;
+init_daemon_domain(hal_configstore_default)
diff --git a/private/isolated_app.te b/private/isolated_app.te
index bfe738b..f98b1d1 100644
--- a/private/isolated_app.te
+++ b/private/isolated_app.te
@@ -51,10 +51,6 @@
 # Do not allow isolated_app to directly open tun_device
 neverallow isolated_app tun_device:chr_file open;
 
-# Do not allow isolated_app to set system properties.
-neverallow isolated_app property_socket:sock_file write;
-neverallow isolated_app property_type:property_service set;
-
 # Isolated apps should not directly open app data files themselves.
 neverallow isolated_app app_data_file:file open;
 
@@ -81,20 +77,6 @@
 neverallow isolated_app cache_file:dir ~{ r_dir_perms };
 neverallow isolated_app cache_file:file ~{ read getattr };
 
-# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
-# ioctl permission, or 3. disallow the socket class.
-neverallowxperm isolated_app domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
-neverallow isolated_app *:{ netlink_route_socket netlink_selinux_socket } ioctl;
-neverallow isolated_app *:{
-  socket netlink_socket packet_socket key_socket appletalk_socket
-  netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket
-  netlink_xfrm_socket netlink_audit_socket netlink_ip6fw_socket
-  netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
-  netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
-  netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
-  netlink_rdma_socket netlink_crypto_socket
-} *;
-
 # Do not allow isolated_app to access external storage, except for files passed
 # via file descriptors (b/32896414).
 neverallow isolated_app { storage_file mnt_user_file sdcard_type }:dir ~getattr;
@@ -107,7 +89,3 @@
 
 # Restrict the webview_zygote control socket.
 neverallow isolated_app webview_zygote_socket:sock_file write;
-
-# Avoid reads from generically labeled /proc files
-# Create a more specific label if needed
-neverallow isolated_app proc:file { no_rw_file_perms no_x_file_perms };
diff --git a/private/platform_app.te b/private/platform_app.te
index 6747848..dde1c71 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -14,10 +14,10 @@
 allow platform_app shell_data_file:dir search;
 allow platform_app shell_data_file:file { open getattr read };
 allow platform_app icon_file:file { open getattr read };
-# Populate /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp, /data/app-ephemeral/vmdl*.tmp files
+# Populate /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files
 # created by system server.
-allow platform_app { apk_tmp_file apk_private_tmp_file ephemeral_apk_tmp_file}:dir rw_dir_perms;
-allow platform_app { apk_tmp_file apk_private_tmp_file ephemeral_apk_tmp_file}:file rw_file_perms;
+allow platform_app { apk_tmp_file apk_private_tmp_file }:dir rw_dir_perms;
+allow platform_app { apk_tmp_file apk_private_tmp_file }:file rw_file_perms;
 allow platform_app apk_private_data_file:dir search;
 # ASEC
 allow platform_app asec_apk_file:dir create_dir_perms;
@@ -56,8 +56,4 @@
 allow platform_app preloads_data_file:file r_file_perms;
 allow platform_app preloads_data_file:dir r_dir_perms;
 
