diff --git a/Android.bp b/Android.bp
index 256262b..4973c13 100644
--- a/Android.bp
+++ b/Android.bp
@@ -36,6 +36,13 @@
 }
 
 se_filegroup {
+    name: "29.0.board.compat.map",
+    srcs: [
+        "compat/29.0/29.0.cil",
+    ],
+}
+
+se_filegroup {
     name: "26.0.board.ignore.map",
     srcs: [
         "compat/26.0/26.0.ignore.cil",
@@ -56,22 +63,103 @@
     ],
 }
 
+se_filegroup {
+    name: "29.0.board.ignore.map",
+    srcs: [
+        "compat/29.0/29.0.ignore.cil",
+    ],
+}
+
 se_cil_compat_map {
-    name: "26.0.cil",
+    name: "plat_26.0.cil",
+    stem: "26.0.cil",
     bottom_half: [":26.0.board.compat.map"],
-    top_half: "27.0.cil",
+    top_half: "plat_27.0.cil",
 }
 
 se_cil_compat_map {
-    name: "27.0.cil",
+    name: "plat_27.0.cil",
+    stem: "27.0.cil",
     bottom_half: [":27.0.board.compat.map"],
-    top_half: "28.0.cil",
+    top_half: "plat_28.0.cil",
 }
 
 se_cil_compat_map {
-    name: "28.0.cil",
+    name: "plat_28.0.cil",
+    stem: "28.0.cil",
     bottom_half: [":28.0.board.compat.map"],
-    // top_half: "29.0.cil",
+    top_half: "plat_29.0.cil",
+}
+
+se_cil_compat_map {
+    name: "plat_29.0.cil",
+    stem: "29.0.cil",
+    bottom_half: [":29.0.board.compat.map"],
+    // top_half: "plat_30.0.cil",
+}
+
+se_cil_compat_map {
+    name: "system_ext_26.0.cil",
+    stem: "26.0.cil",
+    bottom_half: [":26.0.board.compat.map"],
+    top_half: "system_ext_27.0.cil",
+    system_ext_specific: true,
+}
+
+se_cil_compat_map {
+    name: "system_ext_27.0.cil",
+    stem: "27.0.cil",
+    bottom_half: [":27.0.board.compat.map"],
+    top_half: "system_ext_28.0.cil",
+    system_ext_specific: true,
+}
+
+se_cil_compat_map {
+    name: "system_ext_28.0.cil",
+    stem: "28.0.cil",
+    bottom_half: [":28.0.board.compat.map"],
+    top_half: "system_ext_29.0.cil",
+    system_ext_specific: true,
+}
+
+se_cil_compat_map {
+    name: "system_ext_29.0.cil",
+    stem: "29.0.cil",
+    bottom_half: [":29.0.board.compat.map"],
+    // top_half: "system_ext_30.0.cil",
+    system_ext_specific: true,
+}
+
+se_cil_compat_map {
+    name: "product_26.0.cil",
+    stem: "26.0.cil",
+    bottom_half: [":26.0.board.compat.map"],
+    top_half: "product_27.0.cil",
+    product_specific: true,
+}
+
+se_cil_compat_map {
+    name: "product_27.0.cil",
+    stem: "27.0.cil",
+    bottom_half: [":27.0.board.compat.map"],
+    top_half: "product_28.0.cil",
+    product_specific: true,
+}
+
+se_cil_compat_map {
+    name: "product_28.0.cil",
+    stem: "28.0.cil",
+    bottom_half: [":28.0.board.compat.map"],
+    top_half: "product_29.0.cil",
+    product_specific: true,
+}
+
+se_cil_compat_map {
+    name: "product_29.0.cil",
+    stem: "29.0.cil",
+    bottom_half: [":29.0.board.compat.map"],
+    // top_half: "product_30.0.cil",
+    product_specific: true,
 }
 
 se_cil_compat_map {
@@ -89,5 +177,201 @@
 se_cil_compat_map {
     name: "28.0.ignore.cil",
     bottom_half: [":28.0.board.ignore.map"],
-    // top_half: "29.0.ignore.cil",
+    top_half: "29.0.ignore.cil",
+}
+
+se_cil_compat_map {
+    name: "29.0.ignore.cil",
+    bottom_half: [":29.0.board.ignore.map"],
+    // top_half: "30.0.ignore.cil",
+}
+
+prebuilt_etc {
+    name: "26.0.compat.cil",
+    src: "private/compat/26.0/26.0.compat.cil",
+    sub_dir: "selinux/mapping",
+}
+
+prebuilt_etc {
+    name: "27.0.compat.cil",
+    src: "private/compat/27.0/27.0.compat.cil",
+    sub_dir: "selinux/mapping",
+}
+
+prebuilt_etc {
+    name: "28.0.compat.cil",
+    src: "private/compat/28.0/28.0.compat.cil",
+    sub_dir: "selinux/mapping",
+}
+
+prebuilt_etc {
+    name: "29.0.compat.cil",
+    src: "private/compat/29.0/29.0.compat.cil",
+    sub_dir: "selinux/mapping",
+}
+
+se_filegroup {
+    name: "file_contexts_files",
+    srcs: ["file_contexts"],
+}
+
+se_filegroup {
+    name: "file_contexts_asan_files",
+    srcs: ["file_contexts_asan"],
+}
+
+se_filegroup {
+    name: "file_contexts_overlayfs_files",
+    srcs: ["file_contexts_overlayfs"],
+}
+
+se_filegroup {
+    name: "hwservice_contexts_files",
+    srcs: ["hwservice_contexts"],
+}
+
+se_filegroup {
+    name: "property_contexts_files",
+    srcs: ["property_contexts"],
+}
+
+se_filegroup {
+    name: "service_contexts_files",
+    srcs: ["service_contexts"],
+}
+
+file_contexts {
+    name: "plat_file_contexts",
+    srcs: [":file_contexts_files"],
+    product_variables: {
+        address_sanitize: {
+            srcs: [":file_contexts_asan_files"],
+        },
+        debuggable: {
+            srcs: [":file_contexts_overlayfs_files"],
+        },
+    },
+
+    flatten_apex: {
+        srcs: ["apex/*-file_contexts"],
+    },
+
+    recovery_available: true,
+}
+
+file_contexts {
+    name: "vendor_file_contexts",
+    srcs: [":file_contexts_files"],
+    soc_specific: true,
+    recovery_available: true,
+}
+
+file_contexts {
+    name: "system_ext_file_contexts",
+    srcs: [":file_contexts_files"],
+    system_ext_specific: true,
+    recovery_available: true,
+}
+
+file_contexts {
+    name: "product_file_contexts",
+    srcs: [":file_contexts_files"],
+    product_specific: true,
+    recovery_available: true,
+}
+
+file_contexts {
+    name: "odm_file_contexts",
+    srcs: [":file_contexts_files"],
+    device_specific: true,
+    recovery_available: true,
+}
+
+hwservice_contexts {
+    name: "plat_hwservice_contexts",
+    srcs: [":hwservice_contexts_files"],
+}
+
+hwservice_contexts {
+    name: "system_ext_hwservice_contexts",
+    srcs: [":hwservice_contexts_files"],
+    system_ext_specific: true,
+}
+
+hwservice_contexts {
+    name: "product_hwservice_contexts",
+    srcs: [":hwservice_contexts_files"],
+    product_specific: true,
+}
+
+hwservice_contexts {
+    name: "vendor_hwservice_contexts",
+    srcs: [":hwservice_contexts_files"],
+    reqd_mask: true,
+    soc_specific: true,
+}
+
+hwservice_contexts {
+    name: "odm_hwservice_contexts",
+    srcs: [":hwservice_contexts_files"],
+    device_specific: true,
+}
+
+property_contexts {
+    name: "plat_property_contexts",
+    srcs: [":property_contexts_files"],
+    recovery_available: true,
+}
+
+property_contexts {
+    name: "system_ext_property_contexts",
+    srcs: [":property_contexts_files"],
+    system_ext_specific: true,
+    recovery_available: true,
+}
+
+property_contexts {
+    name: "product_property_contexts",
+    srcs: [":property_contexts_files"],
+    product_specific: true,
+    recovery_available: true,
+}
+
+property_contexts {
+    name: "vendor_property_contexts",
+    srcs: [":property_contexts_files"],
+    reqd_mask: true,
+    soc_specific: true,
+    recovery_available: true,
+}
+
+property_contexts {
+    name: "odm_property_contexts",
+    srcs: [":property_contexts_files"],
+    device_specific: true,
+    recovery_available: true,
+}
+
+service_contexts {
+    name: "plat_service_contexts",
+    srcs: [":service_contexts_files"],
+}
+
+service_contexts {
+    name: "system_ext_service_contexts",
+    srcs: [":service_contexts_files"],
+    system_ext_specific: true,
+}
+
+service_contexts {
+    name: "product_service_contexts",
+    srcs: [":service_contexts_files"],
+    product_specific: true,
+}
+
+service_contexts {
+    name: "vendor_service_contexts",
+    srcs: [":service_contexts_files"],
+    reqd_mask: true,
+    soc_specific: true,
 }
diff --git a/Android.mk b/Android.mk
index dadd7b0..6c25fc1 100644
--- a/Android.mk
+++ b/Android.mk
@@ -49,18 +49,18 @@
 #    - compile output binary policy file
 
 PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public
-ifneq ( ,$(BOARD_PLAT_PUBLIC_SEPOLICY_DIR))
-PLAT_PUBLIC_POLICY += $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR)
-endif
 PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private
-ifneq ( ,$(BOARD_PLAT_PRIVATE_SEPOLICY_DIR))
-PLAT_PRIVATE_POLICY += $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR)
-endif
 PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor
 REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask
+SYSTEM_EXT_PUBLIC_POLICY := $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR)
+SYSTEM_EXT_PRIVATE_POLICY := $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR)
 PRODUCT_PUBLIC_POLICY := $(PRODUCT_PUBLIC_SEPOLICY_DIRS)
 PRODUCT_PRIVATE_POLICY := $(PRODUCT_PRIVATE_SEPOLICY_DIRS)
 
+ifneq (,$(SYSTEM_EXT_PUBLIC_POLICY)$(SYSTEM_EXT_PRIVATE_POLICY))
+HAS_SYSTEM_EXT_SEPOLICY_DIR := true
+endif
+
 # TODO(b/119305624): Currently if the device doesn't have a product partition,
 # we install product sepolicy into /system/product. We do that because bits of
 # product sepolicy that's still in /system might depend on bits that have moved
@@ -68,7 +68,7 @@
 # it so that if no product partition is present, product sepolicy artifacts are
 # not built and installed at all.
 ifneq (,$(PRODUCT_PUBLIC_POLICY)$(PRODUCT_PRIVATE_POLICY))
-HAS_PRODUCT_SEPOLICY := true
+HAS_PRODUCT_SEPOLICY_DIR := true
 endif
 
 # TODO: move to README when doing the README update and finalizing versioning.
@@ -123,13 +123,6 @@
 # Builds paths for all policy files found in BOARD_ODM_SEPOLICY_DIRS.
 build_odm_policy = $(call build_policy, $(1), $(BOARD_ODM_SEPOLICY_DIRS))
 
-# Add a file containing only a newline in-between each policy configuration
-# 'contexts' file. This will allow OEM policy configuration files without a
-# final newline (0x0A) to be built correctly by the m4(1) macro processor.
-# $(1): the set of contexts file names.
-# $(2): the file containing only 0x0A.
-add_nl = $(foreach entry, $(1), $(subst $(entry), $(entry) $(2), $(entry)))
-
 sepolicy_build_files := security_classes \
                         initial_sids \
                         access_vectors \
@@ -152,6 +145,42 @@
                         genfs_contexts \
                         port_contexts
 
+# Security classes and permissions defined outside of system/sepolicy.
+security_class_extension_files := $(call build_policy, security_classes access_vectors, \
+  $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
+  $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
+  $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
+
+ifneq (,$(strip $(security_class_extension_files)))
+  $(error Only platform SELinux policy may define classes and permissions: $(strip $(security_class_extension_files)))
+endif
+
+ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
+  # Checks if there are public system_ext policy files.
+  policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY))
+  ifneq (,$(strip $(policy_files)))
+    HAS_SYSTEM_EXT_PUBLIC_SEPOLICY := true
+  endif
+  # Checks if there are public/private system_ext policy files.
+  policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY))
+  ifneq (,$(strip $(policy_files)))
+    HAS_SYSTEM_EXT_SEPOLICY := true
+  endif
+endif # ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
+
+ifdef HAS_PRODUCT_SEPOLICY_DIR
+  # Checks if there are public product policy files.
+  policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY))
+  ifneq (,$(strip $(policy_files)))
+    HAS_PRODUCT_PUBLIC_SEPOLICY := true
+  endif
+  # Checks if there are public/private product policy files.
+  policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY))
+  ifneq (,$(strip $(policy_files)))
+    HAS_PRODUCT_SEPOLICY := true
+  endif
+endif # ifdef HAS_PRODUCT_SEPOLICY_DIR
+
 # CIL files which contain workarounds for current limitation of human-readable
 # module policy language. These files are appended to the CIL files produced
 # from module language files.
@@ -173,6 +202,22 @@
 ifeq ($(NATIVE_COVERAGE),true)
   with_native_coverage := true
 endif
+ifeq ($(CLANG_COVERAGE),true)
+  with_native_coverage := true
+endif
+
+treble_sysprop_neverallow := true
+ifeq ($(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW),true)
+  treble_sysprop_neverallow := false
+endif
+
+ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
+  #$(warning no product shipping level defined)
+else ifneq ($(call math_lt,29,$(PRODUCT_SHIPPING_API_LEVEL)),)
+  ifneq ($(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW),)
+    $(error BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW cannot be set on a device shipping with R or later, and this is tested by CTS.)
+  endif
+endif
 
 # Library extension for host-side tests
 ifeq ($(HOST_OS),darwin)
@@ -184,12 +229,12 @@
 # Convert a file_context file for a non-flattened APEX into a file for
 # flattened APEX. /system/apex/<apex_name> path is prepended to the original paths
 # $(1): path to the input file_contexts file for non-flattened APEX
-# $(2): name of the APEX
-# $(3): path to the generated file_contexs file for flattened APEX
+# $(2): path to the flattened APEX
+# $(3): path to the generated file_contexts file for flattened APEX
 # $(4): variable where $(3) is added to
 define build_flattened_apex_file_contexts
 $(4) += $(3)
-$(3): PRIVATE_APEX_PATH := /system/apex/$(subst .,\\.,$(2))
+$(3): PRIVATE_APEX_PATH := $(subst .,\\.,$(2))
 $(3): $(1)
 	$(hide) awk '/object_r/{printf("$$(PRIVATE_APEX_PATH)%s\n",$$$$0)}' $$< > $$@
 endef
@@ -206,6 +251,10 @@
 
 include $(BUILD_PHONY_PACKAGE)
 
+# selinux_policy is a main goal and triggers lots of tests.
+# Most tests are FAKE modules, so aren'triggered on normal builds. (e.g. 'm')
+# By setting as droidcore's dependency, tests will run on normal builds.
+droidcore: selinux_policy
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := selinux_policy_system
@@ -213,7 +262,8 @@
 # divergence between Treble and non-Treble devices.
 LOCAL_REQUIRED_MODULES += \
     plat_mapping_file \
-    $(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
+    $(addprefix plat_,$(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \
+    $(addsuffix .compat.cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
     plat_sepolicy.cil \
     plat_sepolicy_and_mapping.sha256 \
     secilc \
@@ -221,11 +271,15 @@
 LOCAL_REQUIRED_MODULES += \
     build_sepolicy \
     plat_file_contexts \
+    plat_file_contexts_test \
     plat_mac_permissions.xml \
     plat_property_contexts \
+    plat_property_contexts_test \
     plat_seapp_contexts \
     plat_service_contexts \
+    plat_service_contexts_test \
     plat_hwservice_contexts \
+    plat_hwservice_contexts_test \
     searchpolicy \
 
 # This conditional inclusion closely mimics the conditional logic
@@ -242,10 +296,15 @@
 ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
 LOCAL_REQUIRED_MODULES += \
     sepolicy_tests \
+    $(addsuffix _compat_test,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
+
+ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
+LOCAL_REQUIRED_MODULES += \
     $(addprefix treble_sepolicy_tests_,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
 
-endif
-endif
+endif  # PRODUCT_SEPOLICY_SPLIT
+endif  # SELINUX_IGNORE_NEVERALLOWS
+endif  # with_asan
 
 ifneq ($(PLATFORM_SEPOLICY_VERSION),$(TOT_SEPOLICY_VERSION))
 LOCAL_REQUIRED_MODULES += \
@@ -265,6 +324,8 @@
 LOCAL_REQUIRED_MODULES += \
     precompiled_sepolicy \
     precompiled_sepolicy.plat_sepolicy_and_mapping.sha256 \
+    precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256 \
+    system_ext_sepolicy_and_mapping.sha256 \
     precompiled_sepolicy.product_sepolicy_and_mapping.sha256 \
     product_sepolicy_and_mapping.sha256 \
 
@@ -280,41 +341,83 @@
 
 LOCAL_REQUIRED_MODULES += \
     vendor_file_contexts \
+    vendor_file_contexts_test \
     vendor_mac_permissions.xml \
     vendor_property_contexts \
+    vendor_property_contexts_test \
     vendor_seapp_contexts \
     vendor_hwservice_contexts \
+    vendor_hwservice_contexts_test \
     vndservice_contexts \
 
 ifdef BOARD_ODM_SEPOLICY_DIRS
 LOCAL_REQUIRED_MODULES += \
     odm_sepolicy.cil \
     odm_file_contexts \
+    odm_file_contexts_test \
     odm_seapp_contexts \
     odm_property_contexts \
+    odm_property_contexts_test \
     odm_hwservice_contexts \
+    odm_hwservice_contexts_test \
     odm_mac_permissions.xml
 endif
 
-ifdef HAS_PRODUCT_SEPOLICY
+ifdef HAS_SYSTEM_EXT_SEPOLICY
+LOCAL_REQUIRED_MODULES += system_ext_sepolicy.cil
+endif
+
+ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
 LOCAL_REQUIRED_MODULES += \
-    product_sepolicy.cil \
+    system_ext_mapping_file \
+    $(addprefix system_ext_,$(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \
+
+endif
+
+ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
+LOCAL_REQUIRED_MODULES += \
+    system_ext_file_contexts \
+    system_ext_file_contexts_test \
+    system_ext_hwservice_contexts \
+    system_ext_hwservice_contexts_test \
+    system_ext_property_contexts \
+    system_ext_property_contexts_test \
+    system_ext_seapp_contexts \
+    system_ext_service_contexts \
+    system_ext_service_contexts_test \
+    system_ext_mac_permissions.xml \
+
+endif
+
+ifdef HAS_PRODUCT_SEPOLICY
+LOCAL_REQUIRED_MODULES += product_sepolicy.cil
+endif
+
+ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
+LOCAL_REQUIRED_MODULES += \
+    product_mapping_file \
+    $(addprefix product_,$(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \
+
+endif
+
+ifdef HAS_PRODUCT_SEPOLICY_DIR
+LOCAL_REQUIRED_MODULES += \
     product_file_contexts \
+    product_file_contexts_test \
     product_hwservice_contexts \
+    product_hwservice_contexts_test \
     product_property_contexts \
+    product_property_contexts_test \
     product_seapp_contexts \
     product_service_contexts \
+    product_service_contexts_test \
     product_mac_permissions.xml \
-    product_mapping_file \
 
 endif
 
-ifneq ($(TARGET_BUILD_VARIANT), user)
 LOCAL_REQUIRED_MODULES += \
     selinux_denial_metadata \
 
-endif
-
 # Builds an addtional userdebug sepolicy into the debug ramdisk.
 LOCAL_REQUIRED_MODULES += \
     userdebug_plat_sepolicy.cil \
@@ -325,14 +428,18 @@
 include $(CLEAR_VARS)
 
 LOCAL_MODULE := sepolicy_neverallows
-LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_CLASS := FAKE
 LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
 
 include $(BUILD_SYSTEM)/base_rules.mk
 
 # sepolicy_policy.conf - All of the policy for the device.  This is only used to
 # check neverallow rules.
+policy_files := $(call build_policy, $(sepolicy_build_files), \
+  $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) \
+  $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
+  $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
+  $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
 sepolicy_policy.conf := $(intermediates)/policy.conf
 $(sepolicy_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
 $(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
@@ -342,15 +449,18 @@
 $(sepolicy_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
 $(sepolicy_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
 $(sepolicy_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
-$(sepolicy_policy.conf): $(call build_policy, $(sepolicy_build_files), \
-$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) \
-$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
-$(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
+$(sepolicy_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$(sepolicy_policy.conf): $(policy_files) $(M4)
 	$(transform-policy-to-conf)
 	$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
 
 # sepolicy_policy_2.conf - All of the policy for the device.  This is only used to
 # check neverallow rules using sepolicy-analyze, similar to CTS.
+policy_files := $(call build_policy, $(sepolicy_build_files), \
+  $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) \
+  $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
+  $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
+  $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
 sepolicy_policy_2.conf := $(intermediates)/policy_2.conf
 $(sepolicy_policy_2.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
 $(sepolicy_policy_2.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
@@ -361,10 +471,8 @@
 $(sepolicy_policy_2.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
 $(sepolicy_policy_2.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
 $(sepolicy_policy_2.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
-$(sepolicy_policy_2.conf): $(call build_policy, $(sepolicy_build_files), \
-$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) \
-$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
-$(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
+$(sepolicy_policy_2.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$(sepolicy_policy_2.conf): $(policy_files) $(M4)
 	$(transform-policy-to-conf)
 	$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
 
@@ -397,6 +505,7 @@
 # the compilation of public policy and subsequent removal of CIL policy that
 # should not be exported.
 
+policy_files := $(call build_policy, $(sepolicy_build_files), $(REQD_MASK_POLICY))
 reqd_policy_mask.conf := $(intermediates)/reqd_policy_mask.conf
 $(reqd_policy_mask.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
 $(reqd_policy_mask.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
@@ -407,7 +516,9 @@
 $(reqd_policy_mask.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
 $(reqd_policy_mask.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
 $(reqd_policy_mask.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(reqd_policy_mask.conf): $(call build_policy, $(sepolicy_build_files), $(REQD_MASK_POLICY))
+$(reqd_policy_mask.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
+$(reqd_policy_mask.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$(reqd_policy_mask.conf): $(policy_files) $(M4)
 	$(transform-policy-to-conf)
 # b/37755687
 CHECKPOLICY_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0
@@ -426,6 +537,21 @@
 # policy that would not compile in checkpolicy on its own.  To get around this
 # limitation, add only the required files from private policy, which will
 # generate CIL policy that will then be filtered out by the reqd_policy_mask.
+#
+# There are three pub_policy.cil files below:
+#   - pub_policy.cil: exported 'product', 'system_ext' and 'system' policy.
+#   - system_ext_pub_policy.cil: exported 'system_ext' and 'system' policy.
+#   - plat_pub_policy.cil: exported 'system' policy.
+#
+# Those above files will in turn be used to generate the following versioned cil files:
+#   - product_mapping_file: the versioned, exported 'product' policy in product partition.
+#   - system_ext_mapping_file: the versioned, exported 'system_ext' policy in system_ext partition.
+#   - plat_mapping_file: the versioned, exported 'system' policy in system partition.
+#   - plat_pub_versioned.cil: the versioned, exported 'product', 'system_ext' and 'system'
+#                             policy in vendor partition.
+#
+policy_files := $(call build_policy, $(sepolicy_build_files), \
+  $(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
 pub_policy.conf := $(intermediates)/pub_policy.conf
 $(pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
 $(pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
@@ -436,8 +562,9 @@
 $(pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
 $(pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
 $(pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(pub_policy.conf): $(call build_policy, $(sepolicy_build_files), \
-$(PLAT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
+$(pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
+$(pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$(pub_policy.conf): $(policy_files) $(M4)
 	$(transform-policy-to-conf)
 pub_policy.cil := $(intermediates)/pub_policy.cil
 $(pub_policy.cil): PRIVATE_POL_CONF := $(pub_policy.conf)
@@ -452,6 +579,38 @@
 pub_policy.conf :=
 
 ##################################
+policy_files := $(call build_policy, $(sepolicy_build_files), \
+  $(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
+system_ext_pub_policy.conf := $(intermediates)/system_ext_pub_policy.conf
+$(system_ext_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
+$(system_ext_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
+$(system_ext_pub_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
+$(system_ext_pub_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
+$(system_ext_pub_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
+$(system_ext_pub_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
+$(system_ext_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
+$(system_ext_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
+$(system_ext_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
+$(system_ext_pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
+$(system_ext_pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$(system_ext_pub_policy.conf): $(policy_files) $(M4)
+	$(transform-policy-to-conf)
+
+system_ext_pub_policy.cil := $(intermediates)/system_ext_pub_policy.cil
+$(system_ext_pub_policy.cil): PRIVATE_POL_CONF := $(system_ext_pub_policy.conf)
+$(system_ext_pub_policy.cil): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
+$(system_ext_pub_policy.cil): $(HOST_OUT_EXECUTABLES)/checkpolicy \
+$(HOST_OUT_EXECUTABLES)/build_sepolicy $(system_ext_pub_policy.conf) $(reqd_policy_mask.cil)
+	@mkdir -p $(dir $@)
+	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $< -C -M -c $(POLICYVERS) -o $@ $(PRIVATE_POL_CONF)
+	$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
+		-f $(PRIVATE_REQD_MASK) -t $@
+
+system_ext_pub_policy.conf :=
+
+##################################
+policy_files := $(call build_policy, $(sepolicy_build_files), \
+  $(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
 plat_pub_policy.conf := $(intermediates)/plat_pub_policy.conf
 $(plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
 $(plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
@@ -462,8 +621,9 @@
 $(plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
 $(plat_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
 $(plat_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(plat_pub_policy.conf): $(call build_policy, $(sepolicy_build_files), \
-$(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
+$(plat_pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
+$(plat_pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$(plat_pub_policy.conf): $(policy_files) $(M4)
 	$(transform-policy-to-conf)
 
 plat_pub_policy.cil := $(intermediates)/plat_pub_policy.cil
@@ -478,21 +638,6 @@
 
 plat_pub_policy.conf :=
 
-##################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := sectxfile_nl
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-
-# Create a file containing newline only to add between context config files
-include $(BUILD_SYSTEM)/base_rules.mk
-$(LOCAL_BUILT_MODULE):
-	@mkdir -p $(dir $@)
-	$(hide) echo > $@
-
-built_nl := $(LOCAL_BUILT_MODULE)
-
 #################################
 include $(CLEAR_VARS)
 
@@ -506,6 +651,8 @@
 # plat_policy.conf - A combination of the private and public platform policy
 # which will ship with the device.  The platform will always reflect the most
 # recent platform version and is not currently being attributized.
+policy_files := $(call build_policy, $(sepolicy_build_files), \
+  $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
 plat_policy.conf := $(intermediates)/plat_policy.conf
 $(plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
 $(plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
@@ -516,8 +663,9 @@
 $(plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
 $(plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
 $(plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
-$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
+$(plat_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
+$(plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$(plat_policy.conf): $(policy_files) $(M4)
 	$(transform-policy-to-conf)
 	$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
 
@@ -549,6 +697,8 @@
 include $(BUILD_SYSTEM)/base_rules.mk
 
 # userdebug_plat_policy.conf - the userdebug version plat_sepolicy.cil
+policy_files := $(call build_policy, $(sepolicy_build_files), \
+  $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
 userdebug_plat_policy.conf := $(intermediates)/userdebug_plat_policy.conf
 $(userdebug_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
 $(userdebug_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
@@ -559,8 +709,9 @@
 $(userdebug_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
 $(userdebug_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
 $(userdebug_plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(userdebug_plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
-$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
+$(userdebug_plat_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
+$(userdebug_plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$(userdebug_plat_policy.conf): $(policy_files) $(M4)
 	$(transform-policy-to-conf)
 	$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
 
@@ -583,35 +734,38 @@
 #################################
 include $(CLEAR_VARS)
 
-ifdef HAS_PRODUCT_SEPOLICY
-LOCAL_MODULE := product_sepolicy.cil
+ifdef HAS_SYSTEM_EXT_SEPOLICY
+LOCAL_MODULE := system_ext_sepolicy.cil
 LOCAL_MODULE_CLASS := ETC
 LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux
+LOCAL_MODULE_PATH := $(TARGET_OUT_SYSTEM_EXT)/etc/selinux
 
 include $(BUILD_SYSTEM)/base_rules.mk
 
-# product_policy.conf - A combination of the private and public product policy
-# which will ship with the device. Product policy is not attributized.
-product_policy.conf := $(intermediates)/product_policy.conf
-$(product_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
-$(product_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
-$(product_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
-$(product_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
-$(product_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
-$(product_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
-$(product_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(product_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
-$(product_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(product_policy.conf): $(call build_policy, $(sepolicy_build_files), \
-$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
-$(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY))
+# system_ext_policy.conf - A combination of the private and public system_ext policy
+# which will ship with the device. System_ext policy is not attributized.
+policy_files := $(call build_policy, $(sepolicy_build_files), \
+  $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
+  $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY))
+system_ext_policy.conf := $(intermediates)/system_ext_policy.conf
+$(system_ext_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
+$(system_ext_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
+$(system_ext_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
+$(system_ext_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
+$(system_ext_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
+$(system_ext_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
+$(system_ext_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
+$(system_ext_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
+$(system_ext_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
+$(system_ext_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
+$(system_ext_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$(system_ext_policy.conf): $(policy_files) $(M4)
 	$(transform-policy-to-conf)
 	$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
 
 $(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
 $(LOCAL_BUILT_MODULE): PRIVATE_PLAT_CIL := $(built_plat_cil)
-$(LOCAL_BUILT_MODULE): $(product_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
+$(LOCAL_BUILT_MODULE): $(system_ext_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
 $(HOST_OUT_EXECUTABLES)/build_sepolicy $(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil)
 	@mkdir -p $(dir $@)
 	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
@@ -622,12 +776,69 @@
 	# used for debugging, so we remove them.
 	$(hide) grep -v ';;' $@ > $@.tmp
 	$(hide) mv $@.tmp $@
-	# Combine plat_sepolicy.cil and product_sepolicy.cil to make sure that the
+	# Combine plat_sepolicy.cil and system_ext_sepolicy.cil to make sure that the
 	# latter doesn't accidentally depend on vendor/odm policies.
 	$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) \
 		$(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_PLAT_CIL) $@ -o /dev/null -f /dev/null
 
 
+built_system_ext_cil := $(LOCAL_BUILT_MODULE)
+system_ext_policy.conf :=
+endif # ifdef HAS_SYSTEM_EXT_SEPOLICY
+
+#################################
+include $(CLEAR_VARS)
+
+ifdef HAS_PRODUCT_SEPOLICY
+LOCAL_MODULE := product_sepolicy.cil
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_TAGS := optional
+LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+# product_policy.conf - A combination of the private and public product policy
+# which will ship with the device. Product policy is not attributized.
+policy_files := $(call build_policy, $(sepolicy_build_files), \
+  $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
+  $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
+  $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY))
+product_policy.conf := $(intermediates)/product_policy.conf
+$(product_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
+$(product_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
+$(product_policy.conf): PRIVATE_TARGET_BUILD_VARIANT := $(TARGET_BUILD_VARIANT)
+$(product_policy.conf): PRIVATE_TGT_ARCH := $(my_target_arch)
+$(product_policy.conf): PRIVATE_TGT_WITH_ASAN := $(with_asan)
+$(product_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
+$(product_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
+$(product_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
+$(product_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
+$(product_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
+$(product_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$(product_policy.conf): $(policy_files) $(M4)
+	$(transform-policy-to-conf)
+	$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
+
+$(LOCAL_BUILT_MODULE): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
+$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_CIL_FILES := $(built_plat_cil) $(built_system_ext_cil)
+$(LOCAL_BUILT_MODULE): $(product_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
+$(HOST_OUT_EXECUTABLES)/build_sepolicy $(HOST_OUT_EXECUTABLES)/secilc \
+$(built_plat_cil) $(built_system_ext_cil)
+	@mkdir -p $(dir $@)
+	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
+	$(POLICYVERS) -o $@ $<
+	$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
+		-f $(PRIVATE_PLAT_CIL_FILES) -t $@
+	# Line markers (denoted by ;;) are malformed after above cmd. They are only
+	# used for debugging, so we remove them.
+	$(hide) grep -v ';;' $@ > $@.tmp
+	$(hide) mv $@.tmp $@
+	# Combine plat_sepolicy.cil, system_ext_sepolicy.cil and product_sepolicy.cil to
+	# make sure that the latter doesn't accidentally depend on vendor/odm policies.
+	$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) \
+		$(PRIVATE_NEVERALLOW_ARG) $(PRIVATE_PLAT_CIL_FILES) $@ -o /dev/null -f /dev/null
+
+
 built_product_cil := $(LOCAL_BUILT_MODULE)
 product_policy.conf :=
 endif # ifdef HAS_PRODUCT_SEPOLICY
@@ -671,7 +882,33 @@
 #################################
 include $(CLEAR_VARS)
 
-ifdef HAS_PRODUCT_SEPOLICY
+ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
+LOCAL_MODULE := system_ext_mapping_file
+LOCAL_MODULE_STEM := $(PLATFORM_SEPOLICY_VERSION).cil
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_TAGS := optional
+LOCAL_MODULE_PATH := $(TARGET_OUT_SYSTEM_EXT)/etc/selinux/mapping
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(PLATFORM_SEPOLICY_VERSION)
+$(LOCAL_BUILT_MODULE) : PRIVATE_PLAT_MAPPING_CIL := $(built_plat_mapping_cil)
+$(LOCAL_BUILT_MODULE) : $(system_ext_pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy \
+$(built_plat_mapping_cil)
+	@mkdir -p $(dir $@)
+	# Generate system_ext mapping file as mapping file of 'system' (plat) and 'system_ext'
+	# sepolicy minus plat_mapping_file.
+	$(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@
+	$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
+		-f $(PRIVATE_PLAT_MAPPING_CIL) -t $@
+
+built_system_ext_mapping_cil := $(LOCAL_BUILT_MODULE)
+endif # ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
+
+#################################
+include $(CLEAR_VARS)
+
+ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
 LOCAL_MODULE := product_mapping_file
 LOCAL_MODULE_STEM := $(PLATFORM_SEPOLICY_VERSION).cil
 LOCAL_MODULE_CLASS := ETC
@@ -681,18 +918,18 @@
 include $(BUILD_SYSTEM)/base_rules.mk
 
 $(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(PLATFORM_SEPOLICY_VERSION)
-$(LOCAL_BUILT_MODULE) : PRIVATE_PLAT_MAPPING_CIL := $(built_plat_mapping_cil)
+$(LOCAL_BUILT_MODULE) : PRIVATE_FILTER_CIL_FILES := $(built_plat_mapping_cil) $(built_system_ext_mapping_cil)
 $(LOCAL_BUILT_MODULE) : $(pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy \
-$(built_plat_mapping_cil)
+$(built_plat_mapping_cil) $(built_system_ext_mapping_cil)
 	@mkdir -p $(dir $@)
 	# Generate product mapping file as mapping file of all public sepolicy minus
-	# plat_mapping_file.
+	# plat_mapping_file and system_ext_mapping_file.
 	$(hide) $(HOST_OUT_EXECUTABLES)/version_policy -b $< -m -n $(PRIVATE_VERS) -o $@
 	$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
-		-f $(PRIVATE_PLAT_MAPPING_CIL) -t $@
+		-f $(PRIVATE_FILTER_CIL_FILES) -t $@
 
 built_product_mapping_cil := $(LOCAL_BUILT_MODULE)
-endif # HAS_PRODUCT_SEPOLICY
+endif # ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
 
 #################################
 include $(CLEAR_VARS)
@@ -709,11 +946,12 @@
 
 $(LOCAL_BUILT_MODULE) : PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
 $(LOCAL_BUILT_MODULE) : PRIVATE_TGT_POL := $(pub_policy.cil)
-$(LOCAL_BUILT_MODULE) : PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_product_cil)\
-$(built_plat_mapping_cil) $(built_product_mapping_cil)
+$(LOCAL_BUILT_MODULE) : PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_system_ext_cil) \
+$(built_product_cil) $(built_plat_mapping_cil) $(built_system_ext_mapping_cil) \
+$(built_product_mapping_cil)
 $(LOCAL_BUILT_MODULE) : $(pub_policy.cil) $(HOST_OUT_EXECUTABLES)/version_policy \
-  $(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil) $(built_product_cil) \
-  $(built_plat_mapping_cil) $(built_product_mapping_cil)
+  $(HOST_OUT_EXECUTABLES)/secilc $(built_plat_cil) $(built_system_ext_cil) $(built_product_cil) \
+  $(built_plat_mapping_cil) $(built_system_ext_mapping_cil) $(built_product_mapping_cil)
 	@mkdir -p $(dir $@)
 	$(HOST_OUT_EXECUTABLES)/version_policy -b $< -t $(PRIVATE_TGT_POL) -n $(PRIVATE_VERS) -o $@
 	$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -N -c $(POLICYVERS) \
@@ -735,6 +973,9 @@
 
 include $(BUILD_SYSTEM)/base_rules.mk
 
+policy_files := $(call build_policy, $(sepolicy_build_files), \
+  $(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) \
+  $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS))
 vendor_policy.conf := $(intermediates)/vendor_policy.conf
 $(vendor_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
 $(vendor_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
@@ -745,9 +986,9 @@
 $(vendor_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
 $(vendor_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
 $(vendor_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(vendor_policy.conf): $(call build_policy, $(sepolicy_build_files), \
-$(PLAT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) \
-$(BOARD_VENDOR_SEPOLICY_DIRS))
+$(vendor_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
+$(vendor_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$(vendor_policy.conf): $(policy_files) $(M4)
 	$(transform-policy-to-conf)
 	$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
 
@@ -755,13 +996,15 @@
 $(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
 $(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(pub_policy.cil)
 $(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
-$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_product_cil)\
-$(built_pub_vers_cil) $(built_plat_mapping_cil) $(built_product_mapping_cil)
+$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_system_ext_cil) \
+$(built_product_cil) $(built_pub_vers_cil) $(built_plat_mapping_cil) \
+$(built_system_ext_mapping_cil) $(built_product_mapping_cil)
 $(LOCAL_BUILT_MODULE): PRIVATE_FILTER_CIL := $(built_pub_vers_cil)
 $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \
   $(vendor_policy.conf) $(reqd_policy_mask.cil) $(pub_policy.cil) \
-  $(built_plat_cil) $(built_product_cil) $(built_pub_vers_cil) \
-  $(built_plat_mapping_cil) $(built_product_mapping_cil)
+  $(built_plat_cil) $(built_system_ext_cil) $(built_product_cil) \
+  $(built_pub_vers_cil) $(built_plat_mapping_cil) $(built_system_ext_mapping_cil) \
+  $(built_product_mapping_cil)
 	@mkdir -p $(dir $@)
 	$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \
 		-i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \
@@ -786,6 +1029,9 @@
 
 include $(BUILD_SYSTEM)/base_rules.mk
 
+policy_files := $(call build_policy, $(sepolicy_build_files), \
+  $(PLAT_PUBLIC_POLICY) $(SYSTEM_EXT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) \
+  $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
 odm_policy.conf := $(intermediates)/odm_policy.conf
 $(odm_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
 $(odm_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
@@ -796,9 +1042,9 @@
 $(odm_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
 $(odm_policy.conf): PRIVATE_SEPOLICY_SPLIT := $(PRODUCT_SEPOLICY_SPLIT)
 $(odm_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(odm_policy.conf): $(call build_policy, $(sepolicy_build_files), \
-  $(PLAT_PUBLIC_POLICY) $(PRODUCT_PUBLIC_POLICY) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) \
-  $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
+$(odm_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
+$(odm_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$(odm_policy.conf): $(policy_files) $(M4)
 	$(transform-policy-to-conf)
 	$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
 
@@ -806,14 +1052,15 @@
 $(LOCAL_BUILT_MODULE): PRIVATE_REQD_MASK := $(reqd_policy_mask.cil)
 $(LOCAL_BUILT_MODULE): PRIVATE_BASE_CIL := $(pub_policy.cil)
 $(LOCAL_BUILT_MODULE): PRIVATE_VERS := $(BOARD_SEPOLICY_VERS)
-$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_product_cil) \
-  $(built_pub_vers_cil) $(built_plat_mapping_cil) $(built_product_mapping_cil)\
-  $(built_vendor_cil)
+$(LOCAL_BUILT_MODULE): PRIVATE_DEP_CIL_FILES := $(built_plat_cil) $(built_system_ext_cil) \
+  $(built_product_cil) $(built_pub_vers_cil) $(built_plat_mapping_cil) \
+  $(built_system_ext_mapping_cil) $(built_product_mapping_cil) $(built_vendor_cil)
 $(LOCAL_BUILT_MODULE) : PRIVATE_FILTER_CIL_FILES := $(built_pub_vers_cil) $(built_vendor_cil)
 $(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/build_sepolicy \
   $(odm_policy.conf) $(reqd_policy_mask.cil) $(pub_policy.cil) \
-  $(built_plat_cil) $(built_product_cil) $(built_pub_vers_cil) \
-  $(built_plat_mapping_cil) $(built_product_mapping_cil) $(built_vendor_cil)
+  $(built_plat_cil) $(built_system_ext_cil) $(built_product_cil) $(built_pub_vers_cil) \
+  $(built_plat_mapping_cil) $(built_system_ext_mapping_cil) $(built_product_mapping_cil) \
+  $(built_vendor_cil)
 	@mkdir -p $(dir $@)
 	$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) build_cil \
 		-i $(PRIVATE_POL_CONF) -m $(PRIVATE_REQD_MASK) -c $(CHECKPOLICY_ASAN_OPTIONS) \
@@ -847,11 +1094,20 @@
     $(built_pub_vers_cil) \
     $(built_vendor_cil)
 
-ifdef HAS_PRODUCT_SEPOLICY
-all_cil_files += \
-    $(built_product_cil) \
-    $(built_product_mapping_cil) \
+ifdef HAS_SYSTEM_EXT_SEPOLICY
+all_cil_files += $(built_system_ext_cil)
+endif
 
+ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
+all_cil_files += $(built_system_ext_mapping_cil)
+endif
+
+ifdef HAS_PRODUCT_SEPOLICY
+all_cil_files += $(built_product_cil)
+endif
+
+ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
+all_cil_files += $(built_product_mapping_cil)
 endif
 
 ifdef BOARD_ODM_SEPOLICY_DIRS
@@ -872,6 +1128,9 @@
 # - plat_sepolicy_and_mapping.sha256 equals
 #   precompiled_sepolicy.plat_sepolicy_and_mapping.sha256
 # AND
+# - system_ext_sepolicy_and_mapping.sha256 equals
+#   precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256
+# AND
 # - product_sepolicy_and_mapping.sha256 equals
 #   precompiled_sepolicy.product_sepolicy_and_mapping.sha256
 # See system/core/init/selinux.cpp for details.
@@ -891,6 +1150,19 @@
 #################################
 include $(CLEAR_VARS)
 
+LOCAL_MODULE := system_ext_sepolicy_and_mapping.sha256
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_TAGS := optional
+LOCAL_MODULE_PATH = $(TARGET_OUT_SYSTEM_EXT)/etc/selinux
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(LOCAL_BUILT_MODULE): $(built_system_ext_cil) $(built_system_ext_mapping_cil)
+	cat $^ | sha256sum | cut -d' ' -f1 > $@
+
+#################################
+include $(CLEAR_VARS)
+
 LOCAL_MODULE := product_sepolicy_and_mapping.sha256
 LOCAL_MODULE_CLASS := ETC
 LOCAL_MODULE_TAGS := optional
@@ -923,6 +1195,27 @@
 	cat $(PRIVATE_CIL_FILES) | sha256sum | cut -d' ' -f1 > $@
 
 #################################
+# SHA-256 digest of the system_ext_sepolicy.cil and system_ext_mapping_file against
+# which precompiled_policy was built.
+#################################
+include $(CLEAR_VARS)
+LOCAL_MODULE := precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_TAGS := optional
+
+ifeq ($(BOARD_USES_ODMIMAGE),true)
+LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
+else
+LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
+endif
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(built_system_ext_cil) $(built_system_ext_mapping_cil)
+$(LOCAL_BUILT_MODULE): $(built_precompiled_sepolicy) $(built_system_ext_cil) $(built_system_ext_mapping_cil)
+	cat $(PRIVATE_CIL_FILES) | sha256sum | cut -d' ' -f1 > $@
+
+#################################
 # SHA-256 digest of the product_sepolicy.cil and product_mapping_file against
 # which precompiled_policy was built.
 #################################
@@ -960,11 +1253,20 @@
     $(built_pub_vers_cil) \
     $(built_vendor_cil)
 
-ifdef HAS_PRODUCT_SEPOLICY
-all_cil_files += \
-    $(built_product_cil) \
-    $(built_product_mapping_cil) \
+ifdef HAS_SYSTEM_EXT_SEPOLICY
+all_cil_files += $(built_system_ext_cil)
+endif
 
+ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
+all_cil_files += $(built_system_ext_mapping_cil)
+endif
+
+ifdef HAS_PRODUCT_SEPOLICY
+all_cil_files += $(built_product_cil)
+endif
+
+ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
+all_cil_files += $(built_product_mapping_cil)
 endif
 
 ifdef BOARD_ODM_SEPOLICY_DIRS
@@ -1004,6 +1306,12 @@
 
 include $(BUILD_SYSTEM)/base_rules.mk
 
+policy_files := $(call build_policy, $(sepolicy_build_files), \
+  $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
+  $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
+  $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
+  $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) \
+  $(BOARD_ODM_SEPOLICY_DIRS))
 sepolicy.recovery.conf := $(intermediates)/sepolicy.recovery.conf
 $(sepolicy.recovery.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
 $(sepolicy.recovery.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
@@ -1013,11 +1321,8 @@
 $(sepolicy.recovery.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
 $(sepolicy.recovery.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
 $(sepolicy.recovery.conf): PRIVATE_TGT_RECOVERY := -D target_recovery=true
-$(sepolicy.recovery.conf): $(call build_policy, $(sepolicy_build_files), \
-                           $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) \
-                           $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
-                           $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) \
-                           $(BOARD_ODM_SEPOLICY_DIRS))
+$(sepolicy.recovery.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$(sepolicy.recovery.conf): $(policy_files) $(M4)
 	$(transform-policy-to-conf)
 	$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
 
@@ -1055,6 +1360,8 @@
 
 include $(BUILD_SYSTEM)/base_rules.mk
 
+policy_files := $(call build_policy, $(sepolicy_build_files), \
+  $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
 $(LOCAL_BUILT_MODULE): PRIVATE_MLS_SENS := $(MLS_SENS)
 $(LOCAL_BUILT_MODULE): PRIVATE_MLS_CATS := $(MLS_CATS)
 $(LOCAL_BUILT_MODULE): PRIVATE_TARGET_BUILD_VARIANT := user
@@ -1062,9 +1369,10 @@
 $(LOCAL_BUILT_MODULE): PRIVATE_WITH_ASAN := false
 $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_SPLIT := cts
 $(LOCAL_BUILT_MODULE): PRIVATE_COMPATIBLE_PROPERTY := cts
+$(LOCAL_BUILT_MODULE): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := cts
 $(LOCAL_BUILT_MODULE): PRIVATE_EXCLUDE_BUILD_TEST := true
-$(LOCAL_BUILT_MODULE): $(call build_policy, $(sepolicy_build_files), \
-$(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
+$(LOCAL_BUILT_MODULE): PRIVATE_POLICY_FILES := $(policy_files)
+$(LOCAL_BUILT_MODULE): $(policy_files) $(M4)
 	$(transform-policy-to-conf)
 	$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
 
@@ -1097,7 +1405,11 @@
 
 local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
 
-ifdef HAS_PRODUCT_SEPOLICY
+ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
+local_fc_files += $(call build_policy, file_contexts, $(SYSTEM_EXT_PRIVATE_POLICY))
+endif
+
+ifdef HAS_PRODUCT_SEPOLICY_DIR
 local_fc_files += $(call build_policy, file_contexts, $(PRODUCT_PRIVATE_POLICY))
 endif
 
@@ -1107,20 +1419,22 @@
 ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
   local_fc_files += $(wildcard $(addsuffix /file_contexts_overlayfs, $(PLAT_PRIVATE_POLICY)))
 endif
-ifeq ($(TARGET_FLATTEN_APEX),true)
-  apex_fc_files := $(wildcard $(LOCAL_PATH)/apex/*-file_contexts)
-  $(foreach _input,$(apex_fc_files),\
-    $(eval _output := $(intermediates)/$(notdir $(_input))-flattened)\
-    $(eval _apex_name := $(patsubst %-file_contexts,%,$(notdir $(_input))))\
-    $(eval $(call build_flattened_apex_file_contexts,$(_input),$(_apex_name),$(_output),local_fc_files))\
-   )
-endif
-local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
+
+# Even if TARGET_FLATTEN_APEX is not turned on, "flattened" APEXes are installed
+$(foreach _tuple,$(APEX_FILE_CONTEXTS_INFOS),\
+  $(eval _apex_name := $(call word-colon,1,$(_tuple)))\
+  $(eval _apex_path := $(call word-colon,2,$(_tuple)))\
+  $(eval _fc_path := $(call word-colon,3,$(_tuple)))\
+  $(eval _input := $(_fc_path))\
+  $(eval _output := $(intermediates)/$(_apex_name)-flattened)\
+  $(eval $(call build_flattened_apex_file_contexts,$(_input),$(_apex_path),$(_output),local_fc_files))\
+  )
 
 file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
-$(file_contexts.local.tmp): $(local_fcfiles_with_nl)
+$(file_contexts.local.tmp): PRIVATE_FC_FILES := $(local_fc_files)
+$(file_contexts.local.tmp): $(local_fc_files) $(M4)
 	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $^ > $@
+	$(hide) $(M4) --fatal-warnings -s $(PRIVATE_FC_FILES) > $@
 
 device_fc_files := $(call build_vendor_policy, file_contexts)
 
@@ -1128,13 +1442,12 @@
 device_fc_files += $(call build_odm_policy, file_contexts)
 endif
 
-device_fcfiles_with_nl := $(call add_nl, $(device_fc_files), $(built_nl))
-
 file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
 $(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(file_contexts.device.tmp): $(device_fcfiles_with_nl)
+$(file_contexts.device.tmp): PRIVATE_DEVICE_FC_FILES := $(device_fc_files)
+$(file_contexts.device.tmp): $(device_fc_files) $(M4)
 	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
+	$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_DEVICE_FC_FILES) > $@
 
 file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
 $(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
@@ -1142,12 +1455,13 @@
   $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
 	@mkdir -p $(dir $@)
 	$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
-	$(hide) $(HOST_OUT_EXECUTABLES)/fc_sort $< $@
+	$(hide) $(HOST_OUT_EXECUTABLES)/fc_sort -i $< -o $@
 
 file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
-$(file_contexts.concat.tmp): $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp)
+$(file_contexts.concat.tmp): PRIVATE_CONTEXTS := $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp)
+$(file_contexts.concat.tmp): $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp) $(M4)
 	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $^ > $@
+	$(hide) $(M4) --fatal-warnings -s $(PRIVATE_CONTEXTS) > $@
 
 $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
 $(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
@@ -1166,7 +1480,6 @@
 file_contexts.local.tmp :=
 
 ##################################
-ifneq ($(TARGET_BUILD_VARIANT), user)
 include $(CLEAR_VARS)
 
 LOCAL_MODULE := selinux_denial_metadata
@@ -1175,29 +1488,19 @@
 
 include $(BUILD_SYSTEM)/base_rules.mk
 
-bug_files := $(call build_policy, bug_map, $(LOCAL_PATH) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEPOLICY_DIRS) $(PLAT_PUBLIC_POLICY))
+bug_files := $(call build_policy, bug_map, $(LOCAL_PATH) $(PLAT_PRIVATE_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(PLAT_PUBLIC_POLICY))
 
