diff --git a/Android.mk b/Android.mk
index dd37341..f427c87 100644
--- a/Android.mk
+++ b/Android.mk
@@ -217,10 +217,14 @@
 		-D target_full_treble=$(PRODUCT_FULL_TREBLE) \
 		-s $^ > $@
 
+# b/37755687
+CHECKPOLICY_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0
+
 reqd_policy_mask.cil := $(intermediates)/reqd_policy_mask.cil
 $(reqd_policy_mask.cil): $(reqd_policy_mask.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
 	@mkdir -p $(dir $@)
-	$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c $(POLICYVERS) -o $@ $<
+	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -C -M -c \
+		$(POLICYVERS) -o $@ $<
 
 reqd_policy_mask.conf :=
 
@@ -253,7 +257,7 @@
 $(plat_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
 $(plat_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy $(plat_pub_policy.conf) $(reqd_policy_mask.cil)
 	@mkdir -p $(dir $@)
-	$(hide) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF)
+	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF)
 	$(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@
 
 plat_pub_policy.conf :=
@@ -311,7 +315,8 @@
   $(HOST_OUT_EXECUTABLES)/secilc \
   $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY))
 	@mkdir -p $(dir $@)
-	$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c $(POLICYVERS) -o $@ $<
+	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
+		$(POLICYVERS) -o $@ $<
 	$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
 	$(hide) $(HOST_OUT_EXECUTABLES)/secilc -M true -G -N -c $(POLICYVERS) $@ -o /dev/null -f /dev/null
 
@@ -419,7 +424,7 @@
 $(nonplat_policy_raw): $(HOST_OUT_EXECUTABLES)/checkpolicy $(nonplat_policy.conf) \
 $(reqd_policy_mask.cil)
 	@mkdir -p $(dir $@)
-	$(hide) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF)
+	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@.tmp $(PRIVATE_POL_CONF)
 	$(hide) grep -Fxv -f $(PRIVATE_REQD_MASK) $@.tmp > $@
 
 $(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
@@ -543,7 +548,8 @@
 $(LOCAL_BUILT_MODULE): $(sepolicy.recovery.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
                        $(HOST_OUT_EXECUTABLES)/sepolicy-analyze
 	@mkdir -p $(dir $@)
-	$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@.tmp $<
+	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c \
+		$(POLICYVERS) -o $@.tmp $<
 	$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $@.tmp permissive > $@.permissivedomains
 	$(hide) if [ "$(TARGET_BUILD_VARIANT)" = "user" -a -s $@.permissivedomains ]; then \
 		echo "==========" 1>&2; \
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 0917724..9c762a1 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -5,7 +5,15 @@
 # Only allow domains in AOSP to use the untrusted_app_all attribute.
 neverallow { untrusted_app_all -untrusted_app -untrusted_app_25 } domain:process fork;
 
-define(`all_untrusted_apps',`{ untrusted_app_all untrusted_app_25 untrusted_app ephemeral_app isolated_app }')
+define(`all_untrusted_apps',`{
+  ephemeral_app
+  isolated_app
+  mediaprovider
+  untrusted_app
+  untrusted_app_25
+  untrusted_app_all
+  untrusted_v2_app
+}')
 # Receive or send uevent messages.
 neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *;
 
@@ -27,9 +35,9 @@
 
 # Do not allow untrusted apps to connect to the property service
 # or set properties. b/10243159
-neverallow all_untrusted_apps property_socket:sock_file write;
-neverallow all_untrusted_apps init:unix_stream_socket connectto;
-neverallow all_untrusted_apps property_type:property_service set;
+neverallow { all_untrusted_apps -mediaprovider } property_socket:sock_file write;
+neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto;
+neverallow { all_untrusted_apps -mediaprovider } property_type:property_service set;
 
 # Do not allow untrusted apps to be assigned mlstrustedsubject.
 # This would undermine the per-user isolation model being
@@ -67,15 +75,15 @@
 } *;
 
 # Do not allow untrusted apps access to /cache
-neverallow all_untrusted_apps { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
-neverallow all_untrusted_apps { cache_file cache_recovery_file }:file ~{ read getattr };
+neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
+neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr };
 