-# Access to ephemeral APKs
-allow platform_app ephemeral_apk_data_file:dir r_dir_perms;
-allow platform_app ephemeral_apk_data_file:file r_file_perms;
-
 read_runtime_log_tags(platform_app)
diff --git a/private/seapp_contexts b/private/seapp_contexts
index 85980e9..0a30829 100644
--- a/private/seapp_contexts
+++ b/private/seapp_contexts
@@ -94,6 +94,6 @@
 user=shell seinfo=platform domain=shell type=shell_data_file
 user=_isolated domain=isolated_app levelFrom=user
 user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
-user=_app isEphemeralApp=true domain=ephemeral_app type=ephemeral_data_file levelFrom=all
+user=_app isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=all
 user=_app isPrivApp=true domain=priv_app type=app_data_file levelFrom=user
 user=_app domain=untrusted_app type=app_data_file levelFrom=user
diff --git a/private/service_contexts b/private/service_contexts
index ebb3265..dffdbd9 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -22,6 +22,7 @@
 commontime_management                     u:object_r:commontime_management_service:s0
 common_time.clock                         u:object_r:mediaserver_service:s0
 common_time.config                        u:object_r:mediaserver_service:s0
+companion_device                          u:object_r:companion_device_service:s0
 connectivity                              u:object_r:connectivity_service:s0
 connectivity_metrics_logger               u:object_r:connectivity_metrics_logger_service:s0
 connmetrics                               u:object_r:connmetrics_service:s0
diff --git a/private/untrusted_app.te b/private/untrusted_app.te
index 643f952..c0d2b93 100644
--- a/private/untrusted_app.te
+++ b/private/untrusted_app.te
@@ -103,100 +103,3 @@
 # b/33214085 b/33814662 b/33791054 b/33211769
 # https://github.com/strazzere/anti-emulator/blob/master/AntiEmulator/src/diff/strazzere/anti/emulator/FindEmulator.java
 allow untrusted_app proc_tty_drivers:file r_file_perms;
-
-###
-### neverallow rules
-###
-
-# Receive or send uevent messages.
-neverallow untrusted_app domain:netlink_kobject_uevent_socket *;
-
-# Receive or send generic netlink messages
-neverallow untrusted_app domain:netlink_socket *;
-
-# Too much leaky information in debugfs. It's a security
-# best practice to ensure these files aren't readable.
-neverallow untrusted_app debugfs_type:file read;
-
-# Do not allow untrusted apps to register services.
-# Only trusted components of Android should be registering
-# services.
-neverallow untrusted_app service_manager_type:service_manager add;
-
-# Do not allow untrusted_apps to connect to the property service
-# or set properties. b/10243159
-neverallow untrusted_app property_socket:sock_file write;
-neverallow untrusted_app init:unix_stream_socket connectto;
-neverallow untrusted_app property_type:property_service set;
-
-# Do not allow untrusted_app to be assigned mlstrustedsubject.
-# This would undermine the per-user isolation model being
-# enforced via levelFrom=user in seapp_contexts and the mls
-# constraints.  As there is no direct way to specify a neverallow
-# on attribute assignment, this relies on the fact that fork
-# permission only makes sense within a domain (hence should
-# never be granted to any other domain within mlstrustedsubject)
-# and untrusted_app is allowed fork permission to itself.
-neverallow untrusted_app mlstrustedsubject:process fork;
-
-# Do not allow untrusted_app to hard link to any files.
-# In particular, if untrusted_app links to other app data
-# files, installd will not be able to guarantee the deletion
-# of the linked to file. Hard links also contribute to security
-# bugs, so we want to ensure untrusted_app never has this
-# capability.
-neverallow untrusted_app file_type:file link;
-
-# Do not allow untrusted_app to access network MAC address file
-neverallow untrusted_app sysfs_mac_address:file no_rw_file_perms;
-
-# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
-# ioctl permission, or 3. disallow the socket class.
-neverallowxperm untrusted_app domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
-neverallow untrusted_app *:{ netlink_route_socket netlink_selinux_socket } ioctl;
-neverallow untrusted_app *:{
-  socket netlink_socket packet_socket key_socket appletalk_socket
-  netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket
-  netlink_xfrm_socket netlink_audit_socket netlink_ip6fw_socket
-  netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
-  netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
-  netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
-  netlink_rdma_socket netlink_crypto_socket
-} *;
-
-# Do not allow untrusted_app access to /cache
-neverallow untrusted_app { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
-neverallow untrusted_app { cache_file cache_recovery_file }:file ~{ read getattr };
-
-# Do not allow untrusted_app to create/unlink files outside of its sandbox,
-# internal storage or sdcard.
-# World accessible data locations allow application to fill the device
-# with unaccounted for data. This data will not get removed during
-# application un-installation.
-neverallow untrusted_app {
-  fs_type
-  -fuse                     # sdcard
-  -sdcardfs                 # sdcard
-  -vfat
-  file_type
-  -app_data_file            # The apps sandbox itself
-  -media_rw_data_file       # Internal storage. Known that apps can
-                            # leave artfacts here after uninstall.
-  -user_profile_data_file   # Access to profile files
-  -user_profile_foreign_dex_data_file   # Access to profile files
-  userdebug_or_eng(`
-    -method_trace_data_file # only on ro.debuggable=1
-    -coredump_file          # userdebug/eng only
-  ')
-}:dir_file_class_set { create unlink };
-
-# Do not allow untrusted_app to directly open tun_device
-neverallow untrusted_app tun_device:chr_file open;
-
-# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
-neverallow untrusted_app anr_data_file:file ~{ open append };
-neverallow untrusted_app anr_data_file:dir ~search;
-
-# Avoid reads from generically labeled /proc files
-# Create a more specific label if needed
-neverallow untrusted_app proc:file { no_rw_file_perms no_x_file_perms };
diff --git a/private/webview_zygote.te b/private/webview_zygote.te
index b5cab2c..b5a3af9 100644
--- a/private/webview_zygote.te
+++ b/private/webview_zygote.te
@@ -79,7 +79,6 @@
     nfc_data_file
     radio_data_file
     shell_data_file
-    ephemeral_data_file
 }:file { rwx_file_perms };
 
 neverallow webview_zygote {
diff --git a/public/adbd.te b/public/adbd.te
index f0df8b1..e3b0ebb 100644
--- a/public/adbd.te
+++ b/public/adbd.te
@@ -82,8 +82,8 @@
 ')
 