 $(LOCAL_BUILT_MODULE) : $(bug_files)
 	@mkdir -p $(dir $@)
 	cat $^ > $@
 
 bug_files :=
-endif
-
-##################################
-include $(LOCAL_PATH)/file_contexts.mk
 
 ##################################
 include $(LOCAL_PATH)/seapp_contexts.mk
 
 ##################################
-include $(LOCAL_PATH)/property_contexts.mk
-
-##################################
-include $(LOCAL_PATH)/service_contexts.mk
-
-##################################
-include $(LOCAL_PATH)/hwservice_contexts.mk
+include $(LOCAL_PATH)/contexts_tests.mk
 
 ##################################
 include $(CLEAR_VARS)
@@ -1214,9 +1517,9 @@
 vndservice_contexts.tmp := $(intermediates)/vndservice_contexts.tmp
 $(vndservice_contexts.tmp): PRIVATE_SVC_FILES := $(vnd_svcfiles)
 $(vndservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(vndservice_contexts.tmp): $(vnd_svcfiles)
+$(vndservice_contexts.tmp): $(vnd_svcfiles) $(M4)
 	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
+	$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
 
 $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
 $(LOCAL_BUILT_MODULE): $(vndservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
@@ -1233,24 +1536,27 @@
 #################################
 include $(CLEAR_VARS)
 LOCAL_MODULE := sepolicy_tests
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := tests
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
 
 include $(BUILD_SYSTEM)/base_rules.mk
 
-all_fc_files := $(built_plat_fc) $(built_vendor_fc)
-ifdef HAS_PRODUCT_SEPOLICY
-all_fc_args += $(built_product_fc)
+all_fc_files := $(TARGET_OUT)/etc/selinux/plat_file_contexts
+all_fc_files += $(TARGET_OUT_VENDOR)/etc/selinux/vendor_file_contexts
+ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
+all_fc_files += $(TARGET_OUT_SYSTEM_EXT)/etc/selinux/system_ext_file_contexts
+endif
+ifdef HAS_PRODUCT_SEPOLICY_DIR
+all_fc_files += $(TARGET_OUT_PRODUCT)/etc/selinux/product_file_contexts
 endif
 ifdef BOARD_ODM_SEPOLICY_DIRS
-all_fc_files += $(built_odm_fc)
+all_fc_files += $(TARGET_OUT_ODM)/etc/selinux/odm_file_contexts
 endif
 all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
 
-sepolicy_tests := $(intermediates)/sepolicy_tests
-$(sepolicy_tests): ALL_FC_ARGS := $(all_fc_args)
-$(sepolicy_tests): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(sepolicy_tests): $(HOST_OUT_EXECUTABLES)/sepolicy_tests $(all_fc_files) $(built_sepolicy)
+$(LOCAL_BUILT_MODULE): ALL_FC_ARGS := $(all_fc_args)
+$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
+$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/sepolicy_tests $(all_fc_files) $(built_sepolicy)
 	@mkdir -p $(dir $@)
 	$(hide) $(HOST_OUT_EXECUTABLES)/sepolicy_tests -l $(HOST_OUT)/lib64/libsepolwrap.$(SHAREDLIB_EXT) \
 		$(ALL_FC_ARGS)  -p $(PRIVATE_SEPOLICY)
@@ -1262,8 +1568,8 @@
 # plat_sepolicy - the current platform policy only, built into a policy binary.
 # TODO - this currently excludes partner extensions, but support should be added
 # to enable partners to add their own compatibility mapping
-BASE_PLAT_PUBLIC_POLICY := $(filter-out $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR), $(PLAT_PUBLIC_POLICY))
-BASE_PLAT_PRIVATE_POLICY := $(filter-out $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR), $(PLAT_PRIVATE_POLICY))
+policy_files := $(call build_policy, $(sepolicy_build_files), \
+  $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
 base_plat_policy.conf := $(intermediates)/base_plat_policy.conf
 $(base_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
 $(base_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
@@ -1273,18 +1579,19 @@
 $(base_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
 $(base_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
 $(base_plat_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(base_plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
-$(BASE_PLAT_PUBLIC_POLICY) $(BASE_PLAT_PRIVATE_POLICY))
+$(base_plat_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
+$(base_plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$(base_plat_policy.conf): $(policy_files) $(M4)
 	$(transform-policy-to-conf)
 	$(hide) sed '/^\s*dontaudit.*;/d' $@ | sed '/^\s*dontaudit/,/;/d' > $@.dontaudit
 
 built_plat_sepolicy := $(intermediates)/built_plat_sepolicy
 $(built_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \
-  $(call build_policy, $(sepolicy_build_cil_workaround_files), $(BASE_PLAT_PRIVATE_POLICY))
+  $(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY))
 $(built_plat_sepolicy): PRIVATE_NEVERALLOW_ARG := $(NEVERALLOW_ARG)
 $(built_plat_sepolicy): $(base_plat_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy \
 $(HOST_OUT_EXECUTABLES)/secilc \
-$(call build_policy, $(sepolicy_build_cil_workaround_files), $(BASE_PLAT_PRIVATE_POLICY)) \
+$(call build_policy, $(sepolicy_build_cil_workaround_files), $(PLAT_PRIVATE_POLICY)) \
 $(built_sepolicy_neverallows)
 	@mkdir -p $(dir $@)
 	$(hide) $(CHECKPOLICY_ASAN_OPTIONS) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -C -c \
@@ -1292,6 +1599,8 @@
 	$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
 	$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null
 
+policy_files := $(call build_policy, $(sepolicy_build_files), \
+  $(PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
 base_plat_pub_policy.conf := $(intermediates)/base_plat_pub_policy.conf
 $(base_plat_pub_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
 $(base_plat_pub_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
@@ -1301,8 +1610,9 @@
 $(base_plat_pub_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
 $(base_plat_pub_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
 $(base_plat_pub_policy.conf): PRIVATE_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY)
-$(base_plat_pub_policy.conf): $(call build_policy, $(sepolicy_build_files), \
-$(BASE_PLAT_PUBLIC_POLICY) $(REQD_MASK_POLICY))
+$(base_plat_pub_policy.conf): PRIVATE_TREBLE_SYSPROP_NEVERALLOW := $(treble_sysprop_neverallow)
+$(base_plat_pub_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$(base_plat_pub_policy.conf): $(policy_files) $(M4)
 	$(transform-policy-to-conf)
 
 base_plat_pub_policy.cil := $(intermediates)/base_plat_pub_policy.cil
@@ -1315,37 +1625,39 @@
 	$(hide) $(HOST_OUT_EXECUTABLES)/build_sepolicy -a $(HOST_OUT_EXECUTABLES) filter_out \
 		-f $(PRIVATE_REQD_MASK) -t $@
 
-all_fc_files := $(built_plat_fc) $(built_vendor_fc)
-ifdef HAS_PRODUCT_SEPOLICY
-all_fc_files += $(built_product_fc)
-endif
-ifdef BOARD_ODM_SEPOLICY_DIRS
-all_fc_files += $(built_odm_fc)
-endif
-all_fc_args := $(foreach file, $(all_fc_files), -f $(file))
-
+ifeq ($(PRODUCT_SEPOLICY_SPLIT),true)
 # Tests for Treble compatibility of current platform policy and vendor policy of
 # given release version.
 version_under_treble_tests := 26.0
 include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
-
 version_under_treble_tests := 27.0
 include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
-
 version_under_treble_tests := 28.0
 include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
+version_under_treble_tests := 29.0
+include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk
+endif  # PRODUCT_SEPOLICY_SPLIT
 
-BASE_PLAT_PUBLIC_POLICY :=
-BASE_PLAT_PRIVATE_POLICY :=
+version_under_treble_tests := 26.0
+include $(LOCAL_PATH)/compat.mk
+version_under_treble_tests := 27.0
+include $(LOCAL_PATH)/compat.mk
+version_under_treble_tests := 28.0
+include $(LOCAL_PATH)/compat.mk
+version_under_treble_tests := 29.0
+include $(LOCAL_PATH)/compat.mk
+
 base_plat_policy.conf :=
 base_plat_pub_policy.conf :=
 plat_sepolicy :=
+all_fc_files :=
+all_fc_args :=
 
 #################################
 include $(CLEAR_VARS)
 LOCAL_MODULE := sepolicy_freeze_test
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := tests
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
 
 include $(BUILD_SYSTEM)/base_rules.mk
 
@@ -1379,37 +1691,30 @@
 #################################
 
 
-add_nl :=
 build_vendor_policy :=
 build_odm_policy :=
 build_policy :=
-built_plat_fc :=
-built_product_fc :=
-built_vendor_fc :=
-built_odm_fc :=
-built_nl :=
 built_plat_cil :=
+built_system_ext_cil :=
+built_product_cil :=
 built_pub_vers_cil :=
 built_plat_mapping_cil :=
+built_system_ext_mapping_cil :=
 built_product_mapping_cil :=
-built_plat_pc :=
-built_product_pc :=
 built_vendor_cil :=
-built_vendor_pc :=
-built_vendor_sc :=
 built_odm_cil :=
-built_odm_pc :=
-built_odm_sc :=
-built_plat_sc :=
 built_precompiled_sepolicy :=
 built_sepolicy :=
 built_sepolicy_neverallows :=
 built_plat_svc :=
 built_vendor_svc :=
 built_plat_sepolicy :=
+treble_sysprop_neverallow :=
 mapping_policy :=
 my_target_arch :=
 pub_policy.cil :=
+system_ext_pub_policy.cil :=
+plat_pub_policy.cil :=
 reqd_policy_mask.cil :=
 sepolicy_build_files :=
 sepolicy_build_cil_workaround_files :=
diff --git a/OWNERS b/OWNERS
index 194acf3..55f7f00 100644
--- a/OWNERS
+++ b/OWNERS
@@ -5,6 +5,7 @@
 jbires@google.com
 jeffv@google.com
 jgalenson@google.com
+jiyong@google.com
 nnk@google.com
 smoreland@google.com
 sspatil@google.com
diff --git a/PREUPLOAD.cfg b/PREUPLOAD.cfg
index ccb3a50..b2b38ea 100644
--- a/PREUPLOAD.cfg
+++ b/PREUPLOAD.cfg
@@ -2,3 +2,6 @@
 whitespace = tools/whitespace.sh ${PREUPLOAD_FILES}
 aosp_hook = ${REPO_ROOT}/frameworks/base/tools/aosp/aosp_sha.sh ${PREUPLOAD_COMMIT} "."
 policy_version_check = tools/policy_version_check.sh
+
+[Builtin Hooks]
+gofmt = true
diff --git a/README b/README
index 0cc8e30..43d9bbc 100644
--- a/README
+++ b/README
@@ -18,13 +18,13 @@
 points.
 
 These device policy files can be configured through the use of
-the BOARD_SEPOLICY_DIRS variable. This variable should be set
+the BOARD_VENDOR_SEPOLICY_DIRS variable. This variable should be set
 in the BoardConfig.mk file in the device or vendor directories.
 
-BOARD_SEPOLICY_DIRS contains a list of directories to search
+BOARD_VENDOR_SEPOLICY_DIRS contains a list of directories to search
 for additional policy files. Order matters in this list.
 For example, if you have 2 instances of widget.te files in the
-BOARD_SEPOLICY_DIRS search path, then the first one found (at the
+BOARD_VENDOR_SEPOLICY_DIRS search path, then the first one found (at the
 first search dir containing the file) will be concatenated first.
 Reviewing out/target/product/<device>/obj/ETC/sepolicy_intermediates/policy.conf
 will help sort out ordering issues.
@@ -32,7 +32,7 @@
 Example BoardConfig.mk Usage:
 From the Tuna device BoardConfig.mk, device/samsung/tuna/BoardConfig.mk
 
-BOARD_SEPOLICY_DIRS += device/samsung/tuna/sepolicy
+BOARD_VENDOR_SEPOLICY_DIRS += device/samsung/tuna/sepolicy
 
 Additionally, OEMs can specify BOARD_SEPOLICY_M4DEFS to pass arbitrary m4
 definitions during the build. A definition consists of a string in the form
diff --git a/TEST_MAPPING b/TEST_MAPPING
new file mode 100644
index 0000000..db12ffe
--- /dev/null
+++ b/TEST_MAPPING
@@ -0,0 +1,19 @@
+{
+    "presubmit": [
+        {
+            "name": "CtsSecurityHostTestCases",
+            "options": [
+                {
+                    "include-filter": "android.security.cts.SELinuxHostTest#testPermissionControllerDomain"
+                },
+                {
+                    "include-filter": "android.security.cts.SELinuxHostTest#testVzwOmaTriggerDomain"
+                },
+                {
+                    "include-filter": "android.security.cts.SELinuxHostTest#testGMSCoreDomain"
+                }
+
+            ]
+        }
+    ]
+}
diff --git a/apex/Android.bp b/apex/Android.bp
new file mode 100644
index 0000000..d3acfdb
--- /dev/null
+++ b/apex/Android.bp
@@ -0,0 +1,189 @@
+// Copyright (C) 2019 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+
+filegroup {
+  name: "apex.test-file_contexts",
+  srcs: [
+    "apex.test-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.adbd-file_contexts",
+  srcs: [
+    "com.android.adbd-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.sdkext-file_contexts",
+  srcs: [
+    "com.android.sdkext-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.art.debug-file_contexts",
+  srcs: [
+    "com.android.art.debug-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.art.release-file_contexts",
+  srcs: [
+    "com.android.art.release-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.bootanimation-file_contexts",
+  srcs: [
+    "com.android.bootanimation-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.cellbroadcast-file_contexts",
+  srcs: [
+    "com.android.cellbroadcast-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.conscrypt-file_contexts",
+  srcs: [
+    "com.android.conscrypt-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.cronet-file_contexts",
+  srcs: [
+    "com.android.cronet-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.ipsec-file_contexts",
+  srcs: [
+    "com.android.ipsec-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.i18n-file_contexts",
+  srcs: [
+    "com.android.i18n-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.media-file_contexts",
+  srcs: [
+    "com.android.media-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.mediaprovider-file_contexts",
+  srcs: [
+    "com.android.mediaprovider-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.media.swcodec-file_contexts",
+  srcs: [
+    "com.android.media.swcodec-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.neuralnetworks-file_contexts",
+  srcs: [
+    "com.android.neuralnetworks-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.os.statsd-file_contexts",
+  srcs: [
+    "com.android.os.statsd-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.permission-file_contexts",
+  srcs: [
+    "com.android.permission-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.resolv-file_contexts",
+  srcs: [
+    "com.android.resolv-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.runtime-file_contexts",
+  srcs: [
+    "com.android.runtime-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.telephony-file_contexts",
+  srcs: [
+    "com.android.telephony-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.tzdata-file_contexts",
+  srcs: [
+    "com.android.tzdata-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.vndk-file_contexts",
+  srcs: [
+    "com.android.vndk-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.wifi-file_contexts",
+  srcs: [
+    "com.android.wifi-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.tethering-file_contexts",
+  srcs: [
+    "com.android.tethering-file_contexts",
+  ],
+}
+
+filegroup {
+  name: "com.android.extservices-file_contexts",
+  srcs: [
+    "com.android.extservices-file_contexts",
+  ],
+}
diff --git a/apex/com.android.adbd-file_contexts b/apex/com.android.adbd-file_contexts
new file mode 100644
index 0000000..3488de2
--- /dev/null
+++ b/apex/com.android.adbd-file_contexts
@@ -0,0 +1,2 @@
+(/.*)?                   u:object_r:system_file:s0
+/bin/adbd                u:object_r:adbd_exec:s0
diff --git a/apex/com.android.appsearch-file_contexts b/apex/com.android.appsearch-file_contexts
new file mode 100644
index 0000000..9398505
--- /dev/null
+++ b/apex/com.android.appsearch-file_contexts
@@ -0,0 +1 @@
+(/.*)?           u:object_r:system_file:s0
diff --git a/apex/com.android.runtime.debug-file_contexts b/apex/com.android.art.debug-file_contexts
similarity index 78%
rename from apex/com.android.runtime.debug-file_contexts
rename to apex/com.android.art.debug-file_contexts
index 592975d..e90cea4 100644
--- a/apex/com.android.runtime.debug-file_contexts
+++ b/apex/com.android.art.debug-file_contexts
@@ -5,8 +5,6 @@
 /bin/dex2oat(d)?               u:object_r:dex2oat_exec:s0
 /bin/dexoptanalyzer(d)?        u:object_r:dexoptanalyzer_exec:s0
 /bin/profman(d)?               u:object_r:profman_exec:s0
-/bin/linker(64)?               u:object_r:system_linker_exec:s0
 /lib(64)?(/.*)?                u:object_r:system_lib_file:s0
-/etc/tz(/.*)?                  u:object_r:system_zoneinfo_file:s0
 /bin/art_preinstall_hook(.*)?  u:object_r:art_apex_preinstall_exec:s0
 /bin/art_postinstall_hook(.*)? u:object_r:art_apex_postinstall_exec:s0
diff --git a/apex/com.android.runtime.release-file_contexts b/apex/com.android.art.release-file_contexts
similarity index 72%
rename from apex/com.android.runtime.release-file_contexts
rename to apex/com.android.art.release-file_contexts
index 286d698..08688fb 100644
--- a/apex/com.android.runtime.release-file_contexts
+++ b/apex/com.android.art.release-file_contexts
@@ -5,6 +5,4 @@
 /bin/dex2oat             u:object_r:dex2oat_exec:s0
 /bin/dexoptanalyzer      u:object_r:dexoptanalyzer_exec:s0
 /bin/profman             u:object_r:profman_exec:s0
-/bin/linker(64)?         u:object_r:system_linker_exec:s0
 /lib(64)?(/.*)?          u:object_r:system_lib_file:s0
-/etc/tz(/.*)?            u:object_r:system_zoneinfo_file:s0
diff --git a/apex/com.android.bluetooth.updatable-file_contexts b/apex/com.android.bluetooth.updatable-file_contexts
new file mode 100644
index 0000000..f6b21da
--- /dev/null
+++ b/apex/com.android.bluetooth.updatable-file_contexts
@@ -0,0 +1,2 @@
+(/.*)?                u:object_r:system_file:s0
+/lib(64)?(/.*)        u:object_r:system_lib_file:s0
diff --git a/apex/com.android.bootanimation-file_contexts b/apex/com.android.bootanimation-file_contexts
new file mode 100644
index 0000000..83b4b58
--- /dev/null
+++ b/apex/com.android.bootanimation-file_contexts
@@ -0,0 +1 @@
+(/.*)?                   u:object_r:system_file:s0
diff --git a/apex/com.android.cellbroadcast-file_contexts b/apex/com.android.cellbroadcast-file_contexts
new file mode 100644
index 0000000..f3a65d4
--- /dev/null
+++ b/apex/com.android.cellbroadcast-file_contexts
@@ -0,0 +1 @@
+(/.*)?                u:object_r:system_file:s0
diff --git a/apex/com.android.conscrypt-file_contexts b/apex/com.android.conscrypt-file_contexts
index ffc3109..abf0085 100644
--- a/apex/com.android.conscrypt-file_contexts
+++ b/apex/com.android.conscrypt-file_contexts
@@ -1,5 +1,6 @@
 #############################
 # System files
 #
-(/.*)?                   u:object_r:system_file:s0
-/lib(64)?(/.*)?          u:object_r:system_lib_file:s0
+(/.*)?                          u:object_r:system_file:s0
+/lib(64)?(/.*)?                 u:object_r:system_lib_file:s0
+/bin/boringssl_self_test(32|64) u:object_r:boringssl_self_test_exec:s0
diff --git a/apex/com.android.cronet-file_contexts b/apex/com.android.cronet-file_contexts
new file mode 100644
index 0000000..f6b21da
--- /dev/null
+++ b/apex/com.android.cronet-file_contexts
@@ -0,0 +1,2 @@
+(/.*)?                u:object_r:system_file:s0
+/lib(64)?(/.*)        u:object_r:system_lib_file:s0
diff --git a/apex/com.android.extservices-file_contexts b/apex/com.android.extservices-file_contexts
new file mode 100644
index 0000000..f3a65d4
--- /dev/null
+++ b/apex/com.android.extservices-file_contexts
@@ -0,0 +1 @@
+(/.*)?                u:object_r:system_file:s0
diff --git a/apex/com.android.i18n-file_contexts b/apex/com.android.i18n-file_contexts
new file mode 100644
index 0000000..c8b6ba1
--- /dev/null
+++ b/apex/com.android.i18n-file_contexts
@@ -0,0 +1,4 @@
+#############################
+# System files
+#
+(/.*)?                   u:object_r:system_file:s0
diff --git a/apex/com.android.ipsec-file_contexts b/apex/com.android.ipsec-file_contexts
new file mode 100644
index 0000000..270f0e1
--- /dev/null
+++ b/apex/com.android.ipsec-file_contexts
@@ -0,0 +1,2 @@
+(/.*)?                          u:object_r:system_file:s0
+/lib(64)?(/.*)?                 u:object_r:system_lib_file:s0
diff --git a/apex/com.android.mediaprovider-file_contexts b/apex/com.android.mediaprovider-file_contexts
new file mode 100644
index 0000000..f6b21da
--- /dev/null
+++ b/apex/com.android.mediaprovider-file_contexts
@@ -0,0 +1,2 @@
+(/.*)?                u:object_r:system_file:s0
+/lib(64)?(/.*)        u:object_r:system_lib_file:s0
diff --git a/apex/com.android.neuralnetworks-file_contexts b/apex/com.android.neuralnetworks-file_contexts
new file mode 100644
index 0000000..f6b21da
--- /dev/null
+++ b/apex/com.android.neuralnetworks-file_contexts
@@ -0,0 +1,2 @@
+(/.*)?                u:object_r:system_file:s0
+/lib(64)?(/.*)        u:object_r:system_lib_file:s0
diff --git a/apex/com.android.os.statsd-file_contexts b/apex/com.android.os.statsd-file_contexts
new file mode 100644
index 0000000..040441a
--- /dev/null
+++ b/apex/com.android.os.statsd-file_contexts
@@ -0,0 +1,3 @@
+(/.*)?                u:object_r:system_file:s0
+/lib(64)?(/.*)        u:object_r:system_lib_file:s0
+/bin/statsd           u:object_r:statsd_exec:s0
diff --git a/apex/com.android.permission-file_contexts b/apex/com.android.permission-file_contexts
new file mode 100644
index 0000000..f3a65d4
--- /dev/null
+++ b/apex/com.android.permission-file_contexts
@@ -0,0 +1 @@
+(/.*)?                u:object_r:system_file:s0
diff --git a/apex/com.android.runtime-file_contexts b/apex/com.android.runtime-file_contexts
new file mode 100644
index 0000000..7878b20
--- /dev/null
+++ b/apex/com.android.runtime-file_contexts
@@ -0,0 +1,6 @@
+#############################
+# System files
+#
+(/.*)?                   u:object_r:system_file:s0
+/bin/linker(64)?         u:object_r:system_linker_exec:s0
+/lib(64)?(/.*)?          u:object_r:system_lib_file:s0
diff --git a/apex/com.android.sdkext-file_contexts b/apex/com.android.sdkext-file_contexts
new file mode 100644
index 0000000..2d59dda
--- /dev/null
+++ b/apex/com.android.sdkext-file_contexts
@@ -0,0 +1,2 @@
+(/.*)?                u:object_r:system_file:s0
+/bin/derive_sdk       u:object_r:derive_sdk_exec:s0
diff --git a/apex/com.android.telephony-file_contexts b/apex/com.android.telephony-file_contexts
new file mode 100644
index 0000000..f3a65d4
--- /dev/null
+++ b/apex/com.android.telephony-file_contexts
@@ -0,0 +1 @@
+(/.*)?                u:object_r:system_file:s0
diff --git a/apex/com.android.tethering-file_contexts b/apex/com.android.tethering-file_contexts
new file mode 100644
index 0000000..9398505
--- /dev/null
+++ b/apex/com.android.tethering-file_contexts
@@ -0,0 +1 @@
+(/.*)?           u:object_r:system_file:s0
diff --git a/apex/com.android.vndk-file_contexts b/apex/com.android.vndk-file_contexts
new file mode 100644
index 0000000..f6b21da
--- /dev/null
+++ b/apex/com.android.vndk-file_contexts
@@ -0,0 +1,2 @@
+(/.*)?                u:object_r:system_file:s0
+/lib(64)?(/.*)        u:object_r:system_lib_file:s0
diff --git a/apex/com.android.wifi-file_contexts b/apex/com.android.wifi-file_contexts
new file mode 100644
index 0000000..f3a65d4
--- /dev/null
+++ b/apex/com.android.wifi-file_contexts
@@ -0,0 +1 @@
+(/.*)?                u:object_r:system_file:s0
diff --git a/build/soong/Android.bp b/build/soong/Android.bp
index bcd33b3..ae2bdd6 100644
--- a/build/soong/Android.bp
+++ b/build/soong/Android.bp
@@ -23,7 +23,9 @@
     ],
     srcs: [
         "cil_compat_map.go",
-        "filegroup.go"
+        "filegroup.go",
+        "selinux.go",
+        "selinux_contexts.go",
     ],
     pluginFor: ["soong_build"],
 }
diff --git a/build/soong/cil_compat_map.go b/build/soong/cil_compat_map.go
index 9d01d93..f304e62 100644
--- a/build/soong/cil_compat_map.go
+++ b/build/soong/cil_compat_map.go
@@ -27,8 +27,6 @@
 )
 
 var (
-	pctx = android.NewPackageContext("android/soong/selinux")
-
 	combine_maps    = pctx.HostBinToolVariable("combine_maps", "combine_maps")
 	combineMapsCmd  = "${combine_maps} -t ${topHalf} -b ${bottomHalf} -o $out"
 	combineMapsRule = pctx.StaticRule(
@@ -53,7 +51,7 @@
 func cilCompatMapFactory() android.Module {
 	c := &cilCompatMap{}
 	c.AddProperties(&c.properties)
-	android.InitAndroidModule(c)
+	android.InitAndroidArchModule(c, android.DeviceSupported, android.MultilibCommon)
 	return c
 }
 
@@ -67,6 +65,8 @@
 	// other modules that produce source files like genrule or filegroup using
 	// the syntax ":module". srcs has to be non-empty.
 	Bottom_half []string
+	// name of the output
+	Stem *string
 }
 
 type cilCompatMap struct {
@@ -74,17 +74,13 @@
 	properties cilCompatMapProperties
 	// (.intermediate) module output path as installation source.
 	installSource android.Path
+	installPath   android.InstallPath
 }
 
 type CilCompatMapGenerator interface {
 	GeneratedMapFile() android.Path
 }
 
-type dependencyTag struct {
-	blueprint.BaseDependencyTag
-	name string
-}
-
 func expandTopHalf(ctx android.ModuleContext) android.OptionalPath {
 	var topHalf android.OptionalPath
 	ctx.VisitDirectDeps(func(dep android.Module) {
@@ -107,11 +103,13 @@
 				continue
 			}
 			if fg, ok := module.(*fileGroup); ok {
-				// Core compatibility mapping files are under system/sepolicy/private.
-				expandedSrcFiles = append(expandedSrcFiles, fg.SystemPrivateSrcs()...)
-				// Partner extensions to the compatibility mapping in must be located in
-				// BOARD_PLAT_PRIVATE_SEPOLICY_DIR
-				expandedSrcFiles = append(expandedSrcFiles, fg.SystemExtPrivateSrcs()...)
+				if ctx.ProductSpecific() {
+					expandedSrcFiles = append(expandedSrcFiles, fg.ProductPrivateSrcs()...)
+				} else if ctx.SystemExtSpecific() {
+					expandedSrcFiles = append(expandedSrcFiles, fg.SystemExtPrivateSrcs()...)
+				} else {
+					expandedSrcFiles = append(expandedSrcFiles, fg.SystemPrivateSrcs()...)
+				}
 			} else {
 				ctx.ModuleErrorf("srcs dependency %q is not an selinux filegroup", m)
 			}
@@ -124,6 +122,8 @@
 }
 
 func (c *cilCompatMap) GenerateAndroidBuildActions(ctx android.ModuleContext) {
+	c.installPath = android.PathForModuleInstall(ctx, "etc", "selinux", "mapping")
+
 	srcFiles := expandSeSources(ctx, c.properties.Bottom_half)
 
 	for _, src := range srcFiles {
@@ -173,7 +173,10 @@
 		Class:      "ETC",
 	}
 	ret.Extra = append(ret.Extra, func(w io.Writer, outputFile android.Path) {
-		fmt.Fprintln(w, "LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping")
+		fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", c.installPath.ToMakePath().String())
+		if c.properties.Stem != nil {
+			fmt.Fprintln(w, "LOCAL_INSTALLED_MODULE_STEM :=", String(c.properties.Stem))
+		}
 	})
 	return ret
 }
diff --git a/build/soong/filegroup.go b/build/soong/filegroup.go
index 7f75e48..a45b427 100644
--- a/build/soong/filegroup.go
+++ b/build/soong/filegroup.go
@@ -52,6 +52,9 @@
 	systemExtPublicSrcs  android.Paths
 	systemExtPrivateSrcs android.Paths
 
+	productPublicSrcs  android.Paths
+	productPrivateSrcs android.Paths
+
 	vendorSrcs android.Paths
 	odmSrcs    android.Paths
 }
@@ -86,7 +89,17 @@
 	return fg.systemExtPrivateSrcs
 }
 
-// Source files from BOARD_SEPOLICY_DIRS
+// Source files from PRODUCT_PUBLIC_SEPOLICY_DIRS
+func (fg *fileGroup) ProductPublicSrcs() android.Paths {
+	return fg.productPublicSrcs
+}
+
+// Source files from PRODUCT_PRIVATE_SEPOLICY_DIRS
+func (fg *fileGroup) ProductPrivateSrcs() android.Paths {
+	return fg.productPrivateSrcs
+}
+
+// Source files from BOARD_VENDOR_SEPOLICY_DIRS
 func (fg *fileGroup) VendorSrcs() android.Paths {
 	return fg.vendorSrcs
 }
@@ -125,6 +138,9 @@
 	fg.systemExtPublicSrcs = fg.findSrcsInDirs(ctx, ctx.DeviceConfig().PlatPublicSepolicyDirs())
 	fg.systemExtPrivateSrcs = fg.findSrcsInDirs(ctx, ctx.DeviceConfig().PlatPrivateSepolicyDirs())
 
+	fg.productPublicSrcs = fg.findSrcsInDirs(ctx, ctx.Config().ProductPublicSepolicyDirs())
+	fg.productPrivateSrcs = fg.findSrcsInDirs(ctx, ctx.Config().ProductPrivateSepolicyDirs())
+
 	fg.vendorSrcs = fg.findSrcsInDirs(ctx, ctx.DeviceConfig().VendorSepolicyDirs())
 	fg.odmSrcs = fg.findSrcsInDirs(ctx, ctx.DeviceConfig().OdmSepolicyDirs())
 }
diff --git a/build/soong/selinux.go b/build/soong/selinux.go
new file mode 100644
index 0000000..7ad4776
--- /dev/null
+++ b/build/soong/selinux.go
@@ -0,0 +1,30 @@
+// Copyright (C) 2019 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package selinux
+
+import (
+	"github.com/google/blueprint"
+
+	"android/soong/android"
+)
+
+type dependencyTag struct {
+	blueprint.BaseDependencyTag
+	name string
+}
+
+var (
+	pctx = android.NewPackageContext("android/soong/selinux")
+)
diff --git a/build/soong/selinux_contexts.go b/build/soong/selinux_contexts.go
new file mode 100644
index 0000000..03f8f19
--- /dev/null
+++ b/build/soong/selinux_contexts.go
@@ -0,0 +1,374 @@
+// Copyright (C) 2019 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package selinux
+
+import (
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/google/blueprint/proptools"
+
+	"android/soong/android"
+)
+
+const (
+	coreMode     = "core"
+	recoveryMode = "recovery"
+)
+
+type selinuxContextsProperties struct {
+	// Filenames under sepolicy directories, which will be used to generate contexts file.
+	Srcs []string `android:"path"`
+
+	Product_variables struct {
+		Debuggable struct {
+			Srcs []string
+		}
+
+		Address_sanitize struct {
+			Srcs []string
+		}
+	}
+
+	// Whether reqd_mask directory is included to sepolicy directories or not.
+	Reqd_mask *bool
+
+	// Whether the comments in generated contexts file will be removed or not.
+	Remove_comment *bool
+
+	// Whether the result context file is sorted with fc_sort or not.
+	Fc_sort *bool
+
+	// Make this module available when building for recovery
+	Recovery_available *bool
+
+	InRecovery bool `blueprint:"mutated"`
+}
+
+type fileContextsProperties struct {
+	// flatten_apex can be used to specify additional sources of file_contexts.
+	// Apex paths, /system/apex/{apex_name}, will be amended to the paths of file_contexts
+	// entries.
+	Flatten_apex struct {
+		Srcs []string
+	}
+}
+
+type selinuxContextsModule struct {
+	android.ModuleBase
+
+	properties             selinuxContextsProperties
+	fileContextsProperties fileContextsProperties
+	build                  func(ctx android.ModuleContext, inputs android.Paths)
+	outputPath             android.ModuleGenPath
+	installPath            android.InstallPath
+}
+
+var (
+	reuseContextsDepTag = dependencyTag{name: "reuseContexts"}
+)
+
+func init() {
+	pctx.HostBinToolVariable("fc_sort", "fc_sort")
+
+	android.RegisterModuleType("file_contexts", fileFactory)
+	android.RegisterModuleType("hwservice_contexts", hwServiceFactory)
+	android.RegisterModuleType("property_contexts", propertyFactory)
+	android.RegisterModuleType("service_contexts", serviceFactory)
+
+	android.PreDepsMutators(func(ctx android.RegisterMutatorsContext) {
+		ctx.BottomUp("selinux_contexts", selinuxContextsMutator).Parallel()
+	})
+}
+
+func (m *selinuxContextsModule) inRecovery() bool {
+	return m.properties.InRecovery || m.ModuleBase.InstallInRecovery()
+}
+
+func (m *selinuxContextsModule) onlyInRecovery() bool {
+	return m.ModuleBase.InstallInRecovery()
+}
+
+func (m *selinuxContextsModule) InstallInRecovery() bool {
+	return m.inRecovery()
+}
+
+func (m *selinuxContextsModule) InstallInRoot() bool {
+	return m.inRecovery()
+}
+
+func (m *selinuxContextsModule) GenerateAndroidBuildActions(ctx android.ModuleContext) {
+	if m.inRecovery() {
+		// Installing context files at the root of the recovery partition
+		m.installPath = android.PathForModuleInstall(ctx)
+	} else {
+		m.installPath = android.PathForModuleInstall(ctx, "etc", "selinux")
+	}
+
+	if m.inRecovery() && !m.onlyInRecovery() {
+		dep := ctx.GetDirectDepWithTag(m.Name(), reuseContextsDepTag)
+
+		if reuseDeps, ok := dep.(*selinuxContextsModule); ok {
+			m.outputPath = reuseDeps.outputPath
+			ctx.InstallFile(m.installPath, m.Name(), m.outputPath)
+			return
+		}
+	}
+
+	var inputs android.Paths
+
+	ctx.VisitDirectDepsWithTag(android.SourceDepTag, func(dep android.Module) {
+		segroup, ok := dep.(*fileGroup)
+		if !ok {
+			ctx.ModuleErrorf("srcs dependency %q is not an selinux filegroup",
+				ctx.OtherModuleName(dep))
+			return
+		}
+
+		if ctx.ProductSpecific() {
+			inputs = append(inputs, segroup.ProductPrivateSrcs()...)
+		} else if ctx.SocSpecific() {
+			inputs = append(inputs, segroup.SystemVendorSrcs()...)
+			inputs = append(inputs, segroup.VendorSrcs()...)
+		} else if ctx.DeviceSpecific() {
+			inputs = append(inputs, segroup.OdmSrcs()...)
+		} else if ctx.SystemExtSpecific() {
+			inputs = append(inputs, segroup.SystemExtPrivateSrcs()...)
+		} else {
+			inputs = append(inputs, segroup.SystemPrivateSrcs()...)
+
+			if ctx.Config().ProductCompatibleProperty() {
+				inputs = append(inputs, segroup.SystemPublicSrcs()...)
+			}
+		}
+
+		if proptools.Bool(m.properties.Reqd_mask) {
+			inputs = append(inputs, segroup.SystemReqdMaskSrcs()...)
+		}
+	})
+
+	for _, src := range m.properties.Srcs {
+		// Module sources are handled above with VisitDirectDepsWithTag
+		if android.SrcIsModule(src) == "" {
+			inputs = append(inputs, android.PathForModuleSrc(ctx, src))
+		}
+	}
+
+	m.build(ctx, inputs)
+}
+
+func newModule() *selinuxContextsModule {
+	m := &selinuxContextsModule{}
+	m.AddProperties(
+		&m.properties,
+	)
+	android.InitAndroidArchModule(m, android.DeviceSupported, android.MultilibCommon)
+	android.AddLoadHook(m, func(ctx android.LoadHookContext) {
+		m.selinuxContextsHook(ctx)
+	})
+	return m
+}
+
+func (m *selinuxContextsModule) selinuxContextsHook(ctx android.LoadHookContext) {
+	// TODO: clean this up to use build/soong/android/variable.go after b/79249983
+	var srcs []string
+
+	if ctx.Config().Debuggable() {
+		srcs = append(srcs, m.properties.Product_variables.Debuggable.Srcs...)
+	}
+
+	for _, sanitize := range ctx.Config().SanitizeDevice() {
+		if sanitize == "address" {
+			srcs = append(srcs, m.properties.Product_variables.Address_sanitize.Srcs...)
+			break
+		}
+	}
+
+	m.properties.Srcs = append(m.properties.Srcs, srcs...)
+}
+
+func (m *selinuxContextsModule) AndroidMk() android.AndroidMkData {
+	return android.AndroidMkData{
+		Custom: func(w io.Writer, name, prefix, moduleDir string, data android.AndroidMkData) {
+			nameSuffix := ""
+			if m.inRecovery() && !m.onlyInRecovery() {
+				nameSuffix = ".recovery"
+			}
+			fmt.Fprintln(w, "\ninclude $(CLEAR_VARS)")
+			fmt.Fprintln(w, "LOCAL_PATH :=", moduleDir)
+			fmt.Fprintln(w, "LOCAL_MODULE :=", name+nameSuffix)
+			fmt.Fprintln(w, "LOCAL_MODULE_CLASS := ETC")
+			if m.Owner() != "" {
+				fmt.Fprintln(w, "LOCAL_MODULE_OWNER :=", m.Owner())
+			}
+			fmt.Fprintln(w, "LOCAL_MODULE_TAGS := optional")
+			fmt.Fprintln(w, "LOCAL_PREBUILT_MODULE_FILE :=", m.outputPath.String())
+			fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", m.installPath.ToMakePath().String())
+			fmt.Fprintln(w, "LOCAL_INSTALLED_MODULE_STEM :=", name)
+			fmt.Fprintln(w, "include $(BUILD_PREBUILT)")
+		},
+	}
+}
+
+func selinuxContextsMutator(ctx android.BottomUpMutatorContext) {
+	m, ok := ctx.Module().(*selinuxContextsModule)
+	if !ok {
+		return
+	}
+
+	var coreVariantNeeded bool = true
+	var recoveryVariantNeeded bool = false
+	if proptools.Bool(m.properties.Recovery_available) {
+		recoveryVariantNeeded = true
+	}
+
+	if m.ModuleBase.InstallInRecovery() {
+		recoveryVariantNeeded = true
+		coreVariantNeeded = false
+	}
+
+	var variants []string
+	if coreVariantNeeded {
+		variants = append(variants, coreMode)
+	}
+	if recoveryVariantNeeded {
+		variants = append(variants, recoveryMode)
+	}
+	mod := ctx.CreateVariations(variants...)
+
+	for i, v := range variants {
+		if v == recoveryMode {
+			m := mod[i].(*selinuxContextsModule)
+			m.properties.InRecovery = true
+
+			if coreVariantNeeded {
+				ctx.AddInterVariantDependency(reuseContextsDepTag, m, mod[i-1])
+			}
+		}
+	}
+}
+
+func (m *selinuxContextsModule) buildGeneralContexts(ctx android.ModuleContext, inputs android.Paths) {
+	m.outputPath = android.PathForModuleGen(ctx, ctx.ModuleName()+"_m4out")
+
+	rule := android.NewRuleBuilder()
+
+	rule.Command().
+		Tool(ctx.Config().PrebuiltBuildTool(ctx, "m4")).
+		Text("--fatal-warnings -s").
+		FlagForEachArg("-D", ctx.DeviceConfig().SepolicyM4Defs()).
+		Inputs(inputs).
+		FlagWithOutput("> ", m.outputPath)
+
+	if proptools.Bool(m.properties.Remove_comment) {
+		rule.Temporary(m.outputPath)
+
+		remove_comment_output := android.PathForModuleGen(ctx, ctx.ModuleName()+"_remove_comment")
+
+		rule.Command().
+			Text("sed -e 's/#.*$//' -e '/^$/d'").
+			Input(m.outputPath).
+			FlagWithOutput("> ", remove_comment_output)
+
+		m.outputPath = remove_comment_output
+	}
+
+	if proptools.Bool(m.properties.Fc_sort) {
+		rule.Temporary(m.outputPath)
+
+		sorted_output := android.PathForModuleGen(ctx, ctx.ModuleName()+"_sorted")
+
+		rule.Command().
+			Tool(ctx.Config().HostToolPath(ctx, "fc_sort")).
+			FlagWithInput("-i ", m.outputPath).
+			FlagWithOutput("-o ", sorted_output)
+
+		m.outputPath = sorted_output
+	}
+
+	rule.Build(pctx, ctx, "selinux_contexts", m.Name())
+
+	rule.DeleteTemporaryFiles()
+
+	ctx.InstallFile(m.installPath, ctx.ModuleName(), m.outputPath)
+}
+
+func (m *selinuxContextsModule) buildFileContexts(ctx android.ModuleContext, inputs android.Paths) {
+	if m.properties.Fc_sort == nil {
+		m.properties.Fc_sort = proptools.BoolPtr(true)
+	}
+
+	rule := android.NewRuleBuilder()
+
+	if ctx.Config().FlattenApex() {
+		for _, src := range m.fileContextsProperties.Flatten_apex.Srcs {
+			if m := android.SrcIsModule(src); m != "" {
+				ctx.ModuleErrorf(
+					"Module srcs dependency %q is not supported for flatten_apex.srcs", m)
+				return
+			}
+			for _, path := range android.PathsForModuleSrcExcludes(ctx, []string{src}, nil) {
+				out := android.PathForModuleGen(ctx, "flattened_apex", path.Rel())
+				apex_path := "/system/apex/" + strings.Replace(
+					strings.TrimSuffix(path.Base(), "-file_contexts"),
+					".", "\\\\.", -1)
+
+				rule.Command().
+					Text("awk '/object_r/{printf(\""+apex_path+"%s\\n\",$0)}'").
+					Input(path).
+					FlagWithOutput("> ", out)
+
+				inputs = append(inputs, out)
+			}
+		}
+	}
+
+	rule.Build(pctx, ctx, m.Name(), "flattened_apex_file_contexts")
+	m.buildGeneralContexts(ctx, inputs)
+}
+
+func fileFactory() android.Module {
+	m := newModule()
+	m.AddProperties(&m.fileContextsProperties)
+	m.build = m.buildFileContexts
+	return m
+}
+
+func (m *selinuxContextsModule) buildHwServiceContexts(ctx android.ModuleContext, inputs android.Paths) {
+	if m.properties.Remove_comment == nil {
+		m.properties.Remove_comment = proptools.BoolPtr(true)
+	}
+
+	m.buildGeneralContexts(ctx, inputs)
+}
+
+func hwServiceFactory() android.Module {
+	m := newModule()
+	m.build = m.buildHwServiceContexts
+	return m
+}
+
+func propertyFactory() android.Module {
+	m := newModule()
+	m.build = m.buildGeneralContexts
+	return m
+}
+
+func serviceFactory() android.Module {
+	m := newModule()
+	m.build = m.buildGeneralContexts
+	return m
+}
diff --git a/compat.mk b/compat.mk
new file mode 100644
index 0000000..5e6dc41
--- /dev/null
+++ b/compat.mk
@@ -0,0 +1,48 @@
+version := $(version_under_treble_tests)
+
+include $(CLEAR_VARS)
+#################################
+# build this target to ensure the compat permissions files all build against the current policy
+#
+LOCAL_MODULE := $(version)_compat_test
+LOCAL_REQUIRED_MODULES := $(version).compat.cil
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+all_cil_files := \
+    $(built_plat_cil) \
+    $(built_plat_mapping_cil) \
+    $(built_pub_vers_cil) \
+    $(built_vendor_cil) \
+    $(ALL_MODULES.$(version).compat.cil.BUILT) \
+
+ifdef HAS_SYSTEM_EXT_SEPOLICY
+all_cil_files += $(built_system_ext_cil)
+endif
+
+ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
+all_cil_files += $(built_system_ext_mapping_cil)
+endif
+
+ifdef HAS_PRODUCT_SEPOLICY
+all_cil_files += $(built_product_cil)
+endif
+
+ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
+all_cil_files += $(built_product_mapping_cil)
+endif
+
+ifdef BOARD_ODM_SEPOLICY_DIRS
+all_cil_files += $(built_odm_cil)
+endif
+
+$(LOCAL_BUILT_MODULE): PRIVATE_CIL_FILES := $(all_cil_files)
+$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/secilc $(HOST_OUT_EXECUTABLES)/sepolicy-analyze $(all_cil_files)
+	@mkdir -p $(dir $@)
+	$(hide) $< -m -N -M true -G -c $(POLICYVERS) $(PRIVATE_CIL_FILES) -o $@ -f /dev/null
+
+all_cil_files :=
+version :=
+version_under_treble_tests :=
diff --git a/contexts_tests.mk b/contexts_tests.mk
new file mode 100644
index 0000000..da5dd83
--- /dev/null
+++ b/contexts_tests.mk
@@ -0,0 +1,289 @@
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+include $(CLEAR_VARS)
+
+# TODO: move tests into Soong after refactoring sepolicy module (b/130693869)
+
+# Run host-side test with contexts files and the sepolicy file.
+# $(1): paths to contexts files
+# $(2): path to the host tool
+# $(3): additional argument to be passed to the tool
+define run_contexts_test
+$$(LOCAL_BUILT_MODULE): PRIVATE_CONTEXTS := $(1)
+$$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $$(built_sepolicy)
+$$(LOCAL_BUILT_MODULE): $(2) $(1) $$(built_sepolicy)
+	$$(hide) $$< $(3) $$(PRIVATE_SEPOLICY) $$(PRIVATE_CONTEXTS)
+	$$(hide) mkdir -p $$(dir $$@)
+	$$(hide) touch $$@
+endef
+
+system_out := $(TARGET_OUT)/etc/selinux
+system_ext_out := $(TARGET_OUT_SYSTEM_EXT)/etc/selinux
+product_out := $(TARGET_OUT_PRODUCT)/etc/selinux
+vendor_out := $(TARGET_OUT_VENDOR)/etc/selinux
+odm_out := $(TARGET_OUT_ODM)/etc/selinux
+
+checkfc := $(HOST_OUT_EXECUTABLES)/checkfc
+property_info_checker := $(HOST_OUT_EXECUTABLES)/property_info_checker
+
+##################################
+LOCAL_MODULE := plat_file_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(system_out)/plat_file_contexts, $(checkfc),))
+
+##################################
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := system_ext_file_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(system_ext_out)/system_ext_file_contexts, $(checkfc),))
+
+##################################
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := product_file_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(product_out)/product_file_contexts, $(checkfc),))
+
+##################################
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := vendor_file_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(vendor_out)/vendor_file_contexts, $(checkfc),))
+
+##################################
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := odm_file_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(odm_out)/odm_file_contexts, $(checkfc),))
+
+##################################
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := plat_hwservice_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(system_out)/plat_hwservice_contexts, $(checkfc), -e -l))
+
+##################################
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := system_ext_hwservice_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(system_ext_out)/system_ext_hwservice_contexts, $(checkfc), -e -l))
+
+##################################
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := product_hwservice_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(product_out)/product_hwservice_contexts, $(checkfc), -e -l))
+
+##################################
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := vendor_hwservice_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(vendor_out)/vendor_hwservice_contexts, $(checkfc), -e -l))
+
+##################################
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := odm_hwservice_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(odm_out)/odm_hwservice_contexts, $(checkfc), -e -l))
+
+##################################
+
+pc_files := $(system_out)/plat_property_contexts
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := plat_property_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(pc_files), $(property_info_checker),))
+
+##################################
+
+ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
+
+pc_files += $(system_ext_out)/system_ext_property_contexts
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := system_ext_property_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(pc_files), $(property_info_checker),))
+
+endif
+
+##################################
+
+pc_files += $(vendor_out)/vendor_property_contexts
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := vendor_property_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(pc_files), $(property_info_checker),))
+
+##################################
+
+ifdef BOARD_ODM_SEPOLICY_DIRS
+
+pc_files += $(odm_out)/odm_property_contexts
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := odm_property_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(pc_files), $(property_info_checker),))
+
+endif
+
+##################################
+
+ifdef HAS_PRODUCT_SEPOLICY_DIR
+
+pc_files += $(product_out)/product_property_contexts
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := product_property_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(pc_files), $(property_info_checker),))
+
+endif
+
+pc_files :=
+
+##################################
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := plat_service_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(system_out)/plat_service_contexts, $(checkfc), -s))
+
+##################################
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := system_ext_service_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(system_ext_out)/system_ext_service_contexts, $(checkfc), -s))
+
+##################################
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := product_service_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(product_out)/product_service_contexts, $(checkfc), -s))
+
+##################################
+# nonplat_service_contexts is only allowed on non-full-treble devices
+ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := vendor_service_contexts_test
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+$(eval $(call run_contexts_test, $(vendor_out)/vendor_service_contexts, $(checkfc), -s))
+
+endif
+
+system_out :=
+product_out :=
+vendor_out :=
+odm_out :=
+checkfc :=
+property_info_checker :=
+run_contexts_test :=
diff --git a/definitions.mk b/definitions.mk
index 16c8bd6..2ecdbdc 100644
--- a/definitions.mk
+++ b/definitions.mk
@@ -2,7 +2,7 @@
 # processed by checkpolicy
 define transform-policy-to-conf
 @mkdir -p $(dir $@)
-$(hide) m4 --fatal-warnings $(PRIVATE_ADDITIONAL_M4DEFS) \
+$(hide) $(M4) --fatal-warnings $(PRIVATE_ADDITIONAL_M4DEFS) \
 	-D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
 	-D target_build_variant=$(PRIVATE_TARGET_BUILD_VARIANT) \
 	-D target_with_dexpreopt=$(WITH_DEXPREOPT) \
@@ -11,8 +11,10 @@
 	-D target_with_native_coverage=$(PRIVATE_TGT_WITH_NATIVE_COVERAGE) \
 	-D target_full_treble=$(PRIVATE_SEPOLICY_SPLIT) \
 	-D target_compatible_property=$(PRIVATE_COMPATIBLE_PROPERTY) \
+	-D target_treble_sysprop_neverallow=$(PRIVATE_TREBLE_SYSPROP_NEVERALLOW) \
 	-D target_exclude_build_test=$(PRIVATE_EXCLUDE_BUILD_TEST) \
+	-D target_requires_insecure_execmem_for_swiftshader=$(PRODUCT_REQUIRES_INSECURE_EXECMEM_FOR_SWIFTSHADER) \
 	$(PRIVATE_TGT_RECOVERY) \
-	-s $^ > $@
+	-s $(PRIVATE_POLICY_FILES) > $@
 endef
 .KATI_READONLY := transform-policy-to-conf
diff --git a/file_contexts.mk b/file_contexts.mk
deleted file mode 100644
index 267b68f..0000000
--- a/file_contexts.mk
+++ /dev/null
@@ -1,177 +0,0 @@
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := plat_file_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-local_fc_files := $(call build_policy, file_contexts, $(PLAT_PRIVATE_POLICY))
-ifneq ($(filter address,$(SANITIZE_TARGET)),)
-  local_fc_files += $(wildcard $(addsuffix /file_contexts_asan, $(PLAT_PRIVATE_POLICY)))
-endif
-ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
-  local_fc_files += $(wildcard $(addsuffix /file_contexts_overlayfs, $(PLAT_PRIVATE_POLICY)))
-endif
-ifeq ($(TARGET_FLATTEN_APEX),true)
-  apex_fc_files := $(wildcard $(LOCAL_PATH)/apex/*-file_contexts)
-  $(foreach _input,$(apex_fc_files),\
-    $(eval _output := $(intermediates)/$(notdir $(_input))-flattened)\
-    $(eval _apex_name := $(patsubst %-file_contexts,%,$(notdir $(_input))))\
-    $(eval $(call build_flattened_apex_file_contexts,$(_input),$(_apex_name),$(_output),local_fc_files))\
-   )
-endif
-local_fcfiles_with_nl := $(call add_nl, $(local_fc_files), $(built_nl))
-
-$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(local_fcfiles_with_nl)
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
-$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
-$(local_fcfiles_with_nl) $(built_sepolicy)
-	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_FC_FILES) > $@.tmp
-	$(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
-	$(hide) $(PRIVATE_FC_SORT) $@.tmp $@
-
-built_plat_fc := $(LOCAL_BUILT_MODULE)
-local_fc_files :=
-local_fcfiles_with_nl :=
-
-##################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := product_file_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-product_fc_files := $(call build_policy, file_contexts, $(PRODUCT_PRIVATE_POLICY))
-product_fcfiles_with_nl := $(call add_nl, $(product_fc_files), $(built_nl))
-
-$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(product_fcfiles_with_nl)
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
-$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
-$(product_fcfiles_with_nl) $(built_sepolicy)
-	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
-	$(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
-	$(hide) $(PRIVATE_FC_SORT) $@.tmp $@
-
-built_product_fc := $(LOCAL_BUILT_MODULE)
-product_fc_files :=
-product_fcfiles_with_nl :=
-
-##################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := vendor_file_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-vendor_fc_files := $(call build_vendor_policy, file_contexts)
-vendor_fcfiles_with_nl := $(call add_nl, $(vendor_fc_files), $(built_nl))
-
-$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(vendor_fcfiles_with_nl)
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
-$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
-$(vendor_fcfiles_with_nl) $(built_sepolicy)
-	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
-	$(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
-	$(hide) $(PRIVATE_FC_SORT) $@.tmp $@
-
-built_vendor_fc := $(LOCAL_BUILT_MODULE)
-vendor_fc_files :=
-vendor_fcfiles_with_nl :=
-
-##################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := odm_file_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-odm_fc_files := $(call build_odm_policy, file_contexts)
-odm_fcfiles_with_nl := $(call add_nl, $(odm_fc_files), $(built_nl))
-
-$(LOCAL_BUILT_MODULE): PRIVATE_FC_FILES := $(odm_fcfiles_with_nl)
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(LOCAL_BUILT_MODULE): PRIVATE_FC_SORT := $(HOST_OUT_EXECUTABLES)/fc_sort
-$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/checkfc $(HOST_OUT_EXECUTABLES)/fc_sort \
-$(odm_fcfiles_with_nl) $(built_sepolicy)
-	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_FC_FILES) > $@.tmp
-	$(hide) $< $(PRIVATE_SEPOLICY) $@.tmp
-	$(hide) $(PRIVATE_FC_SORT) $@.tmp $@
-
-built_odm_fc := $(LOCAL_BUILT_MODULE)
-odm_fc_files :=
-odm_fcfiles_with_nl :=
-
-##################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := plat_file_contexts.recovery
-LOCAL_MODULE_STEM := plat_file_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-$(LOCAL_BUILT_MODULE): $(built_plat_fc)
-	$(hide) cp -f $< $@
-
-##################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := product_file_contexts.recovery
-LOCAL_MODULE_STEM := product_file_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-$(LOCAL_BUILT_MODULE): $(built_product_fc)
-	$(hide) cp -f $< $@
-
-##################################
-include $(CLEAR_VARS)
-LOCAL_MODULE := vendor_file_contexts.recovery
-LOCAL_MODULE_STEM := vendor_file_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-$(LOCAL_BUILT_MODULE): $(built_vendor_fc)
-	$(hide) cp -f $< $@
-
-##################################
-include $(CLEAR_VARS)
-LOCAL_MODULE := odm_file_contexts.recovery
-LOCAL_MODULE_STEM := odm_file_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-$(LOCAL_BUILT_MODULE): $(built_odm_fc)
-	$(hide) cp -f $< $@
diff --git a/hwservice_contexts.mk b/hwservice_contexts.mk
deleted file mode 100644
index 15f404d..0000000
--- a/hwservice_contexts.mk
+++ /dev/null
@@ -1,110 +0,0 @@
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := plat_hwservice_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-plat_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_PRIVATE_POLICY))
-
-plat_hwservice_contexts.tmp := $(intermediates)/plat_hwservice_contexts.tmp
-$(plat_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(plat_hwsvcfiles)
-$(plat_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(plat_hwservice_contexts.tmp): $(plat_hwsvcfiles)
-	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
-
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): $(plat_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
-	@mkdir -p $(dir $@)
-	sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
-	$(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
-
-plat_hwsvcfiles :=
-plat_hwservice_contexts.tmp :=
-
-##################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := product_hwservice_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-product_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PRODUCT_PRIVATE_POLICY))
-
-product_hwservice_contexts.tmp := $(intermediates)/product_hwservice_contexts.tmp
-$(product_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(product_hwsvcfiles)
-$(product_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(product_hwservice_contexts.tmp): $(product_hwsvcfiles)
-	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
-
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): $(product_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
-	@mkdir -p $(dir $@)
-	sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
-	$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
-
-product_hwsvcfiles :=
-product_hwservice_contexts.tmp :=
-
-##################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := vendor_hwservice_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-vendor_hwsvcfiles := $(call build_policy, hwservice_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
-
-vendor_hwservice_contexts.tmp := $(intermediates)/vendor_hwservice_contexts.tmp
-$(vendor_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(vendor_hwsvcfiles)
-$(vendor_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(vendor_hwservice_contexts.tmp): $(vendor_hwsvcfiles)
-	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
-
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): $(vendor_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
-	@mkdir -p $(dir $@)
-	sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
-	$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
-
-vendor_hwsvcfiles :=
-vendor_hwservice_contexts.tmp :=
-
-##################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := odm_hwservice_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-odm_hwsvcfiles := $(call build_policy, hwservice_contexts, $(BOARD_ODM_SEPOLICY_DIRS))
-
-odm_hwservice_contexts.tmp := $(intermediates)/odm_hwservice_contexts.tmp
-$(odm_hwservice_contexts.tmp): PRIVATE_SVC_FILES := $(odm_hwsvcfiles)
-$(odm_hwservice_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(odm_hwservice_contexts.tmp): $(odm_hwsvcfiles)
-	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
-
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): $(odm_hwservice_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
-	@mkdir -p $(dir $@)
-	sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
-	$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e -l $(PRIVATE_SEPOLICY) $@
-
-odm_hwsvcfiles :=
-odm_hwservice_contexts.tmp :=
diff --git a/mac_permissions.mk b/mac_permissions.mk
index 889795c..3bcff95 100644
--- a/mac_permissions.mk
+++ b/mac_permissions.mk
@@ -7,33 +7,68 @@
 