 # Do not allow untrusted apps to create/unlink files outside of its sandbox,
 # internal storage or sdcard.
 # World accessible data locations allow application to fill the device
 # with unaccounted for data. This data will not get removed during
 # application un-installation.
-neverallow all_untrusted_apps {
+neverallow { all_untrusted_apps -mediaprovider } {
   fs_type
   -fuse                     # sdcard
   -sdcardfs                 # sdcard
diff --git a/private/bluetooth.te b/private/bluetooth.te
index 1c0e14f..451d27a 100644
--- a/private/bluetooth.te
+++ b/private/bluetooth.te
@@ -1,7 +1,6 @@
-# bluetooth subsystem
+# bluetooth app
 
 typeattribute bluetooth coredomain;
-typeattribute bluetooth domain_deprecated;
 
 app_domain(bluetooth)
 net_domain(bluetooth)
diff --git a/private/file_contexts b/private/file_contexts
index 2879265..937ede6 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -94,7 +94,6 @@
 /dev/ion		u:object_r:ion_device:s0
 /dev/keychord   u:object_r:keychord_device:s0
 /dev/kmem		u:object_r:kmem_device:s0
-/dev/log(/.*)?		u:object_r:log_device:s0
 /dev/loop-control	u:object_r:loop_control_device:s0
 /dev/mem		u:object_r:kmem_device:s0
 /dev/modem.*		u:object_r:radio_device:s0
@@ -107,6 +106,7 @@
 /dev/ptmx		u:object_r:ptmx_device:s0
 /dev/pvrsrvkm		u:object_r:gpu_device:s0
 /dev/kmsg		u:object_r:kmsg_device:s0
+/dev/kmsg_debug	u:object_r:kmsg_debug_device:s0
 /dev/null		u:object_r:null_device:s0
 /dev/nvhdcp1		u:object_r:video_device:s0
 /dev/random		u:object_r:random_device:s0
diff --git a/private/mediaprovider.te b/private/mediaprovider.te
new file mode 100644
index 0000000..63f56c8
--- /dev/null
+++ b/private/mediaprovider.te
@@ -0,0 +1,35 @@
+###
+### A domain for android.process.media, which contains both
+### MediaProvider and DownloadProvider and associated services.
+###
+
+typeattribute mediaprovider coredomain;
+app_domain(mediaprovider)
+
+# DownloadProvider accesses the network.
+net_domain(mediaprovider)
+
+# DownloadProvider uses /cache.
+allow mediaprovider cache_file:dir create_dir_perms;
+allow mediaprovider cache_file:file create_file_perms;
+# /cache is a symlink to /data/cache on some devices. Allow reading the link.
+allow mediaprovider cache_file:lnk_file r_file_perms;
+
+allow mediaprovider app_api_service:service_manager find;
+allow mediaprovider audioserver_service:service_manager find;
+allow mediaprovider drmserver_service:service_manager find;
+allow mediaprovider mediaserver_service:service_manager find;
+allow mediaprovider surfaceflinger_service:service_manager find;
+
+# Allow MediaProvider to read/write cached ringtones (opened by system).
+allow mediaprovider ringtone_file:file { getattr read write };
+
+# MtpServer uses /dev/mtp_usb
+allow mediaprovider mtp_device:chr_file rw_file_perms;
+
+# MtpServer uses /dev/usb-ffs/mtp
+allow mediaprovider functionfs:dir search;
+allow mediaprovider functionfs:file rw_file_perms;
+
+# MtpServer sets sys.usb.ffs.mtp.ready
+set_prop(mediaprovider, ffs_prop)
diff --git a/private/priv_app.te b/private/priv_app.te
index 065ea1a..109c869 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -105,20 +105,6 @@
 allow priv_app preloads_media_file:file r_file_perms;
 allow priv_app preloads_media_file:dir r_dir_perms;
 