 # ndk-gdb invokes adb forward to forward the gdbserver socket.
-allow adbd { app_data_file ephemeral_data_file }:dir search;
-allow adbd { app_data_file ephemeral_data_file }:sock_file write;
+allow adbd app_data_file:dir search;
+allow adbd app_data_file:sock_file write;
 allow adbd appdomain:unix_stream_socket connectto;
 
 # ndk-gdb invokes adb pull of app_process, linker, and libc.so.
diff --git a/public/attributes b/public/attributes
index 368af4f..75db022 100644
--- a/public/attributes
+++ b/public/attributes
@@ -121,6 +121,7 @@
 attribute hal_audio;
 attribute hal_bluetooth;
 attribute hal_camera;
+attribute hal_configstore;
 attribute hal_contexthub;
 attribute hal_drm;
 attribute hal_dumpstate;
diff --git a/public/dex2oat.te b/public/dex2oat.te
index f4a7418..e547296 100644
--- a/public/dex2oat.te
+++ b/public/dex2oat.te
@@ -2,7 +2,7 @@
 type dex2oat, domain, domain_deprecated;
 type dex2oat_exec, exec_type, file_type;
 
-r_dir_file(dex2oat, {apk_data_file ephemeral_apk_data_file})
+r_dir_file(dex2oat, apk_data_file)
 
 allow dex2oat tmpfs:file { read getattr };
 
@@ -19,7 +19,7 @@
 allow dex2oat asec_apk_file:file read;
 allow dex2oat unlabeled:file read;
 allow dex2oat oemfs:file read;
-allow dex2oat {apk_tmp_file ephemeral_apk_tmp_file}:file read;
+allow dex2oat apk_tmp_file:file read;
 allow dex2oat user_profile_data_file:file { getattr read lock };
 
 # Allow dex2oat to compile app's secondary dex files which were reported back to
diff --git a/public/domain.te b/public/domain.te
index 5df7a43..8bdd548 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -271,9 +271,7 @@
 
 # Don't allow raw read/write/open access to generic devices.
 # Rather force a relabel to a more specific type.
-# init is exempt from this as there are character devices that only it uses.
-# ueventd is exempt from this, as it is managing these devices.
-neverallow { domain -init -ueventd } device:chr_file { open read write };
+neverallow domain device:chr_file { open read write };
 
 # Limit what domains can mount filesystems or change their mount flags.
 # sdcard_type / vfat is exempt as a larger set of domains need
@@ -311,7 +309,6 @@
   -dalvikcache_data_file
   -system_data_file # shared libs in apks
   -apk_data_file
-  -ephemeral_apk_data_file
 }:file no_x_file_perms;
 
 neverallow { domain userdebug_or_eng(`-shell') } nativetest_data_file:file no_x_file_perms;
diff --git a/public/drmserver.te b/public/drmserver.te
index 453ce12..825e828 100644
--- a/public/drmserver.te
+++ b/public/drmserver.te
@@ -21,7 +21,7 @@
 allow drmserver drm_data_file:dir create_dir_perms;
 allow drmserver drm_data_file:file create_file_perms;
 allow drmserver tee_device:chr_file rw_file_perms;
-allow drmserver { app_data_file ephemeral_data_file}:file { read write getattr };
+allow drmserver app_data_file:file { read write getattr };
 allow drmserver sdcard_type:file { read write getattr };
 r_dir_file(drmserver, efs_file)
 
diff --git a/public/file.te b/public/file.te
index c48e04e..e562798 100644
--- a/public/file.te
+++ b/public/file.te
@@ -103,9 +103,6 @@
 # /data/app-private - forward-locked apps
 type apk_private_data_file, file_type, data_file_type;
 type apk_private_tmp_file, file_type, data_file_type, mlstrustedobject;
-# /data/app-ephemeral - ephemeral apps
-type ephemeral_apk_data_file, file_type, data_file_type;
-type ephemeral_apk_tmp_file, file_type, data_file_type, mlstrustedobject;
 # /data/dalvik-cache
 type dalvikcache_data_file, file_type, data_file_type;
 # /data/ota
@@ -181,7 +178,6 @@
 