 include $(BUILD_SYSTEM)/base_rules.mk
 
+all_plat_mac_perms_keys := $(call build_policy, keys.conf, $(PLAT_PRIVATE_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
+all_plat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_PRIVATE_POLICY))
+
 # Build keys.conf
 plat_mac_perms_keys.tmp := $(intermediates)/plat_keys.tmp
 $(plat_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(plat_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
+$(plat_mac_perms_keys.tmp): PRIVATE_KEYS := $(all_plat_mac_perms_keys)
+$(plat_mac_perms_keys.tmp): $(all_plat_mac_perms_keys) $(M4)
 	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
-
-all_plat_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_PRIVATE_POLICY))
+	$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_KEYS) > $@
 
 # Should be synced with keys.conf.
-all_plat_keys := platform media shared testkey
-all_plat_keys := $(all_keys:%=$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))/%.x509.pem)
+all_plat_keys := platform media networkstack shared testkey
+all_plat_keys := $(all_plat_keys:%=$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))/%.x509.pem)
 
 $(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_plat_mac_perms_files)
 $(LOCAL_BUILT_MODULE): $(plat_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
 $(all_plat_mac_perms_files) $(all_plat_keys)
 	@mkdir -p $(dir $@)
 	$(hide) DEFAULT_SYSTEM_DEV_CERTIFICATE="$(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))" \
+		MAINLINE_SEPOLICY_DEV_CERTIFICATES="$(MAINLINE_SEPOLICY_DEV_CERTIFICATES)" \
 		$(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
 
-all_mac_perms_files :=
 all_plat_keys :=
+all_plat_mac_perms_files :=
+all_plat_mac_perms_keys :=
 plat_mac_perms_keys.tmp :=
 
 ##################################
 include $(CLEAR_VARS)
 
+LOCAL_MODULE := system_ext_mac_permissions.xml
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_TAGS := optional
+LOCAL_MODULE_PATH := $(TARGET_OUT_SYSTEM_EXT)/etc/selinux
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+all_system_ext_mac_perms_keys := $(call build_policy, keys.conf, $(SYSTEM_EXT_PRIVATE_POLICY) $(REQD_MASK_POLICY))
+all_system_ext_mac_perms_files := $(call build_policy, mac_permissions.xml, $(SYSTEM_EXT_PRIVATE_POLICY) $(REQD_MASK_POLICY))
+
+# Build keys.conf
+system_ext_mac_perms_keys.tmp := $(intermediates)/system_ext_keys.tmp
+$(system_ext_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
+$(system_ext_mac_perms_keys.tmp): PRIVATE_KEYS := $(all_system_ext_mac_perms_keys)
+$(system_ext_mac_perms_keys.tmp): $(all_system_ext_mac_perms_keys)
+	@mkdir -p $(dir $@)
+	$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
+
+$(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_system_ext_mac_perms_files)
+$(LOCAL_BUILT_MODULE): $(system_ext_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
+$(all_system_ext_mac_perms_files)
+	@mkdir -p $(dir $@)
+	$(hide) $(HOST_OUT_EXECUTABLES)/insertkeys.py -t $(TARGET_BUILD_VARIANT) -c $(TOP) $< -o $@ $(PRIVATE_MAC_PERMS_FILES)
+
+system_ext_mac_perms_keys.tmp :=
+all_system_ext_mac_perms_files :=
+all_system_ext_mac_perms_keys :=
+
+##################################
+include $(CLEAR_VARS)
+
 LOCAL_MODULE := product_mac_permissions.xml
 LOCAL_MODULE_CLASS := ETC
 LOCAL_MODULE_TAGS := optional
@@ -41,14 +76,16 @@
 
 include $(BUILD_SYSTEM)/base_rules.mk
 
+all_product_mac_perms_keys := $(call build_policy, keys.conf, $(PRODUCT_PRIVATE_POLICY) $(REQD_MASK_POLICY))
+all_product_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PRODUCT_PRIVATE_POLICY) $(REQD_MASK_POLICY))
+
 # Build keys.conf
 product_mac_perms_keys.tmp := $(intermediates)/product_keys.tmp
 $(product_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(product_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PRODUCT_PRIVATE_POLICY) $(REQD_MASK_POLICY))
+$(product_mac_perms_keys.tmp): PRIVATE_KEYS := $(all_product_mac_perms_keys)
+$(product_mac_perms_keys.tmp): $(all_product_mac_perms_keys)
 	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
-
-all_product_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PRODUCT_PRIVATE_POLICY) $(REQD_MASK_POLICY))
+	$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
 
 $(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_product_mac_perms_files)
 $(LOCAL_BUILT_MODULE): $(product_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
@@ -58,6 +95,7 @@
 
 product_mac_perms_keys.tmp :=
 all_product_mac_perms_files :=
+all_product_mac_perms_keys :=
 
 ##################################
 include $(CLEAR_VARS)
@@ -69,14 +107,16 @@
 
 include $(BUILD_SYSTEM)/base_rules.mk
 
+all_vendor_mac_perms_keys := $(call build_policy, keys.conf, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
+all_vendor_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
+
 # Build keys.conf
 vendor_mac_perms_keys.tmp := $(intermediates)/vendor_keys.tmp
 $(vendor_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(vendor_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
+$(vendor_mac_perms_keys.tmp): PRIVATE_KEYS := $(all_vendor_mac_perms_keys)
+$(vendor_mac_perms_keys.tmp): $(all_vendor_mac_perms_keys) $(M4)
 	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
-
-all_vendor_mac_perms_files := $(call build_policy, mac_permissions.xml, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
+	$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_KEYS) > $@
 
 $(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_vendor_mac_perms_files)
 $(LOCAL_BUILT_MODULE): $(vendor_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
@@ -86,6 +126,7 @@
 
 vendor_mac_perms_keys.tmp :=
 all_vendor_mac_perms_files :=
+all_vendor_mac_perms_keys :=
 
 ##################################
 include $(CLEAR_VARS)
@@ -97,14 +138,16 @@
 
 include $(BUILD_SYSTEM)/base_rules.mk
 
+all_odm_mac_perms_keys := $(call build_policy, keys.conf, $(BOARD_ODM_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
+all_odm_mac_perms_files := $(call build_policy, mac_permissions.xml, $(BOARD_ODM_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
+
 # Build keys.conf
 odm_mac_perms_keys.tmp := $(intermediates)/odm_keys.tmp
 $(odm_mac_perms_keys.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(odm_mac_perms_keys.tmp): $(call build_policy, keys.conf, $(BOARD_ODM_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
+$(odm_mac_perms_keys.tmp): PRIVATE_KEYS := $(all_odm_mac_perms_keys)
+$(odm_mac_perms_keys.tmp): $(all_odm_mac_perms_keys) $(M4)
 	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $^ > $@
-
-all_odm_mac_perms_files := $(call build_policy, mac_permissions.xml, $(BOARD_ODM_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
+	$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_KEYS) > $@
 