-# TODO: revert this as part of fixing 33574909
-# android.process.media uses /dev/mtp_usb
-allow priv_app mtp_device:chr_file rw_file_perms;
-
-# TODO: revert this as part of fixing 33574909
-# MtpServer uses /dev/usb-ffs/mtp
-allow priv_app functionfs:dir search;
-allow priv_app functionfs:file rw_file_perms;
-
-# TODO: revert this as part of fixing 33574909
-# Traverse into /mnt/media_rw for bypassing FUSE daemon
-# TODO: narrow this to just MediaProvider
-allow priv_app mnt_media_rw_file:dir search;
-
 # Allow privileged apps (e.g. GMS core) to generate unique hardware IDs
 allow priv_app keystore:keystore_key gen_unique_id;
 
diff --git a/private/seapp_contexts b/private/seapp_contexts
index 4356889..dc7e389 100644
--- a/private/seapp_contexts
+++ b/private/seapp_contexts
@@ -102,6 +102,7 @@
 user=shared_relro domain=shared_relro
 user=shell seinfo=platform domain=shell type=shell_data_file
 user=_isolated domain=isolated_app levelFrom=user
+user=_app seinfo=media domain=mediaprovider name=android.process.media type=app_data_file levelFrom=user
 user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
 user=_app isV2App=true isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=user
 user=_app isV2App=true domain=untrusted_v2_app type=app_data_file levelFrom=user
diff --git a/private/untrusted_app.te b/private/untrusted_app.te
index 68c1a41..93a73f1 100644
--- a/private/untrusted_app.te
+++ b/private/untrusted_app.te
@@ -24,6 +24,14 @@
 net_domain(untrusted_app)
 bluetooth_domain(untrusted_app)
 
+# allow untrusted apps to use UDP sockets provided by the system server but not
+# modify them other than to connect
+allow untrusted_app system_server:udp_socket { connect getattr read recvfrom sendto write };
+
 # Allow the allocation and use of ptys
 # Used by: https://play.google.com/store/apps/details?id=jackpal.androidterm
 create_pty(untrusted_app)
+
+neverallow untrusted_app system_server:udp_socket {
+        accept append bind create getopt ioctl listen lock name_bind
+        relabelfrom relabelto setattr setopt shutdown };
diff --git a/public/crash_dump.te b/public/crash_dump.te
index ee617a1..c101b34 100644
--- a/public/crash_dump.te
+++ b/public/crash_dump.te
@@ -15,6 +15,9 @@
 
 userdebug_or_eng(`
   allow crash_dump logd:process { ptrace signal sigchld sigstop sigkill };
+
+  # Let crash_dump write to /dev/kmsg_debug crashes that happen before logd comes up.
+  allow crash_dump kmsg_debug_device:chr_file { open append };
 ')
 
 # Use inherited file descriptors
diff --git a/public/device.te b/public/device.te
index 4a3bec9..475948d 100644
--- a/public/device.te
+++ b/public/device.te
@@ -30,12 +30,12 @@
 type input_device, dev_type;
 type kmem_device, dev_type;
 type port_device, dev_type;
-type log_device, dev_type, mlstrustedobject;
 type mtd_device, dev_type;
 type mtp_device, dev_type, mlstrustedobject;
 type nfc_device, dev_type;
 type ptmx_device, dev_type, mlstrustedobject;
 type kmsg_device, dev_type;
+type kmsg_debug_device, dev_type;
 type null_device, dev_type, mlstrustedobject;
 type random_device, dev_type, mlstrustedobject;
 type sensors_device, dev_type;
diff --git a/public/domain.te b/public/domain.te
index c48950d..61fd28c 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -892,7 +892,7 @@
 
 # Only domains spawned from zygote and runas may have the appdomain attribute.
 neverallow { domain -runas -webview_zygote -zygote } {
-  appdomain -shell userdebug_or_eng(`-su') -bluetooth
+  appdomain -shell userdebug_or_eng(`-su')
 }:process { transition dyntransition };
 
 # Minimize read access to shell- or app-writable symlinks.
diff --git a/public/domain_deprecated.te b/public/domain_deprecated.te
index 9777753..dc99b89 100644
--- a/public/domain_deprecated.te
+++ b/public/domain_deprecated.te
@@ -208,7 +208,6 @@
 } proc:lnk_file { open ioctl lock }; # getattr read granted in domain
 auditallow {
   domain_deprecated
-  -bluetooth
   -fingerprintd
   -healthd
   -netd
@@ -222,7 +221,6 @@
 } sysfs:dir { open getattr read ioctl lock }; # search granted in domain
 auditallow {
   domain_deprecated
-  -bluetooth
   -fingerprintd
   -healthd
   -netd
@@ -236,7 +234,6 @@
 } sysfs:file r_file_perms;
 auditallow {
   domain_deprecated
-  -bluetooth
   -fingerprintd
   -healthd
   -netd
diff --git a/public/init.te b/public/init.te
index 6d43ef4..02859ba 100644
--- a/public/init.te
+++ b/public/init.te
@@ -13,6 +13,10 @@
 # /dev/kmsg
 allow init tmpfs:chr_file relabelfrom;
 allow init kmsg_device:chr_file { write relabelto };
+# /dev/kmsg_debug
+userdebug_or_eng(`
+  allow init kmsg_debug_device:chr_file { write relabelto };
+')
 # /dev/__properties__
 allow init properties_device:dir relabelto;
 allow init properties_serial:file { write relabelto };
@@ -81,6 +85,7 @@
 # /config
 allow init configfs:dir mounton;
 allow init configfs:dir create_dir_perms;
+allow init configfs:{ file lnk_file } create_file_perms;
 