 # /data/data subdirectories - app sandboxes
 type app_data_file, file_type, data_file_type;
-type ephemeral_data_file, file_type, data_file_type;
 # /data/data subdirectory for system UID apps.
 type system_app_data_file, file_type, data_file_type, mlstrustedobject;
 # Compatibility with type name used in Android 4.3 and 4.4.
diff --git a/public/init.te b/public/init.te
index debdc39..fe8cdbb 100644
--- a/public/init.te
+++ b/public/init.te
@@ -175,7 +175,7 @@
   -vold_data_file
 }:lnk_file { create getattr setattr relabelfrom unlink };
 
-allow init {file_type -system_file -exec_type}:dir_file_class_set relabelto;
+allow init { file_type -system_file -exec_type }:dir_file_class_set relabelto;
 allow init { sysfs debugfs debugfs_tracing }:{ dir file lnk_file } { getattr relabelfrom };
 allow init { sysfs_type debugfs_type }:{ dir file lnk_file } relabelto;
 allow init dev_type:dir create_dir_perms;
@@ -195,8 +195,19 @@
 allow init { fs_type -contextmount_type -sdcard_type -rootfs }:file { open read setattr };
 allow init { fs_type -contextmount_type -sdcard_type -rootfs }:dir  { open read setattr search };
 
+# init should not be able to read or open generic devices
+# TODO: auditing to see if this can be deleted entirely
+allow init { dev_type -kmem_device -port_device -device }:chr_file { read open };
+auditallow init {
+  dev_type
+  -kmem_device
+  -port_device
+  -device
+  -null_device
+}:chr_file { read open };
+
 # chown/chmod on devices.
-allow init { dev_type -kmem_device -port_device }:chr_file { read open setattr };
+allow init { dev_type -kmem_device -port_device }:chr_file setattr;
 
 # Unlabeled file access for upgrades from 4.2.
 allow init unlabeled:dir { create_dir_perms relabelfrom };
@@ -318,11 +329,6 @@
 # only ever accessed by init.
 allow init device:file create_file_perms;
 
-# Access character devices without a specific type,
-# TODO: Remove this access and auditallow (b/33347297)
-allow init device:chr_file { rw_file_perms setattr };
-auditallow init device:chr_file { rw_file_perms setattr };
-
 # keychord configuration
 allow init self:capability sys_tty_config;
 allow init keychord_device:chr_file rw_file_perms;
diff --git a/public/installd.te b/public/installd.te
index 08255a4..08c438d 100644
--- a/public/installd.te
+++ b/public/installd.te
@@ -9,13 +9,13 @@
 allow installd dalvikcache_data_file:file { relabelto link };
 
 # Allow movement of APK files between volumes
-allow installd {apk_data_file ephemeral_apk_data_file}:dir { create_dir_perms relabelfrom };
-allow installd {apk_data_file ephemeral_apk_data_file}:file { create_file_perms relabelfrom link };
-allow installd {apk_data_file ephemeral_apk_data_file}:lnk_file { create r_file_perms unlink };
+allow installd apk_data_file:dir { create_dir_perms relabelfrom };
+allow installd apk_data_file:file { create_file_perms relabelfrom link };
+allow installd apk_data_file:lnk_file { create r_file_perms unlink };
 
 allow installd asec_apk_file:file r_file_perms;
-allow installd {apk_tmp_file ephemeral_apk_tmp_file}:file { r_file_perms unlink };
-allow installd {apk_tmp_file ephemeral_apk_tmp_file}:dir { relabelfrom create_dir_perms };
+allow installd apk_tmp_file:file { r_file_perms unlink };
+allow installd apk_tmp_file:dir { relabelfrom create_dir_perms };
 allow installd oemfs:dir r_dir_perms;
 allow installd oemfs:file r_file_perms;
 allow installd cgroup:dir create_dir_perms;
@@ -88,7 +88,6 @@
     radio_data_file
     shell_data_file
     app_data_file
-    ephemeral_data_file
 }:dir { create_dir_perms relabelfrom relabelto };
 
 allow installd {
@@ -98,7 +97,6 @@
     radio_data_file
     shell_data_file
     app_data_file
-    ephemeral_data_file
 }:notdevfile_class_set { create_file_perms relabelfrom relabelto };
 