 $(LOCAL_BUILT_MODULE): PRIVATE_MAC_PERMS_FILES := $(all_odm_mac_perms_files)
 $(LOCAL_BUILT_MODULE): $(odm_mac_perms_keys.tmp) $(HOST_OUT_EXECUTABLES)/insertkeys.py \
diff --git a/prebuilts/api/26.0/public/property.te b/prebuilts/api/26.0/public/property.te
index d6fa868..232872c 100644
--- a/prebuilts/api/26.0/public/property.te
+++ b/prebuilts/api/26.0/public/property.te
@@ -1,6 +1,7 @@
 type asan_reboot_prop, property_type;
 type audio_prop, property_type, core_property_type;
 type boottime_prop, property_type;
+type boottime_public_prop, property_type;
 type bluetooth_prop, property_type;
 type config_prop, property_type, core_property_type;
 type cppreopt_prop, property_type, core_property_type;
diff --git a/prebuilts/api/27.0/public/property.te b/prebuilts/api/27.0/public/property.te
index 95efcaa..2c716c5 100644
--- a/prebuilts/api/27.0/public/property.te
+++ b/prebuilts/api/27.0/public/property.te
@@ -1,5 +1,6 @@
 type audio_prop, property_type, core_property_type;
 type boottime_prop, property_type;
+type boottime_public_prop, property_type;
 type bluetooth_prop, property_type;
 type config_prop, property_type, core_property_type;
 type cppreopt_prop, property_type, core_property_type;
diff --git a/prebuilts/api/28.0/public/property.te b/prebuilts/api/28.0/public/property.te
index b0397e9..a4f0d87 100644
--- a/prebuilts/api/28.0/public/property.te
+++ b/prebuilts/api/28.0/public/property.te
@@ -1,5 +1,6 @@
 type audio_prop, property_type, core_property_type;
 type boottime_prop, property_type;
+type boottime_public_prop, property_type;
 type bluetooth_a2dp_offload_prop, property_type;
 type bluetooth_prop, property_type;
 type bootloader_boot_reason_prop, property_type;
diff --git a/prebuilts/api/29.0/plat_pub_versioned.cil b/prebuilts/api/29.0/plat_pub_versioned.cil
new file mode 100644
index 0000000..b80abeb
--- /dev/null
+++ b/prebuilts/api/29.0/plat_pub_versioned.cil
@@ -0,0 +1,2208 @@
+(type DockObserver_service)
+(type IProxyService_service)
+(type accessibility_service)
+(type account_service)
+(type activity_service)
+(type activity_task_service)
+(type adb_data_file)
+(type adb_keys_file)
+(type adb_service)
+(type adbd)
+(type adbd_exec)
+(type adbd_socket)
+(type alarm_service)
+(type anr_data_file)
+(type apex_data_file)
+(type apex_metadata_file)
+(type apex_mnt_dir)
+(type apex_service)
+(type apexd)
+(type apexd_exec)
+(type apexd_prop)
+(type apk_data_file)
+(type apk_private_data_file)
+(type apk_private_tmp_file)
+(type apk_tmp_file)
+(type app_binding_service)
+(type app_data_file)
+(type app_fuse_file)
+(type app_fusefs)
+(type app_prediction_service)
+(type app_zygote)
+(type app_zygote_tmpfs)
+(type appdomain_tmpfs)
+(type appops_service)
+(type appwidget_service)
+(type asec_apk_file)
+(type asec_image_file)
+(type asec_public_file)
+(type ashmem_device)
+(type ashmemd)
+(type assetatlas_service)
+(type audio_data_file)
+(type audio_device)
+(type audio_prop)
+(type audio_service)
+(type audiohal_data_file)
+(type audioserver)
+(type audioserver_data_file)
+(type audioserver_service)
+(type audioserver_tmpfs)
+(type autofill_service)
+(type backup_data_file)
+(type backup_service)
+(type battery_service)
+(type batteryproperties_service)
+(type batterystats_service)
+(type binder_calls_stats_service)
+(type binder_device)
+(type binfmt_miscfs)
+(type biometric_service)
+(type blkid)
+(type blkid_untrusted)
+(type block_device)
+(type bluetooth)
+(type bluetooth_a2dp_offload_prop)
+(type bluetooth_audio_hal_prop)
+(type bluetooth_data_file)
+(type bluetooth_efs_file)
+(type bluetooth_logs_data_file)
+(type bluetooth_manager_service)
+(type bluetooth_prop)
+(type bluetooth_service)
+(type bluetooth_socket)
+(type boot_block_device)
+(type bootanim)
+(type bootanim_exec)
+(type bootchart_data_file)
+(type bootloader_boot_reason_prop)
+(type bootstat)
+(type bootstat_data_file)
+(type bootstat_exec)
+(type boottime_prop)
+(type boottrace_data_file)
+(type bpf_progs_loaded_prop)
+(type broadcastradio_service)
+(type bufferhubd)
+(type bufferhubd_exec)
+(type bugreport_service)
+(type cache_backup_file)
+(type cache_block_device)
+(type cache_file)
+(type cache_private_backup_file)
+(type cache_recovery_file)
+(type camera_data_file)
+(type camera_device)
+(type cameraproxy_service)
+(type cameraserver)
+(type cameraserver_exec)
+(type cameraserver_service)
+(type cameraserver_tmpfs)
+(type cgroup)
+(type cgroup_bpf)
+(type cgroup_desc_file)
+(type cgroup_rc_file)
+(type charger)
+(type charger_exec)
+(type clatd)
+(type clatd_exec)
+(type clipboard_service)
+(type color_display_service)
+(type companion_device_service)
+(type config_prop)
+(type configfs)
+(type connectivity_service)
+(type connmetrics_service)
+(type console_device)
+(type consumer_ir_service)
+(type content_capture_service)
+(type content_service)
+(type content_suggestions_service)
+(type contexthub_service)
+(type coredump_file)
+(type country_detector_service)
+(type coverage_service)
+(type cppreopt_prop)
+(type cpu_variant_prop)
+(type cpuinfo_service)
+(type crash_dump)
+(type crash_dump_exec)
+(type crossprofileapps_service)
+(type ctl_adbd_prop)
+(type ctl_bootanim_prop)
+(type ctl_bugreport_prop)
+(type ctl_console_prop)
+(type ctl_default_prop)
+(type ctl_dumpstate_prop)
+(type ctl_fuse_prop)
+(type ctl_gsid_prop)
+(type ctl_interface_restart_prop)
+(type ctl_interface_start_prop)
+(type ctl_interface_stop_prop)
+(type ctl_mdnsd_prop)
+(type ctl_restart_prop)
+(type ctl_rildaemon_prop)
+(type ctl_sigstop_prop)
+(type ctl_start_prop)
+(type ctl_stop_prop)
+(type dalvik_prop)
+(type dalvikcache_data_file)
+(type dbinfo_service)
+(type debug_prop)
+(type debugfs)
+(type debugfs_mmc)
+(type debugfs_trace_marker)
+(type debugfs_tracing)
+(type debugfs_tracing_debug)
+(type debugfs_tracing_instances)
+(type debugfs_wakeup_sources)
+(type debugfs_wifi_tracing)
+(type debuggerd_prop)
+(type default_android_hwservice)
+(type default_android_service)
+(type default_android_vndservice)
+(type default_prop)
+(type dev_cpu_variant)
+(type device)
+(type device_config_activity_manager_native_boot_prop)
+(type device_config_boot_count_prop)
+(type device_config_input_native_boot_prop)
+(type device_config_media_native_prop)
+(type device_config_netd_native_prop)
+(type device_config_reset_performed_prop)
+(type device_config_runtime_native_boot_prop)
+(type device_config_runtime_native_prop)
+(type device_config_service)
+(type device_identifiers_service)
+(type device_logging_prop)
+(type device_policy_service)
+(type deviceidle_service)
+(type devicestoragemonitor_service)
+(type devpts)
+(type dhcp)
+(type dhcp_data_file)
+(type dhcp_exec)
+(type dhcp_prop)
+(type diskstats_service)
+(type display_service)
+(type dm_device)
+(type dnsmasq)
+(type dnsmasq_exec)
+(type dnsproxyd_socket)
+(type dnsresolver_service)
+(type dreams_service)
+(type drm_data_file)
+(type drmserver)
+(type drmserver_exec)
+(type drmserver_service)
+(type drmserver_socket)
+(type dropbox_data_file)
+(type dropbox_service)
+(type dumpstate)
+(type dumpstate_exec)
+(type dumpstate_options_prop)
+(type dumpstate_prop)
+(type dumpstate_service)
+(type dumpstate_socket)
+(type dynamic_system_prop)
+(type e2fs)
+(type e2fs_exec)
+(type efs_file)
+(type ephemeral_app)
+(type ethernet_service)
+(type exfat)
+(type exported2_config_prop)
+(type exported2_default_prop)
+(type exported2_radio_prop)
+(type exported2_system_prop)
+(type exported2_vold_prop)
+(type exported3_default_prop)
+(type exported3_radio_prop)
+(type exported3_system_prop)
+(type exported_audio_prop)
+(type exported_bluetooth_prop)
+(type exported_config_prop)
+(type exported_dalvik_prop)
+(type exported_default_prop)
+(type exported_dumpstate_prop)
+(type exported_ffs_prop)
+(type exported_fingerprint_prop)
+(type exported_overlay_prop)
+(type exported_pm_prop)
+(type exported_radio_prop)
+(type exported_secure_prop)
+(type exported_system_prop)
+(type exported_system_radio_prop)
+(type exported_vold_prop)
+(type exported_wifi_prop)
+(type external_vibrator_service)
+(type face_service)
+(type face_vendor_data_file)
+(type fastbootd)
+(type ffs_prop)
+(type file_contexts_file)
+(type fingerprint_prop)
+(type fingerprint_service)
+(type fingerprint_vendor_data_file)
+(type fingerprintd)
+(type fingerprintd_data_file)
+(type fingerprintd_exec)
+(type fingerprintd_service)
+(type firstboot_prop)
+(type flags_health_check)
+(type flags_health_check_exec)
+(type font_service)
+(type frp_block_device)
+(type fs_bpf)
+(type fsck)
+(type fsck_exec)
+(type fsck_untrusted)
+(type fscklogs)
+(type functionfs)
+(type fuse)
+(type fuse_device)
+(type fwk_bufferhub_hwservice)
+(type fwk_camera_hwservice)
+(type fwk_display_hwservice)
+(type fwk_scheduler_hwservice)
+(type fwk_sensor_hwservice)
+(type fwk_stats_hwservice)
+(type fwmarkd_socket)
+(type gatekeeper_data_file)
+(type gatekeeper_service)
+(type gatekeeperd)
+(type gatekeeperd_exec)
+(type gfxinfo_service)
+(type gps_control)
+(type gpu_device)
+(type gpu_service)
+(type gpuservice)
+(type graphics_device)
+(type graphicsstats_service)
+(type gsi_data_file)
+(type gsi_metadata_file)
+(type gsid_prop)
+(type hal_atrace_hwservice)
+(type hal_audio_hwservice)
+(type hal_audiocontrol_hwservice)
+(type hal_authsecret_hwservice)
+(type hal_bluetooth_hwservice)
+(type hal_bootctl_hwservice)
+(type hal_broadcastradio_hwservice)
+(type hal_camera_hwservice)
+(type hal_cas_hwservice)
+(type hal_codec2_hwservice)
+(type hal_configstore_ISurfaceFlingerConfigs)
+(type hal_confirmationui_hwservice)
+(type hal_contexthub_hwservice)
+(type hal_drm_hwservice)
+(type hal_dumpstate_hwservice)
+(type hal_evs_hwservice)
+(type hal_face_hwservice)
+(type hal_fingerprint_hwservice)
+(type hal_fingerprint_service)
+(type hal_gatekeeper_hwservice)
+(type hal_gnss_hwservice)
+(type hal_graphics_allocator_hwservice)
+(type hal_graphics_composer_hwservice)
+(type hal_graphics_composer_server_tmpfs)
+(type hal_graphics_mapper_hwservice)
+(type hal_health_hwservice)
+(type hal_health_storage_hwservice)
+(type hal_input_classifier_hwservice)
+(type hal_ir_hwservice)
+(type hal_keymaster_hwservice)
+(type hal_light_hwservice)
+(type hal_lowpan_hwservice)
+(type hal_memtrack_hwservice)
+(type hal_neuralnetworks_hwservice)
+(type hal_nfc_hwservice)
+(type hal_oemlock_hwservice)
+(type hal_omx_hwservice)
+(type hal_power_hwservice)
+(type hal_power_stats_hwservice)
+(type hal_renderscript_hwservice)
+(type hal_secure_element_hwservice)
+(type hal_sensors_hwservice)
+(type hal_telephony_hwservice)
+(type hal_tetheroffload_hwservice)
+(type hal_thermal_hwservice)
+(type hal_tv_cec_hwservice)
+(type hal_tv_input_hwservice)
+(type hal_usb_gadget_hwservice)
+(type hal_usb_hwservice)
+(type hal_vehicle_hwservice)
+(type hal_vibrator_hwservice)
+(type hal_vr_hwservice)
+(type hal_weaver_hwservice)
+(type hal_wifi_hostapd_hwservice)
+(type hal_wifi_hwservice)
+(type hal_wifi_offload_hwservice)
+(type hal_wifi_supplicant_hwservice)
+(type hardware_properties_service)
+(type hardware_service)
+(type hci_attach_dev)
+(type hdmi_control_service)
+(type healthd)
+(type healthd_exec)
+(type heapdump_data_file)
+(type heapprofd)
+(type heapprofd_enabled_prop)
+(type heapprofd_prop)
+(type heapprofd_socket)
+(type hidl_allocator_hwservice)
+(type hidl_base_hwservice)
+(type hidl_manager_hwservice)
+(type hidl_memory_hwservice)
+(type hidl_token_hwservice)
+(type hw_random_device)
+(type hwbinder_device)
+(type hwservice_contexts_file)
+(type hwservicemanager)
+(type hwservicemanager_exec)
+(type hwservicemanager_prop)
+(type icon_file)
+(type idmap)
+(type idmap_exec)
+(type idmap_service)
+(type iio_device)
+(type imms_service)
+(type incident)
+(type incident_data_file)
+(type incident_helper)
+(type incident_service)
+(type incidentd)
+(type init)
+(type init_exec)
+(type init_tmpfs)
+(type inotify)
+(type input_device)
+(type input_method_service)
+(type input_service)
+(type inputflinger)
+(type inputflinger_exec)
+(type inputflinger_service)
+(type install_data_file)
+(type install_recovery)
+(type install_recovery_exec)
+(type installd)
+(type installd_exec)
+(type installd_service)
+(type ion_device)
+(type iorapd)
+(type iorapd_data_file)
+(type iorapd_exec)
+(type iorapd_service)
+(type iorapd_tmpfs)
+(type ipsec_service)
+(type iris_service)
+(type iris_vendor_data_file)
+(type isolated_app)
+(type jobscheduler_service)
+(type kernel)
+(type keychain_data_file)
+(type keychord_device)
+(type keystore)
+(type keystore_data_file)
+(type keystore_exec)
+(type keystore_service)
+(type kmsg_debug_device)
+(type kmsg_device)
+(type labeledfs)
+(type last_boot_reason_prop)
+(type launcherapps_service)
+(type llkd)
+(type llkd_exec)
+(type llkd_prop)
+(type lmkd)
+(type lmkd_exec)
+(type lmkd_socket)
+(type location_service)
+(type lock_settings_service)
+(type log_prop)
+(type log_tag_prop)
+(type logcat_exec)
+(type logd)
+(type logd_exec)
+(type logd_prop)
+(type logd_socket)
+(type logdr_socket)
+(type logdw_socket)
+(type logpersist)
+(type logpersistd_logging_prop)
+(type loop_control_device)
+(type loop_device)
+(type looper_stats_service)
+(type lowpan_device)
+(type lowpan_prop)
+(type lowpan_service)
+(type lpdump_service)
+(type lpdumpd_prop)
+(type mac_perms_file)
+(type mdns_socket)
+(type mdnsd)
+(type mdnsd_socket)
+(type media_data_file)
+(type media_projection_service)
+(type media_router_service)
+(type media_rw_data_file)
+(type media_session_service)
+(type mediacodec_service)
+(type mediadrmserver)
+(type mediadrmserver_exec)
+(type mediadrmserver_service)
+(type mediaextractor)
+(type mediaextractor_exec)
+(type mediaextractor_service)
+(type mediaextractor_tmpfs)
+(type mediametrics)
+(type mediametrics_exec)
+(type mediametrics_service)
+(type mediaprovider)
+(type mediaserver)
+(type mediaserver_exec)
+(type mediaserver_service)
+(type mediaserver_tmpfs)
+(type mediaswcodec)
+(type mediaswcodec_exec)
+(type meminfo_service)
+(type metadata_block_device)
+(type metadata_file)
+(type method_trace_data_file)
+(type midi_service)
+(type misc_block_device)
+(type misc_logd_file)
+(type misc_user_data_file)
+(type mmc_prop)
+(type mnt_expand_file)
+(type mnt_media_rw_file)
+(type mnt_media_rw_stub_file)
+(type mnt_product_file)
+(type mnt_user_file)
+(type mnt_vendor_file)
+(type modprobe)
+(type mount_service)
+(type mqueue)
+(type mtp)
+(type mtp_device)
+(type mtp_exec)
+(type mtpd_socket)
+(type nativetest_data_file)
+(type net_data_file)
+(type net_dns_prop)
+(type net_radio_prop)
+(type netd)
+(type netd_exec)
+(type netd_listener_service)
+(type netd_service)
+(type netd_stable_secret_prop)
+(type netif)
+(type netpolicy_service)
+(type netstats_service)
+(type netutils_wrapper)
+(type netutils_wrapper_exec)
+(type network_management_service)
+(type network_score_service)
+(type network_stack)
+(type network_stack_service)
+(type network_time_update_service)
+(type network_watchlist_data_file)
+(type network_watchlist_service)
+(type nfc)
+(type nfc_data_file)
+(type nfc_device)
+(type nfc_prop)
+(type nfc_service)
+(type nnapi_ext_deny_product_prop)
+(type node)
+(type nonplat_service_contexts_file)
+(type notification_service)
+(type null_device)
+(type oem_lock_service)
+(type oemfs)
+(type ota_data_file)
+(type ota_package_file)
+(type otadexopt_service)
+(type overlay_prop)
+(type overlay_service)
+(type overlayfs_file)
+(type owntty_device)
+(type package_native_service)
+(type package_service)
+(type packages_list_file)
+(type pan_result_prop)
+(type password_slot_metadata_file)
+(type pdx_bufferhub_client_channel_socket)
+(type pdx_bufferhub_client_endpoint_socket)
+(type pdx_bufferhub_dir)
+(type pdx_display_client_channel_socket)
+(type pdx_display_client_endpoint_socket)
+(type pdx_display_dir)
+(type pdx_display_manager_channel_socket)
+(type pdx_display_manager_endpoint_socket)
+(type pdx_display_screenshot_channel_socket)
+(type pdx_display_screenshot_endpoint_socket)
+(type pdx_display_vsync_channel_socket)
+(type pdx_display_vsync_endpoint_socket)
+(type pdx_performance_client_channel_socket)
+(type pdx_performance_client_endpoint_socket)
+(type pdx_performance_dir)
+(type perfetto)
+(type performanced)
+(type performanced_exec)
+(type perfprofd)
+(type perfprofd_data_file)
+(type perfprofd_exec)
+(type perfprofd_service)
+(type permission_service)
+(type permissionmgr_service)
+(type persist_debug_prop)
+(type persistent_data_block_service)
+(type persistent_properties_ready_prop)
+(type pinner_service)
+(type pipefs)
+(type platform_app)
+(type pm_prop)
+(type pmsg_device)
+(type port)
+(type port_device)
+(type postinstall)
+(type postinstall_apex_mnt_dir)
+(type postinstall_file)
+(type postinstall_mnt_dir)
+(type power_service)
+(type powerctl_prop)
+(type ppp)
+(type ppp_device)
+(type ppp_exec)
+(type preloads_data_file)
+(type preloads_media_file)
+(type print_service)
+(type priv_app)
+(type privapp_data_file)
+(type proc)
+(type proc_abi)
+(type proc_asound)
+(type proc_bluetooth_writable)
+(type proc_buddyinfo)
+(type proc_cmdline)
+(type proc_cpuinfo)
+(type proc_dirty)
+(type proc_diskstats)
+(type proc_drop_caches)
+(type proc_extra_free_kbytes)
+(type proc_filesystems)
+(type proc_fs_verity)
+(type proc_hostname)
+(type proc_hung_task)
+(type proc_interrupts)
+(type proc_iomem)
+(type proc_keys)
+(type proc_kmsg)
+(type proc_loadavg)
+(type proc_max_map_count)
+(type proc_meminfo)
+(type proc_min_free_order_shift)
+(type proc_misc)
+(type proc_modules)
+(type proc_mounts)
+(type proc_net)
+(type proc_net_tcp_udp)
+(type proc_overcommit_memory)
+(type proc_page_cluster)
+(type proc_pagetypeinfo)
+(type proc_panic)
+(type proc_perf)
+(type proc_pid_max)
+(type proc_pipe_conf)
+(type proc_pressure_cpu)
+(type proc_pressure_io)
+(type proc_pressure_mem)
+(type proc_qtaguid_ctrl)
+(type proc_qtaguid_stat)
+(type proc_random)
+(type proc_sched)
+(type proc_security)
+(type proc_slabinfo)
+(type proc_stat)
+(type proc_swaps)
+(type proc_sysrq)
+(type proc_timer)
+(type proc_tty_drivers)
+(type proc_uid_concurrent_active_time)
+(type proc_uid_concurrent_policy_time)
+(type proc_uid_cpupower)
+(type proc_uid_cputime_removeuid)
+(type proc_uid_cputime_showstat)
+(type proc_uid_io_stats)
+(type proc_uid_procstat_set)
+(type proc_uid_time_in_state)
+(type proc_uptime)
+(type proc_version)
+(type proc_vmallocinfo)
+(type proc_vmstat)
+(type proc_zoneinfo)
+(type processinfo_service)
+(type procstats_service)
+(type profman)
+(type profman_dump_data_file)
+(type profman_exec)
+(type properties_device)
+(type properties_serial)
+(type property_contexts_file)
+(type property_data_file)
+(type property_info)
+(type property_socket)
+(type pstorefs)
+(type ptmx_device)
+(type qtaguid_device)
+(type racoon)
+(type racoon_exec)
+(type racoon_socket)
+(type radio)
+(type radio_data_file)
+(type radio_device)
+(type radio_prop)
+(type radio_service)
+(type ram_device)
+(type random_device)
+(type recovery)
+(type recovery_block_device)
+(type recovery_data_file)
+(type recovery_persist)
+(type recovery_persist_exec)
+(type recovery_refresh)
+(type recovery_refresh_exec)
+(type recovery_service)
+(type recovery_socket)
+(type registry_service)
+(type resourcecache_data_file)
+(type restorecon_prop)
+(type restrictions_service)
+(type rild_debug_socket)
+(type rild_socket)
+(type ringtone_file)
+(type role_service)
+(type rollback_service)
+(type root_block_device)
+(type rootfs)
+(type rpmsg_device)
+(type rs)
+(type rs_exec)
+(type rss_hwm_reset)
+(type rtc_device)
+(type rttmanager_service)
+(type runas)
+(type runas_app)
+(type runas_exec)
+(type runtime_event_log_tags_file)
+(type runtime_service)
+(type safemode_prop)
+(type same_process_hal_file)
+(type samplingprofiler_service)
+(type scheduling_policy_service)
+(type sdcard_block_device)
+(type sdcardd)
+(type sdcardd_exec)
+(type sdcardfs)
+(type seapp_contexts_file)
+(type search_service)
+(type sec_key_att_app_id_provider_service)
+(type secure_element)
+(type secure_element_device)
+(type secure_element_service)
+(type selinuxfs)
+(type sensor_privacy_service)
+(type sensors_device)
+(type sensorservice_service)
+(type sepolicy_file)
+(type serial_device)
+(type serial_service)
+(type serialno_prop)
+(type server_configurable_flags_data_file)
+(type service_contexts_file)
+(type servicediscovery_service)
+(type servicemanager)
+(type servicemanager_exec)
+(type settings_service)
+(type sgdisk)
+(type sgdisk_exec)
+(type shared_relro)
+(type shared_relro_file)
+(type shell)
+(type shell_data_file)
+(type shell_exec)
+(type shell_prop)
+(type shm)
+(type shortcut_manager_icons)
+(type shortcut_service)
+(type simpleperf_app_runner)
+(type simpleperf_app_runner_exec)
+(type slice_service)
+(type slideshow)
+(type socket_device)
+(type sockfs)
+(type staging_data_file)
+(type stats_data_file)
+(type statsd)
+(type statsd_exec)
+(type statsdw_socket)
+(type statusbar_service)
+(type storage_file)
+(type storage_stub_file)
+(type storaged_service)
+(type storagestats_service)
+(type su)
+(type su_exec)
+(type super_block_device)
+(type surfaceflinger)
+(type surfaceflinger_service)
+(type surfaceflinger_tmpfs)
+(type swap_block_device)
+(type sysfs)
+(type sysfs_android_usb)
+(type sysfs_batteryinfo)
+(type sysfs_bluetooth_writable)
+(type sysfs_devices_block)
+(type sysfs_devices_system_cpu)
+(type sysfs_dm)
+(type sysfs_dt_firmware_android)
+(type sysfs_extcon)
+(type sysfs_fs_ext4_features)
+(type sysfs_fs_f2fs)
+(type sysfs_hwrandom)
+(type sysfs_ipv4)
+(type sysfs_kernel_notes)
+(type sysfs_leds)
+(type sysfs_loop)
+(type sysfs_lowmemorykiller)
+(type sysfs_mac_address)
+(type sysfs_net)
+(type sysfs_nfc_power_writable)
+(type sysfs_power)
+(type sysfs_rtc)
+(type sysfs_switch)
+(type sysfs_thermal)
+(type sysfs_transparent_hugepage)
+(type sysfs_uio)
+(type sysfs_usb)
+(type sysfs_usermodehelper)
+(type sysfs_vibrator)
+(type sysfs_wake_lock)
+(type sysfs_wakeup_reasons)
+(type sysfs_wlan_fwpath)
+(type sysfs_zram)
+(type sysfs_zram_uevent)
+(type system_app)
+(type system_app_data_file)
+(type system_app_service)
+(type system_asan_options_file)
+(type system_block_device)
+(type system_boot_reason_prop)
+(type system_bootstrap_lib_file)
+(type system_data_file)
+(type system_event_log_tags_file)
+(type system_file)
+(type system_lib_file)
+(type system_linker_config_file)
+(type system_linker_exec)
+(type system_lmk_prop)
+(type system_ndebug_socket)
+(type system_net_netd_hwservice)
+(type system_prop)
+(type system_radio_prop)
+(type system_seccomp_policy_file)
+(type system_security_cacerts_file)
+(type system_server)
+(type system_server_tmpfs)
+(type system_suspend_control_service)
+(type system_suspend_hwservice)
+(type system_trace_prop)
+(type system_update_service)
+(type system_wifi_keystore_hwservice)
+(type system_wpa_socket)
+(type system_zoneinfo_file)
+(type systemkeys_data_file)
+(type task_profiles_file)
+(type task_service)
+(type tcpdump_exec)
+(type tee)
+(type tee_data_file)
+(type tee_device)
+(type telecom_service)
+(type test_boot_reason_prop)
+(type test_harness_prop)
+(type testharness_service)
+(type textclassification_service)
+(type textclassifier_data_file)
+(type textservices_service)
+(type thermal_service)
+(type thermalcallback_hwservice)
+(type time_prop)
+(type timedetector_service)
+(type timezone_service)
+(type tmpfs)
+(type tombstone_data_file)
+(type tombstone_wifi_data_file)
+(type tombstoned)
+(type tombstoned_crash_socket)
+(type tombstoned_exec)
+(type tombstoned_intercept_socket)
+(type tombstoned_java_trace_socket)
+(type toolbox)
+(type toolbox_exec)
+(type trace_data_file)
+(type traced)
+(type traced_consumer_socket)
+(type traced_enabled_prop)
+(type traced_lazy_prop)
+(type traced_probes)
+(type traced_producer_socket)
+(type traceur_app)
+(type trust_service)
+(type tty_device)
+(type tun_device)
+(type tv_input_service)
+(type tzdatacheck)
+(type tzdatacheck_exec)
+(type ueventd)
+(type ueventd_tmpfs)
+(type uhid_device)
+(type uimode_service)
+(type uio_device)
+(type uncrypt)
+(type uncrypt_exec)
+(type uncrypt_socket)
+(type unencrypted_data_file)
+(type unlabeled)
+(type untrusted_app)
+(type untrusted_app_25)
+(type untrusted_app_27)
+(type update_engine)
+(type update_engine_data_file)
+(type update_engine_exec)
+(type update_engine_log_data_file)
+(type update_engine_service)
+(type update_verifier)
+(type update_verifier_exec)
+(type updatelock_service)
+(type uri_grants_service)
+(type usagestats_service)
+(type usb_device)
+(type usb_service)
+(type usbaccessory_device)
+(type usbd)
+(type usbd_exec)
+(type usbfs)
+(type use_memfd_prop)
+(type user_profile_data_file)
+(type user_service)
+(type userdata_block_device)
+(type usermodehelper)
+(type vdc)
+(type vdc_exec)
+(type vendor_app_file)
+(type vendor_cgroup_desc_file)
+(type vendor_configs_file)
+(type vendor_data_file)
+(type vendor_default_prop)
+(type vendor_file)
+(type vendor_framework_file)
+(type vendor_hal_file)
+(type vendor_idc_file)
+(type vendor_init)
+(type vendor_keychars_file)
+(type vendor_keylayout_file)
+(type vendor_overlay_file)
+(type vendor_public_lib_file)
+(type vendor_security_patch_level_prop)
+(type vendor_shell)
+(type vendor_shell_exec)
+(type vendor_task_profiles_file)
+(type vendor_toolbox_exec)
+(type vfat)
+(type vibrator_service)
+(type video_device)
+(type virtual_touchpad)
+(type virtual_touchpad_exec)
+(type virtual_touchpad_service)
+(type vndbinder_device)
+(type vndk_sp_file)
+(type vndservice_contexts_file)
+(type vndservicemanager)
+(type voiceinteraction_service)
+(type vold)
+(type vold_data_file)
+(type vold_device)
+(type vold_exec)
+(type vold_metadata_file)
+(type vold_prepare_subdirs)
+(type vold_prepare_subdirs_exec)
+(type vold_prop)
+(type vold_service)
+(type vpn_data_file)
+(type vr_hwc)
+(type vr_hwc_exec)
+(type vr_hwc_service)
+(type vr_manager_service)
+(type vrflinger_vsync_service)
+(type wallpaper_file)
+(type wallpaper_service)
+(type watchdog_device)
+(type watchdogd)
+(type watchdogd_exec)
+(type webview_zygote)
+(type webview_zygote_exec)
+(type webview_zygote_tmpfs)
+(type webviewupdate_service)
+(type wifi_data_file)
+(type wifi_log_prop)
+(type wifi_prop)
+(type wifi_service)
+(type wifiaware_service)
+(type wificond)
+(type wificond_exec)
+(type wificond_service)
+(type wifip2p_service)
+(type wifiscanner_service)
+(type window_service)
+(type wpa_socket)
+(type wpantund)
+(type wpantund_exec)
+(type wpantund_service)
+(type zero_device)
+(type zoneinfo_data_file)
+(type zygote)
+(type zygote_exec)
+(type zygote_socket)
+(type zygote_tmpfs)
+(typeattribute DockObserver_service_29_0)
+(typeattribute IProxyService_service_29_0)
+(typeattribute accessibility_service_29_0)
+(typeattribute account_service_29_0)
+(typeattribute activity_service_29_0)
+(typeattribute activity_task_service_29_0)
+(typeattribute adb_data_file_29_0)
+(typeattribute adb_keys_file_29_0)
+(typeattribute adb_service_29_0)
+(typeattribute adbd_29_0)
+(typeattribute adbd_exec_29_0)
+(typeattribute adbd_socket_29_0)
+(typeattribute alarm_service_29_0)
+(typeattribute anr_data_file_29_0)
+(typeattribute apex_data_file_29_0)
+(typeattribute apex_metadata_file_29_0)
+(typeattribute apex_mnt_dir_29_0)
+(typeattribute apex_service_29_0)
+(typeattribute apexd_29_0)
+(typeattribute apexd_exec_29_0)
+(typeattribute apexd_prop_29_0)
+(typeattribute apk_data_file_29_0)
+(typeattribute apk_private_data_file_29_0)
+(typeattribute apk_private_tmp_file_29_0)
+(typeattribute apk_tmp_file_29_0)
+(typeattribute app_api_service)
+(typeattribute app_binding_service_29_0)
+(typeattribute app_data_file_29_0)
+(typeattribute app_fuse_file_29_0)
+(typeattribute app_fusefs_29_0)
+(typeattribute app_prediction_service_29_0)
+(typeattribute app_zygote_29_0)
+(typeattribute app_zygote_tmpfs_29_0)
+(typeattribute appdomain)
+(typeattribute appdomain_tmpfs_29_0)
+(typeattribute appops_service_29_0)
+(typeattribute appwidget_service_29_0)
+(typeattribute asec_apk_file_29_0)
+(typeattribute asec_image_file_29_0)
+(typeattribute asec_public_file_29_0)
+(typeattribute ashmem_device_29_0)
+(typeattribute ashmemd_29_0)
+(typeattribute assetatlas_service_29_0)
+(typeattribute audio_data_file_29_0)
+(typeattribute audio_device_29_0)
+(typeattribute audio_prop_29_0)
+(typeattribute audio_service_29_0)
+(typeattribute audiohal_data_file_29_0)
+(typeattribute audioserver_29_0)
+(typeattribute audioserver_data_file_29_0)
+(typeattribute audioserver_service_29_0)
+(typeattribute audioserver_tmpfs_29_0)
+(typeattribute autofill_service_29_0)
+(typeattribute backup_data_file_29_0)
+(typeattribute backup_service_29_0)
+(typeattribute battery_service_29_0)
+(typeattribute batteryproperties_service_29_0)
+(typeattribute batterystats_service_29_0)
+(typeattribute binder_calls_stats_service_29_0)
+(typeattribute binder_device_29_0)
+(typeattribute binder_in_vendor_violators)
+(typeattribute binderservicedomain)
+(typeattribute binfmt_miscfs_29_0)
+(typeattribute biometric_service_29_0)
+(typeattribute blkid_29_0)
+(typeattribute blkid_untrusted_29_0)
+(typeattribute block_device_29_0)
+(typeattribute bluetooth_29_0)
+(typeattribute bluetooth_a2dp_offload_prop_29_0)
+(typeattribute bluetooth_audio_hal_prop_29_0)
+(typeattribute bluetooth_data_file_29_0)
+(typeattribute bluetooth_efs_file_29_0)
+(typeattribute bluetooth_logs_data_file_29_0)
+(typeattribute bluetooth_manager_service_29_0)
+(typeattribute bluetooth_prop_29_0)
+(typeattribute bluetooth_service_29_0)
+(typeattribute bluetooth_socket_29_0)
+(typeattribute bluetoothdomain)
+(typeattribute boot_block_device_29_0)
+(typeattribute bootanim_29_0)
+(typeattribute bootanim_exec_29_0)
+(typeattribute bootchart_data_file_29_0)
+(typeattribute bootloader_boot_reason_prop_29_0)
+(typeattribute bootstat_29_0)
+(typeattribute bootstat_data_file_29_0)
+(typeattribute bootstat_exec_29_0)
+(typeattribute boottime_prop_29_0)
+(typeattribute boottrace_data_file_29_0)
+(typeattribute bpf_progs_loaded_prop_29_0)
+(typeattribute broadcastradio_service_29_0)
+(typeattribute bufferhubd_29_0)
+(typeattribute bufferhubd_exec_29_0)
+(typeattribute bugreport_service_29_0)
+(typeattribute cache_backup_file_29_0)
+(typeattribute cache_block_device_29_0)
+(typeattribute cache_file_29_0)
+(typeattribute cache_private_backup_file_29_0)
+(typeattribute cache_recovery_file_29_0)
+(typeattribute camera_data_file_29_0)
+(typeattribute camera_device_29_0)
+(typeattribute camera_service_server)
+(typeattribute cameraproxy_service_29_0)
+(typeattribute cameraserver_29_0)
+(typeattribute cameraserver_exec_29_0)
+(typeattribute cameraserver_service_29_0)
+(typeattribute cameraserver_tmpfs_29_0)
+(typeattribute cgroup_29_0)
+(typeattribute cgroup_bpf_29_0)
+(typeattribute cgroup_desc_file_29_0)
+(typeattribute cgroup_rc_file_29_0)
+(typeattribute charger_29_0)
+(typeattribute charger_exec_29_0)
+(typeattribute clatd_29_0)
+(typeattribute clatd_exec_29_0)
+(typeattribute clipboard_service_29_0)
+(typeattribute color_display_service_29_0)
+(typeattribute companion_device_service_29_0)
+(typeattribute config_prop_29_0)
+(typeattribute configfs_29_0)
+(typeattribute connectivity_service_29_0)
+(typeattribute connmetrics_service_29_0)
+(typeattribute console_device_29_0)
+(typeattribute consumer_ir_service_29_0)
+(typeattribute content_capture_service_29_0)
+(typeattribute content_service_29_0)
+(typeattribute content_suggestions_service_29_0)
+(typeattribute contexthub_service_29_0)
+(typeattribute contextmount_type)
+(typeattribute core_data_file_type)
+(typeattribute core_property_type)
+(typeattribute coredomain)
+(typeattribute coredomain_hwservice)
+(typeattribute coredomain_socket)
+(typeattribute coredump_file_29_0)
+(typeattribute country_detector_service_29_0)
+(typeattribute coverage_service_29_0)
+(typeattribute cppreopt_prop_29_0)
+(typeattribute cpu_variant_prop_29_0)
+(typeattribute cpuinfo_service_29_0)
+(typeattribute crash_dump_29_0)
+(typeattribute crash_dump_exec_29_0)
+(typeattribute crossprofileapps_service_29_0)
+(typeattribute ctl_adbd_prop_29_0)
+(typeattribute ctl_bootanim_prop_29_0)
+(typeattribute ctl_bugreport_prop_29_0)
+(typeattribute ctl_console_prop_29_0)
+(typeattribute ctl_default_prop_29_0)
+(typeattribute ctl_dumpstate_prop_29_0)
+(typeattribute ctl_fuse_prop_29_0)
+(typeattribute ctl_gsid_prop_29_0)
+(typeattribute ctl_interface_restart_prop_29_0)
+(typeattribute ctl_interface_start_prop_29_0)
+(typeattribute ctl_interface_stop_prop_29_0)
+(typeattribute ctl_mdnsd_prop_29_0)
+(typeattribute ctl_restart_prop_29_0)
+(typeattribute ctl_rildaemon_prop_29_0)
+(typeattribute ctl_sigstop_prop_29_0)
+(typeattribute ctl_start_prop_29_0)
+(typeattribute ctl_stop_prop_29_0)
+(typeattribute dalvik_prop_29_0)
+(typeattribute dalvikcache_data_file_29_0)
+(typeattribute data_between_core_and_vendor_violators)
+(typeattribute data_file_type)
+(typeattribute dbinfo_service_29_0)
+(typeattribute debug_prop_29_0)
+(typeattribute debugfs_29_0)
+(typeattribute debugfs_mmc_29_0)
+(typeattribute debugfs_trace_marker_29_0)
+(typeattribute debugfs_tracing_29_0)
+(typeattribute debugfs_tracing_debug_29_0)
+(typeattribute debugfs_tracing_instances_29_0)
+(typeattribute debugfs_type)
+(typeattribute debugfs_wakeup_sources_29_0)
+(typeattribute debugfs_wifi_tracing_29_0)
+(typeattribute debuggerd_prop_29_0)
+(typeattribute default_android_hwservice_29_0)
+(typeattribute default_android_service_29_0)
+(typeattribute default_android_vndservice_29_0)
+(typeattribute default_prop_29_0)
+(typeattribute dev_cpu_variant_29_0)
+(typeattribute dev_type)
+(typeattribute device_29_0)
+(typeattribute device_config_activity_manager_native_boot_prop_29_0)
+(typeattribute device_config_boot_count_prop_29_0)
+(typeattribute device_config_input_native_boot_prop_29_0)
+(typeattribute device_config_media_native_prop_29_0)
+(typeattribute device_config_netd_native_prop_29_0)
+(typeattribute device_config_reset_performed_prop_29_0)
+(typeattribute device_config_runtime_native_boot_prop_29_0)
+(typeattribute device_config_runtime_native_prop_29_0)
+(typeattribute device_config_service_29_0)
+(typeattribute device_identifiers_service_29_0)
+(typeattribute device_logging_prop_29_0)
+(typeattribute device_policy_service_29_0)
+(typeattribute deviceidle_service_29_0)
+(typeattribute devicestoragemonitor_service_29_0)
+(typeattribute devpts_29_0)
+(typeattribute dhcp_29_0)
+(typeattribute dhcp_data_file_29_0)
+(typeattribute dhcp_exec_29_0)
+(typeattribute dhcp_prop_29_0)
+(typeattribute diskstats_service_29_0)
+(typeattribute display_service_29_0)
+(typeattribute display_service_server)
+(typeattribute dm_device_29_0)
+(typeattribute dnsmasq_29_0)
+(typeattribute dnsmasq_exec_29_0)
+(typeattribute dnsproxyd_socket_29_0)
+(typeattribute dnsresolver_service_29_0)
+(typeattribute domain)
+(typeattribute dreams_service_29_0)
+(typeattribute drm_data_file_29_0)
+(typeattribute drmserver_29_0)
+(typeattribute drmserver_exec_29_0)
+(typeattribute drmserver_service_29_0)
+(typeattribute drmserver_socket_29_0)
+(typeattribute dropbox_data_file_29_0)
+(typeattribute dropbox_service_29_0)
+(typeattribute dumpstate_29_0)
+(typeattribute dumpstate_exec_29_0)
+(typeattribute dumpstate_options_prop_29_0)
+(typeattribute dumpstate_prop_29_0)
+(typeattribute dumpstate_service_29_0)
+(typeattribute dumpstate_socket_29_0)
+(typeattribute dynamic_system_prop_29_0)
+(typeattribute e2fs_29_0)
+(typeattribute e2fs_exec_29_0)
+(typeattribute efs_file_29_0)
+(typeattribute ephemeral_app_29_0)
+(typeattribute ephemeral_app_api_service)
+(typeattribute ethernet_service_29_0)
+(typeattribute exec_type)
+(typeattribute exfat_29_0)
+(typeattribute exported2_config_prop_29_0)
+(typeattribute exported2_default_prop_29_0)
+(typeattribute exported2_radio_prop_29_0)
+(typeattribute exported2_system_prop_29_0)
+(typeattribute exported2_vold_prop_29_0)
+(typeattribute exported3_default_prop_29_0)
+(typeattribute exported3_radio_prop_29_0)
+(typeattribute exported3_system_prop_29_0)
+(typeattribute exported_audio_prop_29_0)
+(typeattribute exported_bluetooth_prop_29_0)
+(typeattribute exported_config_prop_29_0)
+(typeattribute exported_dalvik_prop_29_0)
+(typeattribute exported_default_prop_29_0)
+(typeattribute exported_dumpstate_prop_29_0)
+(typeattribute exported_ffs_prop_29_0)
+(typeattribute exported_fingerprint_prop_29_0)
+(typeattribute exported_overlay_prop_29_0)
+(typeattribute exported_pm_prop_29_0)
+(typeattribute exported_radio_prop_29_0)
+(typeattribute exported_secure_prop_29_0)
+(typeattribute exported_system_prop_29_0)
+(typeattribute exported_system_radio_prop_29_0)
+(typeattribute exported_vold_prop_29_0)
+(typeattribute exported_wifi_prop_29_0)
+(typeattribute extended_core_property_type)
+(typeattribute external_vibrator_service_29_0)
+(typeattribute face_service_29_0)
+(typeattribute face_vendor_data_file_29_0)
+(typeattribute fastbootd_29_0)
+(typeattribute ffs_prop_29_0)
+(typeattribute file_contexts_file_29_0)
+(typeattribute file_type)
+(typeattribute fingerprint_prop_29_0)
+(typeattribute fingerprint_service_29_0)
+(typeattribute fingerprint_vendor_data_file_29_0)
+(typeattribute fingerprintd_29_0)
+(typeattribute fingerprintd_data_file_29_0)
+(typeattribute fingerprintd_exec_29_0)
+(typeattribute fingerprintd_service_29_0)
+(typeattribute firstboot_prop_29_0)
+(typeattribute flags_health_check_29_0)
+(typeattribute flags_health_check_exec_29_0)
+(typeattribute font_service_29_0)
+(typeattribute frp_block_device_29_0)
+(typeattribute fs_bpf_29_0)
+(typeattribute fs_type)
+(typeattribute fsck_29_0)
+(typeattribute fsck_exec_29_0)
+(typeattribute fsck_untrusted_29_0)
+(typeattribute fscklogs_29_0)
+(typeattribute functionfs_29_0)
+(typeattribute fuse_29_0)
+(typeattribute fuse_device_29_0)
+(typeattribute fwk_bufferhub_hwservice_29_0)
+(typeattribute fwk_camera_hwservice_29_0)
+(typeattribute fwk_display_hwservice_29_0)
+(typeattribute fwk_scheduler_hwservice_29_0)
+(typeattribute fwk_sensor_hwservice_29_0)
+(typeattribute fwk_stats_hwservice_29_0)
+(typeattribute fwmarkd_socket_29_0)
+(typeattribute gatekeeper_data_file_29_0)
+(typeattribute gatekeeper_service_29_0)
+(typeattribute gatekeeperd_29_0)
+(typeattribute gatekeeperd_exec_29_0)
+(typeattribute gfxinfo_service_29_0)
+(typeattribute gps_control_29_0)
+(typeattribute gpu_device_29_0)
+(typeattribute gpu_service_29_0)
+(typeattribute gpuservice_29_0)
+(typeattribute graphics_device_29_0)
+(typeattribute graphicsstats_service_29_0)
+(typeattribute gsi_data_file_29_0)
+(typeattribute gsi_metadata_file_29_0)
+(typeattribute gsid_prop_29_0)
+(typeattribute hal_allocator)
+(typeattribute hal_allocator_client)
+(typeattribute hal_allocator_server)
+(typeattribute hal_atrace)
+(typeattribute hal_atrace_client)
+(typeattribute hal_atrace_hwservice_29_0)
+(typeattribute hal_atrace_server)
+(typeattribute hal_audio)
+(typeattribute hal_audio_client)
+(typeattribute hal_audio_hwservice_29_0)
+(typeattribute hal_audio_server)
+(typeattribute hal_audiocontrol)
+(typeattribute hal_audiocontrol_client)
+(typeattribute hal_audiocontrol_hwservice_29_0)
+(typeattribute hal_audiocontrol_server)
+(typeattribute hal_authsecret)
+(typeattribute hal_authsecret_client)
+(typeattribute hal_authsecret_hwservice_29_0)
+(typeattribute hal_authsecret_server)
+(typeattribute hal_automotive_socket_exemption)
+(typeattribute hal_bluetooth)
+(typeattribute hal_bluetooth_client)
+(typeattribute hal_bluetooth_hwservice_29_0)
+(typeattribute hal_bluetooth_server)
+(typeattribute hal_bootctl)
+(typeattribute hal_bootctl_client)
+(typeattribute hal_bootctl_hwservice_29_0)
+(typeattribute hal_bootctl_server)
+(typeattribute hal_broadcastradio)
+(typeattribute hal_broadcastradio_client)
+(typeattribute hal_broadcastradio_hwservice_29_0)
+(typeattribute hal_broadcastradio_server)
+(typeattribute hal_bufferhub)
+(typeattribute hal_bufferhub_client)
+(typeattribute hal_bufferhub_server)
+(typeattribute hal_camera)
+(typeattribute hal_camera_client)
+(typeattribute hal_camera_hwservice_29_0)
+(typeattribute hal_camera_server)
+(typeattribute hal_cas)
+(typeattribute hal_cas_client)
+(typeattribute hal_cas_hwservice_29_0)
+(typeattribute hal_cas_server)
+(typeattribute hal_codec2_hwservice_29_0)
+(typeattribute hal_configstore)
+(typeattribute hal_configstore_ISurfaceFlingerConfigs_29_0)
+(typeattribute hal_configstore_client)
+(typeattribute hal_configstore_server)
+(typeattribute hal_confirmationui)
+(typeattribute hal_confirmationui_client)
+(typeattribute hal_confirmationui_hwservice_29_0)
+(typeattribute hal_confirmationui_server)
+(typeattribute hal_contexthub)
+(typeattribute hal_contexthub_client)
+(typeattribute hal_contexthub_hwservice_29_0)
+(typeattribute hal_contexthub_server)
+(typeattribute hal_drm)
+(typeattribute hal_drm_client)
+(typeattribute hal_drm_hwservice_29_0)
+(typeattribute hal_drm_server)
+(typeattribute hal_dumpstate)
+(typeattribute hal_dumpstate_client)
+(typeattribute hal_dumpstate_hwservice_29_0)
+(typeattribute hal_dumpstate_server)
+(typeattribute hal_evs)
+(typeattribute hal_evs_client)
+(typeattribute hal_evs_hwservice_29_0)
+(typeattribute hal_evs_server)
+(typeattribute hal_face)
+(typeattribute hal_face_client)
+(typeattribute hal_face_hwservice_29_0)
+(typeattribute hal_face_server)
+(typeattribute hal_fingerprint)
+(typeattribute hal_fingerprint_client)
+(typeattribute hal_fingerprint_hwservice_29_0)
+(typeattribute hal_fingerprint_server)
+(typeattribute hal_fingerprint_service_29_0)
+(typeattribute hal_gatekeeper)
+(typeattribute hal_gatekeeper_client)
+(typeattribute hal_gatekeeper_hwservice_29_0)
+(typeattribute hal_gatekeeper_server)
+(typeattribute hal_gnss)
+(typeattribute hal_gnss_client)
+(typeattribute hal_gnss_hwservice_29_0)
+(typeattribute hal_gnss_server)
+(typeattribute hal_graphics_allocator)
+(typeattribute hal_graphics_allocator_client)
+(typeattribute hal_graphics_allocator_hwservice_29_0)
+(typeattribute hal_graphics_allocator_server)
+(typeattribute hal_graphics_composer)
+(typeattribute hal_graphics_composer_client)
+(typeattribute hal_graphics_composer_client_tmpfs)
+(typeattribute hal_graphics_composer_hwservice_29_0)
+(typeattribute hal_graphics_composer_server)
+(typeattribute hal_graphics_composer_server_tmpfs_29_0)
+(typeattribute hal_graphics_mapper_hwservice_29_0)
+(typeattribute hal_health)
+(typeattribute hal_health_client)
+(typeattribute hal_health_hwservice_29_0)
+(typeattribute hal_health_server)
+(typeattribute hal_health_storage)
+(typeattribute hal_health_storage_client)
+(typeattribute hal_health_storage_hwservice_29_0)
+(typeattribute hal_health_storage_server)
+(typeattribute hal_input_classifier)
+(typeattribute hal_input_classifier_client)
+(typeattribute hal_input_classifier_hwservice_29_0)
+(typeattribute hal_input_classifier_server)
+(typeattribute hal_ir)
+(typeattribute hal_ir_client)
+(typeattribute hal_ir_hwservice_29_0)
+(typeattribute hal_ir_server)
+(typeattribute hal_keymaster)
+(typeattribute hal_keymaster_client)
+(typeattribute hal_keymaster_hwservice_29_0)
+(typeattribute hal_keymaster_server)
+(typeattribute hal_light)
+(typeattribute hal_light_client)
+(typeattribute hal_light_hwservice_29_0)
+(typeattribute hal_light_server)
+(typeattribute hal_lowpan)
+(typeattribute hal_lowpan_client)
+(typeattribute hal_lowpan_hwservice_29_0)
+(typeattribute hal_lowpan_server)
+(typeattribute hal_memtrack)
+(typeattribute hal_memtrack_client)
+(typeattribute hal_memtrack_hwservice_29_0)
+(typeattribute hal_memtrack_server)
+(typeattribute hal_neuralnetworks)
+(typeattribute hal_neuralnetworks_client)
+(typeattribute hal_neuralnetworks_hwservice_29_0)
+(typeattribute hal_neuralnetworks_server)
+(typeattribute hal_nfc)
+(typeattribute hal_nfc_client)
+(typeattribute hal_nfc_hwservice_29_0)
+(typeattribute hal_nfc_server)
+(typeattribute hal_oemlock)
+(typeattribute hal_oemlock_client)
+(typeattribute hal_oemlock_hwservice_29_0)
+(typeattribute hal_oemlock_server)
+(typeattribute hal_omx)
+(typeattribute hal_omx_client)
+(typeattribute hal_omx_hwservice_29_0)
+(typeattribute hal_omx_server)
+(typeattribute hal_power)
+(typeattribute hal_power_client)
+(typeattribute hal_power_hwservice_29_0)
+(typeattribute hal_power_server)
+(typeattribute hal_power_stats)
+(typeattribute hal_power_stats_client)
+(typeattribute hal_power_stats_hwservice_29_0)
+(typeattribute hal_power_stats_server)
+(typeattribute hal_renderscript_hwservice_29_0)
+(typeattribute hal_secure_element)
+(typeattribute hal_secure_element_client)
+(typeattribute hal_secure_element_hwservice_29_0)
+(typeattribute hal_secure_element_server)
+(typeattribute hal_sensors)
+(typeattribute hal_sensors_client)
+(typeattribute hal_sensors_hwservice_29_0)
+(typeattribute hal_sensors_server)
+(typeattribute hal_telephony)
+(typeattribute hal_telephony_client)
+(typeattribute hal_telephony_hwservice_29_0)
+(typeattribute hal_telephony_server)
+(typeattribute hal_tetheroffload)
+(typeattribute hal_tetheroffload_client)
+(typeattribute hal_tetheroffload_hwservice_29_0)
+(typeattribute hal_tetheroffload_server)
+(typeattribute hal_thermal)
+(typeattribute hal_thermal_client)
+(typeattribute hal_thermal_hwservice_29_0)
+(typeattribute hal_thermal_server)
+(typeattribute hal_tv_cec)
+(typeattribute hal_tv_cec_client)
+(typeattribute hal_tv_cec_hwservice_29_0)
+(typeattribute hal_tv_cec_server)
+(typeattribute hal_tv_input)
+(typeattribute hal_tv_input_client)
+(typeattribute hal_tv_input_hwservice_29_0)
+(typeattribute hal_tv_input_server)
+(typeattribute hal_usb)
+(typeattribute hal_usb_client)
+(typeattribute hal_usb_gadget)
+(typeattribute hal_usb_gadget_client)
+(typeattribute hal_usb_gadget_hwservice_29_0)
+(typeattribute hal_usb_gadget_server)
+(typeattribute hal_usb_hwservice_29_0)
+(typeattribute hal_usb_server)
+(typeattribute hal_vehicle)
+(typeattribute hal_vehicle_client)
+(typeattribute hal_vehicle_hwservice_29_0)
+(typeattribute hal_vehicle_server)
+(typeattribute hal_vibrator)
+(typeattribute hal_vibrator_client)
+(typeattribute hal_vibrator_hwservice_29_0)
+(typeattribute hal_vibrator_server)
+(typeattribute hal_vr)
+(typeattribute hal_vr_client)
+(typeattribute hal_vr_hwservice_29_0)
+(typeattribute hal_vr_server)
+(typeattribute hal_weaver)
+(typeattribute hal_weaver_client)
+(typeattribute hal_weaver_hwservice_29_0)
+(typeattribute hal_weaver_server)
+(typeattribute hal_wifi)
+(typeattribute hal_wifi_client)
+(typeattribute hal_wifi_hostapd)
+(typeattribute hal_wifi_hostapd_client)
+(typeattribute hal_wifi_hostapd_hwservice_29_0)
+(typeattribute hal_wifi_hostapd_server)
+(typeattribute hal_wifi_hwservice_29_0)
+(typeattribute hal_wifi_offload)
+(typeattribute hal_wifi_offload_client)
+(typeattribute hal_wifi_offload_hwservice_29_0)
+(typeattribute hal_wifi_offload_server)
+(typeattribute hal_wifi_server)
+(typeattribute hal_wifi_supplicant)
+(typeattribute hal_wifi_supplicant_client)
+(typeattribute hal_wifi_supplicant_hwservice_29_0)
+(typeattribute hal_wifi_supplicant_server)
+(typeattribute halclientdomain)
+(typeattribute halserverdomain)
+(typeattribute hardware_properties_service_29_0)
+(typeattribute hardware_service_29_0)
+(typeattribute hci_attach_dev_29_0)
+(typeattribute hdmi_control_service_29_0)
+(typeattribute healthd_29_0)
+(typeattribute healthd_exec_29_0)
+(typeattribute heapdump_data_file_29_0)
+(typeattribute heapprofd_29_0)
+(typeattribute heapprofd_enabled_prop_29_0)
+(typeattribute heapprofd_prop_29_0)
+(typeattribute heapprofd_socket_29_0)
+(typeattribute hidl_allocator_hwservice_29_0)
+(typeattribute hidl_base_hwservice_29_0)
+(typeattribute hidl_manager_hwservice_29_0)
+(typeattribute hidl_memory_hwservice_29_0)
+(typeattribute hidl_token_hwservice_29_0)
+(typeattribute hw_random_device_29_0)
+(typeattribute hwbinder_device_29_0)
+(typeattribute hwservice_contexts_file_29_0)
+(typeattribute hwservice_manager_type)
+(typeattribute hwservicemanager_29_0)
+(typeattribute hwservicemanager_exec_29_0)
+(typeattribute hwservicemanager_prop_29_0)
+(typeattribute icon_file_29_0)
+(typeattribute idmap_29_0)
+(typeattribute idmap_exec_29_0)
+(typeattribute idmap_service_29_0)
+(typeattribute iio_device_29_0)
+(typeattribute imms_service_29_0)
+(typeattribute incident_29_0)
+(typeattribute incident_data_file_29_0)
+(typeattribute incident_helper_29_0)
+(typeattribute incident_service_29_0)
+(typeattribute incidentd_29_0)
+(typeattribute init_29_0)
+(typeattribute init_exec_29_0)
+(typeattribute init_tmpfs_29_0)
+(typeattribute inotify_29_0)
+(typeattribute input_device_29_0)
+(typeattribute input_method_service_29_0)
+(typeattribute input_service_29_0)
+(typeattribute inputflinger_29_0)
+(typeattribute inputflinger_exec_29_0)
+(typeattribute inputflinger_service_29_0)
+(typeattribute install_data_file_29_0)
+(typeattribute install_recovery_29_0)
+(typeattribute install_recovery_exec_29_0)
+(typeattribute installd_29_0)
+(typeattribute installd_exec_29_0)
+(typeattribute installd_service_29_0)
+(typeattribute ion_device_29_0)
+(typeattribute iorapd_29_0)
+(typeattribute iorapd_data_file_29_0)
+(typeattribute iorapd_exec_29_0)
+(typeattribute iorapd_service_29_0)
+(typeattribute iorapd_tmpfs_29_0)
+(typeattribute ipsec_service_29_0)
+(typeattribute iris_service_29_0)
+(typeattribute iris_vendor_data_file_29_0)
+(typeattribute isolated_app_29_0)
+(typeattribute jobscheduler_service_29_0)
+(typeattribute kernel_29_0)
+(typeattribute keychain_data_file_29_0)
+(typeattribute keychord_device_29_0)
+(typeattribute keystore_29_0)
+(typeattribute keystore_data_file_29_0)
+(typeattribute keystore_exec_29_0)
+(typeattribute keystore_service_29_0)
+(typeattribute kmsg_debug_device_29_0)
+(typeattribute kmsg_device_29_0)
+(typeattribute labeledfs_29_0)
+(typeattribute last_boot_reason_prop_29_0)
+(typeattribute launcherapps_service_29_0)
+(typeattribute llkd_29_0)
+(typeattribute llkd_exec_29_0)
+(typeattribute llkd_prop_29_0)
+(typeattribute lmkd_29_0)
+(typeattribute lmkd_exec_29_0)
+(typeattribute lmkd_socket_29_0)
+(typeattribute location_service_29_0)
+(typeattribute lock_settings_service_29_0)
+(typeattribute log_prop_29_0)
+(typeattribute log_property_type)
+(typeattribute log_tag_prop_29_0)
+(typeattribute logcat_exec_29_0)
+(typeattribute logd_29_0)
+(typeattribute logd_exec_29_0)
+(typeattribute logd_prop_29_0)
+(typeattribute logd_socket_29_0)
+(typeattribute logdr_socket_29_0)
+(typeattribute logdw_socket_29_0)
+(typeattribute logpersist_29_0)
+(typeattribute logpersistd_logging_prop_29_0)
+(typeattribute loop_control_device_29_0)
+(typeattribute loop_device_29_0)
+(typeattribute looper_stats_service_29_0)
+(typeattribute lowpan_device_29_0)
+(typeattribute lowpan_prop_29_0)
+(typeattribute lowpan_service_29_0)
+(typeattribute lpdump_service_29_0)
+(typeattribute lpdumpd_prop_29_0)
+(typeattribute mac_perms_file_29_0)
+(typeattribute mdns_socket_29_0)
+(typeattribute mdnsd_29_0)
+(typeattribute mdnsd_socket_29_0)
+(typeattribute media_data_file_29_0)
+(typeattribute media_projection_service_29_0)
+(typeattribute media_router_service_29_0)
+(typeattribute media_rw_data_file_29_0)
+(typeattribute media_session_service_29_0)
+(typeattribute mediacodec_service_29_0)
+(typeattribute mediadrmserver_29_0)
+(typeattribute mediadrmserver_exec_29_0)
+(typeattribute mediadrmserver_service_29_0)
+(typeattribute mediaextractor_29_0)
+(typeattribute mediaextractor_exec_29_0)
+(typeattribute mediaextractor_service_29_0)
+(typeattribute mediaextractor_tmpfs_29_0)
+(typeattribute mediametrics_29_0)
+(typeattribute mediametrics_exec_29_0)
+(typeattribute mediametrics_service_29_0)
+(typeattribute mediaprovider_29_0)
+(typeattribute mediaserver_29_0)
+(typeattribute mediaserver_exec_29_0)
+(typeattribute mediaserver_service_29_0)
+(typeattribute mediaserver_tmpfs_29_0)
+(typeattribute mediaswcodec_29_0)
+(typeattribute mediaswcodec_exec_29_0)
+(typeattribute mediaswcodec_server)
+(typeattribute meminfo_service_29_0)
+(typeattribute metadata_block_device_29_0)
+(typeattribute metadata_file_29_0)
+(typeattribute method_trace_data_file_29_0)
+(typeattribute midi_service_29_0)
+(typeattribute misc_block_device_29_0)
+(typeattribute misc_logd_file_29_0)
+(typeattribute misc_user_data_file_29_0)
+(typeattribute mlstrustedobject)
+(typeattribute mlstrustedsubject)
+(typeattribute mmc_prop_29_0)
+(typeattribute mnt_expand_file_29_0)
+(typeattribute mnt_media_rw_file_29_0)
+(typeattribute mnt_media_rw_stub_file_29_0)
+(typeattribute mnt_product_file_29_0)
+(typeattribute mnt_user_file_29_0)
+(typeattribute mnt_vendor_file_29_0)
+(typeattribute modprobe_29_0)
+(typeattribute mount_service_29_0)
+(typeattribute mqueue_29_0)
+(typeattribute mtp_29_0)
+(typeattribute mtp_device_29_0)
+(typeattribute mtp_exec_29_0)
+(typeattribute mtpd_socket_29_0)
+(typeattribute nativetest_data_file_29_0)
+(typeattribute net_data_file_29_0)
+(typeattribute net_dns_prop_29_0)
+(typeattribute net_radio_prop_29_0)
+(typeattribute netd_29_0)
+(typeattribute netd_exec_29_0)
+(typeattribute netd_listener_service_29_0)
+(typeattribute netd_service_29_0)
+(typeattribute netd_stable_secret_prop_29_0)
+(typeattribute netdomain)
+(typeattribute netif_29_0)
+(typeattribute netif_type)
+(typeattribute netpolicy_service_29_0)
+(typeattribute netstats_service_29_0)
+(typeattribute netutils_wrapper_29_0)
+(typeattribute netutils_wrapper_exec_29_0)
+(typeattribute network_management_service_29_0)
+(typeattribute network_score_service_29_0)
+(typeattribute network_stack_29_0)
+(typeattribute network_stack_service_29_0)
+(typeattribute network_time_update_service_29_0)
+(typeattribute network_watchlist_data_file_29_0)
+(typeattribute network_watchlist_service_29_0)
+(typeattribute nfc_29_0)
+(typeattribute nfc_data_file_29_0)
+(typeattribute nfc_device_29_0)
+(typeattribute nfc_prop_29_0)
+(typeattribute nfc_service_29_0)
+(typeattribute nnapi_ext_deny_product_prop_29_0)
+(typeattribute node_29_0)
+(typeattribute node_type)
+(typeattribute nonplat_service_contexts_file_29_0)
+(typeattribute notification_service_29_0)
+(typeattribute null_device_29_0)
+(typeattribute oem_lock_service_29_0)
+(typeattribute oemfs_29_0)
+(typeattribute ota_data_file_29_0)
+(typeattribute ota_package_file_29_0)
+(typeattribute otadexopt_service_29_0)
+(typeattribute overlay_prop_29_0)
+(typeattribute overlay_service_29_0)
+(typeattribute overlayfs_file_29_0)
+(typeattribute owntty_device_29_0)
+(typeattribute package_native_service_29_0)
+(typeattribute package_service_29_0)
+(typeattribute packages_list_file_29_0)
+(typeattribute pan_result_prop_29_0)
+(typeattribute password_slot_metadata_file_29_0)
+(typeattribute pdx_bufferhub_client_channel_socket_29_0)
+(typeattribute pdx_bufferhub_client_channel_socket_type)
+(typeattribute pdx_bufferhub_client_endpoint_dir_type)
+(typeattribute pdx_bufferhub_client_endpoint_socket_29_0)
+(typeattribute pdx_bufferhub_client_endpoint_socket_type)
+(typeattribute pdx_bufferhub_client_server_type)
+(typeattribute pdx_bufferhub_dir_29_0)
+(typeattribute pdx_channel_socket_type)
+(typeattribute pdx_display_client_channel_socket_29_0)
+(typeattribute pdx_display_client_channel_socket_type)
+(typeattribute pdx_display_client_endpoint_dir_type)
+(typeattribute pdx_display_client_endpoint_socket_29_0)
+(typeattribute pdx_display_client_endpoint_socket_type)
+(typeattribute pdx_display_client_server_type)
+(typeattribute pdx_display_dir_29_0)
+(typeattribute pdx_display_manager_channel_socket_29_0)
+(typeattribute pdx_display_manager_channel_socket_type)
+(typeattribute pdx_display_manager_endpoint_dir_type)
+(typeattribute pdx_display_manager_endpoint_socket_29_0)
+(typeattribute pdx_display_manager_endpoint_socket_type)
+(typeattribute pdx_display_manager_server_type)
+(typeattribute pdx_display_screenshot_channel_socket_29_0)
+(typeattribute pdx_display_screenshot_channel_socket_type)
+(typeattribute pdx_display_screenshot_endpoint_dir_type)
+(typeattribute pdx_display_screenshot_endpoint_socket_29_0)
+(typeattribute pdx_display_screenshot_endpoint_socket_type)
+(typeattribute pdx_display_screenshot_server_type)
+(typeattribute pdx_display_vsync_channel_socket_29_0)
+(typeattribute pdx_display_vsync_channel_socket_type)
+(typeattribute pdx_display_vsync_endpoint_dir_type)
+(typeattribute pdx_display_vsync_endpoint_socket_29_0)
+(typeattribute pdx_display_vsync_endpoint_socket_type)
+(typeattribute pdx_display_vsync_server_type)
+(typeattribute pdx_endpoint_dir_type)
+(typeattribute pdx_endpoint_socket_type)
+(typeattribute pdx_performance_client_channel_socket_29_0)
+(typeattribute pdx_performance_client_channel_socket_type)
+(typeattribute pdx_performance_client_endpoint_dir_type)
+(typeattribute pdx_performance_client_endpoint_socket_29_0)
+(typeattribute pdx_performance_client_endpoint_socket_type)
+(typeattribute pdx_performance_client_server_type)
+(typeattribute pdx_performance_dir_29_0)
+(typeattribute perfetto_29_0)
+(typeattribute performanced_29_0)
+(typeattribute performanced_exec_29_0)
+(typeattribute perfprofd_29_0)
+(typeattribute perfprofd_data_file_29_0)
+(typeattribute perfprofd_exec_29_0)
+(typeattribute perfprofd_service_29_0)
+(typeattribute permission_service_29_0)
+(typeattribute permissionmgr_service_29_0)
+(typeattribute persist_debug_prop_29_0)
+(typeattribute persistent_data_block_service_29_0)
+(typeattribute persistent_properties_ready_prop_29_0)
+(typeattribute pinner_service_29_0)
+(typeattribute pipefs_29_0)
+(typeattribute platform_app_29_0)
+(typeattribute pm_prop_29_0)
+(typeattribute pmsg_device_29_0)
+(typeattribute port_29_0)
+(typeattribute port_device_29_0)
+(typeattribute port_type)
+(typeattribute postinstall_29_0)
+(typeattribute postinstall_apex_mnt_dir_29_0)
+(typeattribute postinstall_file_29_0)
+(typeattribute postinstall_mnt_dir_29_0)
+(typeattribute power_service_29_0)
+(typeattribute powerctl_prop_29_0)
+(typeattribute ppp_29_0)
+(typeattribute ppp_device_29_0)
+(typeattribute ppp_exec_29_0)
+(typeattribute preloads_data_file_29_0)
+(typeattribute preloads_media_file_29_0)
+(typeattribute print_service_29_0)
+(typeattribute priv_app_29_0)
+(typeattribute privapp_data_file_29_0)
+(typeattribute proc_29_0)
+(typeattribute proc_abi_29_0)
+(typeattribute proc_asound_29_0)
+(typeattribute proc_bluetooth_writable_29_0)
+(typeattribute proc_buddyinfo_29_0)
+(typeattribute proc_cmdline_29_0)
+(typeattribute proc_cpuinfo_29_0)
+(typeattribute proc_dirty_29_0)
+(typeattribute proc_diskstats_29_0)
+(typeattribute proc_drop_caches_29_0)
+(typeattribute proc_extra_free_kbytes_29_0)
+(typeattribute proc_filesystems_29_0)
+(typeattribute proc_fs_verity_29_0)
+(typeattribute proc_hostname_29_0)
+(typeattribute proc_hung_task_29_0)
+(typeattribute proc_interrupts_29_0)
+(typeattribute proc_iomem_29_0)
+(typeattribute proc_keys_29_0)
+(typeattribute proc_kmsg_29_0)
+(typeattribute proc_loadavg_29_0)
+(typeattribute proc_max_map_count_29_0)
+(typeattribute proc_meminfo_29_0)
+(typeattribute proc_min_free_order_shift_29_0)
+(typeattribute proc_misc_29_0)
+(typeattribute proc_modules_29_0)
+(typeattribute proc_mounts_29_0)
+(typeattribute proc_net_29_0)
+(typeattribute proc_net_tcp_udp_29_0)
+(typeattribute proc_net_type)
+(typeattribute proc_overcommit_memory_29_0)
+(typeattribute proc_page_cluster_29_0)
+(typeattribute proc_pagetypeinfo_29_0)
+(typeattribute proc_panic_29_0)
+(typeattribute proc_perf_29_0)
+(typeattribute proc_pid_max_29_0)
+(typeattribute proc_pipe_conf_29_0)
+(typeattribute proc_pressure_cpu_29_0)
+(typeattribute proc_pressure_io_29_0)
+(typeattribute proc_pressure_mem_29_0)
+(typeattribute proc_qtaguid_ctrl_29_0)
+(typeattribute proc_qtaguid_stat_29_0)
+(typeattribute proc_random_29_0)
+(typeattribute proc_sched_29_0)
+(typeattribute proc_security_29_0)
+(typeattribute proc_slabinfo_29_0)
+(typeattribute proc_stat_29_0)
+(typeattribute proc_swaps_29_0)
+(typeattribute proc_sysrq_29_0)
+(typeattribute proc_timer_29_0)
+(typeattribute proc_tty_drivers_29_0)
+(typeattribute proc_type)
+(typeattribute proc_uid_concurrent_active_time_29_0)
+(typeattribute proc_uid_concurrent_policy_time_29_0)
+(typeattribute proc_uid_cpupower_29_0)
+(typeattribute proc_uid_cputime_removeuid_29_0)
+(typeattribute proc_uid_cputime_showstat_29_0)
+(typeattribute proc_uid_io_stats_29_0)
+(typeattribute proc_uid_procstat_set_29_0)
+(typeattribute proc_uid_time_in_state_29_0)
+(typeattribute proc_uptime_29_0)
+(typeattribute proc_version_29_0)
+(typeattribute proc_vmallocinfo_29_0)
+(typeattribute proc_vmstat_29_0)
+(typeattribute proc_zoneinfo_29_0)
+(typeattribute processinfo_service_29_0)
+(typeattribute procstats_service_29_0)
+(typeattribute profman_29_0)
+(typeattribute profman_dump_data_file_29_0)
+(typeattribute profman_exec_29_0)
+(typeattribute properties_device_29_0)
+(typeattribute properties_serial_29_0)
+(typeattribute property_contexts_file_29_0)
+(typeattribute property_data_file_29_0)
+(typeattribute property_info_29_0)
+(typeattribute property_socket_29_0)
+(typeattribute property_type)
+(typeattribute pstorefs_29_0)
+(typeattribute ptmx_device_29_0)
+(typeattribute qtaguid_device_29_0)
+(typeattribute racoon_29_0)
+(typeattribute racoon_exec_29_0)
+(typeattribute racoon_socket_29_0)
+(typeattribute radio_29_0)
+(typeattribute radio_data_file_29_0)
+(typeattribute radio_device_29_0)
+(typeattribute radio_prop_29_0)
+(typeattribute radio_service_29_0)
+(typeattribute ram_device_29_0)
+(typeattribute random_device_29_0)
+(typeattribute recovery_29_0)
+(typeattribute recovery_block_device_29_0)
+(typeattribute recovery_data_file_29_0)
+(typeattribute recovery_persist_29_0)
+(typeattribute recovery_persist_exec_29_0)
+(typeattribute recovery_refresh_29_0)
+(typeattribute recovery_refresh_exec_29_0)
+(typeattribute recovery_service_29_0)
+(typeattribute recovery_socket_29_0)
+(typeattribute registry_service_29_0)
+(typeattribute resourcecache_data_file_29_0)
+(typeattribute restorecon_prop_29_0)
+(typeattribute restrictions_service_29_0)
+(typeattribute rild_debug_socket_29_0)
+(typeattribute rild_socket_29_0)
+(typeattribute ringtone_file_29_0)
+(typeattribute role_service_29_0)
+(typeattribute rollback_service_29_0)
+(typeattribute root_block_device_29_0)
+(typeattribute rootfs_29_0)
+(typeattribute rpmsg_device_29_0)
+(typeattribute rs_29_0)
+(typeattribute rs_exec_29_0)
+(typeattribute rss_hwm_reset_29_0)
+(typeattribute rtc_device_29_0)
+(typeattribute rttmanager_service_29_0)
+(typeattribute runas_29_0)
+(typeattribute runas_app_29_0)
+(typeattribute runas_exec_29_0)
+(typeattribute runtime_event_log_tags_file_29_0)
+(typeattribute runtime_service_29_0)
+(typeattribute safemode_prop_29_0)
+(typeattribute same_process_hal_file_29_0)
+(typeattribute same_process_hwservice)
+(typeattribute samplingprofiler_service_29_0)
+(typeattribute scheduler_service_server)
+(typeattribute scheduling_policy_service_29_0)
+(typeattribute sdcard_block_device_29_0)
+(typeattribute sdcard_type)
+(typeattribute sdcardd_29_0)
+(typeattribute sdcardd_exec_29_0)
+(typeattribute sdcardfs_29_0)
+(typeattribute seapp_contexts_file_29_0)
+(typeattribute search_service_29_0)
+(typeattribute sec_key_att_app_id_provider_service_29_0)
+(typeattribute secure_element_29_0)
+(typeattribute secure_element_device_29_0)
+(typeattribute secure_element_service_29_0)
+(typeattribute selinuxfs_29_0)
+(typeattribute sensor_privacy_service_29_0)
+(typeattribute sensor_service_server)
+(typeattribute sensors_device_29_0)
+(typeattribute sensorservice_service_29_0)
+(typeattribute sepolicy_file_29_0)
+(typeattribute serial_device_29_0)
+(typeattribute serial_service_29_0)
+(typeattribute serialno_prop_29_0)
+(typeattribute server_configurable_flags_data_file_29_0)
+(typeattribute service_contexts_file_29_0)
+(typeattribute service_manager_type)
+(typeattribute servicediscovery_service_29_0)
+(typeattribute servicemanager_29_0)
+(typeattribute servicemanager_exec_29_0)
+(typeattribute settings_service_29_0)
+(typeattribute sgdisk_29_0)
+(typeattribute sgdisk_exec_29_0)
+(typeattribute shared_relro_29_0)
+(typeattribute shared_relro_file_29_0)
+(typeattribute shell_29_0)
+(typeattribute shell_data_file_29_0)
+(typeattribute shell_exec_29_0)
+(typeattribute shell_prop_29_0)
+(typeattribute shm_29_0)
+(typeattribute shortcut_manager_icons_29_0)
+(typeattribute shortcut_service_29_0)
+(typeattribute simpleperf_app_runner_29_0)
+(typeattribute simpleperf_app_runner_exec_29_0)
+(typeattribute slice_service_29_0)
+(typeattribute slideshow_29_0)
+(typeattribute socket_between_core_and_vendor_violators)
+(typeattribute socket_device_29_0)
+(typeattribute sockfs_29_0)
+(typeattribute staging_data_file_29_0)
+(typeattribute stats_data_file_29_0)
+(typeattribute stats_service_server)
+(typeattribute statsd_29_0)
+(typeattribute statsd_exec_29_0)
+(typeattribute statsdw_socket_29_0)
+(typeattribute statusbar_service_29_0)
+(typeattribute storage_file_29_0)
+(typeattribute storage_stub_file_29_0)
+(typeattribute storaged_service_29_0)
+(typeattribute storagestats_service_29_0)
+(typeattribute su_29_0)
+(typeattribute su_exec_29_0)
+(typeattribute super_block_device_29_0)
+(typeattribute super_block_device_type)
+(typeattribute surfaceflinger_29_0)
+(typeattribute surfaceflinger_service_29_0)
+(typeattribute surfaceflinger_tmpfs_29_0)
+(typeattribute swap_block_device_29_0)
+(typeattribute sysfs_29_0)
+(typeattribute sysfs_android_usb_29_0)
+(typeattribute sysfs_batteryinfo_29_0)
+(typeattribute sysfs_bluetooth_writable_29_0)
+(typeattribute sysfs_devices_block_29_0)
+(typeattribute sysfs_devices_system_cpu_29_0)
+(typeattribute sysfs_dm_29_0)
+(typeattribute sysfs_dt_firmware_android_29_0)
+(typeattribute sysfs_extcon_29_0)
+(typeattribute sysfs_fs_ext4_features_29_0)
+(typeattribute sysfs_fs_f2fs_29_0)
+(typeattribute sysfs_hwrandom_29_0)
+(typeattribute sysfs_ipv4_29_0)
+(typeattribute sysfs_kernel_notes_29_0)
+(typeattribute sysfs_leds_29_0)
+(typeattribute sysfs_loop_29_0)
+(typeattribute sysfs_lowmemorykiller_29_0)
+(typeattribute sysfs_mac_address_29_0)
+(typeattribute sysfs_net_29_0)
+(typeattribute sysfs_nfc_power_writable_29_0)
+(typeattribute sysfs_power_29_0)
+(typeattribute sysfs_rtc_29_0)
+(typeattribute sysfs_switch_29_0)
+(typeattribute sysfs_thermal_29_0)
+(typeattribute sysfs_transparent_hugepage_29_0)
+(typeattribute sysfs_type)
+(typeattribute sysfs_uio_29_0)
+(typeattribute sysfs_usb_29_0)
+(typeattribute sysfs_usermodehelper_29_0)
+(typeattribute sysfs_vibrator_29_0)
+(typeattribute sysfs_wake_lock_29_0)
+(typeattribute sysfs_wakeup_reasons_29_0)
+(typeattribute sysfs_wlan_fwpath_29_0)
+(typeattribute sysfs_zram_29_0)
+(typeattribute sysfs_zram_uevent_29_0)
+(typeattribute system_api_service)
+(typeattribute system_app_29_0)
+(typeattribute system_app_data_file_29_0)
+(typeattribute system_app_service_29_0)
+(typeattribute system_asan_options_file_29_0)
+(typeattribute system_block_device_29_0)
+(typeattribute system_boot_reason_prop_29_0)
+(typeattribute system_bootstrap_lib_file_29_0)
+(typeattribute system_data_file_29_0)
+(typeattribute system_event_log_tags_file_29_0)
+(typeattribute system_executes_vendor_violators)
+(typeattribute system_file_29_0)
+(typeattribute system_file_type)
+(typeattribute system_lib_file_29_0)
+(typeattribute system_linker_config_file_29_0)
+(typeattribute system_linker_exec_29_0)
+(typeattribute system_lmk_prop_29_0)
+(typeattribute system_ndebug_socket_29_0)
+(typeattribute system_net_netd_hwservice_29_0)
+(typeattribute system_prop_29_0)
+(typeattribute system_radio_prop_29_0)
+(typeattribute system_seccomp_policy_file_29_0)
+(typeattribute system_security_cacerts_file_29_0)
+(typeattribute system_server_29_0)
+(typeattribute system_server_service)
+(typeattribute system_server_tmpfs_29_0)
+(typeattribute system_suspend_control_service_29_0)
+(typeattribute system_suspend_hwservice_29_0)
+(typeattribute system_suspend_server)
+(typeattribute system_trace_prop_29_0)
+(typeattribute system_update_service_29_0)
+(typeattribute system_wifi_keystore_hwservice_29_0)
+(typeattribute system_wpa_socket_29_0)
+(typeattribute system_writes_mnt_vendor_violators)
+(typeattribute system_writes_vendor_properties_violators)
+(typeattribute system_zoneinfo_file_29_0)
+(typeattribute systemkeys_data_file_29_0)
+(typeattribute task_profiles_file_29_0)
+(typeattribute task_service_29_0)
+(typeattribute tcpdump_exec_29_0)
+(typeattribute tee_29_0)
+(typeattribute tee_data_file_29_0)
+(typeattribute tee_device_29_0)
+(typeattribute telecom_service_29_0)
+(typeattribute test_boot_reason_prop_29_0)
+(typeattribute test_harness_prop_29_0)
+(typeattribute testharness_service_29_0)
+(typeattribute textclassification_service_29_0)
+(typeattribute textclassifier_data_file_29_0)
+(typeattribute textservices_service_29_0)
+(typeattribute thermal_service_29_0)
+(typeattribute thermalcallback_hwservice_29_0)
+(typeattribute time_prop_29_0)
+(typeattribute timedetector_service_29_0)
+(typeattribute timezone_service_29_0)
+(typeattribute tmpfs_29_0)
+(typeattribute tombstone_data_file_29_0)
+(typeattribute tombstone_wifi_data_file_29_0)
+(typeattribute tombstoned_29_0)
+(typeattribute tombstoned_crash_socket_29_0)
+(typeattribute tombstoned_exec_29_0)
+(typeattribute tombstoned_intercept_socket_29_0)
+(typeattribute tombstoned_java_trace_socket_29_0)
+(typeattribute toolbox_29_0)
+(typeattribute toolbox_exec_29_0)
+(typeattribute trace_data_file_29_0)
+(typeattribute traced_29_0)
+(typeattribute traced_consumer_socket_29_0)
+(typeattribute traced_enabled_prop_29_0)
+(typeattribute traced_lazy_prop_29_0)
+(typeattribute traced_probes_29_0)
+(typeattribute traced_producer_socket_29_0)
+(typeattribute traceur_app_29_0)
+(typeattribute trust_service_29_0)
+(typeattribute tty_device_29_0)
+(typeattribute tun_device_29_0)
+(typeattribute tv_input_service_29_0)
+(typeattribute tzdatacheck_29_0)
+(typeattribute tzdatacheck_exec_29_0)
+(typeattribute ueventd_29_0)
+(typeattribute ueventd_tmpfs_29_0)
+(typeattribute uhid_device_29_0)
+(typeattribute uimode_service_29_0)
+(typeattribute uio_device_29_0)
+(typeattribute uncrypt_29_0)
+(typeattribute uncrypt_exec_29_0)
+(typeattribute uncrypt_socket_29_0)
+(typeattribute unencrypted_data_file_29_0)
+(typeattribute unlabeled_29_0)
+(typeattribute untrusted_app_25_29_0)
+(typeattribute untrusted_app_27_29_0)
+(typeattribute untrusted_app_29_0)
+(typeattribute untrusted_app_all)
+(typeattribute untrusted_app_visible_halserver_violators)
+(typeattribute untrusted_app_visible_hwservice_violators)
+(typeattribute update_engine_29_0)
+(typeattribute update_engine_common)
+(typeattribute update_engine_data_file_29_0)
+(typeattribute update_engine_exec_29_0)
+(typeattribute update_engine_log_data_file_29_0)
+(typeattribute update_engine_service_29_0)
+(typeattribute update_verifier_29_0)
+(typeattribute update_verifier_exec_29_0)
+(typeattribute updatelock_service_29_0)
+(typeattribute uri_grants_service_29_0)
+(typeattribute usagestats_service_29_0)
+(typeattribute usb_device_29_0)
+(typeattribute usb_service_29_0)
+(typeattribute usbaccessory_device_29_0)
+(typeattribute usbd_29_0)
+(typeattribute usbd_exec_29_0)
+(typeattribute usbfs_29_0)
+(typeattribute use_memfd_prop_29_0)
+(typeattribute user_profile_data_file_29_0)
+(typeattribute user_service_29_0)
+(typeattribute userdata_block_device_29_0)
+(typeattribute usermodehelper_29_0)
+(typeattribute vdc_29_0)
+(typeattribute vdc_exec_29_0)
+(typeattribute vendor_app_file_29_0)
+(typeattribute vendor_cgroup_desc_file_29_0)
+(typeattribute vendor_configs_file_29_0)
+(typeattribute vendor_data_file_29_0)
+(typeattribute vendor_default_prop_29_0)
+(typeattribute vendor_executes_system_violators)
+(typeattribute vendor_file_29_0)
+(typeattribute vendor_file_type)
+(typeattribute vendor_framework_file_29_0)
+(typeattribute vendor_hal_file_29_0)
+(typeattribute vendor_idc_file_29_0)
+(typeattribute vendor_init_29_0)
+(typeattribute vendor_keychars_file_29_0)
+(typeattribute vendor_keylayout_file_29_0)
+(typeattribute vendor_overlay_file_29_0)
+(typeattribute vendor_public_lib_file_29_0)
+(typeattribute vendor_security_patch_level_prop_29_0)
+(typeattribute vendor_shell_29_0)
+(typeattribute vendor_shell_exec_29_0)
+(typeattribute vendor_task_profiles_file_29_0)
+(typeattribute vendor_toolbox_exec_29_0)
+(typeattribute vfat_29_0)
+(typeattribute vibrator_service_29_0)
+(typeattribute video_device_29_0)
+(typeattribute virtual_touchpad_29_0)
+(typeattribute virtual_touchpad_exec_29_0)
+(typeattribute virtual_touchpad_service_29_0)
+(typeattribute vndbinder_device_29_0)
+(typeattribute vndk_sp_file_29_0)
+(typeattribute vndservice_contexts_file_29_0)
+(typeattribute vndservice_manager_type)
+(typeattribute vndservicemanager_29_0)
+(typeattribute voiceinteraction_service_29_0)
+(typeattribute vold_29_0)
+(typeattribute vold_data_file_29_0)
+(typeattribute vold_device_29_0)
+(typeattribute vold_exec_29_0)
+(typeattribute vold_metadata_file_29_0)
+(typeattribute vold_prepare_subdirs_29_0)
+(typeattribute vold_prepare_subdirs_exec_29_0)
+(typeattribute vold_prop_29_0)
+(typeattribute vold_service_29_0)
+(typeattribute vpn_data_file_29_0)
+(typeattribute vr_hwc_29_0)
+(typeattribute vr_hwc_exec_29_0)
+(typeattribute vr_hwc_service_29_0)
+(typeattribute vr_manager_service_29_0)
+(typeattribute vrflinger_vsync_service_29_0)
+(typeattribute wallpaper_file_29_0)
+(typeattribute wallpaper_service_29_0)
+(typeattribute watchdog_device_29_0)
+(typeattribute watchdogd_29_0)
+(typeattribute watchdogd_exec_29_0)
+(typeattribute webview_zygote_29_0)
+(typeattribute webview_zygote_exec_29_0)
+(typeattribute webview_zygote_tmpfs_29_0)
+(typeattribute webviewupdate_service_29_0)
+(typeattribute wifi_data_file_29_0)
+(typeattribute wifi_keystore_service_server)
+(typeattribute wifi_log_prop_29_0)
+(typeattribute wifi_prop_29_0)
+(typeattribute wifi_service_29_0)
+(typeattribute wifiaware_service_29_0)
+(typeattribute wificond_29_0)
+(typeattribute wificond_exec_29_0)
+(typeattribute wificond_service_29_0)
+(typeattribute wifip2p_service_29_0)
+(typeattribute wifiscanner_service_29_0)
+(typeattribute window_service_29_0)
+(typeattribute wpa_socket_29_0)
+(typeattribute wpantund_29_0)
+(typeattribute wpantund_exec_29_0)
+(typeattribute wpantund_service_29_0)
+(typeattribute zero_device_29_0)
+(typeattribute zoneinfo_data_file_29_0)
+(typeattribute zygote_29_0)
+(typeattribute zygote_exec_29_0)
+(typeattribute zygote_socket_29_0)
+(typeattribute zygote_tmpfs_29_0)
diff --git a/prebuilts/api/29.0/private/app.te b/prebuilts/api/29.0/private/app.te
index 7f06d29..0d9a2b4 100644
--- a/prebuilts/api/29.0/private/app.te
+++ b/prebuilts/api/29.0/private/app.te
@@ -2,22 +2,6 @@
 # the implementation of ActivityManager.isDeviceInTestHarnessMode()
 get_prop(appdomain, test_harness_prop)
 
-# Prevent apps from causing presubmit failures.
-# Apps can cause selinux denials by accessing CE storage
-# and/or external storage. In either case, the selinux denial is
-# not the cause of the failure, but just a symptom that
-# storage isn't ready. Many apps handle the failure appropriately.
-#
-# Apps cannot access external storage before it becomes available.
-dontaudit appdomain storage_stub_file:dir getattr;
-# Attempts to write to system_data_file is generally a sign
-# that apps are attempting to access encrypted storage before
-# the ACTION_USER_UNLOCKED intent is delivered. Apps are not
-# allowed to write to CE storage before it's available.
-# Attempting to do so will be blocked by both selinux and unix
-# permissions.
-dontaudit appdomain system_data_file:dir write;
-
 neverallow appdomain system_server:udp_socket {
         accept append bind create ioctl listen lock name_bind
         relabelfrom relabelto setattr shutdown };
diff --git a/prebuilts/api/29.0/private/atrace.te b/prebuilts/api/29.0/private/atrace.te
index 75be787..0cdd35a 100644
--- a/prebuilts/api/29.0/private/atrace.te
+++ b/prebuilts/api/29.0/private/atrace.te
@@ -24,7 +24,16 @@
 # atrace pokes all the binder-enabled processes at startup with a
 # SYSPROPS_TRANSACTION, to tell them to reload the debug.atrace.* properties.
 