 # Use tmpfs as /data, used for booting when /data is encrypted
 allow init tmpfs:dir relabelfrom;
diff --git a/public/kernel.te b/public/kernel.te
index 9537c0d..7f5d224 100644
--- a/public/kernel.te
+++ b/public/kernel.te
@@ -50,11 +50,12 @@
 allow kernel selinuxfs:file write;
 allow kernel self:security setcheckreqprot;
 
-# MTP sync (b/15835289)
 # kernel thread "loop0", used by the loop block device, for ASECs (b/17158723)
-allow kernel priv_app:fd use;
 allow kernel sdcard_type:file { read write };
 
+# f_mtp driver accesses files from kernel context.
+allow kernel mediaprovider:fd use;
+
 # Allow the kernel to read OBB files from app directories. (b/17428116)
 # Kernel thread "loop0" reads a vold supplied file descriptor.
 # Fixes CTS tests:
diff --git a/public/mediaprovider.te b/public/mediaprovider.te
new file mode 100644
index 0000000..24170a5
--- /dev/null
+++ b/public/mediaprovider.te
@@ -0,0 +1,6 @@
+###
+### A domain for android.process.media, which contains both
+### MediaProvider and DownloadProvider and associated services.
+###
+
+type mediaprovider, domain;
diff --git a/public/shell.te b/public/shell.te
index 1fb896a..9540cca 100644
--- a/public/shell.te
+++ b/public/shell.te
@@ -46,6 +46,7 @@
 r_dir_file(shell, system_file)
 allow shell system_file:file x_file_perms;
 allow shell toolbox_exec:file rx_file_perms;
+allow shell tzdatacheck_exec:file rx_file_perms;
 allow shell shell_exec:file rx_file_perms;
 allow shell zygote_exec:file rx_file_perms;
 
diff --git a/public/tzdatacheck.te b/public/tzdatacheck.te
index 93ae165..6f60c8e 100644
--- a/public/tzdatacheck.te
+++ b/public/tzdatacheck.te
@@ -4,3 +4,15 @@
 
 allow tzdatacheck zoneinfo_data_file:dir create_dir_perms;
 allow tzdatacheck zoneinfo_data_file:file unlink;
+
+# Below are strong assertion that only init, system_server and tzdatacheck
+# can modify the /data time zone rules directories. This is to make it very
+# clear that only these domains should modify the actual time zone rules data.
+# The tzdatacheck binary itself may be executed by shell for tests but it must
+# not be able to modify the real rules.
+# If other users / binaries could modify time zone rules on device this might
+# have negative implications for users (who may get incorrect local times)
+# or break assumptions made / invalidate data held by the components actually
+# responsible for updating time zone rules.
+neverallow { domain -system_server -init -tzdatacheck } zoneinfo_data_file:file no_w_file_perms;
+neverallow { domain -system_server -init -tzdatacheck } zoneinfo_data_file:dir no_w_dir_perms;
diff --git a/tools/fc_sort/fc_sort.c b/tools/fc_sort/fc_sort.c
index 5561288..9a3a3ee 100644
--- a/tools/fc_sort/fc_sort.c
+++ b/tools/fc_sort/fc_sort.c
@@ -350,6 +350,7 @@
 
 	/* Parse the file into a file_context linked list. */
 	line_buf = NULL;
+	buf_len = 0;
 
 	while ( getline(&line_buf, &buf_len, in_file) != -1 ){
 		line_len = strlen(line_buf);
@@ -478,15 +479,13 @@
 		current->next = temp;
 		current = current->next;
 		lines++;
-
-
-		free(line_buf);
-		line_buf = NULL;
 	}
+	free(line_buf);
 	fclose(in_file);
 