 # Similar for the files under /data/misc/profiles/
diff --git a/public/service.te b/public/service.te
index adcb177..c0cf256 100644
--- a/public/service.te
+++ b/public/service.te
@@ -44,6 +44,7 @@
 type contexthub_service, app_api_service, system_server_service, service_manager_type;
 type IProxyService_service, app_api_service, system_server_service, service_manager_type;
 type commontime_management_service, system_server_service, service_manager_type;
+type companion_device_service, app_api_service, system_server_service, service_manager_type;
 type connectivity_metrics_logger_service, app_api_service, system_server_service, service_manager_type;
 type connectivity_service, app_api_service, system_server_service, service_manager_type;
 type connmetrics_service, app_api_service, system_server_service, service_manager_type;
diff --git a/public/surfaceflinger.te b/public/surfaceflinger.te
index d09a350..3bdc97f 100644
--- a/public/surfaceflinger.te
+++ b/public/surfaceflinger.te
@@ -10,6 +10,7 @@
 hwbinder_use(surfaceflinger)
 binder_call(surfaceflinger, hal_graphics_allocator)
 binder_call(surfaceflinger, hal_graphics_composer)
+binder_call(surfaceflinger, hal_configstore)
 
 # Perform Binder IPC.
 binder_use(surfaceflinger)
diff --git a/public/system_server.te b/public/system_server.te
index 2426283..78784b7 100644
--- a/public/system_server.te
+++ b/public/system_server.te
@@ -272,12 +272,6 @@
 allow system_server apk_private_tmp_file:dir create_dir_perms;
 allow system_server apk_private_tmp_file:file create_file_perms;
 
-# Manage /data/app-ephemeral
-allow system_server ephemeral_apk_data_file:dir create_dir_perms;
-allow system_server ephemeral_apk_data_file:file create_file_perms;
-allow system_server ephemeral_apk_tmp_file:dir create_dir_perms;
-allow system_server ephemeral_apk_tmp_file:file create_file_perms;
-
 # Manage files within asec containers.
 allow system_server asec_apk_file:dir create_dir_perms;
 allow system_server asec_apk_file:file create_file_perms;
@@ -326,7 +320,7 @@
 
 # Walk /data/data subdirectories.
 # Types extracted from seapp_contexts type= fields.
-allow system_server { system_app_data_file bluetooth_data_file nfc_data_file radio_data_file shell_data_file app_data_file ephemeral_data_file }:dir { getattr read search };
+allow system_server { system_app_data_file bluetooth_data_file nfc_data_file radio_data_file shell_data_file app_data_file }:dir { getattr read search };
 # Also permit for unlabeled /data/data subdirectories and
 # for unlabeled asec containers on upgrades from 4.2.
 allow system_server unlabeled:dir r_dir_perms;
@@ -349,8 +343,8 @@
 allow system_server media_rw_data_file:file { getattr read write append };
 
 # Relabel apk files.
-allow system_server { apk_tmp_file apk_private_tmp_file ephemeral_apk_tmp_file }:{ dir file } { relabelfrom relabelto };
-allow system_server { apk_data_file apk_private_data_file ephemeral_apk_data_file}:{ dir file } { relabelfrom relabelto };
+allow system_server { apk_tmp_file apk_private_tmp_file }:{ dir file } { relabelfrom relabelto };
+allow system_server { apk_data_file apk_private_data_file }:{ dir file } { relabelfrom relabelto };
 
 # Relabel wallpaper.
 allow system_server system_data_file:file relabelfrom;
diff --git a/public/ueventd.te b/public/ueventd.te
index 11235ed..b0706c8 100644
--- a/public/ueventd.te
+++ b/public/ueventd.te
@@ -7,8 +7,6 @@
 
 allow ueventd self:capability { chown mknod net_admin setgid fsetid sys_rawio dac_override fowner };
 allow ueventd device:file create_file_perms;
-allow ueventd device:chr_file rw_file_perms;
-auditallow ueventd device:chr_file rw_file_perms;
 
 r_dir_file(ueventd, sysfs_type)
 r_dir_file(ueventd, rootfs)
diff --git a/public/update_verifier.te b/public/update_verifier.te
index 5ee5258..8482159 100644
--- a/public/update_verifier.te
+++ b/public/update_verifier.te
@@ -13,8 +13,8 @@
 allow update_verifier ota_package_file:dir r_dir_perms;
 allow update_verifier ota_package_file:file r_file_perms;
 
-# Read all blocks in system partition.
-allow update_verifier system_block_device:blk_file r_file_perms;
+# Read all blocks in dm wrapped system partition.
+allow update_verifier dm_device:blk_file r_file_perms;
 
 # Use binderized HAL
 hwbinder_use(update_verifier)