-# Allow discovery of binder services.
+binder_use(atrace)
+allow atrace healthd:binder call;
+allow atrace surfaceflinger:binder call;
+allow atrace system_server:binder call;
+
+get_prop(atrace, hwservicemanager_prop)
+
+# atrace can call atrace HAL
+hal_client_domain(atrace, hal_atrace)
+
 allow atrace {
   service_manager_type
   -apex_service
@@ -40,33 +49,6 @@
 }:service_manager { find };
 allow atrace servicemanager:service_manager list;
 
-# Allow notifying the processes hosting specific binder services that
-# trace-related system properties have changed.
-binder_use(atrace)
-allow atrace healthd:binder call;
-allow atrace surfaceflinger:binder call;
-allow atrace system_server:binder call;
-allow atrace cameraserver:binder call;
-
-# Similarly, on debug builds, allow specific HALs to be notified that
-# trace-related system properties have changed.
-userdebug_or_eng(`
-  # List HAL interfaces.
-  allow atrace hwservicemanager:hwservice_manager list;
-  # Notify the camera HAL.
-  hal_client_domain(atrace, hal_camera)
-')
-
-# Remove logspam from notification attempts to non-whitelisted services.
-dontaudit atrace hwservice_manager_type:hwservice_manager find;
-dontaudit atrace service_manager_type:service_manager find;
-dontaudit atrace domain:binder call;
-
-# atrace can call atrace HAL
-hal_client_domain(atrace, hal_atrace)
-
-get_prop(atrace, hwservicemanager_prop)
-
 userdebug_or_eng(`
   # atrace is generally invoked as a standalone binary from shell or perf
   # daemons like Perfetto traced_probes. However, in userdebug builds, there is
diff --git a/prebuilts/api/29.0/private/compat/26.0/26.0.cil b/prebuilts/api/29.0/private/compat/26.0/26.0.cil
index 3b3dae1..60f42b9 100644
--- a/prebuilts/api/29.0/private/compat/26.0/26.0.cil
+++ b/prebuilts/api/29.0/private/compat/26.0/26.0.cil
@@ -336,6 +336,7 @@
 (typeattributeset mdnsd_socket_26_0 (mdnsd_socket))
 (typeattributeset mdns_socket_26_0 (mdns_socket))
 (typeattributeset mediacasserver_service_26_0 (mediacasserver_service))
+(typeattributeset hal_omx_server (mediacodec_26_0))
 (typeattributeset mediacodec_26_0 (mediacodec))
 (typeattributeset mediacodec_exec_26_0 (mediacodec_exec))
 (typeattributeset mediacodec_service_26_0 (mediacodec_service))
diff --git a/prebuilts/api/29.0/private/compat/27.0/27.0.cil b/prebuilts/api/29.0/private/compat/27.0/27.0.cil
index 365d791..8c8f82f 100644
--- a/prebuilts/api/29.0/private/compat/27.0/27.0.cil
+++ b/prebuilts/api/29.0/private/compat/27.0/27.0.cil
@@ -1047,6 +1047,7 @@
 (typeattributeset mdnsd_27_0 (mdnsd))
 (typeattributeset mdnsd_socket_27_0 (mdnsd_socket))
 (typeattributeset mdns_socket_27_0 (mdns_socket))
+(typeattributeset hal_omx_server (mediacodec_27_0))
 (typeattributeset mediacodec_27_0 (mediacodec))
 (typeattributeset mediacodec_exec_27_0 (mediacodec_exec))
 (typeattributeset mediacodec_service_27_0 (mediacodec_service))
diff --git a/prebuilts/api/29.0/private/compat/28.0/28.0.cil b/prebuilts/api/29.0/private/compat/28.0/28.0.cil
index 305cb3a..338cbd0 100644
--- a/prebuilts/api/29.0/private/compat/28.0/28.0.cil
+++ b/prebuilts/api/29.0/private/compat/28.0/28.0.cil
@@ -1242,6 +1242,7 @@
 (typeattributeset mdnsd_28_0 (mdnsd))
 (typeattributeset mdnsd_socket_28_0 (mdnsd_socket))
 (typeattributeset mdns_socket_28_0 (mdns_socket))
+(typeattributeset hal_omx_server (mediacodec_28_0))
 (typeattributeset mediacodec_28_0 (mediacodec))
 (typeattributeset mediacodec_exec_28_0 (mediacodec_exec))
 (typeattributeset mediacodec_service_28_0 (mediacodec_service))
diff --git a/prebuilts/api/29.0/private/compat/28.0/28.0.ignore.cil b/prebuilts/api/29.0/private/compat/28.0/28.0.ignore.cil
index 98c4b9c..ed3671f 100644
--- a/prebuilts/api/29.0/private/compat/28.0/28.0.ignore.cil
+++ b/prebuilts/api/29.0/private/compat/28.0/28.0.ignore.cil
@@ -49,6 +49,7 @@
     dynamic_system_prop
     face_service
     face_vendor_data_file
+    sota_prop
     fastbootd
     flags_health_check
     flags_health_check_exec
diff --git a/prebuilts/api/29.0/private/gsid.te b/prebuilts/api/29.0/private/gsid.te
index 1a35a4b..5dcf746 100644
--- a/prebuilts/api/29.0/private/gsid.te
+++ b/prebuilts/api/29.0/private/gsid.te
@@ -118,7 +118,6 @@
 neverallow {
     domain
     -gsid
-    -init
 } gsi_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
 
 neverallow {
diff --git a/prebuilts/api/29.0/private/incidentd.te b/prebuilts/api/29.0/private/incidentd.te
index 0c57f0f..b93f1b2 100644
--- a/prebuilts/api/29.0/private/incidentd.te
+++ b/prebuilts/api/29.0/private/incidentd.te
@@ -49,13 +49,6 @@
 allow incidentd stats_service:service_manager find;
 binder_call(incidentd, statsd)
 
-# section id 3026, allow reading /data/misc/perfetto-traces.
-# TODO(b/134706389): remove when no longer used.
-userdebug_or_eng(`
-  allow incidentd perfetto_traces_data_file:dir r_dir_perms;
-  allow incidentd perfetto_traces_data_file:file r_file_perms;
-');
-
 # Create and write into /data/misc/incidents
 allow incidentd incident_data_file:dir rw_dir_perms;
 allow incidentd incident_data_file:file create_file_perms;
@@ -154,14 +147,12 @@
 ### neverallow rules
 ###
 
-# only specific domains can find the incident service
-# TODO(b/134706389): remove "perfetto" when no longer used.
+# only dumpstate, system_server, system_app and incident command can find the incident service
 neverallow {
   domain
   -dumpstate
   -incident
   -incidentd
-  userdebug_or_eng(`-perfetto')
   -priv_app
   -statsd
   -system_app
diff --git a/prebuilts/api/29.0/private/perfetto.te b/prebuilts/api/29.0/private/perfetto.te
index 419c4b9..60a6250 100644
--- a/prebuilts/api/29.0/private/perfetto.te
+++ b/prebuilts/api/29.0/private/perfetto.te
@@ -37,19 +37,12 @@
 allow perfetto adbd:fd use;
 allow perfetto adbd:unix_stream_socket { read write };
 
-# Allow adbd to reap perfetto
+# allow adbd to reap perfetto
 allow perfetto adbd:process { sigchld };
 
 # Allow to access /dev/pts when launched in an adb shell.
 allow perfetto devpts:chr_file rw_file_perms;
 
-# Allow perfetto to ask incidentd to start a report.
-# TODO(b/134706389): remove when no longer used.
-userdebug_or_eng(`
-  allow perfetto incident_service:service_manager find;
-  binder_call(perfetto, incidentd)
-');
-
 ###
 ### Neverallow rules
 ###
diff --git a/prebuilts/api/29.0/private/priv_app.te b/prebuilts/api/29.0/private/priv_app.te
index 1bff418..ab3847b 100644
--- a/prebuilts/api/29.0/private/priv_app.te
+++ b/prebuilts/api/29.0/private/priv_app.te
@@ -186,6 +186,12 @@
 allow priv_app system_server:udp_socket {
         connect getattr read recvfrom sendto write getopt setopt };
 
+# Attempts to write to system_data_file is generally a sign
+# that apps are attempting to access encrypted storage before
+# the ACTION_USER_UNLOCKED intent is delivered. Suppress this
+# denial to prevent apps from spamming the logs.
+dontaudit priv_app system_data_file:dir write;
+
 ###
 ### neverallow rules
 ###
diff --git a/prebuilts/api/29.0/private/shell.te b/prebuilts/api/29.0/private/shell.te
index daec360..02b01f5 100644
--- a/prebuilts/api/29.0/private/shell.te
+++ b/prebuilts/api/29.0/private/shell.te
@@ -52,7 +52,7 @@
 
 # Allow shell to read and unlink traces stored in /data/misc/perfetto-traces.
 allow shell perfetto_traces_data_file:dir rw_dir_perms;
-allow shell perfetto_traces_data_file:file { r_file_perms unlink };
+allow shell perfetto_traces_data_file:file r_file_perms;
 
 # Allow shell to run adb shell cmd gpu commands.
 binder_call(shell, gpuservice);
diff --git a/prebuilts/api/29.0/private/statsd.te b/prebuilts/api/29.0/private/statsd.te
index 9d250bd..99548a0 100644
--- a/prebuilts/api/29.0/private/statsd.te
+++ b/prebuilts/api/29.0/private/statsd.te
@@ -18,6 +18,3 @@
 
 # Allow incidentd to obtain the statsd incident section.
 allow statsd incidentd:fifo_file write;
-
-# Allow StatsCompanionService to pipe data to statsd.
-allow statsd system_server:fifo_file { read getattr };
diff --git a/prebuilts/api/29.0/private/untrusted_app_all.te b/prebuilts/api/29.0/private/untrusted_app_all.te
index 89fb6cb..3c20c08 100644
--- a/prebuilts/api/29.0/private/untrusted_app_all.te
+++ b/prebuilts/api/29.0/private/untrusted_app_all.te
@@ -173,6 +173,12 @@
 # Used by: https://play.google.com/store/apps/details?id=jackpal.androidterm
 create_pty(untrusted_app_all)
 
+# Attempts to write to system_data_file is generally a sign
+# that apps are attempting to access encrypted storage before
+# the ACTION_USER_UNLOCKED intent is delivered. Suppress this
+# denial to prevent third party apps from spamming the logs.
+dontaudit untrusted_app_all system_data_file:dir write;
+
 # Allow access to kcov via its ioctl interface for coverage
 # guided kernel fuzzing.
 userdebug_or_eng(`
diff --git a/prebuilts/api/29.0/public/domain.te b/prebuilts/api/29.0/public/domain.te
index f348701..987bb9f 100644
--- a/prebuilts/api/29.0/public/domain.te
+++ b/prebuilts/api/29.0/public/domain.te
@@ -1154,7 +1154,6 @@
   -system_server
   -system_app
   -init
-  -toolbox # TODO(b/141108496) We want to remove toolbox
   -installd # for relabelfrom and unlink, check for this in explicit neverallow
   -vold_prepare_subdirs # For unlink
   with_asan(`-asan_extract')
@@ -1408,3 +1407,4 @@
   -hal_codec2_server
   -hal_omx_server
 } hal_codec2_hwservice:hwservice_manager add;
+
diff --git a/prebuilts/api/29.0/public/init.te b/prebuilts/api/29.0/public/init.te
index 6fd4780..2d52f59 100644
--- a/prebuilts/api/29.0/public/init.te
+++ b/prebuilts/api/29.0/public/init.te
@@ -46,8 +46,6 @@
   userdata_block_device
 }:{ blk_file lnk_file } relabelto;
 
-allow init super_block_device:lnk_file relabelto;
-
 # setrlimit
 allow init self:global_capability_class_set sys_resource;
 
@@ -167,6 +165,7 @@
   file_type
   -app_data_file
   -exec_type
+  -gsi_data_file
   -iorapd_data_file
   -keystore_data_file
   -misc_logd_file
diff --git a/prebuilts/api/29.0/public/property.te b/prebuilts/api/29.0/public/property.te
index e166c00..4ccd8ac 100644
--- a/prebuilts/api/29.0/public/property.te
+++ b/prebuilts/api/29.0/public/property.te
@@ -1,6 +1,7 @@
 type apexd_prop, property_type;
 type audio_prop, property_type, core_property_type;
 type boottime_prop, property_type;
+type boottime_public_prop, property_type;
 type bluetooth_a2dp_offload_prop, property_type;
 type bluetooth_audio_hal_prop, property_type;
 type bluetooth_prop, property_type;
@@ -44,6 +45,7 @@
 type dumpstate_prop, property_type, core_property_type;
 type dynamic_system_prop, property_type;
 type exported_secure_prop, property_type;
+type sota_prop, property_type;
 type ffs_prop, property_type, core_property_type;
 type fingerprint_prop, property_type, core_property_type;
 type firstboot_prop, property_type;
@@ -360,6 +362,7 @@
     -bluetooth_prop
     -bootloader_boot_reason_prop
     -boottime_prop
+    -boottime_public_prop
     -bpf_progs_loaded_prop
     -config_prop
     -cppreopt_prop
@@ -412,6 +415,7 @@
     -exported_vold_prop
     -exported_wifi_prop
     -extended_core_property_type
+    -sota_prop
     -ffs_prop
     -fingerprint_prop
     -firstboot_prop
diff --git a/prebuilts/api/29.0/public/property_contexts b/prebuilts/api/29.0/public/property_contexts
index 46819af..865502e 100644
--- a/prebuilts/api/29.0/public/property_contexts
+++ b/prebuilts/api/29.0/public/property_contexts
@@ -115,7 +115,11 @@
 ro.control_privapp_permissions u:object_r:exported3_default_prop:s0 exact string
 ro.cp_system_other_odex u:object_r:exported3_default_prop:s0 exact int
 ro.crypto.allow_encrypt_override u:object_r:exported2_vold_prop:s0 exact bool
+ro.crypto.fde_algorithm u:object_r:exported2_vold_prop:s0 exact string
+ro.crypto.fde_sector_size u:object_r:exported2_vold_prop:s0 exact int
 ro.crypto.scrypt_params u:object_r:exported2_vold_prop:s0 exact string
+ro.crypto.set_dun u:object_r:exported2_vold_prop:s0 exact bool
+ro.crypto.volume.contents_mode u:object_r:exported2_vold_prop:s0 exact string
 ro.crypto.volume.filenames_mode u:object_r:exported2_vold_prop:s0 exact string
 ro.dalvik.vm.native.bridge u:object_r:exported_dalvik_prop:s0 exact string
 ro.enable_boot_charger_mode u:object_r:exported3_default_prop:s0 exact bool
@@ -211,6 +215,8 @@
 ro.boot.bootdevice u:object_r:exported2_default_prop:s0 exact string
 ro.boot.bootloader u:object_r:exported2_default_prop:s0 exact string
 ro.boot.boottime u:object_r:exported2_default_prop:s0 exact string
+ro.boottime.init.mount.data u:object_r:boottime_public_prop:s0 exact string
+ro.boottime.init.fsck.data u:object_r:boottime_public_prop:s0 exact string
 ro.boot.console u:object_r:exported2_default_prop:s0 exact string
 ro.boot.hardware u:object_r:exported2_default_prop:s0 exact string
 ro.boot.hardware.color u:object_r:exported2_default_prop:s0 exact string
@@ -400,4 +406,3 @@
 ro.surface_flinger.support_kernel_idle_timer u:object_r:exported_default_prop:s0 exact bool
 ro.surface_flinger.use_smart_90_for_video u:object_r:exported_default_prop:s0 exact bool
 ro.surface_flinger.color_space_agnostic_dataspace u:object_r:exported_default_prop:s0 exact int
-ro.surface_flinger.refresh_rate_switching u:object_r:exported_default_prop:s0 exact bool
diff --git a/prebuilts/api/29.0/public/recovery.te b/prebuilts/api/29.0/public/recovery.te
index 2b77bc3..35964ef 100644
--- a/prebuilts/api/29.0/public/recovery.te
+++ b/prebuilts/api/29.0/public/recovery.te
@@ -138,10 +138,6 @@
   # This line seems suspect, as it should not really need to
   # set scheduling parameters for a kernel domain task.
   allow recovery kernel:process setsched;
-
-  # These are needed to update dynamic partitions in recovery.
-  r_dir_file(recovery, sysfs_dm)
-  allowxperm recovery super_block_device_type:blk_file ioctl { BLKIOMIN BLKALIGNOFF };
 ')
 
 ###
diff --git a/prebuilts/api/29.0/public/toolbox.te b/prebuilts/api/29.0/public/toolbox.te
index fcf0ec3..19cc3b6 100644
--- a/prebuilts/api/29.0/public/toolbox.te
+++ b/prebuilts/api/29.0/public/toolbox.te
@@ -22,7 +22,3 @@
 neverallow { domain -init } toolbox:process transition;
 neverallow * toolbox:process dyntransition;
 neverallow toolbox { file_type fs_type -toolbox_exec}:file entrypoint;
-
-# rm -rf directories in /data
-allow toolbox system_data_file:dir { rmdir rw_dir_perms };
-allow toolbox system_data_file:file { getattr unlink };
diff --git a/prebuilts/api/29.0/vendor_sepolicy.cil b/prebuilts/api/29.0/vendor_sepolicy.cil
new file mode 100644
index 0000000..4a3aac3
--- /dev/null
+++ b/prebuilts/api/29.0/vendor_sepolicy.cil
@@ -0,0 +1 @@
+;; empty stub
diff --git a/private/access_vectors b/private/access_vectors
index b77dcc1..4144be8 100644
--- a/private/access_vectors
+++ b/private/access_vectors
@@ -27,6 +27,14 @@
 	execute
 	quotaon
 	mounton
+	audit_access
+	open
+	execmod
+	watch
+	watch_mount
+	watch_sb
+	watch_with_perm
+	watch_reads
 }
 
 
@@ -125,7 +133,7 @@
 common cap2
 {
 	mac_override	# unused by SELinux
-	mac_admin	# unused by SELinux
+	mac_admin
 	syslog
 	wake_alarm
 	block_suspend
@@ -153,6 +161,7 @@
 	associate
 	quotamod
 	quotaget
+	watch
 }
 
 class dir
@@ -163,9 +172,6 @@
 	reparent
 	search
 	rmdir
-	open
-	audit_access
-	execmod
 }
 
 class file
@@ -173,52 +179,26 @@
 {
 	execute_no_trans
 	entrypoint
-	execmod
-	open
-	audit_access
 }
 
 class lnk_file
 inherits file
-{
-	open
-	audit_access
-	execmod
-}
 
 class chr_file
 inherits file
 {
 	execute_no_trans
 	entrypoint
-	execmod
-	open
-	audit_access
 }
 
 class blk_file
 inherits file
-{
-	open
-	audit_access
-	execmod
-}
 
 class sock_file
 inherits file
-{
-	open
-	audit_access
-	execmod
-}
 
 class fifo_file
 inherits file
-{
-	open
-	audit_access
-	execmod
-}
 
 class fd
 {
@@ -410,6 +390,7 @@
 {
 	nlmsg_read
 	nlmsg_write
+	nlmsg_readpriv
 }
 
 class netlink_tcpdiag_socket
@@ -468,8 +449,6 @@
 	send
 	recv
 	relabelto
-	flow_in		# deprecated
-	flow_out	# deprecated
 	forward_in
 	forward_out
 }
@@ -744,3 +723,19 @@
 
 class xdp_socket
 inherits socket
+
+class perf_event
+{
+	open
+	cpu
+	kernel
+	tracepoint
+	read
+	write
+}
+
+class lockdown
+{
+	integrity
+	confidentiality
+}
diff --git a/private/adbd.te b/private/adbd.te
index ec5c57e..89fa1f9 100644
--- a/private/adbd.te
+++ b/private/adbd.te
@@ -87,6 +87,9 @@
 set_prop(adbd, ffs_prop)
 set_prop(adbd, exported_ffs_prop)
 
+# Set service.adb.tls.port, persist.adb.wifi. properties
+set_prop(adbd, adbd_prop)
+
 # Access device logging gating property
 get_prop(adbd, device_logging_prop)
 
@@ -96,6 +99,9 @@
 # Read whether or not Test Harness Mode is enabled
 get_prop(adbd, test_harness_prop)
 
+# Read persist.adb.tls_server.enable property
+get_prop(adbd, system_adbd_prop)
+
 # Read device's overlayfs related properties and files
 userdebug_or_eng(`
   get_prop(adbd, persistent_properties_ready_prop)
@@ -180,7 +186,7 @@
 
 # Connect to shell and use a socket transferred from it.
 # Used for e.g. abb.
-allow adbd shell:unix_stream_socket { read write };
+allow adbd shell:unix_stream_socket { read write shutdown };
 allow adbd shell:fd use;
 
 ###
diff --git a/private/aidl_lazy_test_server.te b/private/aidl_lazy_test_server.te
new file mode 100644
index 0000000..33efde0
--- /dev/null
+++ b/private/aidl_lazy_test_server.te
@@ -0,0 +1,5 @@
+userdebug_or_eng(`
+  typeattribute aidl_lazy_test_server coredomain;
+
+  init_daemon_domain(aidl_lazy_test_server)
+')
diff --git a/private/apexd.te b/private/apexd.te
index b3aabea..9e702dd 100644
--- a/private/apexd.te
+++ b/private/apexd.te
@@ -11,6 +11,20 @@
 allow apexd apex_metadata_file:dir create_dir_perms;
 allow apexd apex_metadata_file:file create_file_perms;
 
+# Allow apexd to create files and directories for snapshots of apex data
+allow apexd apex_permission_data_file:dir { create_dir_perms relabelto };
+allow apexd apex_permission_data_file:file { create_file_perms relabelto };
+allow apexd apex_module_data_file:dir { create_dir_perms relabelfrom };
+allow apexd apex_module_data_file:file { create_file_perms relabelfrom };
+allow apexd apex_rollback_data_file:dir create_dir_perms;
+allow apexd apex_rollback_data_file:file create_file_perms;
+allow apexd apex_wifi_data_file:dir { create_dir_perms relabelto };
+allow apexd apex_wifi_data_file:file { create_file_perms relabelto };
+
+# Allow apexd to read directories under /data/misc_de in order to snapshot and
+# restore apex data for all users.
+allow apexd system_data_file:dir r_dir_perms;
+
 # allow apexd to create loop devices with /dev/loop-control
 allow apexd loop_control_device:chr_file rw_file_perms;
 # allow apexd to access loop devices
@@ -32,7 +46,16 @@
 allow apexd dm_device:blk_file rw_file_perms;
 
 # sys_admin is required to access the device-mapper and mount
-allow apexd self:global_capability_class_set sys_admin;
+# dac_override, chown, and fowner are needed for snapshot and restore
+allow apexd self:global_capability_class_set { sys_admin chown dac_override dac_read_search fowner };
+
+# Note: fsetid is deliberately not included above. fsetid checks are
+# triggered by chmod on a directory or file owned by a group other
+# than one of the groups assigned to the current process to see if
+# the setgid bit should be cleared, regardless of whether the setgid
+# bit was even set.  We do not appear to truly need this capability
+# for apexd to operate.
+dontaudit apexd self:global_capability_class_set fsetid;
 
 # allow apexd to create a mount point in /apex
 allow apexd apex_mnt_dir:dir create_dir_perms;
@@ -50,6 +73,10 @@
 allow apexd staging_data_file:dir r_dir_perms;
 allow apexd staging_data_file:file { r_file_perms link };
 
+# allow apexd to read files from /vendor/apex
+allow apexd vendor_apex_file:dir r_dir_perms;
+allow apexd vendor_apex_file:file r_file_perms;
+
 # Unmount and mount filesystems
 allow apexd labeledfs:filesystem { mount unmount };
 
@@ -63,12 +90,6 @@
 allow apexd sysfs_loop:dir r_dir_perms;
 allow apexd sysfs_loop:file rw_file_perms;
 
-# Spawning a libbinder thread results in a dac_override deny,
-# /dev/cpuset/tasks is owned by system.
-#
-# See b/35323867#comment3
-dontaudit apexd self:global_capability_class_set { dac_override dac_read_search };
-
 # Allow apexd to log to the kernel.
 allow apexd kmsg_device:chr_file w_file_perms;
 
@@ -76,6 +97,9 @@
 # not covered by rollback manager.
 set_prop(apexd, powerctl_prop)
 
+# Allow apexd to stop itself
+set_prop(apexd, ctl_apexd_prop)
+
 # Find the vold service, and call into vold to manage FS checkpoints
 allow apexd vold_service:service_manager find;
 binder_call(apexd, vold)
@@ -107,8 +131,27 @@
   domain_auto_trans(apexd, apex_test_prepostinstall_exec, apex_test_prepostinstall)
 ')
 
+# Allow apexd to be invoked with logwrapper from init during userspace reboot.
+allow apexd devpts:chr_file { read write };
+
+# Allow apexd to create pts files via logwrap_fork_exec for its own use, to pass to
+# other processes
+create_pty(apexd)
+
+# Allow apexd to read file contexts when performing restorecon of snapshots.
+allow apexd file_contexts_file:file r_file_perms;
+
+# Allow apexd to execute toybox for snapshot & restore
+allow apexd toolbox_exec:file rx_file_perms;
+
 neverallow { domain -apexd -init } apex_data_file:dir no_w_dir_perms;
 neverallow { domain -apexd -init } apex_metadata_file:dir no_w_dir_perms;
 neverallow { domain -apexd -init -kernel } apex_data_file:file no_w_file_perms;
 neverallow { domain -apexd -init -kernel } apex_metadata_file:file no_w_file_perms;
 neverallow { domain -apexd } apex_mnt_dir:lnk_file no_w_file_perms;
+
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:dir no_w_dir_perms;
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:file no_w_file_perms;
+
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:dir no_w_dir_perms;
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:file no_w_file_perms;
diff --git a/private/app.te b/private/app.te
index 7f06d29..5590ca5 100644
--- a/private/app.te
+++ b/private/app.te
@@ -2,6 +2,8 @@
 # the implementation of ActivityManager.isDeviceInTestHarnessMode()
 get_prop(appdomain, test_harness_prop)
 
+userdebug_or_eng(`perfetto_producer({ appdomain })')
+
 # Prevent apps from causing presubmit failures.
 # Apps can cause selinux denials by accessing CE storage
 # and/or external storage. In either case, the selinux denial is
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 23e1fd2..66e9f69 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -6,9 +6,11 @@
   ephemeral_app
   isolated_app
   mediaprovider
+  mediaprovider_app
   untrusted_app
   untrusted_app_25
   untrusted_app_27
+  untrusted_app_29
   untrusted_app_all
 }')
 # Receive or send uevent messages.
@@ -37,9 +39,8 @@
 neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto;
 neverallow { all_untrusted_apps -mediaprovider } property_type:property_service set;
 
-# net.dns properties are not a public API. Temporarily exempt pre-Oreo apps,
-# but otherwise disallow untrusted apps from reading this property.
-neverallow { all_untrusted_apps -untrusted_app_25 } net_dns_prop:file read;
+# net.dns properties are not a public API. Disallow untrusted apps from reading this property.
+neverallow { all_untrusted_apps } net_dns_prop:file read;
 
 # Shared libraries created by trusted components within an app home
 # directory can be dlopen()ed. To maintain the W^X property, these files
@@ -86,7 +87,7 @@
 neverallow all_untrusted_apps file_type:file link;
 
 # Do not allow untrusted apps to access network MAC address file
-neverallow all_untrusted_apps sysfs_mac_address:file no_rw_file_perms;
+neverallow all_untrusted_apps sysfs_net:file no_rw_file_perms;
 
 # Do not allow any write access to files in /sys
 neverallow all_untrusted_apps sysfs_type:file { no_w_file_perms no_x_file_perms };
@@ -112,6 +113,14 @@
   alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket xdp_socket
 } *;
 
+# Disallow sending RTM_GETLINK messages on netlink sockets.
+neverallow {
+  all_untrusted_apps
+  -untrusted_app_25
+  -untrusted_app_27
+  -untrusted_app_29
+} domain:netlink_route_socket { bind nlmsg_readpriv };
+
 # Do not allow untrusted apps access to /cache
 neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
 neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr };
@@ -137,8 +146,8 @@
   ')
 }:dir_file_class_set { create unlink };
 
-# No untrusted component should be touching /dev/fuse
-neverallow all_untrusted_apps fuse_device:chr_file *;
+# No untrusted component except mediaprovider_app should be touching /dev/fuse
+neverallow { all_untrusted_apps -mediaprovider_app } fuse_device:chr_file *;
 
 # Do not allow untrusted apps to directly open the tun_device
 neverallow all_untrusted_apps tun_device:chr_file open;
@@ -177,7 +186,6 @@
 neverallow all_untrusted_apps {
   proc
   proc_asound
-  proc_filesystems
   proc_kmsg
   proc_loadavg
   proc_mounts
@@ -191,6 +199,10 @@
   proc_vmstat
 }:file { no_rw_file_perms no_x_file_perms };
 
+# /proc/filesystems is accessible to mediaprovider_app only since it handles
+# external storage
+neverallow { all_untrusted_apps - mediaprovider_app } proc_filesystems:file { no_rw_file_perms no_x_file_perms };
+
 # Avoid all access to kernel configuration
 neverallow all_untrusted_apps config_gz:file { no_rw_file_perms no_x_file_perms };
 
@@ -205,11 +217,11 @@
 # other than find actions for services listed below
 neverallow all_untrusted_apps *:hwservice_manager ~find;
 
-# Do not permit access from apps which host arbitrary code to HwBinder services,
-# except those considered sufficiently safe for access from such apps.
+# Do not permit access from apps which host arbitrary code to the protected HwBinder
+# services.
 # The two main reasons for this are:
-# 1. HwBinder servers do not perform client authentication because HIDL
-#    currently does not expose caller UID information and, even if it did, many
+# 1. Protected HwBinder servers do not perform client authentication because HIDL
+#    currently does not expose caller UID information and, even if it did, those
 #    HwBinder services either operate at a level below that of apps (e.g., HALs)
 #    or must not rely on app identity for authorization. Thus, to be safe, the
 #    default assumption is that every HwBinder service treats all its clients as
@@ -218,110 +230,15 @@
 #    incidence rate of security issues than system/core components and have
 #    access to lower layes of the stack (all the way down to hardware) thus
 #    increasing opportunities for bypassing the Android security model.
-#
-# Safe services include:
-# - same process services: because they by definition run in the process
-#   of the client and thus have the same access as the client domain in which
-#   the process runs
-# - coredomain_hwservice: are considered safe because they do not pose risks
-#   associated with reason #2 above.
-# - hal_configstore_ISurfaceFlingerConfigs:  becuase it has specifically been
-#   designed for use by any domain.
-# - hal_graphics_allocator_hwservice: because these operations are also offered
-#   by surfaceflinger Binder service, which apps are permitted to access
-# - hal_omx_hwservice: because this is a HwBinder version of the mediacodec
-#   Binder service which apps were permitted to access.
-# - hal_codec2_hwservice: because this is a newer version of hal_omx_hwservice.
-neverallow all_untrusted_apps {
-  hwservice_manager_type
-  -same_process_hwservice
-  -coredomain_hwservice
-  -hal_codec2_hwservice
-  -hal_configstore_ISurfaceFlingerConfigs
-  -hal_graphics_allocator_hwservice
-  -hal_omx_hwservice
-  -hal_cas_hwservice
-  -hal_neuralnetworks_hwservice
-  -untrusted_app_visible_hwservice_violators
-}:hwservice_manager find;
+neverallow all_untrusted_apps protected_hwservice:hwservice_manager find;
 
-# Make sure that the following services are never accessible by untrusted_apps
 neverallow all_untrusted_apps {
-  default_android_hwservice
-  hal_atrace_hwservice
-  hal_audio_hwservice
-  hal_authsecret_hwservice
-  hal_bluetooth_hwservice
-  hal_bootctl_hwservice
-  hal_camera_hwservice
-  hal_confirmationui_hwservice
-  hal_contexthub_hwservice
-  hal_drm_hwservice
-  hal_dumpstate_hwservice
-  hal_fingerprint_hwservice
-  hal_gatekeeper_hwservice
-  hal_gnss_hwservice
-  hal_graphics_composer_hwservice
-  hal_health_hwservice
-  hal_input_classifier_hwservice
-  hal_ir_hwservice
-  hal_keymaster_hwservice
-  hal_light_hwservice
-  hal_memtrack_hwservice
-  hal_nfc_hwservice
-  hal_oemlock_hwservice
-  hal_power_hwservice
-  hal_power_stats_hwservice
-  hal_secure_element_hwservice
-  hal_sensors_hwservice
-  hal_telephony_hwservice
-  hal_thermal_hwservice
-  hal_tv_cec_hwservice
-  hal_tv_input_hwservice
-  hal_usb_hwservice
-  hal_vibrator_hwservice
-  hal_vr_hwservice
-  hal_weaver_hwservice
-  hal_wifi_hwservice
-  hal_wifi_offload_hwservice
-  hal_wifi_supplicant_hwservice
-  hidl_base_hwservice
-  system_net_netd_hwservice
-  thermalcallback_hwservice
-}:hwservice_manager find;
-# HwBinder services offered by core components (as opposed to vendor components)
-# are considered somewhat safer due to point #2 above.
-neverallow all_untrusted_apps {
-  coredomain_hwservice
-  -same_process_hwservice
-  -fwk_bufferhub_hwservice # Designed for use by any domain
-  -hidl_allocator_hwservice # Designed for use by any domain
-  -hidl_manager_hwservice # Designed for use by any domain
-  -hidl_memory_hwservice # Designed for use by any domain
-  -hidl_token_hwservice # Designed for use by any domain
-}:hwservice_manager find;
+  vendor_service
+}:service_manager find;
 
 # SELinux is not an API for untrusted apps to use
 neverallow all_untrusted_apps selinuxfs:file no_rw_file_perms;
 
-# Restrict *Binder access from apps to HAL domains. We can only do this on full
-# Treble devices where *Binder communications between apps and HALs are tightly
-# restricted.
-full_treble_only(`
-  neverallow all_untrusted_apps {
-    halserverdomain
-    -coredomain
-    -hal_cas_server
-    -hal_codec2_server
-    -hal_configstore_server
-    -hal_graphics_allocator_server
-    -hal_neuralnetworks_server
-    -hal_omx_server
-    -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
-    -untrusted_app_visible_halserver_violators
-  }:binder { call transfer };
-')
-
 # Access to /proc/tty/drivers, to allow apps to determine if they
 # are running in an emulated environment.
 # b/33214085 b/33814662 b/33791054 b/33211769
@@ -333,11 +250,10 @@
 # Untrusted apps are not allowed to use cgroups.
 neverallow all_untrusted_apps cgroup:file *;
 
-# Untrusted apps targetting >= Q are not allowed to open /dev/ashmem directly.
-# They must use ASharedMemory NDK API instead.
+# /mnt/sdcard symlink was supposed to have been removed in Gingerbread. Apps
+# must not use it.
 neverallow {
   all_untrusted_apps
-  -ephemeral_app
   -untrusted_app_25
   -untrusted_app_27
-} ashmem_device:chr_file open;
+} mnt_sdcard_file:lnk_file *;
diff --git a/private/app_zygote.te b/private/app_zygote.te
index e44c1be..a826f7f 100644
--- a/private/app_zygote.te
+++ b/private/app_zygote.te
@@ -61,12 +61,18 @@
 allow app_zygote apk_data_file:dir r_dir_perms;
 allow app_zygote apk_data_file:file { r_file_perms execute };
 
+# /oem accesses.
+allow app_zygote oemfs:dir search;
+
 # Allow app_zygote access to /vendor/overlay
 r_dir_file(app_zygote, vendor_overlay_file)
 
 allow app_zygote system_data_file:lnk_file r_file_perms;
 allow app_zygote system_data_file:file { getattr read map };
 
+# Send unsolicited message to system_server
+unix_socket_send(app_zygote, system_unsolzygote, system_server)
+
 #####
 ##### Neverallow
 #####
@@ -100,7 +106,6 @@
 neverallow app_zygote {
     service_manager_type
     -activity_service
-    -ashmem_device_service
     -webviewupdate_service
 }:service_manager find;
 
@@ -127,15 +132,18 @@
   alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket
 } *;
 
-# Only allow app_zygote to talk to the logd socket, and su/heapprofd on eng/userdebug
-# This is because cap_setuid/cap_setgid allow to forge uid/gid in SCM_CREDENTIALS.
+# Only allow app_zygote to talk to the logd socket, and
+# su/heapprofd/traced_perf on eng/userdebug. This is because
+# cap_setuid/cap_setgid allow to forge uid/gid in SCM_CREDENTIALS.
 # Think twice before changing.
 neverallow app_zygote {
   domain
   -app_zygote
   -logd
+  -system_server
   userdebug_or_eng(`-su')
   userdebug_or_eng(`-heapprofd')
+  userdebug_or_eng(`-traced_perf')
 }:unix_dgram_socket *;
 
 neverallow app_zygote {
@@ -143,6 +151,7 @@
   -app_zygote
   userdebug_or_eng(`-su')
   userdebug_or_eng(`-heapprofd')
+  userdebug_or_eng(`-traced_perf')
 }:unix_stream_socket *;
 
 # Never allow ptrace
diff --git a/private/ashmemd.te b/private/ashmemd.te
deleted file mode 100644
index 08df515..0000000
--- a/private/ashmemd.te
+++ /dev/null
@@ -1,9 +0,0 @@
-typeattribute ashmemd coredomain;
-type ashmemd_exec, exec_type, file_type, system_file_type;
-
-init_daemon_domain(ashmemd)
-
-binder_use(ashmemd)
-add_service(ashmemd, ashmem_device_service)
-
-allow ashmemd ashmem_device:chr_file rw_file_perms;
diff --git a/private/atrace.te b/private/atrace.te
index 75be787..ad7d177 100644
--- a/private/atrace.te
+++ b/private/atrace.te
@@ -37,6 +37,7 @@
   -installd_service
   -vold_service
   -lpdump_service
+  -default_android_service
 }:service_manager { find };
 allow atrace servicemanager:service_manager list;
 
@@ -55,6 +56,7 @@
   allow atrace hwservicemanager:hwservice_manager list;
   # Notify the camera HAL.
   hal_client_domain(atrace, hal_camera)
+  hal_client_domain(atrace, hal_vibrator)
 ')
 
 # Remove logspam from notification attempts to non-whitelisted services.
diff --git a/private/audioserver.te b/private/audioserver.te
index 05e793c..067152f 100644
--- a/private/audioserver.te
+++ b/private/audioserver.te
@@ -40,6 +40,7 @@
 allow audioserver scheduling_policy_service:service_manager find;
 allow audioserver mediametrics_service:service_manager find;
 allow audioserver sensor_privacy_service:service_manager find;
+allow audioserver soundtrigger_middleware_service:service_manager find;
 
 # Allow read/write access to bluetooth-specific properties
 set_prop(audioserver, bluetooth_a2dp_offload_prop)
diff --git a/private/automotive_display_service.te b/private/automotive_display_service.te
new file mode 100644
index 0000000..fa11ca4
--- /dev/null
+++ b/private/automotive_display_service.te
@@ -0,0 +1,33 @@
+# Display proxy service for Automotive
+type automotive_display_service, domain, coredomain;
+type automotive_display_service_exec, system_file_type, exec_type, file_type;
+
+typeattribute automotive_display_service automotive_display_service_server;
+
+# Allow to add a display service to the manager
+add_hwservice(automotive_display_service, fwk_automotive_display_hwservice);
+
+# Allow init to launch automotive display service
+init_daemon_domain(automotive_display_service)
+
+# Allow to use Binder IPC for SurfaceFlinger.
+binder_use(automotive_display_service)
+
+# Allow to use HwBinder IPC for HAL implementations.
+hwbinder_use(automotive_display_service)
+hal_client_domain(automotive_display_service, hal_graphics_composer)
+
+# Allow to read the target property.
+get_prop(automotive_display_service, hwservicemanager_prop)
+
+# Allow to find SurfaceFlinger.
+allow automotive_display_service surfaceflinger_service:service_manager find;
+
+# Allow client domain to do binder IPC to serverdomain.
+binder_call(automotive_display_service, surfaceflinger)
+
+# Allow to use a graphics mapper
+allow automotive_display_service hal_graphics_mapper_hwservice:hwservice_manager find;
+
+# Allow to use hidl token service
+allow automotive_display_service hidl_token_hwservice:hwservice_manager find;
diff --git a/private/blank_screen.te b/private/blank_screen.te
index 51310d1..69dd7e6 100644
--- a/private/blank_screen.te
+++ b/private/blank_screen.te
@@ -4,3 +4,5 @@
 init_daemon_domain(blank_screen)
 
 hal_client_domain(blank_screen, hal_light)
+
+allow blank_screen hal_light_service:service_manager find;
diff --git a/private/bluetooth.te b/private/bluetooth.te
index b96fc58..1680361 100644
--- a/private/bluetooth.te
+++ b/private/bluetooth.te
@@ -40,6 +40,9 @@
 allow bluetooth proc_bluetooth_writable:file rw_file_perms;
 
 # Allow write access to bluetooth specific properties
+set_prop(bluetooth, binder_cache_bluetooth_server_prop);
+neverallow { domain -bluetooth -init }
+    binder_cache_bluetooth_server_prop:property_service set;
 set_prop(bluetooth, bluetooth_a2dp_offload_prop)
 set_prop(bluetooth, bluetooth_audio_hal_prop)
 set_prop(bluetooth, bluetooth_prop)
diff --git a/private/boringssl_self_test.te b/private/boringssl_self_test.te
new file mode 100644
index 0000000..50fc1fc
--- /dev/null
+++ b/private/boringssl_self_test.te
@@ -0,0 +1,74 @@
+# System and vendor domains for BoringSSL self test binaries.
+#
+# For FIPS compliance, all processes linked against libcrypto perform a startup
+# self test which computes a hash of the BoringSSL Crypto Module (BCM) and, at least once
+# per device boot, also run a series of Known Answer Tests (KAT) to verify functionality.
+#
+# The KATs are expensive, and to ensure they are run as few times as possible, they
+# are skipped if a marker file exists in /dev/boringssl/selftest whose name is
+# the hash of the BCM that was computed earlier.  The files are zero length and their contents
+# should never be read or written.  To avoid giving arbitrary processes access to /dev/boringssl
+# to create these marker files, there are dedicated self test binaries which this policy
+# gives access to and which are run during early-init.
+#
+# Due to build skew, the version of libcrypto in /vendor may have a different hash than
+# the system one.  To cater for this there are vendor variants of the self test binaries
+# which also have permission to write to the same files in /dev/boringssl.  In the case where
+# vendor and system libcrypto have the same hash, there will be a race to create the file,
+# but this is harmless.
+#
+# If the self tests fail, then the device should reboot into firmware and for this reason
+# the system boringssl_self_test domain needs to be in coredomain.  As vendor domains
+# are not allowed in coredomain, this means that the vendor self tests cannot trigger a
+# reboot.  However every binary linked against the vendor libcrypto will abort on startup,
+# so in practice the device will crash anyway in this unlikely scenario.
+
+# System boringssl_self_test domain
+type boringssl_self_test, domain, coredomain;
+type boringssl_self_test_exec, system_file_type, exec_type, file_type;
+
+# Vendor boringssl_self_test domain
+type vendor_boringssl_self_test, domain;
+type vendor_boringssl_self_test_exec, vendor_file_type, exec_type, file_type;
+
+# Switch to boringssl_self_test security domain when running boringssl_self_test_exec
+init_daemon_domain(boringssl_self_test)
+
+# Switch to vendor_boringssl_self_test security domain when running vendor_boringssl_self_test_exec
+init_daemon_domain(vendor_boringssl_self_test)
+
+# Marker files, common to both domains, indicating KAT have been performed on a particular libcrypto
+#
+# The files are zero length so there is no issue if both vendor and system code
+# try to create the same file simultaneously. One will succeed and the other will fail
+# silently, i.e. still indicate success.  Similar harmless naming collisions will happen in the
+# system domain e.g. when system and APEX copies of libcrypto are identical.
+type boringssl_self_test_marker, file_type;
+
+# Allow self test binaries to create/check for the existence of boringssl_self_test_marker files
+allow { boringssl_self_test vendor_boringssl_self_test }
+  boringssl_self_test_marker:file create_file_perms;
+allow { boringssl_self_test vendor_boringssl_self_test }
+  boringssl_self_test_marker:dir ra_dir_perms;
+
+# Allow self test binaries to write their stdout/stderr messages to kmsg_debug
+allow { boringssl_self_test vendor_boringssl_self_test }
+  kmsg_debug_device:chr_file { w_file_perms getattr ioctl };
+
+# No other process should be able to create marker files because their existence causes the
+# boringssl KAT to be skipped.
+neverallow {
+  domain
+  -vendor_boringssl_self_test
+  -boringssl_self_test
+  -init
+  -vendor_init
+} boringssl_self_test_marker:file no_rw_file_perms;
+
+neverallow {
+  domain
+  -vendor_boringssl_self_test
+  -boringssl_self_test
+  -init
+  -vendor_init
+} boringssl_self_test_marker:dir write;
diff --git a/private/bpfloader.te b/private/bpfloader.te
index 00d4c79..249f3df 100644
--- a/private/bpfloader.te
+++ b/private/bpfloader.te
@@ -3,26 +3,36 @@
 type bpfloader_exec, system_file_type, exec_type, file_type;
 typeattribute bpfloader coredomain;
 
-# These permission is required for pin bpf program for netd.
-allow bpfloader fs_bpf:dir  create_dir_perms;
-allow bpfloader fs_bpf:file create_file_perms;
-allow bpfloader devpts:chr_file { read write };
+# These permissions are required to pin ebpf maps & programs.
+allow bpfloader fs_bpf:dir { search write add_name };
+allow bpfloader fs_bpf:file { create setattr };
 
-# Allow bpfloader to create bpf maps and programs. The map_read and map_write permission is needed
-# for retrieving a pinned map when bpfloader do a run time restart.
-allow bpfloader self:bpf { prog_load prog_run map_read map_write map_create };
+# Allow bpfloader to create bpf maps and programs.
+allow bpfloader self:bpf { map_create map_read map_write prog_load prog_run };
 
-allow bpfloader self:global_capability_class_set sys_admin;
+allow bpfloader self:capability { chown sys_admin };
 
 ###
 ### Neverallow rules
 ###
+
+# TODO: get rid of init & vendor_init
+neverallow { domain -init -vendor_init } fs_bpf:dir setattr;
+neverallow { domain -bpfloader } fs_bpf:dir { write add_name };
+neverallow domain fs_bpf:dir { reparent rename rmdir };
+
+# TODO: get rid of init & vendor_init
+neverallow { domain -bpfloader -init -vendor_init } fs_bpf:file setattr;
+neverallow { domain -bpfloader } fs_bpf:file create;
+neverallow domain fs_bpf:file { rename unlink };
+
 neverallow { domain -bpfloader } *:bpf { map_create prog_load };
-neverallow { domain -bpfloader -netd -netutils_wrapper } *:bpf prog_run;
+neverallow { domain -bpfloader -netd -netutils_wrapper -system_server } *:bpf prog_run;
+neverallow { domain -bpfloader -netd -system_server } *:bpf { map_read map_write };
+
 neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
+
 neverallow bpfloader domain:{ tcp_socket udp_socket rawip_socket } *;
-# only system_server, netd and bpfloader can read/write the bpf maps
-neverallow { domain -system_server -netd -bpfloader} *:bpf { map_read map_write };
 