 	/* Create the bucket linked list from the earlier linked list. */
 	current = head->next;
+	free(head);
 	bcurrent = master =
 	    (file_context_bucket_t *)
 	    malloc(sizeof(file_context_bucket_t));
diff --git a/tools/sepolicy-analyze/README b/tools/sepolicy-analyze/README
index fdee588..c6657ec 100644
--- a/tools/sepolicy-analyze/README
+++ b/tools/sepolicy-analyze/README
@@ -69,6 +69,10 @@
 
     Displays the attributes associated with the specified type name.
 
+    sepolicy-analyze out/target/product/<board>/root/sepolicy attribute -l
+
+    Displays all attributes in the policy.
+
     NEVERALLOW CHECKING (neverallow)
     sepolicy-analyze out/target/product/<board>/root/sepolicy neverallow \
     [-w] [-d] [-f neverallows.conf] | [-n "neverallow string"]
diff --git a/tools/sepolicy-analyze/attribute.c b/tools/sepolicy-analyze/attribute.c
index ae98aa9..f7c9b4c 100644
--- a/tools/sepolicy-analyze/attribute.c
+++ b/tools/sepolicy-analyze/attribute.c
@@ -3,7 +3,7 @@
 #include "attribute.h"
 
 void attribute_usage() {
-    fprintf(stderr, "\tattribute <name> [-r|--reverse]\n");
+    fprintf(stderr, "\tattribute [-l|--list] [-r|--reverse] <name>\n");
 }
 
 static void retrieve_mapping(policydb_t *policydb, struct type_datum *dat, char *name, int reverse) {
@@ -53,29 +53,58 @@
     return 0;
 }
 
+static int print_attr(__attribute__ ((unused)) hashtab_key_t k,
+                      hashtab_datum_t d, void *args) {
+    struct type_datum *dat = (struct type_datum *)d;
+    policydb_t *pdb = (policydb_t *)args;
+    if (!dat) {
+        fprintf(stderr, "type encountered without datum!\n");
+        return -1;
+    }
+    if (dat->flavor == TYPE_ATTRIB) {
+        printf("%s\n", pdb->p_type_val_to_name[dat->s.value - 1]);
+    }
+    return 0;
+}
+
+static int list_all_attributes(policydb_t *policydb) {
+    return hashtab_map(policydb->p_types.table, print_attr, policydb);
+}
+
 int attribute_func (int argc, char **argv, policydb_t *policydb) {
+    int rc = -1;
+    int list = 0;
     int reverse = 0;
     char ch;
 
     struct option attribute_options[] = {
+        {"list", no_argument, NULL, 'l'},
         {"reverse", no_argument, NULL, 'r'},
         {NULL, 0, NULL, 0}
     };
 
-    while ((ch = getopt_long(argc, argv, "r", attribute_options, NULL)) != -1) {
+    while ((ch = getopt_long(argc, argv, "lr", attribute_options, NULL)) != -1) {
         switch (ch) {
+        case 'l':
+            list = 1;
+            break;
         case 'r':
             reverse = 1;
             break;
         default:
             USAGE_ERROR = true;
-            return -1;
+            goto out;
         }
     }
 
-    if (argc != 2 && !(reverse && argc == 3)) {
+    if ((argc != 2 && !(reverse && argc == 3)) || (list && reverse)) {
         USAGE_ERROR = true;
-        return -1;
+        goto out;
     }
-    return list_attribute(policydb, argv[optind], reverse);
+    if (list)
+        rc = list_all_attributes(policydb);
+    else
+        rc = list_attribute(policydb, argv[optind], reverse);
+ out:
+    return rc;
 }
diff --git a/tools/sepolicy-analyze/sepolicy-analyze.c b/tools/sepolicy-analyze/sepolicy-analyze.c
index b70eaaa..b4571a6 100644
--- a/tools/sepolicy-analyze/sepolicy-analyze.c
+++ b/tools/sepolicy-analyze/sepolicy-analyze.c
@@ -57,6 +57,7 @@
             rc = analyze_components[i].func(argc - 2, argv + 2, &policydb);
             if (rc && USAGE_ERROR) {
                 usage(argv[0]); }
+            policydb_destroy(&policydb);
             return rc;
         }
     }