 # No domain should be allowed to ptrace bpfloader
 neverallow { domain userdebug_or_eng(`-llkd') } bpfloader:process ptrace;
diff --git a/private/bug_map b/private/bug_map
index 4b29fde..60c2f15 100644
--- a/private/bug_map
+++ b/private/bug_map
@@ -1,31 +1,33 @@
-dnsmasq netd fifo_file 77868789
-dnsmasq netd unix_stream_socket 77868789
-init app_data_file file 77873135
-init cache_file blk_file 77873135
-init logpersist file 77873135
-init nativetest_data_file dir 77873135
-init pstorefs dir 77873135
-init shell_data_file dir 77873135
-init shell_data_file file 77873135
-init shell_data_file lnk_file 77873135
-init shell_data_file sock_file 77873135
-init system_data_file chr_file 77873135
-isolated_app privapp_data_file dir 119596573
-isolated_app app_data_file dir 120394782
-mediaextractor app_data_file file 77923736
-mediaextractor radio_data_file file 77923736
-mediaprovider cache_file blk_file 77925342
-mediaprovider mnt_media_rw_file dir 77925342
-mediaprovider shell_data_file dir 77925342
-netd priv_app unix_stream_socket 77870037
-netd untrusted_app unix_stream_socket 77870037
-netd untrusted_app_25 unix_stream_socket 77870037
-netd untrusted_app_27 unix_stream_socket 77870037
-platform_app nfc_data_file dir 74331887
-system_server crash_dump process 73128755
-system_server sdcardfs file 77856826
-system_server storage_stub_file dir 112609936
-system_server zygote process 77856826
-usbd usbd capability 72472544
-vold system_data_file file 124108085
-zygote untrusted_app_25 process 77925912
+dnsmasq netd fifo_file b/77868789
+dnsmasq netd unix_stream_socket b/77868789
+gmscore_app system_data_file dir b/146166941
+init app_data_file file b/77873135
+init cache_file blk_file b/77873135
+init logpersist file b/77873135
+init nativetest_data_file dir b/77873135
+init pstorefs dir b/77873135
+init shell_data_file dir b/77873135
+init shell_data_file file b/77873135
+init shell_data_file lnk_file b/77873135
+init shell_data_file sock_file b/77873135
+init system_data_file chr_file b/77873135
+isolated_app privapp_data_file dir b/119596573
+isolated_app app_data_file dir b/120394782
+mediaextractor app_data_file file b/77923736
+mediaextractor radio_data_file file b/77923736
+mediaprovider cache_file blk_file b/77925342
+mediaprovider mnt_media_rw_file dir b/77925342
+mediaprovider shell_data_file dir b/77925342
+mediaswcodec ashmem_device chr_file b/142679232
+netd priv_app unix_stream_socket b/77870037
+netd untrusted_app unix_stream_socket b/77870037
+netd untrusted_app_25 unix_stream_socket b/77870037
+netd untrusted_app_27 unix_stream_socket b/77870037
+platform_app nfc_data_file dir b/74331887
+system_server crash_dump process b/73128755
+system_server overlayfs_file file b/142390309
+system_server sdcardfs file b/77856826
+system_server storage_stub_file dir b/145267097
+system_server zygote process b/77856826
+vold system_data_file file b/124108085
+zygote untrusted_app_25 process b/77925912
diff --git a/private/clatd.te b/private/clatd.te
index 5ba0fc5..0fa774a 100644
--- a/private/clatd.te
+++ b/private/clatd.te
@@ -1 +1,36 @@
-typeattribute clatd coredomain;
+# 464xlat daemon
+type clatd, domain, coredomain;
+type clatd_exec, system_file_type, exec_type, file_type;
+
+net_domain(clatd)
+
+r_dir_file(clatd, proc_net_type)
+userdebug_or_eng(`
+  auditallow clatd proc_net_type:{ dir file lnk_file } { getattr open read };
+')
+
+# Access objects inherited from netd.
+allow clatd netd:fd use;
+allow clatd netd:fifo_file { read write };
+# TODO: Check whether some or all of these sockets should be close-on-exec.
+allow clatd netd:netlink_kobject_uevent_socket { read write };
+allow clatd netd:netlink_nflog_socket { read write };
+allow clatd netd:netlink_route_socket { read write };
+allow clatd netd:udp_socket { read write };
+allow clatd netd:unix_stream_socket { read write };
+allow clatd netd:unix_dgram_socket { read write };
+
+allow clatd self:global_capability_class_set { net_admin net_raw setuid setgid };
+
+# clatd calls mmap(MAP_LOCKED) with a 1M buffer. MAP_LOCKED first checks
+# capable(CAP_IPC_LOCK), and then checks to see the requested amount is
+# under RLIMIT_MEMLOCK. If the latter check succeeds clatd won't have
+# needed CAP_IPC_LOCK. But this is not guaranteed to succeed on all devices
+# so we permit any requests we see from clatd asking for this capability.
+# See https://android-review.googlesource.com/127940 and
+# https://b.corp.google.com/issues/21736319
+allow clatd self:global_capability_class_set ipc_lock;
+
+allow clatd self:netlink_route_socket nlmsg_write;
+allow clatd self:{ packet_socket rawip_socket } create_socket_perms_no_ioctl;
+allow clatd tun_device:chr_file rw_file_perms;
diff --git a/private/compat/26.0/26.0.cil b/private/compat/26.0/26.0.cil
index 3b3dae1..498bca5 100644
--- a/private/compat/26.0/26.0.cil
+++ b/private/compat/26.0/26.0.cil
@@ -2,11 +2,15 @@
 (typeattribute hal_wifi_keystore)
 (typeattribute hal_wifi_keystore_client)
 (typeattribute hal_wifi_keystore_server)
+(typeattribute hal_wifi_offload)
+(typeattribute hal_wifi_offload_client)
+(typeattribute hal_wifi_offload_server)
 
 ;; types removed from current policy
 (type untrusted_v2_app)
 (type asan_reboot_prop)
 (type commontime_management_service)
+(type hal_wifi_offload_hwservice)
 (type log_device)
 (type mediacasserver_service)
 (type mediacodec)
@@ -336,6 +340,7 @@
 (typeattributeset mdnsd_socket_26_0 (mdnsd_socket))
 (typeattributeset mdns_socket_26_0 (mdns_socket))
 (typeattributeset mediacasserver_service_26_0 (mediacasserver_service))
+(typeattributeset hal_omx_server (mediacodec_26_0))
 (typeattributeset mediacodec_26_0 (mediacodec))
 (typeattributeset mediacodec_exec_26_0 (mediacodec_exec))
 (typeattributeset mediacodec_service_26_0 (mediacodec_service))
@@ -432,9 +437,6 @@
 (typeattributeset pdx_performance_dir_26_0 (pdx_performance_dir))
 (typeattributeset performanced_26_0 (performanced))
 (typeattributeset performanced_exec_26_0 (performanced_exec))
-(typeattributeset perfprofd_26_0 (perfprofd))
-(typeattributeset perfprofd_data_file_26_0 (perfprofd_data_file))
-(typeattributeset perfprofd_exec_26_0 (perfprofd_exec))
 (typeattributeset permission_service_26_0 (permission_service))
 (typeattributeset persist_debug_prop_26_0 (persist_debug_prop))
 (typeattributeset persistent_data_block_service_26_0 (persistent_data_block_service))
diff --git a/private/compat/26.0/26.0.compat.cil b/private/compat/26.0/26.0.compat.cil
new file mode 100644
index 0000000..30af58c
--- /dev/null
+++ b/private/compat/26.0/26.0.compat.cil
@@ -0,0 +1,5 @@
+(typeattribute vendordomain)
+(typeattributeset vendordomain ((and (domain) ((not (coredomain))))))
+(allowx vendordomain dev_type (ioctl blk_file ((range 0x0000 0xffff))))
+(allowx vendordomain file_type (ioctl file ((range 0x0000 0xffff))))
+(allow vendordomain self (netlink_route_socket (nlmsg_readpriv)))
diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index 45e1dd9..b395855 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -34,6 +34,7 @@
     color_display_service
     content_capture_service
     crossprofileapps_service
+    ctl_apexd_prop
     ctl_interface_restart_prop
     ctl_interface_start_prop
     ctl_interface_stop_prop
@@ -117,6 +118,7 @@
     mediaswcodec_tmpfs
     mediaextractor_update_service
     mediaprovider_tmpfs
+    metadata_bootstat_file
     metadata_file
     mnt_product_file
     mnt_vendor_file
@@ -131,11 +133,11 @@
     perfetto_exec
     perfetto_tmpfs
     perfetto_traces_data_file
-    perfprofd_service
     property_info
     recovery_socket
     role_service
     runas_app
+    art_apex_dir
     runtime_service
     secure_element
     secure_element_device
@@ -145,6 +147,7 @@
     simpleperf_app_runner
     simpleperf_app_runner_exec
     slice_service
+    socket_hook_prop
     staging_data_file
     stats
     stats_data_file
@@ -195,8 +198,11 @@
     usbd
     usbd_exec
     usbd_tmpfs
+    vendor_apex_file
     vendor_init
     vendor_shell
+    vendor_socket_hook_prop
+    vndk_prop
     vold_metadata_file
     vold_prepare_subdirs
     vold_prepare_subdirs_exec
diff --git a/private/compat/27.0/27.0.cil b/private/compat/27.0/27.0.cil
index 365d791..0d883c0 100644
--- a/private/compat/27.0/27.0.cil
+++ b/private/compat/27.0/27.0.cil
@@ -1,5 +1,11 @@
+;; attributes removed from current policy
+(typeattribute hal_wifi_offload)
+(typeattribute hal_wifi_offload_client)
+(typeattribute hal_wifi_offload_server)
+
 ;; types removed from current policy
 (type commontime_management_service)
+(type hal_wifi_offload_hwservice)
 (type mediacodec)
 (type mediacodec_exec)
 (type netd_socket)
@@ -430,9 +436,6 @@
 (expandtypeattribute (pdx_performance_dir_27_0) true)
 (expandtypeattribute (performanced_27_0) true)
 (expandtypeattribute (performanced_exec_27_0) true)
-(expandtypeattribute (perfprofd_27_0) true)
-(expandtypeattribute (perfprofd_data_file_27_0) true)
-(expandtypeattribute (perfprofd_exec_27_0) true)
 (expandtypeattribute (permission_service_27_0) true)
 (expandtypeattribute (persist_debug_prop_27_0) true)
 (expandtypeattribute (persistent_data_block_service_27_0) true)
@@ -1047,6 +1050,7 @@
 (typeattributeset mdnsd_27_0 (mdnsd))
 (typeattributeset mdnsd_socket_27_0 (mdnsd_socket))
 (typeattributeset mdns_socket_27_0 (mdns_socket))
+(typeattributeset hal_omx_server (mediacodec_27_0))
 (typeattributeset mediacodec_27_0 (mediacodec))
 (typeattributeset mediacodec_exec_27_0 (mediacodec_exec))
 (typeattributeset mediacodec_service_27_0 (mediacodec_service))
@@ -1147,9 +1151,6 @@
 (typeattributeset pdx_performance_dir_27_0 (pdx_performance_dir))
 (typeattributeset performanced_27_0 (performanced))
 (typeattributeset performanced_exec_27_0 (performanced_exec))
-(typeattributeset perfprofd_27_0 (perfprofd))
-(typeattributeset perfprofd_data_file_27_0 (perfprofd_data_file))
-(typeattributeset perfprofd_exec_27_0 (perfprofd_exec))
 (typeattributeset permission_service_27_0 (permission_service))
 (typeattributeset persist_debug_prop_27_0 (persist_debug_prop))
 (typeattributeset persistent_data_block_service_27_0 (persistent_data_block_service))
diff --git a/private/compat/27.0/27.0.compat.cil b/private/compat/27.0/27.0.compat.cil
new file mode 100644
index 0000000..30af58c
--- /dev/null
+++ b/private/compat/27.0/27.0.compat.cil
@@ -0,0 +1,5 @@
+(typeattribute vendordomain)
+(typeattributeset vendordomain ((and (domain) ((not (coredomain))))))
+(allowx vendordomain dev_type (ioctl blk_file ((range 0x0000 0xffff))))
+(allowx vendordomain file_type (ioctl file ((range 0x0000 0xffff))))
+(allow vendordomain self (netlink_route_socket (nlmsg_readpriv)))
diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil
index 0e830f8..cb500c9 100644
--- a/private/compat/27.0/27.0.ignore.cil
+++ b/private/compat/27.0/27.0.ignore.cil
@@ -32,6 +32,7 @@
     color_display_service
     content_capture_service
     crossprofileapps_service
+    ctl_apexd_prop
     ctl_interface_restart_prop
     ctl_interface_start_prop
     ctl_interface_stop_prop
@@ -106,6 +107,7 @@
     mediaswcodec
     mediaswcodec_exec
     mediaswcodec_tmpfs
+    metadata_bootstat_file
     metadata_file
     mnt_product_file
     mnt_vendor_file
@@ -118,11 +120,11 @@
     perfetto_exec
     perfetto_tmpfs
     perfetto_traces_data_file
-    perfprofd_service
     property_info
     recovery_socket
     role_service
     runas_app
+    art_apex_dir
     runtime_service
     secure_element
     secure_element_device
@@ -132,6 +134,7 @@
     simpleperf_app_runner
     simpleperf_app_runner_exec
     slice_service
+    socket_hook_prop
     stats
     stats_data_file
     stats_exec
@@ -171,10 +174,13 @@
     usbd
     usbd_exec
     usbd_tmpfs
+    vendor_apex_file
     vendor_default_prop
     vendor_init
     vendor_security_patch_level_prop
     vendor_shell
+    vendor_socket_hook_prop
+    vndk_prop
     vold_metadata_file
     vold_prepare_subdirs
     vold_prepare_subdirs_exec
diff --git a/private/compat/28.0/28.0.cil b/private/compat/28.0/28.0.cil
index 305cb3a..321e938 100644
--- a/private/compat/28.0/28.0.cil
+++ b/private/compat/28.0/28.0.cil
@@ -1,3 +1,8 @@
+;; attributes removed from current policy
+(typeattribute hal_wifi_offload)
+(typeattribute hal_wifi_offload_client)
+(typeattribute hal_wifi_offload_server)
+
 ;; types removed from current policy
 (type alarm_device)
 (type audio_seq_device)
@@ -5,6 +10,7 @@
 (type commontime_management_service)
 (type cpuctl_device)
 (type full_device)
+(type hal_wifi_offload_hwservice)
 (type i2c_device)
 (type kmem_device)
 (type mediacodec)
@@ -504,10 +510,6 @@
 (expandtypeattribute (pdx_performance_dir_28_0) true)
 (expandtypeattribute (performanced_28_0) true)
 (expandtypeattribute (performanced_exec_28_0) true)
-(expandtypeattribute (perfprofd_28_0) true)
-(expandtypeattribute (perfprofd_data_file_28_0) true)
-(expandtypeattribute (perfprofd_exec_28_0) true)
-(expandtypeattribute (perfprofd_service_28_0) true)
 (expandtypeattribute (permission_service_28_0) true)
 (expandtypeattribute (persist_debug_prop_28_0) true)
 (expandtypeattribute (persistent_data_block_service_28_0) true)
@@ -1242,6 +1244,7 @@
 (typeattributeset mdnsd_28_0 (mdnsd))
 (typeattributeset mdnsd_socket_28_0 (mdnsd_socket))
 (typeattributeset mdns_socket_28_0 (mdns_socket))
+(typeattributeset hal_omx_server (mediacodec_28_0))
 (typeattributeset mediacodec_28_0 (mediacodec))
 (typeattributeset mediacodec_exec_28_0 (mediacodec_exec))
 (typeattributeset mediacodec_service_28_0 (mediacodec_service))
@@ -1347,10 +1350,6 @@
 (typeattributeset pdx_performance_dir_28_0 (pdx_performance_dir))
 (typeattributeset performanced_28_0 (performanced))
 (typeattributeset performanced_exec_28_0 (performanced_exec))
-(typeattributeset perfprofd_28_0 (perfprofd))
-(typeattributeset perfprofd_data_file_28_0 (perfprofd_data_file))
-(typeattributeset perfprofd_exec_28_0 (perfprofd_exec))
-(typeattributeset perfprofd_service_28_0 (perfprofd_service))
 (typeattributeset permission_service_28_0 (permission_service))
 (typeattributeset persist_debug_prop_28_0 (persist_debug_prop))
 (typeattributeset persistent_data_block_service_28_0 (persistent_data_block_service))
@@ -1381,6 +1380,8 @@
   ( proc
     proc_fs_verity
     proc_keys
+    proc_kpageflags
+    proc_lowmemorykiller
     proc_pressure_cpu
     proc_pressure_io
     proc_pressure_mem
@@ -1617,7 +1618,9 @@
 (typeattributeset thermalcallback_hwservice_28_0 (thermalcallback_hwservice))
 (typeattributeset thermal_service_28_0 (thermal_service))
 (typeattributeset timezone_service_28_0 (timezone_service))
-(typeattributeset tmpfs_28_0 (tmpfs))
+(typeattributeset tmpfs_28_0
+  ( mnt_sdcard_file
+    tmpfs))
 (typeattributeset tombstoned_28_0 (tombstoned))
 (typeattributeset tombstone_data_file_28_0 (tombstone_data_file))
 (typeattributeset tombstoned_crash_socket_28_0 (tombstoned_crash_socket))
diff --git a/private/compat/28.0/28.0.compat.cil b/private/compat/28.0/28.0.compat.cil
new file mode 100644
index 0000000..30af58c
--- /dev/null
+++ b/private/compat/28.0/28.0.compat.cil
@@ -0,0 +1,5 @@
+(typeattribute vendordomain)
+(typeattributeset vendordomain ((and (domain) ((not (coredomain))))))
+(allowx vendordomain dev_type (ioctl blk_file ((range 0x0000 0xffff))))
+(allowx vendordomain file_type (ioctl file ((range 0x0000 0xffff))))
+(allow vendordomain self (netlink_route_socket (nlmsg_readpriv)))
diff --git a/private/compat/28.0/28.0.ignore.cil b/private/compat/28.0/28.0.ignore.cil
index 98c4b9c..d24d12d 100644
--- a/private/compat/28.0/28.0.ignore.cil
+++ b/private/compat/28.0/28.0.ignore.cil
@@ -33,6 +33,7 @@
     content_capture_service
     content_suggestions_service
     cpu_variant_prop
+    ctl_apexd_prop
     ctl_gsid_prop
     dev_cpu_variant
     device_config_activity_manager_native_boot_prop
@@ -44,11 +45,13 @@
     device_config_runtime_native_prop
     device_config_media_native_prop
     device_config_service
+    device_config_sys_traced_prop
     dnsresolver_service
     dynamic_system_service
     dynamic_system_prop
     face_service
     face_vendor_data_file
+    sota_prop
     fastbootd
     flags_health_check
     flags_health_check_exec
@@ -95,6 +98,7 @@
     mediaswcodec
     mediaswcodec_exec
     mediaswcodec_tmpfs
+    metadata_bootstat_file
     mnt_product_file
     network_stack
     network_stack_service
@@ -113,12 +117,14 @@
     rss_hwm_reset_exec
     runas_app
     runas_app_tmpfs
+    art_apex_dir
     runtime_service
     sdcard_block_device
     sensor_privacy_service
     server_configurable_flags_data_file
     simpleperf_app_runner
     simpleperf_app_runner_exec
+    socket_hook_prop
     su_tmpfs
     super_block_device
     sysfs_fs_f2fs
@@ -139,12 +145,15 @@
     traced_lazy_prop
     uri_grants_service
     use_memfd_prop
+    vendor_apex_file
     vendor_cgroup_desc_file
     vendor_idc_file
     vendor_keychars_file
     vendor_keylayout_file
     vendor_misc_writer
     vendor_misc_writer_exec
+    vendor_socket_hook_prop
     vendor_task_profiles_file
+    vndk_prop
     vrflinger_vsync_service
     watchdogd_tmpfs))
diff --git a/private/compat/29.0/29.0.cil b/private/compat/29.0/29.0.cil
new file mode 100644
index 0000000..5231498
--- /dev/null
+++ b/private/compat/29.0/29.0.cil
@@ -0,0 +1,1970 @@
+;; types removed from current policy
+(type ashmemd)
+(type hal_wifi_offload_hwservice)
+(type install_recovery)
+(type install_recovery_exec)
+(type mediacodec_service)
+(type perfprofd_data_file)
+(type perfprofd_service)
+(type sysfs_mac_address)
+(type wificond_service)
+
+(expandtypeattribute (accessibility_service_29_0) true)
+(expandtypeattribute (account_service_29_0) true)
+(expandtypeattribute (activity_service_29_0) true)
+(expandtypeattribute (activity_task_service_29_0) true)
+(expandtypeattribute (adbd_29_0) true)
+(expandtypeattribute (adb_data_file_29_0) true)
+(expandtypeattribute (adbd_exec_29_0) true)
+(expandtypeattribute (adbd_socket_29_0) true)
+(expandtypeattribute (adb_keys_file_29_0) true)
+(expandtypeattribute (adb_service_29_0) true)
+(expandtypeattribute (alarm_service_29_0) true)
+(expandtypeattribute (anr_data_file_29_0) true)
+(expandtypeattribute (apexd_29_0) true)
+(expandtypeattribute (apex_data_file_29_0) true)
+(expandtypeattribute (apexd_exec_29_0) true)
+(expandtypeattribute (apexd_prop_29_0) true)
+(expandtypeattribute (apex_metadata_file_29_0) true)
+(expandtypeattribute (apex_mnt_dir_29_0) true)
+(expandtypeattribute (apex_service_29_0) true)
+(expandtypeattribute (apk_data_file_29_0) true)
+(expandtypeattribute (apk_private_data_file_29_0) true)
+(expandtypeattribute (apk_private_tmp_file_29_0) true)
+(expandtypeattribute (apk_tmp_file_29_0) true)
+(expandtypeattribute (app_binding_service_29_0) true)
+(expandtypeattribute (app_data_file_29_0) true)
+(expandtypeattribute (appdomain_tmpfs_29_0) true)
+(expandtypeattribute (app_fuse_file_29_0) true)
+(expandtypeattribute (app_fusefs_29_0) true)
+(expandtypeattribute (appops_service_29_0) true)
+(expandtypeattribute (app_prediction_service_29_0) true)
+(expandtypeattribute (appwidget_service_29_0) true)
+(expandtypeattribute (app_zygote_29_0) true)
+(expandtypeattribute (app_zygote_tmpfs_29_0) true)
+(expandtypeattribute (asec_apk_file_29_0) true)
+(expandtypeattribute (asec_image_file_29_0) true)
+(expandtypeattribute (asec_public_file_29_0) true)
+(expandtypeattribute (ashmemd_29_0) true)
+(expandtypeattribute (ashmem_device_29_0) true)
+(expandtypeattribute (assetatlas_service_29_0) true)
+(expandtypeattribute (audio_data_file_29_0) true)
+(expandtypeattribute (audio_device_29_0) true)
+(expandtypeattribute (audiohal_data_file_29_0) true)
+(expandtypeattribute (audio_prop_29_0) true)
+(expandtypeattribute (audioserver_29_0) true)
+(expandtypeattribute (audioserver_data_file_29_0) true)
+(expandtypeattribute (audioserver_service_29_0) true)
+(expandtypeattribute (audioserver_tmpfs_29_0) true)
+(expandtypeattribute (audio_service_29_0) true)
+(expandtypeattribute (autofill_service_29_0) true)
+(expandtypeattribute (backup_data_file_29_0) true)
+(expandtypeattribute (backup_service_29_0) true)
+(expandtypeattribute (batteryproperties_service_29_0) true)
+(expandtypeattribute (battery_service_29_0) true)
+(expandtypeattribute (batterystats_service_29_0) true)
+(expandtypeattribute (binder_calls_stats_service_29_0) true)
+(expandtypeattribute (binder_device_29_0) true)
+(expandtypeattribute (binfmt_miscfs_29_0) true)
+(expandtypeattribute (biometric_service_29_0) true)
+(expandtypeattribute (blkid_29_0) true)
+(expandtypeattribute (blkid_untrusted_29_0) true)
+(expandtypeattribute (block_device_29_0) true)
+(expandtypeattribute (bluetooth_29_0) true)
+(expandtypeattribute (bluetooth_a2dp_offload_prop_29_0) true)
+(expandtypeattribute (bluetooth_audio_hal_prop_29_0) true)
+(expandtypeattribute (bluetooth_data_file_29_0) true)
+(expandtypeattribute (bluetooth_efs_file_29_0) true)
+(expandtypeattribute (bluetooth_logs_data_file_29_0) true)
+(expandtypeattribute (bluetooth_manager_service_29_0) true)
+(expandtypeattribute (bluetooth_prop_29_0) true)
+(expandtypeattribute (bluetooth_service_29_0) true)
+(expandtypeattribute (bluetooth_socket_29_0) true)
+(expandtypeattribute (bootanim_29_0) true)
+(expandtypeattribute (bootanim_exec_29_0) true)
+(expandtypeattribute (boot_block_device_29_0) true)
+(expandtypeattribute (bootchart_data_file_29_0) true)
+(expandtypeattribute (bootloader_boot_reason_prop_29_0) true)
+(expandtypeattribute (bootstat_29_0) true)
+(expandtypeattribute (bootstat_data_file_29_0) true)
+(expandtypeattribute (bootstat_exec_29_0) true)
+(expandtypeattribute (boottime_prop_29_0) true)
+(expandtypeattribute (boottrace_data_file_29_0) true)
+(expandtypeattribute (bpf_progs_loaded_prop_29_0) true)
+(expandtypeattribute (broadcastradio_service_29_0) true)
+(expandtypeattribute (bufferhubd_29_0) true)
+(expandtypeattribute (bufferhubd_exec_29_0) true)
+(expandtypeattribute (bugreport_service_29_0) true)
+(expandtypeattribute (cache_backup_file_29_0) true)
+(expandtypeattribute (cache_block_device_29_0) true)
+(expandtypeattribute (cache_file_29_0) true)
+(expandtypeattribute (cache_private_backup_file_29_0) true)
+(expandtypeattribute (cache_recovery_file_29_0) true)
+(expandtypeattribute (camera_data_file_29_0) true)
+(expandtypeattribute (camera_device_29_0) true)
+(expandtypeattribute (cameraproxy_service_29_0) true)
+(expandtypeattribute (cameraserver_29_0) true)
+(expandtypeattribute (cameraserver_exec_29_0) true)
+(expandtypeattribute (cameraserver_service_29_0) true)
+(expandtypeattribute (cameraserver_tmpfs_29_0) true)
+(expandtypeattribute (cgroup_29_0) true)
+(expandtypeattribute (cgroup_bpf_29_0) true)
+(expandtypeattribute (cgroup_desc_file_29_0) true)
+(expandtypeattribute (cgroup_rc_file_29_0) true)
+(expandtypeattribute (charger_29_0) true)
+(expandtypeattribute (charger_exec_29_0) true)
+(expandtypeattribute (clatd_29_0) true)
+(expandtypeattribute (clatd_exec_29_0) true)
+(expandtypeattribute (clipboard_service_29_0) true)
+(expandtypeattribute (color_display_service_29_0) true)
+(expandtypeattribute (companion_device_service_29_0) true)
+(expandtypeattribute (configfs_29_0) true)
+(expandtypeattribute (config_prop_29_0) true)
+(expandtypeattribute (connectivity_service_29_0) true)
+(expandtypeattribute (connmetrics_service_29_0) true)
+(expandtypeattribute (console_device_29_0) true)
+(expandtypeattribute (consumer_ir_service_29_0) true)
+(expandtypeattribute (content_capture_service_29_0) true)
+(expandtypeattribute (content_service_29_0) true)
+(expandtypeattribute (content_suggestions_service_29_0) true)
+(expandtypeattribute (contexthub_service_29_0) true)
+(expandtypeattribute (coredump_file_29_0) true)
+(expandtypeattribute (country_detector_service_29_0) true)
+(expandtypeattribute (coverage_service_29_0) true)
+(expandtypeattribute (cppreopt_prop_29_0) true)
+(expandtypeattribute (cpuinfo_service_29_0) true)
+(expandtypeattribute (cpu_variant_prop_29_0) true)
+(expandtypeattribute (crash_dump_29_0) true)
+(expandtypeattribute (crash_dump_exec_29_0) true)
+(expandtypeattribute (crossprofileapps_service_29_0) true)
+(expandtypeattribute (ctl_adbd_prop_29_0) true)
+(expandtypeattribute (ctl_bootanim_prop_29_0) true)
+(expandtypeattribute (ctl_bugreport_prop_29_0) true)
+(expandtypeattribute (ctl_console_prop_29_0) true)
+(expandtypeattribute (ctl_default_prop_29_0) true)
+(expandtypeattribute (ctl_dumpstate_prop_29_0) true)
+(expandtypeattribute (ctl_fuse_prop_29_0) true)
+(expandtypeattribute (ctl_gsid_prop_29_0) true)
+(expandtypeattribute (ctl_interface_restart_prop_29_0) true)
+(expandtypeattribute (ctl_interface_start_prop_29_0) true)
+(expandtypeattribute (ctl_interface_stop_prop_29_0) true)
+(expandtypeattribute (ctl_mdnsd_prop_29_0) true)
+(expandtypeattribute (ctl_restart_prop_29_0) true)
+(expandtypeattribute (ctl_rildaemon_prop_29_0) true)
+(expandtypeattribute (ctl_sigstop_prop_29_0) true)
+(expandtypeattribute (ctl_start_prop_29_0) true)
+(expandtypeattribute (ctl_stop_prop_29_0) true)
+(expandtypeattribute (dalvikcache_data_file_29_0) true)
+(expandtypeattribute (dalvik_prop_29_0) true)
+(expandtypeattribute (dbinfo_service_29_0) true)
+(expandtypeattribute (debugfs_29_0) true)
+(expandtypeattribute (debugfs_mmc_29_0) true)
+(expandtypeattribute (debugfs_trace_marker_29_0) true)
+(expandtypeattribute (debugfs_tracing_29_0) true)
+(expandtypeattribute (debugfs_tracing_debug_29_0) true)
+(expandtypeattribute (debugfs_tracing_instances_29_0) true)
+(expandtypeattribute (debugfs_wakeup_sources_29_0) true)
+(expandtypeattribute (debugfs_wifi_tracing_29_0) true)
+(expandtypeattribute (debuggerd_prop_29_0) true)
+(expandtypeattribute (debug_prop_29_0) true)
+(expandtypeattribute (default_android_hwservice_29_0) true)
+(expandtypeattribute (default_android_service_29_0) true)
+(expandtypeattribute (default_android_vndservice_29_0) true)
+(expandtypeattribute (default_prop_29_0) true)
+(expandtypeattribute (dev_cpu_variant_29_0) true)
+(expandtypeattribute (device_29_0) true)
+(expandtypeattribute (device_config_activity_manager_native_boot_prop_29_0) true)
+(expandtypeattribute (device_config_boot_count_prop_29_0) true)
+(expandtypeattribute (device_config_input_native_boot_prop_29_0) true)
+(expandtypeattribute (device_config_media_native_prop_29_0) true)
+(expandtypeattribute (device_config_netd_native_prop_29_0) true)
+(expandtypeattribute (device_config_reset_performed_prop_29_0) true)
+(expandtypeattribute (device_config_runtime_native_boot_prop_29_0) true)
+(expandtypeattribute (device_config_runtime_native_prop_29_0) true)
+(expandtypeattribute (device_config_service_29_0) true)
+(expandtypeattribute (device_identifiers_service_29_0) true)
+(expandtypeattribute (deviceidle_service_29_0) true)
+(expandtypeattribute (device_logging_prop_29_0) true)
+(expandtypeattribute (device_policy_service_29_0) true)
+(expandtypeattribute (devicestoragemonitor_service_29_0) true)
+(expandtypeattribute (devpts_29_0) true)
+(expandtypeattribute (dhcp_29_0) true)
+(expandtypeattribute (dhcp_data_file_29_0) true)
+(expandtypeattribute (dhcp_exec_29_0) true)
+(expandtypeattribute (dhcp_prop_29_0) true)
+(expandtypeattribute (diskstats_service_29_0) true)
+(expandtypeattribute (display_service_29_0) true)
+(expandtypeattribute (dm_device_29_0) true)
+(expandtypeattribute (dnsmasq_29_0) true)
+(expandtypeattribute (dnsmasq_exec_29_0) true)
+(expandtypeattribute (dnsproxyd_socket_29_0) true)
+(expandtypeattribute (dnsresolver_service_29_0) true)
+(expandtypeattribute (DockObserver_service_29_0) true)
+(expandtypeattribute (dreams_service_29_0) true)
+(expandtypeattribute (drm_data_file_29_0) true)
+(expandtypeattribute (drmserver_29_0) true)
+(expandtypeattribute (drmserver_exec_29_0) true)
+(expandtypeattribute (drmserver_service_29_0) true)
+(expandtypeattribute (drmserver_socket_29_0) true)
+(expandtypeattribute (dropbox_data_file_29_0) true)
+(expandtypeattribute (dropbox_service_29_0) true)
+(expandtypeattribute (dumpstate_29_0) true)
+(expandtypeattribute (dumpstate_exec_29_0) true)
+(expandtypeattribute (dumpstate_options_prop_29_0) true)
+(expandtypeattribute (dumpstate_prop_29_0) true)
+(expandtypeattribute (dumpstate_service_29_0) true)
+(expandtypeattribute (dumpstate_socket_29_0) true)
+(expandtypeattribute (dynamic_system_prop_29_0) true)
+(expandtypeattribute (e2fs_29_0) true)
+(expandtypeattribute (e2fs_exec_29_0) true)
+(expandtypeattribute (efs_file_29_0) true)
+(expandtypeattribute (ephemeral_app_29_0) true)
+(expandtypeattribute (ethernet_service_29_0) true)
+(expandtypeattribute (exfat_29_0) true)
+(expandtypeattribute (exported2_config_prop_29_0) true)
+(expandtypeattribute (exported2_default_prop_29_0) true)
+(expandtypeattribute (exported2_radio_prop_29_0) true)
+(expandtypeattribute (exported2_system_prop_29_0) true)
+(expandtypeattribute (exported2_vold_prop_29_0) true)
+(expandtypeattribute (exported3_default_prop_29_0) true)
+(expandtypeattribute (exported3_radio_prop_29_0) true)
+(expandtypeattribute (exported3_system_prop_29_0) true)
+(expandtypeattribute (exported_audio_prop_29_0) true)
+(expandtypeattribute (exported_bluetooth_prop_29_0) true)
+(expandtypeattribute (exported_config_prop_29_0) true)
+(expandtypeattribute (exported_dalvik_prop_29_0) true)
+(expandtypeattribute (exported_default_prop_29_0) true)
+(expandtypeattribute (exported_dumpstate_prop_29_0) true)
+(expandtypeattribute (exported_ffs_prop_29_0) true)
+(expandtypeattribute (exported_fingerprint_prop_29_0) true)
+(expandtypeattribute (exported_overlay_prop_29_0) true)
+(expandtypeattribute (exported_pm_prop_29_0) true)
+(expandtypeattribute (exported_radio_prop_29_0) true)
+(expandtypeattribute (exported_secure_prop_29_0) true)
+(expandtypeattribute (exported_system_prop_29_0) true)
+(expandtypeattribute (exported_system_radio_prop_29_0) true)
+(expandtypeattribute (exported_vold_prop_29_0) true)
+(expandtypeattribute (exported_wifi_prop_29_0) true)
+(expandtypeattribute (external_vibrator_service_29_0) true)
+(expandtypeattribute (face_service_29_0) true)
+(expandtypeattribute (face_vendor_data_file_29_0) true)
+(expandtypeattribute (fastbootd_29_0) true)
+(expandtypeattribute (ffs_prop_29_0) true)
+(expandtypeattribute (file_contexts_file_29_0) true)
+(expandtypeattribute (fingerprintd_29_0) true)
+(expandtypeattribute (fingerprintd_data_file_29_0) true)
+(expandtypeattribute (fingerprintd_exec_29_0) true)
+(expandtypeattribute (fingerprintd_service_29_0) true)
+(expandtypeattribute (fingerprint_prop_29_0) true)
+(expandtypeattribute (fingerprint_service_29_0) true)
+(expandtypeattribute (fingerprint_vendor_data_file_29_0) true)
+(expandtypeattribute (firstboot_prop_29_0) true)
+(expandtypeattribute (flags_health_check_29_0) true)
+(expandtypeattribute (flags_health_check_exec_29_0) true)
+(expandtypeattribute (font_service_29_0) true)
+(expandtypeattribute (frp_block_device_29_0) true)
+(expandtypeattribute (fs_bpf_29_0) true)
+(expandtypeattribute (fsck_29_0) true)
+(expandtypeattribute (fsck_exec_29_0) true)
+(expandtypeattribute (fscklogs_29_0) true)
+(expandtypeattribute (fsck_untrusted_29_0) true)
+(expandtypeattribute (functionfs_29_0) true)
+(expandtypeattribute (fuse_29_0) true)
+(expandtypeattribute (fuse_device_29_0) true)
+(expandtypeattribute (fwk_bufferhub_hwservice_29_0) true)
+(expandtypeattribute (fwk_camera_hwservice_29_0) true)
+(expandtypeattribute (fwk_display_hwservice_29_0) true)
+(expandtypeattribute (fwk_scheduler_hwservice_29_0) true)
+(expandtypeattribute (fwk_sensor_hwservice_29_0) true)
+(expandtypeattribute (fwk_stats_hwservice_29_0) true)
+(expandtypeattribute (fwmarkd_socket_29_0) true)
+(expandtypeattribute (gatekeeperd_29_0) true)
+(expandtypeattribute (gatekeeper_data_file_29_0) true)
+(expandtypeattribute (gatekeeperd_exec_29_0) true)
+(expandtypeattribute (gatekeeper_service_29_0) true)
+(expandtypeattribute (gfxinfo_service_29_0) true)
+(expandtypeattribute (gps_control_29_0) true)
+(expandtypeattribute (gpu_device_29_0) true)
+(expandtypeattribute (gpu_service_29_0) true)
+(expandtypeattribute (gpuservice_29_0) true)
+(expandtypeattribute (graphics_device_29_0) true)
+(expandtypeattribute (graphicsstats_service_29_0) true)
+(expandtypeattribute (gsi_data_file_29_0) true)
+(expandtypeattribute (gsid_prop_29_0) true)
+(expandtypeattribute (gsi_metadata_file_29_0) true)
+(expandtypeattribute (hal_atrace_hwservice_29_0) true)
+(expandtypeattribute (hal_audiocontrol_hwservice_29_0) true)
+(expandtypeattribute (hal_audio_hwservice_29_0) true)
+(expandtypeattribute (hal_authsecret_hwservice_29_0) true)
+(expandtypeattribute (hal_bluetooth_hwservice_29_0) true)
+(expandtypeattribute (hal_bootctl_hwservice_29_0) true)
+(expandtypeattribute (hal_broadcastradio_hwservice_29_0) true)
+(expandtypeattribute (hal_camera_hwservice_29_0) true)
+(expandtypeattribute (hal_cas_hwservice_29_0) true)
+(expandtypeattribute (hal_codec2_hwservice_29_0) true)
+(expandtypeattribute (hal_configstore_ISurfaceFlingerConfigs_29_0) true)
+(expandtypeattribute (hal_confirmationui_hwservice_29_0) true)
+(expandtypeattribute (hal_contexthub_hwservice_29_0) true)
+(expandtypeattribute (hal_drm_hwservice_29_0) true)
+(expandtypeattribute (hal_dumpstate_hwservice_29_0) true)
+(expandtypeattribute (hal_evs_hwservice_29_0) true)
+(expandtypeattribute (hal_face_hwservice_29_0) true)
+(expandtypeattribute (hal_fingerprint_hwservice_29_0) true)
+(expandtypeattribute (hal_fingerprint_service_29_0) true)
+(expandtypeattribute (hal_gatekeeper_hwservice_29_0) true)
+(expandtypeattribute (hal_gnss_hwservice_29_0) true)
+(expandtypeattribute (hal_graphics_allocator_hwservice_29_0) true)
+(expandtypeattribute (hal_graphics_composer_hwservice_29_0) true)
+(expandtypeattribute (hal_graphics_composer_server_tmpfs_29_0) true)
+(expandtypeattribute (hal_graphics_mapper_hwservice_29_0) true)
+(expandtypeattribute (hal_health_hwservice_29_0) true)
+(expandtypeattribute (hal_health_storage_hwservice_29_0) true)
+(expandtypeattribute (hal_input_classifier_hwservice_29_0) true)
+(expandtypeattribute (hal_ir_hwservice_29_0) true)
+(expandtypeattribute (hal_keymaster_hwservice_29_0) true)
+(expandtypeattribute (hal_light_hwservice_29_0) true)
+(expandtypeattribute (hal_lowpan_hwservice_29_0) true)
+(expandtypeattribute (hal_memtrack_hwservice_29_0) true)
+(expandtypeattribute (hal_neuralnetworks_hwservice_29_0) true)
+(expandtypeattribute (hal_nfc_hwservice_29_0) true)
+(expandtypeattribute (hal_oemlock_hwservice_29_0) true)
+(expandtypeattribute (hal_omx_hwservice_29_0) true)
+(expandtypeattribute (hal_power_hwservice_29_0) true)
+(expandtypeattribute (hal_power_stats_hwservice_29_0) true)
+(expandtypeattribute (hal_renderscript_hwservice_29_0) true)
+(expandtypeattribute (hal_secure_element_hwservice_29_0) true)
+(expandtypeattribute (hal_sensors_hwservice_29_0) true)
+(expandtypeattribute (hal_telephony_hwservice_29_0) true)
+(expandtypeattribute (hal_tetheroffload_hwservice_29_0) true)
+(expandtypeattribute (hal_thermal_hwservice_29_0) true)
+(expandtypeattribute (hal_tv_cec_hwservice_29_0) true)
+(expandtypeattribute (hal_tv_input_hwservice_29_0) true)
+(expandtypeattribute (hal_usb_gadget_hwservice_29_0) true)
+(expandtypeattribute (hal_usb_hwservice_29_0) true)
+(expandtypeattribute (hal_vehicle_hwservice_29_0) true)
+(expandtypeattribute (hal_vibrator_hwservice_29_0) true)
+(expandtypeattribute (hal_vr_hwservice_29_0) true)
+(expandtypeattribute (hal_weaver_hwservice_29_0) true)
+(expandtypeattribute (hal_wifi_hostapd_hwservice_29_0) true)
+(expandtypeattribute (hal_wifi_hwservice_29_0) true)
+(expandtypeattribute (hal_wifi_offload_hwservice_29_0) true)
+(expandtypeattribute (hal_wifi_supplicant_hwservice_29_0) true)
+(expandtypeattribute (hardware_properties_service_29_0) true)
+(expandtypeattribute (hardware_service_29_0) true)
+(expandtypeattribute (hci_attach_dev_29_0) true)
+(expandtypeattribute (hdmi_control_service_29_0) true)
+(expandtypeattribute (healthd_29_0) true)
+(expandtypeattribute (healthd_exec_29_0) true)
+(expandtypeattribute (heapdump_data_file_29_0) true)
+(expandtypeattribute (heapprofd_29_0) true)
+(expandtypeattribute (heapprofd_enabled_prop_29_0) true)
+(expandtypeattribute (heapprofd_prop_29_0) true)
+(expandtypeattribute (heapprofd_socket_29_0) true)
+(expandtypeattribute (hidl_allocator_hwservice_29_0) true)
+(expandtypeattribute (hidl_base_hwservice_29_0) true)
+(expandtypeattribute (hidl_manager_hwservice_29_0) true)
+(expandtypeattribute (hidl_memory_hwservice_29_0) true)
+(expandtypeattribute (hidl_token_hwservice_29_0) true)
+(expandtypeattribute (hwbinder_device_29_0) true)
+(expandtypeattribute (hw_random_device_29_0) true)
+(expandtypeattribute (hwservice_contexts_file_29_0) true)
+(expandtypeattribute (hwservicemanager_29_0) true)
+(expandtypeattribute (hwservicemanager_exec_29_0) true)
+(expandtypeattribute (hwservicemanager_prop_29_0) true)
+(expandtypeattribute (icon_file_29_0) true)
+(expandtypeattribute (idmap_29_0) true)
+(expandtypeattribute (idmap_exec_29_0) true)
+(expandtypeattribute (idmap_service_29_0) true)
+(expandtypeattribute (iio_device_29_0) true)
+(expandtypeattribute (imms_service_29_0) true)
+(expandtypeattribute (incident_29_0) true)
+(expandtypeattribute (incidentd_29_0) true)
+(expandtypeattribute (incident_data_file_29_0) true)
+(expandtypeattribute (incident_helper_29_0) true)
+(expandtypeattribute (incident_service_29_0) true)
+(expandtypeattribute (init_29_0) true)
+(expandtypeattribute (init_exec_29_0) true)
+(expandtypeattribute (init_tmpfs_29_0) true)
+(expandtypeattribute (inotify_29_0) true)
+(expandtypeattribute (input_device_29_0) true)
+(expandtypeattribute (inputflinger_29_0) true)
+(expandtypeattribute (inputflinger_exec_29_0) true)
+(expandtypeattribute (inputflinger_service_29_0) true)
+(expandtypeattribute (input_method_service_29_0) true)
+(expandtypeattribute (input_service_29_0) true)
+(expandtypeattribute (installd_29_0) true)
+(expandtypeattribute (install_data_file_29_0) true)
+(expandtypeattribute (installd_exec_29_0) true)
+(expandtypeattribute (installd_service_29_0) true)
+(expandtypeattribute (install_recovery_29_0) true)
+(expandtypeattribute (install_recovery_exec_29_0) true)
+(expandtypeattribute (ion_device_29_0) true)
+(expandtypeattribute (iorapd_29_0) true)
+(expandtypeattribute (iorapd_data_file_29_0) true)
+(expandtypeattribute (iorapd_exec_29_0) true)
+(expandtypeattribute (iorapd_service_29_0) true)
+(expandtypeattribute (iorapd_tmpfs_29_0) true)
+(expandtypeattribute (IProxyService_service_29_0) true)
+(expandtypeattribute (ipsec_service_29_0) true)
+(expandtypeattribute (iris_service_29_0) true)
+(expandtypeattribute (iris_vendor_data_file_29_0) true)
+(expandtypeattribute (isolated_app_29_0) true)
+(expandtypeattribute (jobscheduler_service_29_0) true)
+(expandtypeattribute (kernel_29_0) true)
+(expandtypeattribute (keychain_data_file_29_0) true)
+(expandtypeattribute (keychord_device_29_0) true)
+(expandtypeattribute (keystore_29_0) true)
+(expandtypeattribute (keystore_data_file_29_0) true)
+(expandtypeattribute (keystore_exec_29_0) true)
+(expandtypeattribute (keystore_service_29_0) true)
+(expandtypeattribute (kmsg_debug_device_29_0) true)
+(expandtypeattribute (kmsg_device_29_0) true)
+(expandtypeattribute (labeledfs_29_0) true)
+(expandtypeattribute (last_boot_reason_prop_29_0) true)
+(expandtypeattribute (launcherapps_service_29_0) true)
+(expandtypeattribute (llkd_29_0) true)
+(expandtypeattribute (llkd_exec_29_0) true)
+(expandtypeattribute (llkd_prop_29_0) true)
+(expandtypeattribute (lmkd_29_0) true)
+(expandtypeattribute (lmkd_exec_29_0) true)
+(expandtypeattribute (lmkd_socket_29_0) true)
+(expandtypeattribute (location_service_29_0) true)
+(expandtypeattribute (lock_settings_service_29_0) true)
+(expandtypeattribute (logcat_exec_29_0) true)
+(expandtypeattribute (logd_29_0) true)
+(expandtypeattribute (logd_exec_29_0) true)
+(expandtypeattribute (logd_prop_29_0) true)
+(expandtypeattribute (logdr_socket_29_0) true)
+(expandtypeattribute (logd_socket_29_0) true)
+(expandtypeattribute (logdw_socket_29_0) true)
+(expandtypeattribute (logpersist_29_0) true)
+(expandtypeattribute (logpersistd_logging_prop_29_0) true)
+(expandtypeattribute (log_prop_29_0) true)
+(expandtypeattribute (log_tag_prop_29_0) true)
+(expandtypeattribute (loop_control_device_29_0) true)
+(expandtypeattribute (loop_device_29_0) true)
+(expandtypeattribute (looper_stats_service_29_0) true)
+(expandtypeattribute (lowpan_device_29_0) true)
+(expandtypeattribute (lowpan_prop_29_0) true)
+(expandtypeattribute (lowpan_service_29_0) true)
+(expandtypeattribute (lpdumpd_prop_29_0) true)
+(expandtypeattribute (lpdump_service_29_0) true)
+(expandtypeattribute (mac_perms_file_29_0) true)
+(expandtypeattribute (mdnsd_29_0) true)
+(expandtypeattribute (mdnsd_socket_29_0) true)
+(expandtypeattribute (mdns_socket_29_0) true)
+(expandtypeattribute (mediacodec_service_29_0) true)
+(expandtypeattribute (media_data_file_29_0) true)
+(expandtypeattribute (mediadrmserver_29_0) true)
+(expandtypeattribute (mediadrmserver_exec_29_0) true)
+(expandtypeattribute (mediadrmserver_service_29_0) true)
+(expandtypeattribute (mediaextractor_29_0) true)
+(expandtypeattribute (mediaextractor_exec_29_0) true)
+(expandtypeattribute (mediaextractor_service_29_0) true)
+(expandtypeattribute (mediaextractor_tmpfs_29_0) true)
+(expandtypeattribute (mediametrics_29_0) true)
+(expandtypeattribute (mediametrics_exec_29_0) true)
+(expandtypeattribute (mediametrics_service_29_0) true)
+(expandtypeattribute (media_projection_service_29_0) true)
+(expandtypeattribute (mediaprovider_29_0) true)
+(expandtypeattribute (media_router_service_29_0) true)
+(expandtypeattribute (media_rw_data_file_29_0) true)
+(expandtypeattribute (mediaserver_29_0) true)
+(expandtypeattribute (mediaserver_exec_29_0) true)
+(expandtypeattribute (mediaserver_service_29_0) true)
+(expandtypeattribute (mediaserver_tmpfs_29_0) true)
+(expandtypeattribute (media_session_service_29_0) true)
+(expandtypeattribute (mediaswcodec_29_0) true)
+(expandtypeattribute (mediaswcodec_exec_29_0) true)
+(expandtypeattribute (meminfo_service_29_0) true)
+(expandtypeattribute (metadata_block_device_29_0) true)
+(expandtypeattribute (metadata_file_29_0) true)
+(expandtypeattribute (method_trace_data_file_29_0) true)
+(expandtypeattribute (midi_service_29_0) true)
+(expandtypeattribute (misc_block_device_29_0) true)
+(expandtypeattribute (misc_logd_file_29_0) true)
+(expandtypeattribute (misc_user_data_file_29_0) true)
+(expandtypeattribute (mmc_prop_29_0) true)
+(expandtypeattribute (mnt_expand_file_29_0) true)
+(expandtypeattribute (mnt_media_rw_file_29_0) true)
+(expandtypeattribute (mnt_media_rw_stub_file_29_0) true)
+(expandtypeattribute (mnt_product_file_29_0) true)
+(expandtypeattribute (mnt_user_file_29_0) true)
+(expandtypeattribute (mnt_vendor_file_29_0) true)
+(expandtypeattribute (modprobe_29_0) true)
+(expandtypeattribute (mount_service_29_0) true)
+(expandtypeattribute (mqueue_29_0) true)
+(expandtypeattribute (mtp_29_0) true)
+(expandtypeattribute (mtp_device_29_0) true)
+(expandtypeattribute (mtpd_socket_29_0) true)
+(expandtypeattribute (mtp_exec_29_0) true)
+(expandtypeattribute (nativetest_data_file_29_0) true)
+(expandtypeattribute (netd_29_0) true)
+(expandtypeattribute (net_data_file_29_0) true)
+(expandtypeattribute (netd_exec_29_0) true)
+(expandtypeattribute (netd_listener_service_29_0) true)
+(expandtypeattribute (net_dns_prop_29_0) true)
+(expandtypeattribute (netd_service_29_0) true)
+(expandtypeattribute (netd_stable_secret_prop_29_0) true)
+(expandtypeattribute (netif_29_0) true)
+(expandtypeattribute (netpolicy_service_29_0) true)
+(expandtypeattribute (net_radio_prop_29_0) true)
+(expandtypeattribute (netstats_service_29_0) true)
+(expandtypeattribute (netutils_wrapper_29_0) true)
+(expandtypeattribute (netutils_wrapper_exec_29_0) true)
+(expandtypeattribute (network_management_service_29_0) true)
+(expandtypeattribute (network_score_service_29_0) true)
+(expandtypeattribute (network_stack_29_0) true)
+(expandtypeattribute (network_stack_service_29_0) true)
+(expandtypeattribute (network_time_update_service_29_0) true)
+(expandtypeattribute (network_watchlist_data_file_29_0) true)
+(expandtypeattribute (network_watchlist_service_29_0) true)
+(expandtypeattribute (nfc_29_0) true)
+(expandtypeattribute (nfc_data_file_29_0) true)
+(expandtypeattribute (nfc_device_29_0) true)
+(expandtypeattribute (nfc_prop_29_0) true)
+(expandtypeattribute (nfc_service_29_0) true)
+(expandtypeattribute (nnapi_ext_deny_product_prop_29_0) true)
+(expandtypeattribute (node_29_0) true)
+(expandtypeattribute (nonplat_service_contexts_file_29_0) true)
+(expandtypeattribute (notification_service_29_0) true)
+(expandtypeattribute (null_device_29_0) true)
+(expandtypeattribute (oemfs_29_0) true)
+(expandtypeattribute (oem_lock_service_29_0) true)
+(expandtypeattribute (ota_data_file_29_0) true)
+(expandtypeattribute (otadexopt_service_29_0) true)
+(expandtypeattribute (ota_package_file_29_0) true)
+(expandtypeattribute (overlayfs_file_29_0) true)
+(expandtypeattribute (overlay_prop_29_0) true)
+(expandtypeattribute (overlay_service_29_0) true)
+(expandtypeattribute (owntty_device_29_0) true)
+(expandtypeattribute (package_native_service_29_0) true)
+(expandtypeattribute (package_service_29_0) true)
+(expandtypeattribute (packages_list_file_29_0) true)
+(expandtypeattribute (pan_result_prop_29_0) true)
+(expandtypeattribute (password_slot_metadata_file_29_0) true)
+(expandtypeattribute (pdx_bufferhub_client_channel_socket_29_0) true)
+(expandtypeattribute (pdx_bufferhub_client_endpoint_socket_29_0) true)
+(expandtypeattribute (pdx_bufferhub_dir_29_0) true)
+(expandtypeattribute (pdx_display_client_channel_socket_29_0) true)
+(expandtypeattribute (pdx_display_client_endpoint_socket_29_0) true)
+(expandtypeattribute (pdx_display_dir_29_0) true)
+(expandtypeattribute (pdx_display_manager_channel_socket_29_0) true)
+(expandtypeattribute (pdx_display_manager_endpoint_socket_29_0) true)
+(expandtypeattribute (pdx_display_screenshot_channel_socket_29_0) true)
+(expandtypeattribute (pdx_display_screenshot_endpoint_socket_29_0) true)
+(expandtypeattribute (pdx_display_vsync_channel_socket_29_0) true)
+(expandtypeattribute (pdx_display_vsync_endpoint_socket_29_0) true)
+(expandtypeattribute (pdx_performance_client_channel_socket_29_0) true)
+(expandtypeattribute (pdx_performance_client_endpoint_socket_29_0) true)
+(expandtypeattribute (pdx_performance_dir_29_0) true)
+(expandtypeattribute (perfetto_29_0) true)
+(expandtypeattribute (performanced_29_0) true)
+(expandtypeattribute (performanced_exec_29_0) true)
+(expandtypeattribute (permissionmgr_service_29_0) true)
+(expandtypeattribute (permission_service_29_0) true)
+(expandtypeattribute (persist_debug_prop_29_0) true)
+(expandtypeattribute (persistent_data_block_service_29_0) true)
+(expandtypeattribute (persistent_properties_ready_prop_29_0) true)
+(expandtypeattribute (pinner_service_29_0) true)
+(expandtypeattribute (pipefs_29_0) true)
+(expandtypeattribute (platform_app_29_0) true)
+(expandtypeattribute (pm_prop_29_0) true)
+(expandtypeattribute (pmsg_device_29_0) true)
+(expandtypeattribute (port_29_0) true)
+(expandtypeattribute (port_device_29_0) true)
+(expandtypeattribute (postinstall_29_0) true)
+(expandtypeattribute (postinstall_apex_mnt_dir_29_0) true)
+(expandtypeattribute (postinstall_file_29_0) true)
+(expandtypeattribute (postinstall_mnt_dir_29_0) true)
+(expandtypeattribute (powerctl_prop_29_0) true)
+(expandtypeattribute (power_service_29_0) true)
+(expandtypeattribute (ppp_29_0) true)
+(expandtypeattribute (ppp_device_29_0) true)
+(expandtypeattribute (ppp_exec_29_0) true)
+(expandtypeattribute (preloads_data_file_29_0) true)
+(expandtypeattribute (preloads_media_file_29_0) true)
+(expandtypeattribute (print_service_29_0) true)
+(expandtypeattribute (priv_app_29_0) true)
+(expandtypeattribute (privapp_data_file_29_0) true)
+(expandtypeattribute (proc_29_0) true)
+(expandtypeattribute (proc_abi_29_0) true)
+(expandtypeattribute (proc_asound_29_0) true)
+(expandtypeattribute (proc_bluetooth_writable_29_0) true)
+(expandtypeattribute (proc_buddyinfo_29_0) true)
+(expandtypeattribute (proc_cmdline_29_0) true)
+(expandtypeattribute (proc_cpuinfo_29_0) true)
+(expandtypeattribute (proc_dirty_29_0) true)
+(expandtypeattribute (proc_diskstats_29_0) true)
+(expandtypeattribute (proc_drop_caches_29_0) true)
+(expandtypeattribute (processinfo_service_29_0) true)
+(expandtypeattribute (proc_extra_free_kbytes_29_0) true)
+(expandtypeattribute (proc_filesystems_29_0) true)
+(expandtypeattribute (proc_fs_verity_29_0) true)
+(expandtypeattribute (proc_hostname_29_0) true)
+(expandtypeattribute (proc_hung_task_29_0) true)
+(expandtypeattribute (proc_interrupts_29_0) true)
+(expandtypeattribute (proc_iomem_29_0) true)
+(expandtypeattribute (proc_keys_29_0) true)
+(expandtypeattribute (proc_kmsg_29_0) true)
+(expandtypeattribute (proc_loadavg_29_0) true)
+(expandtypeattribute (proc_max_map_count_29_0) true)
+(expandtypeattribute (proc_meminfo_29_0) true)
+(expandtypeattribute (proc_min_free_order_shift_29_0) true)
+(expandtypeattribute (proc_misc_29_0) true)
+(expandtypeattribute (proc_modules_29_0) true)
+(expandtypeattribute (proc_mounts_29_0) true)
+(expandtypeattribute (proc_net_29_0) true)
+(expandtypeattribute (proc_net_tcp_udp_29_0) true)
+(expandtypeattribute (proc_overcommit_memory_29_0) true)
+(expandtypeattribute (proc_page_cluster_29_0) true)
+(expandtypeattribute (proc_pagetypeinfo_29_0) true)
+(expandtypeattribute (proc_panic_29_0) true)
+(expandtypeattribute (proc_perf_29_0) true)
+(expandtypeattribute (proc_pid_max_29_0) true)
+(expandtypeattribute (proc_pipe_conf_29_0) true)
+(expandtypeattribute (proc_pressure_cpu_29_0) true)
+(expandtypeattribute (proc_pressure_io_29_0) true)
+(expandtypeattribute (proc_pressure_mem_29_0) true)
+(expandtypeattribute (proc_qtaguid_ctrl_29_0) true)
+(expandtypeattribute (proc_qtaguid_stat_29_0) true)
+(expandtypeattribute (proc_random_29_0) true)
+(expandtypeattribute (proc_sched_29_0) true)
+(expandtypeattribute (proc_security_29_0) true)
+(expandtypeattribute (proc_slabinfo_29_0) true)
+(expandtypeattribute (proc_stat_29_0) true)
+(expandtypeattribute (procstats_service_29_0) true)
+(expandtypeattribute (proc_swaps_29_0) true)
+(expandtypeattribute (proc_sysrq_29_0) true)
+(expandtypeattribute (proc_timer_29_0) true)
+(expandtypeattribute (proc_tty_drivers_29_0) true)
+(expandtypeattribute (proc_uid_concurrent_active_time_29_0) true)
+(expandtypeattribute (proc_uid_concurrent_policy_time_29_0) true)
+(expandtypeattribute (proc_uid_cpupower_29_0) true)
+(expandtypeattribute (proc_uid_cputime_removeuid_29_0) true)
+(expandtypeattribute (proc_uid_cputime_showstat_29_0) true)
+(expandtypeattribute (proc_uid_io_stats_29_0) true)
+(expandtypeattribute (proc_uid_procstat_set_29_0) true)
+(expandtypeattribute (proc_uid_time_in_state_29_0) true)
+(expandtypeattribute (proc_uptime_29_0) true)
+(expandtypeattribute (proc_version_29_0) true)
+(expandtypeattribute (proc_vmallocinfo_29_0) true)
+(expandtypeattribute (proc_vmstat_29_0) true)
+(expandtypeattribute (proc_zoneinfo_29_0) true)
+(expandtypeattribute (profman_29_0) true)
+(expandtypeattribute (profman_dump_data_file_29_0) true)
+(expandtypeattribute (profman_exec_29_0) true)
+(expandtypeattribute (properties_device_29_0) true)
+(expandtypeattribute (properties_serial_29_0) true)
+(expandtypeattribute (property_contexts_file_29_0) true)
+(expandtypeattribute (property_data_file_29_0) true)
+(expandtypeattribute (property_info_29_0) true)
+(expandtypeattribute (property_socket_29_0) true)
+(expandtypeattribute (pstorefs_29_0) true)
+(expandtypeattribute (ptmx_device_29_0) true)
+(expandtypeattribute (qtaguid_device_29_0) true)
+(expandtypeattribute (racoon_29_0) true)
+(expandtypeattribute (racoon_exec_29_0) true)
+(expandtypeattribute (racoon_socket_29_0) true)
+(expandtypeattribute (radio_29_0) true)
+(expandtypeattribute (radio_data_file_29_0) true)
+(expandtypeattribute (radio_device_29_0) true)
+(expandtypeattribute (radio_prop_29_0) true)
+(expandtypeattribute (radio_service_29_0) true)
+(expandtypeattribute (ram_device_29_0) true)
+(expandtypeattribute (random_device_29_0) true)
+(expandtypeattribute (recovery_29_0) true)
+(expandtypeattribute (recovery_block_device_29_0) true)
+(expandtypeattribute (recovery_data_file_29_0) true)
+(expandtypeattribute (recovery_persist_29_0) true)
+(expandtypeattribute (recovery_persist_exec_29_0) true)
+(expandtypeattribute (recovery_refresh_29_0) true)
+(expandtypeattribute (recovery_refresh_exec_29_0) true)
+(expandtypeattribute (recovery_service_29_0) true)
+(expandtypeattribute (recovery_socket_29_0) true)
+(expandtypeattribute (registry_service_29_0) true)
+(expandtypeattribute (resourcecache_data_file_29_0) true)
+(expandtypeattribute (restorecon_prop_29_0) true)
+(expandtypeattribute (restrictions_service_29_0) true)
+(expandtypeattribute (rild_debug_socket_29_0) true)
+(expandtypeattribute (rild_socket_29_0) true)
+(expandtypeattribute (ringtone_file_29_0) true)
+(expandtypeattribute (role_service_29_0) true)
+(expandtypeattribute (rollback_service_29_0) true)
+(expandtypeattribute (root_block_device_29_0) true)
+(expandtypeattribute (rootfs_29_0) true)
+(expandtypeattribute (rpmsg_device_29_0) true)
+(expandtypeattribute (rs_29_0) true)
+(expandtypeattribute (rs_exec_29_0) true)
+(expandtypeattribute (rss_hwm_reset_29_0) true)
+(expandtypeattribute (rtc_device_29_0) true)
+(expandtypeattribute (rttmanager_service_29_0) true)
+(expandtypeattribute (runas_29_0) true)
+(expandtypeattribute (runas_app_29_0) true)
+(expandtypeattribute (runas_exec_29_0) true)
+(expandtypeattribute (runtime_event_log_tags_file_29_0) true)
+(expandtypeattribute (runtime_service_29_0) true)
+(expandtypeattribute (safemode_prop_29_0) true)
+(expandtypeattribute (same_process_hal_file_29_0) true)
+(expandtypeattribute (samplingprofiler_service_29_0) true)
+(expandtypeattribute (scheduling_policy_service_29_0) true)
+(expandtypeattribute (sdcard_block_device_29_0) true)
+(expandtypeattribute (sdcardd_29_0) true)
+(expandtypeattribute (sdcardd_exec_29_0) true)
+(expandtypeattribute (sdcardfs_29_0) true)
+(expandtypeattribute (seapp_contexts_file_29_0) true)
+(expandtypeattribute (search_service_29_0) true)
+(expandtypeattribute (sec_key_att_app_id_provider_service_29_0) true)
+(expandtypeattribute (secure_element_29_0) true)
+(expandtypeattribute (secure_element_device_29_0) true)
+(expandtypeattribute (secure_element_service_29_0) true)
+(expandtypeattribute (selinuxfs_29_0) true)
+(expandtypeattribute (sensor_privacy_service_29_0) true)
+(expandtypeattribute (sensors_device_29_0) true)
+(expandtypeattribute (sensorservice_service_29_0) true)
+(expandtypeattribute (sepolicy_file_29_0) true)
+(expandtypeattribute (serial_device_29_0) true)
+(expandtypeattribute (serialno_prop_29_0) true)
+(expandtypeattribute (serial_service_29_0) true)
+(expandtypeattribute (server_configurable_flags_data_file_29_0) true)
+(expandtypeattribute (service_contexts_file_29_0) true)
+(expandtypeattribute (servicediscovery_service_29_0) true)
+(expandtypeattribute (servicemanager_29_0) true)
+(expandtypeattribute (servicemanager_exec_29_0) true)
+(expandtypeattribute (settings_service_29_0) true)
+(expandtypeattribute (sgdisk_29_0) true)
+(expandtypeattribute (sgdisk_exec_29_0) true)
+(expandtypeattribute (shared_relro_29_0) true)
+(expandtypeattribute (shared_relro_file_29_0) true)
+(expandtypeattribute (shell_29_0) true)
+(expandtypeattribute (shell_data_file_29_0) true)
+(expandtypeattribute (shell_exec_29_0) true)
+(expandtypeattribute (shell_prop_29_0) true)
+(expandtypeattribute (shm_29_0) true)
+(expandtypeattribute (shortcut_manager_icons_29_0) true)
+(expandtypeattribute (shortcut_service_29_0) true)
+(expandtypeattribute (simpleperf_app_runner_29_0) true)
+(expandtypeattribute (simpleperf_app_runner_exec_29_0) true)
+(expandtypeattribute (slice_service_29_0) true)
+(expandtypeattribute (slideshow_29_0) true)
+(expandtypeattribute (socket_device_29_0) true)
+(expandtypeattribute (sockfs_29_0) true)
+(expandtypeattribute (staging_data_file_29_0) true)
+(expandtypeattribute (statsd_29_0) true)
+(expandtypeattribute (stats_data_file_29_0) true)
+(expandtypeattribute (statsd_exec_29_0) true)
+(expandtypeattribute (statsdw_socket_29_0) true)
+(expandtypeattribute (statusbar_service_29_0) true)
+(expandtypeattribute (storaged_service_29_0) true)
+(expandtypeattribute (storage_file_29_0) true)
+(expandtypeattribute (storagestats_service_29_0) true)
+(expandtypeattribute (storage_stub_file_29_0) true)
+(expandtypeattribute (su_29_0) true)
+(expandtypeattribute (su_exec_29_0) true)
+(expandtypeattribute (super_block_device_29_0) true)
+(expandtypeattribute (surfaceflinger_29_0) true)
+(expandtypeattribute (surfaceflinger_service_29_0) true)
+(expandtypeattribute (surfaceflinger_tmpfs_29_0) true)
+(expandtypeattribute (swap_block_device_29_0) true)
+(expandtypeattribute (sysfs_29_0) true)
+(expandtypeattribute (sysfs_android_usb_29_0) true)
+(expandtypeattribute (sysfs_batteryinfo_29_0) true)
+(expandtypeattribute (sysfs_bluetooth_writable_29_0) true)
+(expandtypeattribute (sysfs_devices_block_29_0) true)
+(expandtypeattribute (sysfs_devices_system_cpu_29_0) true)
+(expandtypeattribute (sysfs_dm_29_0) true)
+(expandtypeattribute (sysfs_dt_firmware_android_29_0) true)
+(expandtypeattribute (sysfs_extcon_29_0) true)
+(expandtypeattribute (sysfs_fs_ext4_features_29_0) true)
+(expandtypeattribute (sysfs_fs_f2fs_29_0) true)
+(expandtypeattribute (sysfs_hwrandom_29_0) true)
+(expandtypeattribute (sysfs_ipv4_29_0) true)
+(expandtypeattribute (sysfs_kernel_notes_29_0) true)
+(expandtypeattribute (sysfs_leds_29_0) true)
+(expandtypeattribute (sysfs_loop_29_0) true)
+(expandtypeattribute (sysfs_lowmemorykiller_29_0) true)
+(expandtypeattribute (sysfs_mac_address_29_0) true)
+(expandtypeattribute (sysfs_net_29_0) true)
+(expandtypeattribute (sysfs_nfc_power_writable_29_0) true)
+(expandtypeattribute (sysfs_power_29_0) true)
+(expandtypeattribute (sysfs_rtc_29_0) true)
+(expandtypeattribute (sysfs_switch_29_0) true)
+(expandtypeattribute (sysfs_thermal_29_0) true)
+(expandtypeattribute (sysfs_transparent_hugepage_29_0) true)
+(expandtypeattribute (sysfs_uio_29_0) true)
+(expandtypeattribute (sysfs_usb_29_0) true)
+(expandtypeattribute (sysfs_usermodehelper_29_0) true)
+(expandtypeattribute (sysfs_vibrator_29_0) true)
+(expandtypeattribute (sysfs_wake_lock_29_0) true)
+(expandtypeattribute (sysfs_wakeup_reasons_29_0) true)
+(expandtypeattribute (sysfs_wlan_fwpath_29_0) true)
+(expandtypeattribute (sysfs_zram_29_0) true)
+(expandtypeattribute (sysfs_zram_uevent_29_0) true)
+(expandtypeattribute (system_app_29_0) true)
+(expandtypeattribute (system_app_data_file_29_0) true)
+(expandtypeattribute (system_app_service_29_0) true)
+(expandtypeattribute (system_asan_options_file_29_0) true)
+(expandtypeattribute (system_block_device_29_0) true)
+(expandtypeattribute (system_boot_reason_prop_29_0) true)
+(expandtypeattribute (system_bootstrap_lib_file_29_0) true)
+(expandtypeattribute (system_data_file_29_0) true)
+(expandtypeattribute (system_event_log_tags_file_29_0) true)
+(expandtypeattribute (system_file_29_0) true)
+(expandtypeattribute (systemkeys_data_file_29_0) true)
+(expandtypeattribute (system_lib_file_29_0) true)
+(expandtypeattribute (system_linker_config_file_29_0) true)
+(expandtypeattribute (system_linker_exec_29_0) true)
+(expandtypeattribute (system_lmk_prop_29_0) true)
+(expandtypeattribute (system_ndebug_socket_29_0) true)
+(expandtypeattribute (system_net_netd_hwservice_29_0) true)
+(expandtypeattribute (system_prop_29_0) true)
+(expandtypeattribute (system_radio_prop_29_0) true)
+(expandtypeattribute (system_seccomp_policy_file_29_0) true)
+(expandtypeattribute (system_security_cacerts_file_29_0) true)
+(expandtypeattribute (system_server_29_0) true)
+(expandtypeattribute (system_server_tmpfs_29_0) true)
+(expandtypeattribute (system_suspend_control_service_29_0) true)
+(expandtypeattribute (system_suspend_hwservice_29_0) true)
+(expandtypeattribute (system_trace_prop_29_0) true)
+(expandtypeattribute (system_update_service_29_0) true)
+(expandtypeattribute (system_wifi_keystore_hwservice_29_0) true)
+(expandtypeattribute (system_wpa_socket_29_0) true)
+(expandtypeattribute (system_zoneinfo_file_29_0) true)
+(expandtypeattribute (task_profiles_file_29_0) true)
+(expandtypeattribute (task_service_29_0) true)
+(expandtypeattribute (tcpdump_exec_29_0) true)
+(expandtypeattribute (tee_29_0) true)
+(expandtypeattribute (tee_data_file_29_0) true)
+(expandtypeattribute (tee_device_29_0) true)
+(expandtypeattribute (telecom_service_29_0) true)
+(expandtypeattribute (test_boot_reason_prop_29_0) true)
+(expandtypeattribute (test_harness_prop_29_0) true)
+(expandtypeattribute (testharness_service_29_0) true)
+(expandtypeattribute (textclassification_service_29_0) true)
+(expandtypeattribute (textclassifier_data_file_29_0) true)
+(expandtypeattribute (textservices_service_29_0) true)
+(expandtypeattribute (thermalcallback_hwservice_29_0) true)
+(expandtypeattribute (thermal_service_29_0) true)
+(expandtypeattribute (timedetector_service_29_0) true)
+(expandtypeattribute (time_prop_29_0) true)
+(expandtypeattribute (timezone_service_29_0) true)
+(expandtypeattribute (tmpfs_29_0) true)
+(expandtypeattribute (tombstoned_29_0) true)
+(expandtypeattribute (tombstone_data_file_29_0) true)
+(expandtypeattribute (tombstoned_crash_socket_29_0) true)
+(expandtypeattribute (tombstoned_exec_29_0) true)
+(expandtypeattribute (tombstoned_intercept_socket_29_0) true)
+(expandtypeattribute (tombstoned_java_trace_socket_29_0) true)
+(expandtypeattribute (tombstone_wifi_data_file_29_0) true)
+(expandtypeattribute (toolbox_29_0) true)
+(expandtypeattribute (toolbox_exec_29_0) true)
+(expandtypeattribute (traced_29_0) true)
+(expandtypeattribute (trace_data_file_29_0) true)
+(expandtypeattribute (traced_consumer_socket_29_0) true)
+(expandtypeattribute (traced_enabled_prop_29_0) true)
+(expandtypeattribute (traced_lazy_prop_29_0) true)
+(expandtypeattribute (traced_probes_29_0) true)
+(expandtypeattribute (traced_producer_socket_29_0) true)
+(expandtypeattribute (traceur_app_29_0) true)
+(expandtypeattribute (trust_service_29_0) true)
+(expandtypeattribute (tty_device_29_0) true)
+(expandtypeattribute (tun_device_29_0) true)
+(expandtypeattribute (tv_input_service_29_0) true)
+(expandtypeattribute (tzdatacheck_29_0) true)
+(expandtypeattribute (tzdatacheck_exec_29_0) true)
+(expandtypeattribute (ueventd_29_0) true)
+(expandtypeattribute (ueventd_tmpfs_29_0) true)
+(expandtypeattribute (uhid_device_29_0) true)
+(expandtypeattribute (uimode_service_29_0) true)
+(expandtypeattribute (uio_device_29_0) true)
+(expandtypeattribute (uncrypt_29_0) true)
+(expandtypeattribute (uncrypt_exec_29_0) true)
+(expandtypeattribute (uncrypt_socket_29_0) true)
+(expandtypeattribute (unencrypted_data_file_29_0) true)
+(expandtypeattribute (unlabeled_29_0) true)
+(expandtypeattribute (untrusted_app_25_29_0) true)
+(expandtypeattribute (untrusted_app_27_29_0) true)
+(expandtypeattribute (untrusted_app_29_0) true)
+(expandtypeattribute (update_engine_29_0) true)
+(expandtypeattribute (update_engine_data_file_29_0) true)
+(expandtypeattribute (update_engine_exec_29_0) true)
+(expandtypeattribute (update_engine_log_data_file_29_0) true)
+(expandtypeattribute (update_engine_service_29_0) true)
+(expandtypeattribute (updatelock_service_29_0) true)
+(expandtypeattribute (update_verifier_29_0) true)
+(expandtypeattribute (update_verifier_exec_29_0) true)
+(expandtypeattribute (uri_grants_service_29_0) true)
+(expandtypeattribute (usagestats_service_29_0) true)
+(expandtypeattribute (usbaccessory_device_29_0) true)
+(expandtypeattribute (usbd_29_0) true)
+(expandtypeattribute (usb_device_29_0) true)
+(expandtypeattribute (usbd_exec_29_0) true)
+(expandtypeattribute (usbfs_29_0) true)
+(expandtypeattribute (usb_service_29_0) true)
+(expandtypeattribute (use_memfd_prop_29_0) true)
+(expandtypeattribute (userdata_block_device_29_0) true)
+(expandtypeattribute (usermodehelper_29_0) true)
+(expandtypeattribute (user_profile_data_file_29_0) true)
+(expandtypeattribute (user_service_29_0) true)
+(expandtypeattribute (vdc_29_0) true)
+(expandtypeattribute (vdc_exec_29_0) true)
+(expandtypeattribute (vendor_app_file_29_0) true)
+(expandtypeattribute (vendor_cgroup_desc_file_29_0) true)
+(expandtypeattribute (vendor_configs_file_29_0) true)
+(expandtypeattribute (vendor_data_file_29_0) true)
+(expandtypeattribute (vendor_default_prop_29_0) true)
+(expandtypeattribute (vendor_file_29_0) true)
+(expandtypeattribute (vendor_framework_file_29_0) true)
+(expandtypeattribute (vendor_hal_file_29_0) true)
+(expandtypeattribute (vendor_idc_file_29_0) true)
+(expandtypeattribute (vendor_init_29_0) true)
+(expandtypeattribute (vendor_keychars_file_29_0) true)
+(expandtypeattribute (vendor_keylayout_file_29_0) true)
+(expandtypeattribute (vendor_overlay_file_29_0) true)
+(expandtypeattribute (vendor_public_lib_file_29_0) true)
+(expandtypeattribute (vendor_security_patch_level_prop_29_0) true)
+(expandtypeattribute (vendor_shell_29_0) true)
+(expandtypeattribute (vendor_shell_exec_29_0) true)
+(expandtypeattribute (vendor_task_profiles_file_29_0) true)
+(expandtypeattribute (vendor_toolbox_exec_29_0) true)
+(expandtypeattribute (vfat_29_0) true)
+(expandtypeattribute (vibrator_service_29_0) true)
+(expandtypeattribute (video_device_29_0) true)
+(expandtypeattribute (virtual_touchpad_29_0) true)
+(expandtypeattribute (virtual_touchpad_exec_29_0) true)
+(expandtypeattribute (virtual_touchpad_service_29_0) true)
+(expandtypeattribute (vndbinder_device_29_0) true)
+(expandtypeattribute (vndk_sp_file_29_0) true)
+(expandtypeattribute (vndservice_contexts_file_29_0) true)
+(expandtypeattribute (vndservicemanager_29_0) true)
+(expandtypeattribute (voiceinteraction_service_29_0) true)
+(expandtypeattribute (vold_29_0) true)
+(expandtypeattribute (vold_data_file_29_0) true)
+(expandtypeattribute (vold_device_29_0) true)
+(expandtypeattribute (vold_exec_29_0) true)
+(expandtypeattribute (vold_metadata_file_29_0) true)
+(expandtypeattribute (vold_prepare_subdirs_29_0) true)
+(expandtypeattribute (vold_prepare_subdirs_exec_29_0) true)
+(expandtypeattribute (vold_prop_29_0) true)
+(expandtypeattribute (vold_service_29_0) true)
+(expandtypeattribute (vpn_data_file_29_0) true)
+(expandtypeattribute (vrflinger_vsync_service_29_0) true)
+(expandtypeattribute (vr_hwc_29_0) true)
+(expandtypeattribute (vr_hwc_exec_29_0) true)
+(expandtypeattribute (vr_hwc_service_29_0) true)
+(expandtypeattribute (vr_manager_service_29_0) true)
+(expandtypeattribute (wallpaper_file_29_0) true)
+(expandtypeattribute (wallpaper_service_29_0) true)
+(expandtypeattribute (watchdogd_29_0) true)
+(expandtypeattribute (watchdog_device_29_0) true)
+(expandtypeattribute (watchdogd_exec_29_0) true)
+(expandtypeattribute (webviewupdate_service_29_0) true)
+(expandtypeattribute (webview_zygote_29_0) true)
+(expandtypeattribute (webview_zygote_exec_29_0) true)
+(expandtypeattribute (webview_zygote_tmpfs_29_0) true)
+(expandtypeattribute (wifiaware_service_29_0) true)
+(expandtypeattribute (wificond_29_0) true)
+(expandtypeattribute (wificond_exec_29_0) true)
+(expandtypeattribute (wificond_service_29_0) true)
+(expandtypeattribute (wifi_data_file_29_0) true)
+(expandtypeattribute (wifi_log_prop_29_0) true)
+(expandtypeattribute (wifip2p_service_29_0) true)
+(expandtypeattribute (wifi_prop_29_0) true)
+(expandtypeattribute (wifiscanner_service_29_0) true)
+(expandtypeattribute (wifi_service_29_0) true)
+(expandtypeattribute (window_service_29_0) true)
+(expandtypeattribute (wpantund_29_0) true)
+(expandtypeattribute (wpantund_exec_29_0) true)
+(expandtypeattribute (wpantund_service_29_0) true)
+(expandtypeattribute (wpa_socket_29_0) true)
+(expandtypeattribute (zero_device_29_0) true)
+(expandtypeattribute (zoneinfo_data_file_29_0) true)
+(expandtypeattribute (zygote_29_0) true)
+(expandtypeattribute (zygote_exec_29_0) true)
+(expandtypeattribute (zygote_socket_29_0) true)
+(expandtypeattribute (zygote_tmpfs_29_0) true)
+(typeattributeset accessibility_service_29_0 (accessibility_service))
+(typeattributeset account_service_29_0 (account_service))
+(typeattributeset activity_service_29_0 (activity_service))
+(typeattributeset activity_task_service_29_0 (activity_task_service))
+(typeattributeset adbd_29_0 (adbd))
+(typeattributeset adb_data_file_29_0 (adb_data_file))
+(typeattributeset adbd_exec_29_0 (adbd_exec))
+(typeattributeset adbd_socket_29_0 (adbd_socket))
+(typeattributeset adb_keys_file_29_0 (adb_keys_file))
+(typeattributeset adb_service_29_0 (adb_service))
+(typeattributeset alarm_service_29_0 (alarm_service))
+(typeattributeset anr_data_file_29_0 (anr_data_file))
+(typeattributeset apexd_29_0 (apexd))
+(typeattributeset apex_data_file_29_0 (apex_data_file))
+(typeattributeset apexd_exec_29_0 (apexd_exec))
+(typeattributeset apexd_prop_29_0 (apexd_prop))
+(typeattributeset apex_metadata_file_29_0 (apex_metadata_file))
+(typeattributeset apex_mnt_dir_29_0 (apex_mnt_dir))
+(typeattributeset apex_service_29_0 (apex_service))
+(typeattributeset apk_data_file_29_0 (apk_data_file))
+(typeattributeset apk_private_data_file_29_0 (apk_private_data_file))
+(typeattributeset apk_private_tmp_file_29_0 (apk_private_tmp_file))
+(typeattributeset apk_tmp_file_29_0 (apk_tmp_file))
+(typeattributeset app_binding_service_29_0 (app_binding_service))
+(typeattributeset app_data_file_29_0 (app_data_file))
+(typeattributeset appdomain_tmpfs_29_0 (appdomain_tmpfs))
+(typeattributeset app_fuse_file_29_0 (app_fuse_file))
+(typeattributeset app_fusefs_29_0 (app_fusefs))
+(typeattributeset appops_service_29_0 (appops_service))
+(typeattributeset app_prediction_service_29_0 (app_prediction_service))
+(typeattributeset appwidget_service_29_0 (appwidget_service))
+(typeattributeset app_zygote_29_0 (app_zygote))
+(typeattributeset app_zygote_tmpfs_29_0 (app_zygote_tmpfs))
+(typeattributeset asec_apk_file_29_0 (asec_apk_file))
+(typeattributeset asec_image_file_29_0 (asec_image_file))
+(typeattributeset asec_public_file_29_0 (asec_public_file))
+(typeattributeset ashmemd_29_0 (ashmemd))
+(typeattributeset ashmem_device_29_0 (ashmem_device))
+(typeattributeset assetatlas_service_29_0 (assetatlas_service))
+(typeattributeset audio_data_file_29_0 (audio_data_file))
+(typeattributeset audio_device_29_0 (audio_device))
+(typeattributeset audiohal_data_file_29_0 (audiohal_data_file))
+(typeattributeset audio_prop_29_0 (audio_prop))
+(typeattributeset audioserver_29_0 (audioserver))
+(typeattributeset audioserver_data_file_29_0 (audioserver_data_file))
+(typeattributeset audioserver_service_29_0 (audioserver_service))
+(typeattributeset audioserver_tmpfs_29_0 (audioserver_tmpfs))
+(typeattributeset audio_service_29_0 (audio_service))
+(typeattributeset autofill_service_29_0 (autofill_service))
+(typeattributeset backup_data_file_29_0 (backup_data_file))
+(typeattributeset backup_service_29_0 (backup_service))
+(typeattributeset batteryproperties_service_29_0 (batteryproperties_service))
+(typeattributeset battery_service_29_0 (battery_service))
+(typeattributeset batterystats_service_29_0 (batterystats_service))
+(typeattributeset binder_calls_stats_service_29_0 (binder_calls_stats_service))
+(typeattributeset binder_device_29_0 (binder_device))
+(typeattributeset binfmt_miscfs_29_0 (binfmt_miscfs))
+(typeattributeset biometric_service_29_0 (biometric_service))
+(typeattributeset blkid_29_0 (blkid))
+(typeattributeset blkid_untrusted_29_0 (blkid_untrusted))
+(typeattributeset block_device_29_0 (block_device))
+(typeattributeset bluetooth_29_0 (bluetooth))
+(typeattributeset bluetooth_a2dp_offload_prop_29_0 (bluetooth_a2dp_offload_prop))
+(typeattributeset bluetooth_audio_hal_prop_29_0 (bluetooth_audio_hal_prop))
+(typeattributeset bluetooth_data_file_29_0 (bluetooth_data_file))
+(typeattributeset bluetooth_efs_file_29_0 (bluetooth_efs_file))
+(typeattributeset bluetooth_logs_data_file_29_0 (bluetooth_logs_data_file))
+(typeattributeset bluetooth_manager_service_29_0 (bluetooth_manager_service))
+(typeattributeset bluetooth_prop_29_0 (bluetooth_prop))
+(typeattributeset bluetooth_service_29_0 (bluetooth_service))
+(typeattributeset bluetooth_socket_29_0 (bluetooth_socket))
+(typeattributeset bootanim_29_0 (bootanim))
+(typeattributeset bootanim_exec_29_0 (bootanim_exec))
+(typeattributeset boot_block_device_29_0 (boot_block_device))
+(typeattributeset bootchart_data_file_29_0 (bootchart_data_file))
+(typeattributeset bootloader_boot_reason_prop_29_0 (bootloader_boot_reason_prop))
+(typeattributeset bootstat_29_0 (bootstat))
+(typeattributeset bootstat_data_file_29_0 (bootstat_data_file))
+(typeattributeset bootstat_exec_29_0 (bootstat_exec))
+(typeattributeset boottime_prop_29_0 (boottime_prop))
+(typeattributeset boottrace_data_file_29_0 (boottrace_data_file))
+(typeattributeset bpf_progs_loaded_prop_29_0 (bpf_progs_loaded_prop))
+(typeattributeset broadcastradio_service_29_0 (broadcastradio_service))
+(typeattributeset bufferhubd_29_0 (bufferhubd))
+(typeattributeset bufferhubd_exec_29_0 (bufferhubd_exec))
+(typeattributeset bugreport_service_29_0 (bugreport_service))
+(typeattributeset cache_backup_file_29_0 (cache_backup_file))
+(typeattributeset cache_block_device_29_0 (cache_block_device))
+(typeattributeset cache_file_29_0 (cache_file))
+(typeattributeset cache_private_backup_file_29_0 (cache_private_backup_file))
+(typeattributeset cache_recovery_file_29_0 (cache_recovery_file))
+(typeattributeset camera_data_file_29_0 (camera_data_file))
+(typeattributeset camera_device_29_0 (camera_device))
+(typeattributeset cameraproxy_service_29_0 (cameraproxy_service))
+(typeattributeset cameraserver_29_0 (cameraserver))
+(typeattributeset cameraserver_exec_29_0 (cameraserver_exec))
+(typeattributeset cameraserver_service_29_0 (cameraserver_service))
+(typeattributeset cameraserver_tmpfs_29_0 (cameraserver_tmpfs))
+(typeattributeset cgroup_29_0 (cgroup))
+(typeattributeset cgroup_bpf_29_0 (cgroup_bpf))
+(typeattributeset cgroup_desc_file_29_0 (cgroup_desc_file))
+(typeattributeset cgroup_rc_file_29_0 (cgroup_rc_file))
+(typeattributeset charger_29_0 (charger))
+(typeattributeset charger_exec_29_0 (charger_exec))
+(typeattributeset clatd_29_0 (clatd))
+(typeattributeset clatd_exec_29_0 (clatd_exec))
+(typeattributeset clipboard_service_29_0 (clipboard_service))
+(typeattributeset color_display_service_29_0 (color_display_service))
+(typeattributeset companion_device_service_29_0 (companion_device_service))
+(typeattributeset configfs_29_0 (configfs))
+(typeattributeset config_prop_29_0 (config_prop))
+(typeattributeset connectivity_service_29_0 (connectivity_service))
+(typeattributeset connmetrics_service_29_0 (connmetrics_service))
+(typeattributeset console_device_29_0 (console_device))
+(typeattributeset consumer_ir_service_29_0 (consumer_ir_service))
+(typeattributeset content_capture_service_29_0 (content_capture_service))
+(typeattributeset content_service_29_0 (content_service))
+(typeattributeset content_suggestions_service_29_0 (content_suggestions_service))
+(typeattributeset contexthub_service_29_0 (contexthub_service))
+(typeattributeset coredump_file_29_0 (coredump_file))
+(typeattributeset country_detector_service_29_0 (country_detector_service))
+(typeattributeset coverage_service_29_0 (coverage_service))
+(typeattributeset cppreopt_prop_29_0 (cppreopt_prop))
+(typeattributeset cpuinfo_service_29_0 (cpuinfo_service))
+(typeattributeset cpu_variant_prop_29_0 (cpu_variant_prop))
+(typeattributeset crash_dump_29_0 (crash_dump))
+(typeattributeset crash_dump_exec_29_0 (crash_dump_exec))
+(typeattributeset crossprofileapps_service_29_0 (crossprofileapps_service))
+(typeattributeset ctl_adbd_prop_29_0 (ctl_adbd_prop))
+(typeattributeset ctl_bootanim_prop_29_0 (ctl_bootanim_prop))
+(typeattributeset ctl_bugreport_prop_29_0 (ctl_bugreport_prop))
+(typeattributeset ctl_console_prop_29_0 (ctl_console_prop))
+(typeattributeset ctl_default_prop_29_0 (ctl_default_prop))
+(typeattributeset ctl_dumpstate_prop_29_0 (ctl_dumpstate_prop))
+(typeattributeset ctl_fuse_prop_29_0 (ctl_fuse_prop))
+(typeattributeset ctl_gsid_prop_29_0 (ctl_gsid_prop))
+(typeattributeset ctl_interface_restart_prop_29_0 (ctl_interface_restart_prop))
+(typeattributeset ctl_interface_start_prop_29_0 (ctl_interface_start_prop))
+(typeattributeset ctl_interface_stop_prop_29_0 (ctl_interface_stop_prop))
+(typeattributeset ctl_mdnsd_prop_29_0 (ctl_mdnsd_prop))
+(typeattributeset ctl_restart_prop_29_0 (ctl_restart_prop))
+(typeattributeset ctl_rildaemon_prop_29_0 (ctl_rildaemon_prop))
+(typeattributeset ctl_sigstop_prop_29_0 (ctl_sigstop_prop))
+(typeattributeset ctl_start_prop_29_0 (ctl_start_prop))
+(typeattributeset ctl_stop_prop_29_0 (ctl_stop_prop))
+(typeattributeset dalvikcache_data_file_29_0 (dalvikcache_data_file))
+(typeattributeset dalvik_prop_29_0 (dalvik_prop))
+(typeattributeset dbinfo_service_29_0 (dbinfo_service))
+(typeattributeset debugfs_29_0 (debugfs))
+(typeattributeset debugfs_mmc_29_0 (debugfs_mmc))
+(typeattributeset debugfs_trace_marker_29_0 (debugfs_trace_marker))
+(typeattributeset debugfs_tracing_29_0 (debugfs_tracing))
+(typeattributeset debugfs_tracing_debug_29_0 (debugfs_tracing_debug))
+(typeattributeset debugfs_tracing_instances_29_0 (debugfs_tracing_instances))
+(typeattributeset debugfs_wakeup_sources_29_0 (debugfs_wakeup_sources))
+(typeattributeset debugfs_wifi_tracing_29_0 (debugfs_wifi_tracing))
+(typeattributeset debuggerd_prop_29_0 (debuggerd_prop))
+(typeattributeset debug_prop_29_0 (debug_prop))
+(typeattributeset default_android_hwservice_29_0 (default_android_hwservice))
+(typeattributeset default_android_service_29_0 (default_android_service))
+(typeattributeset default_android_vndservice_29_0 (default_android_vndservice))
+(typeattributeset default_prop_29_0 (default_prop apk_verity_prop))
+(typeattributeset dev_cpu_variant_29_0 (dev_cpu_variant))
+(typeattributeset device_29_0 (device))
+(typeattributeset device_config_activity_manager_native_boot_prop_29_0 (device_config_activity_manager_native_boot_prop))
+(typeattributeset device_config_boot_count_prop_29_0 (device_config_boot_count_prop))
+(typeattributeset device_config_input_native_boot_prop_29_0 (device_config_input_native_boot_prop))
+(typeattributeset device_config_media_native_prop_29_0 (device_config_media_native_prop))
+(typeattributeset device_config_netd_native_prop_29_0 (device_config_netd_native_prop))
+(typeattributeset device_config_reset_performed_prop_29_0 (device_config_reset_performed_prop))
+(typeattributeset device_config_runtime_native_boot_prop_29_0 (device_config_runtime_native_boot_prop))
+(typeattributeset device_config_runtime_native_prop_29_0 (device_config_runtime_native_prop))
+(typeattributeset device_config_service_29_0 (device_config_service))
+(typeattributeset device_identifiers_service_29_0 (device_identifiers_service))
+(typeattributeset deviceidle_service_29_0 (deviceidle_service))
+(typeattributeset device_logging_prop_29_0 (device_logging_prop))
+(typeattributeset device_policy_service_29_0 (device_policy_service))
+(typeattributeset devicestoragemonitor_service_29_0 (devicestoragemonitor_service))
+(typeattributeset devpts_29_0 (devpts))
+(typeattributeset dhcp_29_0 (dhcp))
+(typeattributeset dhcp_data_file_29_0 (dhcp_data_file))
+(typeattributeset dhcp_exec_29_0 (dhcp_exec))
+(typeattributeset dhcp_prop_29_0 (dhcp_prop))
+(typeattributeset diskstats_service_29_0 (diskstats_service))
+(typeattributeset display_service_29_0 (display_service))
+(typeattributeset dm_device_29_0 (dm_device))
+(typeattributeset dnsmasq_29_0 (dnsmasq))
+(typeattributeset dnsmasq_exec_29_0 (dnsmasq_exec))
+(typeattributeset dnsproxyd_socket_29_0 (dnsproxyd_socket))
+(typeattributeset dnsresolver_service_29_0 (dnsresolver_service))
+(typeattributeset DockObserver_service_29_0 (DockObserver_service))
+(typeattributeset dreams_service_29_0 (dreams_service))
+(typeattributeset drm_data_file_29_0 (drm_data_file))
+(typeattributeset drmserver_29_0 (drmserver))
+(typeattributeset drmserver_exec_29_0 (drmserver_exec))
+(typeattributeset drmserver_service_29_0 (drmserver_service))
+(typeattributeset drmserver_socket_29_0 (drmserver_socket))
+(typeattributeset dropbox_data_file_29_0 (dropbox_data_file))
+(typeattributeset dropbox_service_29_0 (dropbox_service))
+(typeattributeset dumpstate_29_0 (dumpstate))
+(typeattributeset dumpstate_exec_29_0 (dumpstate_exec))
+(typeattributeset dumpstate_options_prop_29_0 (dumpstate_options_prop))
+(typeattributeset dumpstate_prop_29_0 (dumpstate_prop))
+(typeattributeset dumpstate_service_29_0 (dumpstate_service))
+(typeattributeset dumpstate_socket_29_0 (dumpstate_socket))
+(typeattributeset dynamic_system_prop_29_0 (dynamic_system_prop))
+(typeattributeset e2fs_29_0 (e2fs))
+(typeattributeset e2fs_exec_29_0 (e2fs_exec))
+(typeattributeset efs_file_29_0 (efs_file))
+(typeattributeset ephemeral_app_29_0 (ephemeral_app))
+(typeattributeset ethernet_service_29_0 (ethernet_service))
+(typeattributeset exfat_29_0 (exfat))
+(typeattributeset exported2_config_prop_29_0 (exported2_config_prop))
+(typeattributeset exported2_default_prop_29_0 (exported2_default_prop))
+(typeattributeset exported2_radio_prop_29_0 (exported2_radio_prop))
+(typeattributeset exported2_system_prop_29_0 (exported2_system_prop))
+(typeattributeset exported2_vold_prop_29_0 (exported2_vold_prop))
+(typeattributeset exported3_default_prop_29_0 (exported3_default_prop))
+(typeattributeset exported3_radio_prop_29_0 (exported3_radio_prop))
+(typeattributeset exported3_system_prop_29_0 (exported3_system_prop))
+(typeattributeset exported_audio_prop_29_0 (exported_audio_prop))
+(typeattributeset exported_bluetooth_prop_29_0 (exported_bluetooth_prop))
+(typeattributeset exported_config_prop_29_0 (exported_config_prop))
+(typeattributeset exported_dalvik_prop_29_0 (exported_dalvik_prop))
+(typeattributeset exported_default_prop_29_0
+  ( exported_default_prop
+    vndk_prop))
+(typeattributeset exported_dumpstate_prop_29_0 (exported_dumpstate_prop))
+(typeattributeset exported_ffs_prop_29_0 (exported_ffs_prop))
+(typeattributeset exported_fingerprint_prop_29_0 (exported_fingerprint_prop))
+(typeattributeset exported_overlay_prop_29_0 (exported_overlay_prop))
+(typeattributeset exported_pm_prop_29_0 (exported_pm_prop))
+(typeattributeset exported_radio_prop_29_0 (exported_radio_prop))
+(typeattributeset exported_secure_prop_29_0 (exported_secure_prop))
+(typeattributeset exported_system_prop_29_0 (exported_system_prop))
+(typeattributeset exported_system_radio_prop_29_0 (exported_system_radio_prop))
+(typeattributeset exported_vold_prop_29_0 (exported_vold_prop))
+(typeattributeset exported_wifi_prop_29_0 (exported_wifi_prop))
+(typeattributeset external_vibrator_service_29_0 (external_vibrator_service))
+(typeattributeset face_service_29_0 (face_service))
+(typeattributeset face_vendor_data_file_29_0 (face_vendor_data_file))
+(typeattributeset fastbootd_29_0 (fastbootd))
+(typeattributeset ffs_prop_29_0 (ffs_prop))
+(typeattributeset file_contexts_file_29_0 (file_contexts_file))
+(typeattributeset fingerprintd_29_0 (fingerprintd))
+(typeattributeset fingerprintd_data_file_29_0 (fingerprintd_data_file))
+(typeattributeset fingerprintd_exec_29_0 (fingerprintd_exec))
+(typeattributeset fingerprintd_service_29_0 (fingerprintd_service))
+(typeattributeset fingerprint_prop_29_0 (fingerprint_prop))
+(typeattributeset fingerprint_service_29_0 (fingerprint_service))
+(typeattributeset fingerprint_vendor_data_file_29_0 (fingerprint_vendor_data_file))
+(typeattributeset firstboot_prop_29_0 (firstboot_prop))
+(typeattributeset flags_health_check_29_0 (flags_health_check))
+(typeattributeset flags_health_check_exec_29_0 (flags_health_check_exec))
+(typeattributeset font_service_29_0 (font_service))
+(typeattributeset frp_block_device_29_0 (frp_block_device))
+(typeattributeset fs_bpf_29_0 (fs_bpf))
+(typeattributeset fsck_29_0 (fsck))
+(typeattributeset fsck_exec_29_0 (fsck_exec))
+(typeattributeset fscklogs_29_0 (fscklogs))
+(typeattributeset fsck_untrusted_29_0 (fsck_untrusted))
+(typeattributeset functionfs_29_0 (functionfs))
+(typeattributeset fuse_29_0 (fuse))
+(typeattributeset fuse_device_29_0 (fuse_device))
+(typeattributeset fwk_bufferhub_hwservice_29_0 (fwk_bufferhub_hwservice))
+(typeattributeset fwk_camera_hwservice_29_0 (fwk_camera_hwservice))
+(typeattributeset fwk_display_hwservice_29_0 (fwk_display_hwservice))
+(typeattributeset fwk_scheduler_hwservice_29_0 (fwk_scheduler_hwservice))
+(typeattributeset fwk_sensor_hwservice_29_0 (fwk_sensor_hwservice))
+(typeattributeset fwk_stats_hwservice_29_0 (fwk_stats_hwservice))
+(typeattributeset fwmarkd_socket_29_0 (fwmarkd_socket))
+(typeattributeset gatekeeperd_29_0 (gatekeeperd))
+(typeattributeset gatekeeper_data_file_29_0 (gatekeeper_data_file))
+(typeattributeset gatekeeperd_exec_29_0 (gatekeeperd_exec))
+(typeattributeset gatekeeper_service_29_0 (gatekeeper_service))
+(typeattributeset gfxinfo_service_29_0 (gfxinfo_service))
+(typeattributeset gps_control_29_0 (gps_control))
+(typeattributeset gpu_device_29_0 (gpu_device))
+(typeattributeset gpu_service_29_0 (gpu_service))
+(typeattributeset gpuservice_29_0 (gpuservice))
+(typeattributeset graphics_device_29_0 (graphics_device))
+(typeattributeset graphicsstats_service_29_0 (graphicsstats_service))
+(typeattributeset gsi_data_file_29_0 (gsi_data_file))
+(typeattributeset gsid_prop_29_0 (gsid_prop))
+(typeattributeset gsi_metadata_file_29_0 (gsi_metadata_file))
+(typeattributeset hal_atrace_hwservice_29_0 (hal_atrace_hwservice))
+(typeattributeset hal_audiocontrol_hwservice_29_0 (hal_audiocontrol_hwservice))
+(typeattributeset hal_audio_hwservice_29_0 (hal_audio_hwservice))
+(typeattributeset hal_authsecret_hwservice_29_0 (hal_authsecret_hwservice))
+(typeattributeset hal_bluetooth_hwservice_29_0 (hal_bluetooth_hwservice))
+(typeattributeset hal_bootctl_hwservice_29_0 (hal_bootctl_hwservice))
+(typeattributeset hal_broadcastradio_hwservice_29_0 (hal_broadcastradio_hwservice))
+(typeattributeset hal_camera_hwservice_29_0 (hal_camera_hwservice))
+(typeattributeset hal_cas_hwservice_29_0 (hal_cas_hwservice))
+(typeattributeset hal_codec2_hwservice_29_0 (hal_codec2_hwservice))
+(typeattributeset hal_configstore_ISurfaceFlingerConfigs_29_0 (hal_configstore_ISurfaceFlingerConfigs))
+(typeattributeset hal_confirmationui_hwservice_29_0 (hal_confirmationui_hwservice))
+(typeattributeset hal_contexthub_hwservice_29_0 (hal_contexthub_hwservice))
+(typeattributeset hal_drm_hwservice_29_0 (hal_drm_hwservice))
+(typeattributeset hal_dumpstate_hwservice_29_0 (hal_dumpstate_hwservice))
+(typeattributeset hal_evs_hwservice_29_0 (hal_evs_hwservice))
+(typeattributeset hal_face_hwservice_29_0 (hal_face_hwservice))
+(typeattributeset hal_fingerprint_hwservice_29_0 (hal_fingerprint_hwservice))
+(typeattributeset hal_fingerprint_service_29_0 (hal_fingerprint_service))
+(typeattributeset hal_gatekeeper_hwservice_29_0 (hal_gatekeeper_hwservice))
+(typeattributeset hal_gnss_hwservice_29_0 (hal_gnss_hwservice))
+(typeattributeset hal_graphics_allocator_hwservice_29_0 (hal_graphics_allocator_hwservice))
+(typeattributeset hal_graphics_composer_hwservice_29_0 (hal_graphics_composer_hwservice))
+(typeattributeset hal_graphics_composer_server_tmpfs_29_0 (hal_graphics_composer_server_tmpfs))
+(typeattributeset hal_graphics_mapper_hwservice_29_0 (hal_graphics_mapper_hwservice))
+(typeattributeset hal_health_hwservice_29_0 (hal_health_hwservice))
+(typeattributeset hal_health_storage_hwservice_29_0 (hal_health_storage_hwservice))
+(typeattributeset hal_input_classifier_hwservice_29_0 (hal_input_classifier_hwservice))
+(typeattributeset hal_ir_hwservice_29_0 (hal_ir_hwservice))
+(typeattributeset hal_keymaster_hwservice_29_0 (hal_keymaster_hwservice))
+(typeattributeset hal_light_hwservice_29_0 (hal_light_hwservice))
+(typeattributeset hal_lowpan_hwservice_29_0 (hal_lowpan_hwservice))
+(typeattributeset hal_memtrack_hwservice_29_0 (hal_memtrack_hwservice))
+(typeattributeset hal_neuralnetworks_hwservice_29_0 (hal_neuralnetworks_hwservice))
+(typeattributeset hal_nfc_hwservice_29_0 (hal_nfc_hwservice))
+(typeattributeset hal_oemlock_hwservice_29_0 (hal_oemlock_hwservice))
+(typeattributeset hal_omx_hwservice_29_0 (hal_omx_hwservice))
+(typeattributeset hal_power_hwservice_29_0 (hal_power_hwservice))
+(typeattributeset hal_power_stats_hwservice_29_0 (hal_power_stats_hwservice))
+(typeattributeset hal_renderscript_hwservice_29_0 (hal_renderscript_hwservice))
+(typeattributeset hal_secure_element_hwservice_29_0 (hal_secure_element_hwservice))
+(typeattributeset hal_sensors_hwservice_29_0 (hal_sensors_hwservice))
+(typeattributeset hal_telephony_hwservice_29_0 (hal_telephony_hwservice))
+(typeattributeset hal_tetheroffload_hwservice_29_0 (hal_tetheroffload_hwservice))
+(typeattributeset hal_thermal_hwservice_29_0 (hal_thermal_hwservice))
+(typeattributeset hal_tv_cec_hwservice_29_0 (hal_tv_cec_hwservice))
+(typeattributeset hal_tv_input_hwservice_29_0 (hal_tv_input_hwservice))
+(typeattributeset hal_usb_gadget_hwservice_29_0 (hal_usb_gadget_hwservice))
+(typeattributeset hal_usb_hwservice_29_0 (hal_usb_hwservice))
+(typeattributeset hal_vehicle_hwservice_29_0 (hal_vehicle_hwservice))
+(typeattributeset hal_vibrator_hwservice_29_0 (hal_vibrator_hwservice))
+(typeattributeset hal_vr_hwservice_29_0 (hal_vr_hwservice))
+(typeattributeset hal_weaver_hwservice_29_0 (hal_weaver_hwservice))
+(typeattributeset hal_wifi_hostapd_hwservice_29_0 (hal_wifi_hostapd_hwservice))
+(typeattributeset hal_wifi_hwservice_29_0 (hal_wifi_hwservice))
+(typeattributeset hal_wifi_offload_hwservice_29_0 (hal_wifi_offload_hwservice))
+(typeattributeset hal_wifi_supplicant_hwservice_29_0 (hal_wifi_supplicant_hwservice))
+(typeattributeset hardware_properties_service_29_0 (hardware_properties_service))
+(typeattributeset hardware_service_29_0 (hardware_service))
+(typeattributeset hci_attach_dev_29_0 (hci_attach_dev))
+(typeattributeset hdmi_control_service_29_0 (hdmi_control_service))
+(typeattributeset healthd_29_0 (healthd))
+(typeattributeset healthd_exec_29_0 (healthd_exec))
+(typeattributeset heapdump_data_file_29_0 (heapdump_data_file))
+(typeattributeset heapprofd_29_0 (heapprofd))
+(typeattributeset heapprofd_enabled_prop_29_0 (heapprofd_enabled_prop))
+(typeattributeset heapprofd_prop_29_0 (heapprofd_prop))
+(typeattributeset heapprofd_socket_29_0 (heapprofd_socket))
+(typeattributeset hidl_allocator_hwservice_29_0 (hidl_allocator_hwservice))
+(typeattributeset hidl_base_hwservice_29_0 (hidl_base_hwservice))
+(typeattributeset hidl_manager_hwservice_29_0 (hidl_manager_hwservice))
+(typeattributeset hidl_memory_hwservice_29_0 (hidl_memory_hwservice))
+(typeattributeset hidl_token_hwservice_29_0 (hidl_token_hwservice))
+(typeattributeset hwbinder_device_29_0 (hwbinder_device))
+(typeattributeset hw_random_device_29_0 (hw_random_device))
+(typeattributeset hwservice_contexts_file_29_0 (hwservice_contexts_file))
+(typeattributeset hwservicemanager_29_0 (hwservicemanager))
+(typeattributeset hwservicemanager_exec_29_0 (hwservicemanager_exec))
+(typeattributeset hwservicemanager_prop_29_0 (hwservicemanager_prop))
+(typeattributeset icon_file_29_0 (icon_file))
+(typeattributeset idmap_29_0 (idmap))
+(typeattributeset idmap_exec_29_0 (idmap_exec))
+(typeattributeset idmap_service_29_0 (idmap_service))
+(typeattributeset iio_device_29_0 (iio_device))
+(typeattributeset imms_service_29_0 (imms_service))
+(typeattributeset incident_29_0 (incident))
+(typeattributeset incidentd_29_0 (incidentd))
+(typeattributeset incident_data_file_29_0 (incident_data_file))
+(typeattributeset incident_helper_29_0 (incident_helper))
+(typeattributeset incident_service_29_0 (incident_service))
+(typeattributeset init_29_0 (init))
+(typeattributeset init_exec_29_0 (init_exec))
+(typeattributeset init_tmpfs_29_0 (init_tmpfs))
+(typeattributeset inotify_29_0 (inotify))
+(typeattributeset input_device_29_0 (input_device))
+(typeattributeset inputflinger_29_0 (inputflinger))
+(typeattributeset inputflinger_exec_29_0 (inputflinger_exec))
+(typeattributeset inputflinger_service_29_0 (inputflinger_service))
+(typeattributeset input_method_service_29_0 (input_method_service))
+(typeattributeset input_service_29_0 (input_service))
+(typeattributeset installd_29_0 (installd))
+(typeattributeset install_data_file_29_0 (install_data_file))
+(typeattributeset installd_exec_29_0 (installd_exec))
+(typeattributeset installd_service_29_0 (installd_service))
+(typeattributeset install_recovery_29_0 (install_recovery))
+(typeattributeset install_recovery_exec_29_0 (install_recovery_exec))
+(typeattributeset ion_device_29_0 (ion_device))
+(typeattributeset iorapd_29_0 (iorapd))
+(typeattributeset iorapd_data_file_29_0 (iorapd_data_file))
+(typeattributeset iorapd_exec_29_0 (iorapd_exec))
+(typeattributeset iorapd_service_29_0 (iorapd_service))
+(typeattributeset iorapd_tmpfs_29_0 (iorapd_tmpfs))
+(typeattributeset IProxyService_service_29_0 (IProxyService_service))
+(typeattributeset ipsec_service_29_0 (ipsec_service))
+(typeattributeset iris_service_29_0 (iris_service))
+(typeattributeset iris_vendor_data_file_29_0 (iris_vendor_data_file))
+(typeattributeset isolated_app_29_0 (isolated_app))
+(typeattributeset jobscheduler_service_29_0 (jobscheduler_service))
+(typeattributeset kernel_29_0 (kernel))
+(typeattributeset keychain_data_file_29_0 (keychain_data_file))
+(typeattributeset keychord_device_29_0 (keychord_device))
+(typeattributeset keystore_29_0 (keystore))
+(typeattributeset keystore_data_file_29_0 (keystore_data_file))
+(typeattributeset keystore_exec_29_0 (keystore_exec))
+(typeattributeset keystore_service_29_0 (keystore_service))
+(typeattributeset kmsg_debug_device_29_0 (kmsg_debug_device))
+(typeattributeset kmsg_device_29_0 (kmsg_device))
+(typeattributeset labeledfs_29_0 (labeledfs))
+(typeattributeset last_boot_reason_prop_29_0 (last_boot_reason_prop))
+(typeattributeset launcherapps_service_29_0 (launcherapps_service))
+(typeattributeset llkd_29_0 (llkd))
+(typeattributeset llkd_exec_29_0 (llkd_exec))
+(typeattributeset llkd_prop_29_0 (llkd_prop))
+(typeattributeset lmkd_29_0 (lmkd))
+(typeattributeset lmkd_exec_29_0 (lmkd_exec))
+(typeattributeset lmkd_socket_29_0 (lmkd_socket))
+(typeattributeset location_service_29_0 (location_service))
+(typeattributeset lock_settings_service_29_0 (lock_settings_service))
+(typeattributeset logcat_exec_29_0 (logcat_exec))
+(typeattributeset logd_29_0 (logd))
+(typeattributeset logd_exec_29_0 (logd_exec))
+(typeattributeset logd_prop_29_0 (logd_prop))
+(typeattributeset logdr_socket_29_0 (logdr_socket))
+(typeattributeset logd_socket_29_0 (logd_socket))
+(typeattributeset logdw_socket_29_0 (logdw_socket))
+(typeattributeset logpersist_29_0 (logpersist))
+(typeattributeset logpersistd_logging_prop_29_0 (logpersistd_logging_prop))
+(typeattributeset log_prop_29_0 (log_prop))
+(typeattributeset log_tag_prop_29_0 (log_tag_prop))
+(typeattributeset loop_control_device_29_0 (loop_control_device))
+(typeattributeset loop_device_29_0 (loop_device))
+(typeattributeset looper_stats_service_29_0 (looper_stats_service))
+(typeattributeset lowpan_device_29_0 (lowpan_device))
+(typeattributeset lowpan_prop_29_0 (lowpan_prop))
+(typeattributeset lowpan_service_29_0 (lowpan_service))
+(typeattributeset lpdumpd_prop_29_0 (lpdumpd_prop))
+(typeattributeset lpdump_service_29_0 (lpdump_service))
+(typeattributeset mac_perms_file_29_0 (mac_perms_file))
+(typeattributeset mdnsd_29_0 (mdnsd))
+(typeattributeset mdnsd_socket_29_0 (mdnsd_socket))
+(typeattributeset mdns_socket_29_0 (mdns_socket))
+(typeattributeset mediacodec_service_29_0 (mediacodec_service))
+(typeattributeset media_data_file_29_0 (media_data_file))
+(typeattributeset mediadrmserver_29_0 (mediadrmserver))
+(typeattributeset mediadrmserver_exec_29_0 (mediadrmserver_exec))
+(typeattributeset mediadrmserver_service_29_0 (mediadrmserver_service))
+(typeattributeset mediaextractor_29_0 (mediaextractor))
+(typeattributeset mediaextractor_exec_29_0 (mediaextractor_exec))
+(typeattributeset mediaextractor_service_29_0 (mediaextractor_service))
+(typeattributeset mediaextractor_tmpfs_29_0 (mediaextractor_tmpfs))
+(typeattributeset mediametrics_29_0 (mediametrics))
+(typeattributeset mediametrics_exec_29_0 (mediametrics_exec))
+(typeattributeset mediametrics_service_29_0 (mediametrics_service))
+(typeattributeset media_projection_service_29_0 (media_projection_service))
+(typeattributeset mediaprovider_29_0 (mediaprovider))
+(typeattributeset media_router_service_29_0 (media_router_service))
+(typeattributeset media_rw_data_file_29_0 (media_rw_data_file))
+(typeattributeset mediaserver_29_0 (mediaserver))
+(typeattributeset mediaserver_exec_29_0 (mediaserver_exec))
+(typeattributeset mediaserver_service_29_0 (mediaserver_service))
+(typeattributeset mediaserver_tmpfs_29_0 (mediaserver_tmpfs))
+(typeattributeset media_session_service_29_0 (media_session_service))
+(typeattributeset mediaswcodec_29_0 (mediaswcodec))
+(typeattributeset mediaswcodec_exec_29_0 (mediaswcodec_exec))
+(typeattributeset meminfo_service_29_0 (meminfo_service))
+(typeattributeset metadata_block_device_29_0 (metadata_block_device))
+(typeattributeset metadata_file_29_0 (metadata_file))
+(typeattributeset method_trace_data_file_29_0 (method_trace_data_file))
+(typeattributeset midi_service_29_0 (midi_service))
+(typeattributeset misc_block_device_29_0 (misc_block_device))
+(typeattributeset misc_logd_file_29_0 (misc_logd_file))
+(typeattributeset misc_user_data_file_29_0 (misc_user_data_file))
+(typeattributeset mmc_prop_29_0 (mmc_prop))
+(typeattributeset mnt_expand_file_29_0 (mnt_expand_file))
+(typeattributeset mnt_media_rw_file_29_0 (mnt_media_rw_file))
+(typeattributeset mnt_media_rw_stub_file_29_0 (mnt_media_rw_stub_file))
+(typeattributeset mnt_product_file_29_0 (mnt_product_file))
+(typeattributeset mnt_user_file_29_0 (mnt_user_file))
+(typeattributeset mnt_vendor_file_29_0 (mnt_vendor_file))
+(typeattributeset modprobe_29_0 (modprobe))
+(typeattributeset mount_service_29_0 (mount_service))
+(typeattributeset mqueue_29_0 (mqueue))
+(typeattributeset mtp_29_0 (mtp))
+(typeattributeset mtp_device_29_0 (mtp_device))
+(typeattributeset mtpd_socket_29_0 (mtpd_socket))
+(typeattributeset mtp_exec_29_0 (mtp_exec))
+(typeattributeset nativetest_data_file_29_0 (nativetest_data_file))
+(typeattributeset netd_29_0 (netd))
+(typeattributeset net_data_file_29_0 (net_data_file))
+(typeattributeset netd_exec_29_0 (netd_exec))
+(typeattributeset netd_listener_service_29_0 (netd_listener_service))
+(typeattributeset net_dns_prop_29_0 (net_dns_prop))
+(typeattributeset netd_service_29_0 (netd_service))
+(typeattributeset netd_stable_secret_prop_29_0 (netd_stable_secret_prop))
+(typeattributeset netif_29_0 (netif))
+(typeattributeset netpolicy_service_29_0 (netpolicy_service))
+(typeattributeset net_radio_prop_29_0 (net_radio_prop))
+(typeattributeset netstats_service_29_0 (netstats_service))
+(typeattributeset netutils_wrapper_29_0 (netutils_wrapper))
+(typeattributeset netutils_wrapper_exec_29_0 (netutils_wrapper_exec))
+(typeattributeset network_management_service_29_0 (network_management_service))
+(typeattributeset network_score_service_29_0 (network_score_service))
+(typeattributeset network_stack_29_0 (network_stack))
+(typeattributeset network_stack_service_29_0 (network_stack_service))
+(typeattributeset network_time_update_service_29_0 (network_time_update_service))
+(typeattributeset network_watchlist_data_file_29_0 (network_watchlist_data_file))
+(typeattributeset network_watchlist_service_29_0 (network_watchlist_service))
+(typeattributeset nfc_29_0 (nfc))
+(typeattributeset nfc_data_file_29_0 (nfc_data_file))
+(typeattributeset nfc_device_29_0 (nfc_device))
+(typeattributeset nfc_prop_29_0 (nfc_prop))
+(typeattributeset nfc_service_29_0 (nfc_service))
+(typeattributeset nnapi_ext_deny_product_prop_29_0 (nnapi_ext_deny_product_prop))
+(typeattributeset node_29_0 (node))
+(typeattributeset nonplat_service_contexts_file_29_0 (nonplat_service_contexts_file))
+(typeattributeset notification_service_29_0 (notification_service))
+(typeattributeset null_device_29_0 (null_device))
+(typeattributeset oemfs_29_0 (oemfs))
+(typeattributeset oem_lock_service_29_0 (oem_lock_service))
+(typeattributeset ota_data_file_29_0 (ota_data_file))
+(typeattributeset otadexopt_service_29_0 (otadexopt_service))
+(typeattributeset ota_package_file_29_0 (ota_package_file))
+(typeattributeset overlayfs_file_29_0 (overlayfs_file))
+(typeattributeset overlay_prop_29_0 (overlay_prop))
+(typeattributeset overlay_service_29_0 (overlay_service))
+(typeattributeset owntty_device_29_0 (owntty_device))
+(typeattributeset package_native_service_29_0 (package_native_service))
+(typeattributeset package_service_29_0 (package_service))
+(typeattributeset packages_list_file_29_0 (packages_list_file))
+(typeattributeset pan_result_prop_29_0 (pan_result_prop))
+(typeattributeset password_slot_metadata_file_29_0 (password_slot_metadata_file))
+(typeattributeset pdx_bufferhub_client_channel_socket_29_0 (pdx_bufferhub_client_channel_socket))
+(typeattributeset pdx_bufferhub_client_endpoint_socket_29_0 (pdx_bufferhub_client_endpoint_socket))
+(typeattributeset pdx_bufferhub_dir_29_0 (pdx_bufferhub_dir))
+(typeattributeset pdx_display_client_channel_socket_29_0 (pdx_display_client_channel_socket))
+(typeattributeset pdx_display_client_endpoint_socket_29_0 (pdx_display_client_endpoint_socket))
+(typeattributeset pdx_display_dir_29_0 (pdx_display_dir))
+(typeattributeset pdx_display_manager_channel_socket_29_0 (pdx_display_manager_channel_socket))
+(typeattributeset pdx_display_manager_endpoint_socket_29_0 (pdx_display_manager_endpoint_socket))
+(typeattributeset pdx_display_screenshot_channel_socket_29_0 (pdx_display_screenshot_channel_socket))
+(typeattributeset pdx_display_screenshot_endpoint_socket_29_0 (pdx_display_screenshot_endpoint_socket))
+(typeattributeset pdx_display_vsync_channel_socket_29_0 (pdx_display_vsync_channel_socket))
+(typeattributeset pdx_display_vsync_endpoint_socket_29_0 (pdx_display_vsync_endpoint_socket))
+(typeattributeset pdx_performance_client_channel_socket_29_0 (pdx_performance_client_channel_socket))
+(typeattributeset pdx_performance_client_endpoint_socket_29_0 (pdx_performance_client_endpoint_socket))
+(typeattributeset pdx_performance_dir_29_0 (pdx_performance_dir))
+(typeattributeset perfetto_29_0 (perfetto))
+(typeattributeset performanced_29_0 (performanced))
+(typeattributeset performanced_exec_29_0 (performanced_exec))
+(typeattributeset permissionmgr_service_29_0 (permissionmgr_service))
+(typeattributeset permission_service_29_0 (permission_service))
+(typeattributeset persist_debug_prop_29_0 (persist_debug_prop))
+(typeattributeset persistent_data_block_service_29_0 (persistent_data_block_service))
+(typeattributeset persistent_properties_ready_prop_29_0 (persistent_properties_ready_prop))
+(typeattributeset pinner_service_29_0 (pinner_service))
+(typeattributeset pipefs_29_0 (pipefs))
+(typeattributeset platform_app_29_0 (platform_app))
+(typeattributeset pm_prop_29_0 (pm_prop))
+(typeattributeset pmsg_device_29_0 (pmsg_device))
+(typeattributeset port_29_0 (port))
+(typeattributeset port_device_29_0 (port_device))
+(typeattributeset postinstall_29_0 (postinstall))
+(typeattributeset postinstall_apex_mnt_dir_29_0 (postinstall_apex_mnt_dir))
+(typeattributeset postinstall_file_29_0 (postinstall_file))
+(typeattributeset postinstall_mnt_dir_29_0 (postinstall_mnt_dir))
+(typeattributeset powerctl_prop_29_0 (powerctl_prop))
+(typeattributeset power_service_29_0 (power_service))
+(typeattributeset ppp_29_0 (ppp))
+(typeattributeset ppp_device_29_0 (ppp_device))
+(typeattributeset ppp_exec_29_0 (ppp_exec))
+(typeattributeset preloads_data_file_29_0 (preloads_data_file))
+(typeattributeset preloads_media_file_29_0 (preloads_media_file))
+(typeattributeset print_service_29_0 (print_service))
+(typeattributeset priv_app_29_0 (priv_app))
+(typeattributeset privapp_data_file_29_0 (privapp_data_file))
+(typeattributeset proc_29_0
+  ( proc
+    proc_kpageflags
+    proc_lowmemorykiller))
+(typeattributeset proc_abi_29_0 (proc_abi))
+(typeattributeset proc_asound_29_0 (proc_asound))
+(typeattributeset proc_bluetooth_writable_29_0 (proc_bluetooth_writable))
+(typeattributeset proc_buddyinfo_29_0 (proc_buddyinfo))
+(typeattributeset proc_cmdline_29_0 (proc_cmdline))
+(typeattributeset proc_cpuinfo_29_0 (proc_cpuinfo))
+(typeattributeset proc_dirty_29_0 (proc_dirty))
+(typeattributeset proc_diskstats_29_0 (proc_diskstats))
+(typeattributeset proc_drop_caches_29_0 (proc_drop_caches))
+(typeattributeset processinfo_service_29_0 (processinfo_service))
+(typeattributeset proc_extra_free_kbytes_29_0 (proc_extra_free_kbytes))
+(typeattributeset proc_filesystems_29_0 (proc_filesystems))
+(typeattributeset proc_fs_verity_29_0 (proc_fs_verity))
+(typeattributeset proc_hostname_29_0 (proc_hostname))
+(typeattributeset proc_hung_task_29_0 (proc_hung_task))
+(typeattributeset proc_interrupts_29_0 (proc_interrupts))
+(typeattributeset proc_iomem_29_0 (proc_iomem))
+(typeattributeset proc_keys_29_0 (proc_keys))
+(typeattributeset proc_kmsg_29_0 (proc_kmsg))
+(typeattributeset proc_loadavg_29_0 (proc_loadavg))
+(typeattributeset proc_max_map_count_29_0 (proc_max_map_count))
+(typeattributeset proc_meminfo_29_0 (proc_meminfo))
+(typeattributeset proc_min_free_order_shift_29_0 (proc_min_free_order_shift))
+(typeattributeset proc_misc_29_0 (proc_misc))
+(typeattributeset proc_modules_29_0 (proc_modules))
+(typeattributeset proc_mounts_29_0 (proc_mounts))
+(typeattributeset proc_net_29_0 (proc_net))
+(typeattributeset proc_net_tcp_udp_29_0 (proc_net_tcp_udp))
+(typeattributeset proc_overcommit_memory_29_0 (proc_overcommit_memory))
+(typeattributeset proc_page_cluster_29_0 (proc_page_cluster))
+(typeattributeset proc_pagetypeinfo_29_0 (proc_pagetypeinfo))
+(typeattributeset proc_panic_29_0 (proc_panic))
+(typeattributeset proc_perf_29_0 (proc_perf))
+(typeattributeset proc_pid_max_29_0 (proc_pid_max))
+(typeattributeset proc_pipe_conf_29_0 (proc_pipe_conf))
+(typeattributeset proc_pressure_cpu_29_0 (proc_pressure_cpu))
+(typeattributeset proc_pressure_io_29_0 (proc_pressure_io))
+(typeattributeset proc_pressure_mem_29_0 (proc_pressure_mem))
+(typeattributeset proc_qtaguid_ctrl_29_0 (proc_qtaguid_ctrl))
+(typeattributeset proc_qtaguid_stat_29_0 (proc_qtaguid_stat))
+(typeattributeset proc_random_29_0 (proc_random))
+(typeattributeset proc_sched_29_0 (proc_sched))
+(typeattributeset proc_security_29_0 (proc_security))
+(typeattributeset proc_slabinfo_29_0 (proc_slabinfo))
+(typeattributeset proc_stat_29_0 (proc_stat))
+(typeattributeset procstats_service_29_0 (procstats_service))
+(typeattributeset proc_swaps_29_0 (proc_swaps))
+(typeattributeset proc_sysrq_29_0 (proc_sysrq))
+(typeattributeset proc_timer_29_0 (proc_timer))
+(typeattributeset proc_tty_drivers_29_0 (proc_tty_drivers))
+(typeattributeset proc_uid_concurrent_active_time_29_0 (proc_uid_concurrent_active_time))
+(typeattributeset proc_uid_concurrent_policy_time_29_0 (proc_uid_concurrent_policy_time))
+(typeattributeset proc_uid_cpupower_29_0 (proc_uid_cpupower))
+(typeattributeset proc_uid_cputime_removeuid_29_0 (proc_uid_cputime_removeuid))
+(typeattributeset proc_uid_cputime_showstat_29_0 (proc_uid_cputime_showstat))
+(typeattributeset proc_uid_io_stats_29_0 (proc_uid_io_stats))
+(typeattributeset proc_uid_procstat_set_29_0 (proc_uid_procstat_set))
+(typeattributeset proc_uid_time_in_state_29_0 (proc_uid_time_in_state))
+(typeattributeset proc_uptime_29_0 (proc_uptime))
+(typeattributeset proc_version_29_0 (proc_version))
+(typeattributeset proc_vmallocinfo_29_0 (proc_vmallocinfo))
+(typeattributeset proc_vmstat_29_0 (proc_vmstat))
+(typeattributeset proc_zoneinfo_29_0 (proc_zoneinfo))
+(typeattributeset profman_29_0 (profman))
+(typeattributeset profman_dump_data_file_29_0 (profman_dump_data_file))
+(typeattributeset profman_exec_29_0 (profman_exec))
+(typeattributeset properties_device_29_0 (properties_device))
+(typeattributeset properties_serial_29_0 (properties_serial))
+(typeattributeset property_contexts_file_29_0 (property_contexts_file))
+(typeattributeset property_data_file_29_0 (property_data_file))
+(typeattributeset property_info_29_0 (property_info))
+(typeattributeset property_socket_29_0 (property_socket))
+(typeattributeset pstorefs_29_0 (pstorefs))
+(typeattributeset ptmx_device_29_0 (ptmx_device))
+(typeattributeset qtaguid_device_29_0 (qtaguid_device))
+(typeattributeset racoon_29_0 (racoon))
+(typeattributeset racoon_exec_29_0 (racoon_exec))
+(typeattributeset racoon_socket_29_0 (racoon_socket))
+(typeattributeset radio_29_0 (radio))
+(typeattributeset radio_data_file_29_0 (radio_data_file))
+(typeattributeset radio_device_29_0 (radio_device))
+(typeattributeset radio_prop_29_0 (radio_prop))
+(typeattributeset radio_service_29_0 (radio_service))
+(typeattributeset ram_device_29_0 (ram_device))
+(typeattributeset random_device_29_0 (random_device))
+(typeattributeset recovery_29_0 (recovery))
+(typeattributeset recovery_block_device_29_0 (recovery_block_device))
+(typeattributeset recovery_data_file_29_0 (recovery_data_file))
+(typeattributeset recovery_persist_29_0 (recovery_persist))
+(typeattributeset recovery_persist_exec_29_0 (recovery_persist_exec))
+(typeattributeset recovery_refresh_29_0 (recovery_refresh))
+(typeattributeset recovery_refresh_exec_29_0 (recovery_refresh_exec))
+(typeattributeset recovery_service_29_0 (recovery_service))
+(typeattributeset recovery_socket_29_0 (recovery_socket))
+(typeattributeset registry_service_29_0 (registry_service))
+(typeattributeset resourcecache_data_file_29_0 (resourcecache_data_file))
+(typeattributeset restorecon_prop_29_0 (restorecon_prop))
+(typeattributeset restrictions_service_29_0 (restrictions_service))
+(typeattributeset rild_debug_socket_29_0 (rild_debug_socket))
+(typeattributeset rild_socket_29_0 (rild_socket))
+(typeattributeset ringtone_file_29_0 (ringtone_file))
+(typeattributeset role_service_29_0 (role_service))
+(typeattributeset rollback_service_29_0 (rollback_service))
+(typeattributeset root_block_device_29_0 (root_block_device))
+(typeattributeset rootfs_29_0 (rootfs))
+(typeattributeset rpmsg_device_29_0 (rpmsg_device))
+(typeattributeset rs_29_0 (rs))
+(typeattributeset rs_exec_29_0 (rs_exec))
+(typeattributeset rss_hwm_reset_29_0 (rss_hwm_reset))
+(typeattributeset rtc_device_29_0 (rtc_device))
+(typeattributeset rttmanager_service_29_0 (rttmanager_service))
+(typeattributeset runas_29_0 (runas))
+(typeattributeset runas_app_29_0 (runas_app))
+(typeattributeset runas_exec_29_0 (runas_exec))
+(typeattributeset runtime_event_log_tags_file_29_0 (runtime_event_log_tags_file))
+(typeattributeset runtime_service_29_0 (runtime_service))
+(typeattributeset safemode_prop_29_0 (safemode_prop))
+(typeattributeset same_process_hal_file_29_0 (same_process_hal_file))
+(typeattributeset samplingprofiler_service_29_0 (samplingprofiler_service))
+(typeattributeset scheduling_policy_service_29_0 (scheduling_policy_service))
+(typeattributeset sdcard_block_device_29_0 (sdcard_block_device))
+(typeattributeset sdcardd_29_0 (sdcardd))
+(typeattributeset sdcardd_exec_29_0 (sdcardd_exec))
+(typeattributeset sdcardfs_29_0 (sdcardfs))
+(typeattributeset seapp_contexts_file_29_0 (seapp_contexts_file))
+(typeattributeset search_service_29_0 (search_service))
+(typeattributeset sec_key_att_app_id_provider_service_29_0 (sec_key_att_app_id_provider_service))
+(typeattributeset secure_element_29_0 (secure_element))
+(typeattributeset secure_element_device_29_0 (secure_element_device))
+(typeattributeset secure_element_service_29_0 (secure_element_service))
+(typeattributeset selinuxfs_29_0 (selinuxfs))
+(typeattributeset sensor_privacy_service_29_0 (sensor_privacy_service))
+(typeattributeset sensors_device_29_0 (sensors_device))
+(typeattributeset sensorservice_service_29_0 (sensorservice_service))
+(typeattributeset sepolicy_file_29_0 (sepolicy_file))
+(typeattributeset serial_device_29_0 (serial_device))
+(typeattributeset serialno_prop_29_0 (serialno_prop))
+(typeattributeset serial_service_29_0 (serial_service))
+(typeattributeset server_configurable_flags_data_file_29_0 (server_configurable_flags_data_file))
+(typeattributeset service_contexts_file_29_0 (service_contexts_file))
+(typeattributeset servicediscovery_service_29_0 (servicediscovery_service))
+(typeattributeset servicemanager_29_0 (servicemanager))
+(typeattributeset servicemanager_exec_29_0 (servicemanager_exec))
+(typeattributeset settings_service_29_0 (settings_service))
+(typeattributeset sgdisk_29_0 (sgdisk))
+(typeattributeset sgdisk_exec_29_0 (sgdisk_exec))
+(typeattributeset shared_relro_29_0 (shared_relro))
+(typeattributeset shared_relro_file_29_0 (shared_relro_file))
+(typeattributeset shell_29_0 (shell))
+(typeattributeset shell_data_file_29_0 (shell_data_file))
+(typeattributeset shell_exec_29_0 (shell_exec))
+(typeattributeset shell_prop_29_0 (shell_prop))
+(typeattributeset shm_29_0 (shm))
+(typeattributeset shortcut_manager_icons_29_0 (shortcut_manager_icons))
+(typeattributeset shortcut_service_29_0 (shortcut_service))
+(typeattributeset simpleperf_app_runner_29_0 (simpleperf_app_runner))
+(typeattributeset simpleperf_app_runner_exec_29_0 (simpleperf_app_runner_exec))
+(typeattributeset slice_service_29_0 (slice_service))
+(typeattributeset slideshow_29_0 (slideshow))
+(typeattributeset socket_device_29_0 (socket_device))
+(typeattributeset sockfs_29_0 (sockfs))
+(typeattributeset staging_data_file_29_0 (staging_data_file))
+(typeattributeset statsd_29_0 (statsd))
+(typeattributeset stats_data_file_29_0 (stats_data_file))
+(typeattributeset statsd_exec_29_0 (statsd_exec))
+(typeattributeset statsdw_socket_29_0 (statsdw_socket))
+(typeattributeset statusbar_service_29_0 (statusbar_service))
+(typeattributeset storaged_service_29_0 (storaged_service))
+(typeattributeset storage_file_29_0 (storage_file))
+(typeattributeset storagestats_service_29_0 (storagestats_service))
+(typeattributeset storage_stub_file_29_0 (storage_stub_file))
+(typeattributeset su_29_0 (su))
+(typeattributeset su_exec_29_0 (su_exec))
+(typeattributeset super_block_device_29_0 (super_block_device))
+(typeattributeset surfaceflinger_29_0 (surfaceflinger))
+(typeattributeset surfaceflinger_service_29_0 (surfaceflinger_service))
+(typeattributeset surfaceflinger_tmpfs_29_0 (surfaceflinger_tmpfs))
+(typeattributeset swap_block_device_29_0 (swap_block_device))
+(typeattributeset sysfs_29_0
+  ( sysfs
+    sysfs_ion
+    sysfs_suspend_stats
+    sysfs_wakeup))
+(typeattributeset sysfs_android_usb_29_0 (sysfs_android_usb))
+(typeattributeset sysfs_batteryinfo_29_0 (sysfs_batteryinfo))
+(typeattributeset sysfs_bluetooth_writable_29_0 (sysfs_bluetooth_writable))
+(typeattributeset sysfs_devices_block_29_0 (sysfs_devices_block))
+(typeattributeset sysfs_devices_system_cpu_29_0 (sysfs_devices_system_cpu))
+(typeattributeset sysfs_dm_29_0 (sysfs_dm))
+(typeattributeset sysfs_dt_firmware_android_29_0 (sysfs_dt_firmware_android))
+(typeattributeset sysfs_extcon_29_0 (sysfs_extcon))
+(typeattributeset sysfs_fs_ext4_features_29_0 (sysfs_fs_ext4_features))
+(typeattributeset sysfs_fs_f2fs_29_0 (sysfs_fs_f2fs))
+(typeattributeset sysfs_hwrandom_29_0 (sysfs_hwrandom))
+(typeattributeset sysfs_ipv4_29_0 (sysfs_ipv4))
+(typeattributeset sysfs_kernel_notes_29_0 (sysfs_kernel_notes))
+(typeattributeset sysfs_leds_29_0 (sysfs_leds))
+(typeattributeset sysfs_loop_29_0 (sysfs_loop))
+(typeattributeset sysfs_lowmemorykiller_29_0 (sysfs_lowmemorykiller))
+(typeattributeset sysfs_mac_address_29_0 (sysfs_mac_address))
+(typeattributeset sysfs_net_29_0 (sysfs_net))
+(typeattributeset sysfs_nfc_power_writable_29_0 (sysfs_nfc_power_writable))
+(typeattributeset sysfs_power_29_0 (sysfs_power))
+(typeattributeset sysfs_rtc_29_0 (sysfs_rtc))
+(typeattributeset sysfs_switch_29_0 (sysfs_switch))
+(typeattributeset sysfs_thermal_29_0 (sysfs_thermal))
+(typeattributeset sysfs_transparent_hugepage_29_0 (sysfs_transparent_hugepage))
+(typeattributeset sysfs_uio_29_0 (sysfs_uio))
+(typeattributeset sysfs_usb_29_0 (sysfs_usb))
+(typeattributeset sysfs_usermodehelper_29_0 (sysfs_usermodehelper))
+(typeattributeset sysfs_vibrator_29_0 (sysfs_vibrator))
+(typeattributeset sysfs_wake_lock_29_0 (sysfs_wake_lock))
+(typeattributeset sysfs_wakeup_reasons_29_0 (sysfs_wakeup_reasons))
+(typeattributeset sysfs_wlan_fwpath_29_0 (sysfs_wlan_fwpath))
+(typeattributeset sysfs_zram_29_0 (sysfs_zram))
+(typeattributeset sysfs_zram_uevent_29_0 (sysfs_zram_uevent))
+(typeattributeset system_app_29_0 (system_app))
+(typeattributeset system_app_data_file_29_0 (system_app_data_file))
+(typeattributeset system_app_service_29_0 (system_app_service))
+(typeattributeset system_asan_options_file_29_0 (system_asan_options_file))
+(typeattributeset system_block_device_29_0 (system_block_device))
+(typeattributeset system_boot_reason_prop_29_0 (system_boot_reason_prop))
+(typeattributeset system_bootstrap_lib_file_29_0 (system_bootstrap_lib_file))
+(typeattributeset system_data_file_29_0 (system_data_file system_data_root_file))
+(typeattributeset system_event_log_tags_file_29_0 (system_event_log_tags_file))
+(typeattributeset system_file_29_0 (system_file))
+(typeattributeset systemkeys_data_file_29_0 (systemkeys_data_file))
+(typeattributeset system_lib_file_29_0 (system_lib_file))
+(typeattributeset system_linker_config_file_29_0 (system_linker_config_file))
+(typeattributeset system_linker_exec_29_0 (system_linker_exec))
+(typeattributeset system_lmk_prop_29_0 (system_lmk_prop))
+(typeattributeset system_ndebug_socket_29_0 (system_ndebug_socket))
+(typeattributeset system_net_netd_hwservice_29_0 (system_net_netd_hwservice))
+(typeattributeset system_prop_29_0 (system_prop))
+(typeattributeset system_radio_prop_29_0 (system_radio_prop))
+(typeattributeset system_seccomp_policy_file_29_0 (system_seccomp_policy_file))
+(typeattributeset system_security_cacerts_file_29_0 (system_security_cacerts_file))
+(typeattributeset system_server_29_0 (system_server))
+(typeattributeset system_server_tmpfs_29_0 (system_server_tmpfs))
+(typeattributeset system_suspend_control_service_29_0 (system_suspend_control_service))
+(typeattributeset system_suspend_hwservice_29_0 (system_suspend_hwservice))
+(typeattributeset system_trace_prop_29_0 (system_trace_prop))
+(typeattributeset system_update_service_29_0 (system_update_service))
+(typeattributeset system_wifi_keystore_hwservice_29_0 (system_wifi_keystore_hwservice))
+(typeattributeset system_wpa_socket_29_0 (system_wpa_socket))
+(typeattributeset system_zoneinfo_file_29_0 (system_zoneinfo_file))
+(typeattributeset task_profiles_file_29_0 (task_profiles_file))
+(typeattributeset task_service_29_0 (task_service))
+(typeattributeset tcpdump_exec_29_0 (tcpdump_exec))
+(typeattributeset tee_29_0 (tee))
+(typeattributeset tee_data_file_29_0 (tee_data_file))
+(typeattributeset tee_device_29_0 (tee_device))
+(typeattributeset telecom_service_29_0 (telecom_service))
+(typeattributeset test_boot_reason_prop_29_0 (test_boot_reason_prop))
+(typeattributeset test_harness_prop_29_0 (test_harness_prop))
+(typeattributeset testharness_service_29_0 (testharness_service))
+(typeattributeset textclassification_service_29_0 (textclassification_service))
+(typeattributeset textclassifier_data_file_29_0 (textclassifier_data_file))
+(typeattributeset textservices_service_29_0 (textservices_service))
+(typeattributeset thermalcallback_hwservice_29_0 (thermalcallback_hwservice))
+(typeattributeset thermal_service_29_0 (thermal_service))
+(typeattributeset timedetector_service_29_0 (timedetector_service))
+(typeattributeset time_prop_29_0 (time_prop))
+(typeattributeset timezone_service_29_0 (timezone_service))
+(typeattributeset tmpfs_29_0
+  ( mnt_sdcard_file
+    tmpfs))
+(typeattributeset tombstoned_29_0 (tombstoned))
+(typeattributeset tombstone_data_file_29_0 (tombstone_data_file))
+(typeattributeset tombstoned_crash_socket_29_0 (tombstoned_crash_socket))
+(typeattributeset tombstoned_exec_29_0 (tombstoned_exec))
+(typeattributeset tombstoned_intercept_socket_29_0 (tombstoned_intercept_socket))
+(typeattributeset tombstoned_java_trace_socket_29_0 (tombstoned_java_trace_socket))
+(typeattributeset tombstone_wifi_data_file_29_0 (tombstone_wifi_data_file))
+(typeattributeset toolbox_29_0 (toolbox))
+(typeattributeset toolbox_exec_29_0 (toolbox_exec))
+(typeattributeset traced_29_0 (traced))
+(typeattributeset trace_data_file_29_0 (trace_data_file))
+(typeattributeset traced_consumer_socket_29_0 (traced_consumer_socket))
+(typeattributeset traced_enabled_prop_29_0 (traced_enabled_prop))
+(typeattributeset traced_lazy_prop_29_0 (traced_lazy_prop))
+(typeattributeset traced_probes_29_0 (traced_probes))
+(typeattributeset traced_producer_socket_29_0 (traced_producer_socket))
+(typeattributeset traceur_app_29_0 (traceur_app))
+(typeattributeset trust_service_29_0 (trust_service))
+(typeattributeset tty_device_29_0 (tty_device))
+(typeattributeset tun_device_29_0 (tun_device))
+(typeattributeset tv_input_service_29_0 (tv_input_service))
+(typeattributeset tzdatacheck_29_0 (tzdatacheck))
+(typeattributeset tzdatacheck_exec_29_0 (tzdatacheck_exec))
+(typeattributeset ueventd_29_0 (ueventd))
+(typeattributeset ueventd_tmpfs_29_0 (ueventd_tmpfs))
+(typeattributeset uhid_device_29_0 (uhid_device))
+(typeattributeset uimode_service_29_0 (uimode_service))
+(typeattributeset uio_device_29_0 (uio_device))
+(typeattributeset uncrypt_29_0 (uncrypt))
+(typeattributeset uncrypt_exec_29_0 (uncrypt_exec))
+(typeattributeset uncrypt_socket_29_0 (uncrypt_socket))
+(typeattributeset unencrypted_data_file_29_0 (unencrypted_data_file))
+(typeattributeset unlabeled_29_0 (unlabeled))
+(typeattributeset untrusted_app_25_29_0 (untrusted_app_25))
+(typeattributeset untrusted_app_27_29_0 (untrusted_app_27))
+(typeattributeset untrusted_app_29_0 (untrusted_app))
+(typeattributeset update_engine_29_0 (update_engine))
+(typeattributeset update_engine_data_file_29_0 (update_engine_data_file))
+(typeattributeset update_engine_exec_29_0 (update_engine_exec))
+(typeattributeset update_engine_log_data_file_29_0 (update_engine_log_data_file))
+(typeattributeset update_engine_service_29_0 (update_engine_service))
+(typeattributeset updatelock_service_29_0 (updatelock_service))
+(typeattributeset update_verifier_29_0 (update_verifier))
+(typeattributeset update_verifier_exec_29_0 (update_verifier_exec))
+(typeattributeset uri_grants_service_29_0 (uri_grants_service))
+(typeattributeset usagestats_service_29_0 (usagestats_service))
+(typeattributeset usbaccessory_device_29_0 (usbaccessory_device))
+(typeattributeset usbd_29_0 (usbd))
+(typeattributeset usb_device_29_0 (usb_device))
+(typeattributeset usbd_exec_29_0 (usbd_exec))
+(typeattributeset usbfs_29_0 (usbfs))
+(typeattributeset usb_service_29_0 (usb_service))
+(typeattributeset use_memfd_prop_29_0 (use_memfd_prop))
+(typeattributeset userdata_block_device_29_0 (userdata_block_device))
+(typeattributeset usermodehelper_29_0 (usermodehelper))
+(typeattributeset user_profile_data_file_29_0 (user_profile_data_file))
+(typeattributeset user_service_29_0 (user_service))
+(typeattributeset vdc_29_0 (vdc))
+(typeattributeset vdc_exec_29_0 (vdc_exec))
+(typeattributeset vendor_app_file_29_0 (vendor_app_file))
+(typeattributeset vendor_cgroup_desc_file_29_0 (vendor_cgroup_desc_file))
+(typeattributeset vendor_configs_file_29_0 (vendor_configs_file))
+(typeattributeset vendor_data_file_29_0 (vendor_data_file))
+(typeattributeset vendor_default_prop_29_0 (vendor_default_prop))
+(typeattributeset vendor_file_29_0 (vendor_file))
+(typeattributeset vendor_framework_file_29_0 (vendor_framework_file))
+(typeattributeset vendor_hal_file_29_0 (vendor_hal_file))
+(typeattributeset vendor_idc_file_29_0 (vendor_idc_file))
+(typeattributeset vendor_init_29_0 (vendor_init))
+(typeattributeset vendor_keychars_file_29_0 (vendor_keychars_file))
+(typeattributeset vendor_keylayout_file_29_0 (vendor_keylayout_file))
+(typeattributeset vendor_overlay_file_29_0 (vendor_overlay_file))
+(typeattributeset vendor_public_lib_file_29_0 (vendor_public_lib_file))
+(typeattributeset vendor_security_patch_level_prop_29_0 (vendor_security_patch_level_prop))
+(typeattributeset vendor_shell_29_0 (vendor_shell))
+(typeattributeset vendor_shell_exec_29_0 (vendor_shell_exec))
+(typeattributeset vendor_task_profiles_file_29_0 (vendor_task_profiles_file))
+(typeattributeset vendor_toolbox_exec_29_0 (vendor_toolbox_exec))
+(typeattributeset vfat_29_0 (vfat))
+(typeattributeset vibrator_service_29_0 (vibrator_service))
+(typeattributeset video_device_29_0 (video_device))
+(typeattributeset virtual_touchpad_29_0 (virtual_touchpad))
+(typeattributeset virtual_touchpad_exec_29_0 (virtual_touchpad_exec))
+(typeattributeset virtual_touchpad_service_29_0 (virtual_touchpad_service))
+(typeattributeset vndbinder_device_29_0 (vndbinder_device))
+(typeattributeset vndk_sp_file_29_0 (vndk_sp_file))
+(typeattributeset vndservice_contexts_file_29_0 (vndservice_contexts_file))
+(typeattributeset vndservicemanager_29_0 (vndservicemanager))
+(typeattributeset voiceinteraction_service_29_0 (voiceinteraction_service))
+(typeattributeset vold_29_0 (vold))
+(typeattributeset vold_data_file_29_0 (vold_data_file))
+(typeattributeset vold_device_29_0 (vold_device))
+(typeattributeset vold_exec_29_0 (vold_exec))
+(typeattributeset vold_metadata_file_29_0 (vold_metadata_file))
+(typeattributeset vold_prepare_subdirs_29_0 (vold_prepare_subdirs))
+(typeattributeset vold_prepare_subdirs_exec_29_0 (vold_prepare_subdirs_exec))
+(typeattributeset vold_prop_29_0 (vold_prop))
+(typeattributeset vold_service_29_0 (vold_service))
+(typeattributeset vpn_data_file_29_0 (vpn_data_file))
+(typeattributeset vrflinger_vsync_service_29_0 (vrflinger_vsync_service))
+(typeattributeset vr_hwc_29_0 (vr_hwc))
+(typeattributeset vr_hwc_exec_29_0 (vr_hwc_exec))
+(typeattributeset vr_hwc_service_29_0 (vr_hwc_service))
+(typeattributeset vr_manager_service_29_0 (vr_manager_service))
+(typeattributeset wallpaper_file_29_0 (wallpaper_file))
+(typeattributeset wallpaper_service_29_0 (wallpaper_service))
+(typeattributeset watchdogd_29_0 (watchdogd))
+(typeattributeset watchdog_device_29_0 (watchdog_device))
+(typeattributeset watchdogd_exec_29_0 (watchdogd_exec))
+(typeattributeset webviewupdate_service_29_0 (webviewupdate_service))
+(typeattributeset webview_zygote_29_0 (webview_zygote))
+(typeattributeset webview_zygote_exec_29_0 (webview_zygote_exec))
+(typeattributeset webview_zygote_tmpfs_29_0 (webview_zygote_tmpfs))
+(typeattributeset wifiaware_service_29_0 (wifiaware_service))
+(typeattributeset wificond_29_0 (wificond))
+(typeattributeset wificond_exec_29_0 (wificond_exec))
+(typeattributeset wificond_service_29_0 (wificond_service wifinl80211_service))
+(typeattributeset wifi_data_file_29_0 (wifi_data_file))
+(typeattributeset wifi_log_prop_29_0 (wifi_log_prop))
+(typeattributeset wifip2p_service_29_0 (wifip2p_service))
+(typeattributeset wifi_prop_29_0 (wifi_prop))
+(typeattributeset wifiscanner_service_29_0 (wifiscanner_service))
+(typeattributeset wifi_service_29_0 (wifi_service))
+(typeattributeset window_service_29_0 (window_service))
+(typeattributeset wpantund_29_0 (wpantund))
+(typeattributeset wpantund_exec_29_0 (wpantund_exec))
+(typeattributeset wpantund_service_29_0 (wpantund_service))
+(typeattributeset wpa_socket_29_0 (wpa_socket))
+(typeattributeset zero_device_29_0 (zero_device))
+(typeattributeset zoneinfo_data_file_29_0 (zoneinfo_data_file))
+(typeattributeset zygote_29_0 (zygote))
+(typeattributeset zygote_exec_29_0 (zygote_exec))
+(typeattributeset zygote_socket_29_0 (zygote_socket))
+(typeattributeset zygote_tmpfs_29_0 (zygote_tmpfs))
diff --git a/private/compat/29.0/29.0.compat.cil b/private/compat/29.0/29.0.compat.cil
new file mode 100644
index 0000000..af4da8a
--- /dev/null
+++ b/private/compat/29.0/29.0.compat.cil
@@ -0,0 +1,3 @@
+(typeattribute vendordomain)
+(typeattributeset vendordomain ((and (domain) ((not (coredomain))))))
+(allow vendordomain self (netlink_route_socket (nlmsg_readpriv)))
diff --git a/private/compat/29.0/29.0.ignore.cil b/private/compat/29.0/29.0.ignore.cil
new file mode 100644
index 0000000..4733042
--- /dev/null
+++ b/private/compat/29.0/29.0.ignore.cil
@@ -0,0 +1,117 @@
+;; new_objects - a collection of types that have been introduced that have no
+;;   analogue in older policy.  Thus, we do not need to map these types to
+;;   previous ones.  Add here to pass checkapi tests.
+(type new_objects)
+(typeattribute new_objects)
+(typeattributeset new_objects
+  ( new_objects
+    aidl_lazy_test_server
+    aidl_lazy_test_server_exec
+    aidl_lazy_test_service
+    adbd_prop
+    apex_module_data_file
+    apex_permission_data_file
+    apex_rollback_data_file
+    apex_wifi_data_file
+    app_integrity_service
+    app_search_service
+    auth_service
+    automotive_display_service
+    automotive_display_service_exec
+    ashmem_libcutils_device
+    blob_store_service
+    binder_cache_bluetooth_server_prop
+    binder_cache_system_server_prop
+    binderfs
+    binderfs_logs
+    binderfs_logs_proc
+    boringssl_self_test
+    bq_config_prop
+    charger_prop
+    cold_boot_done_prop
+    credstore
+    credstore_data_file
+    credstore_exec
+    credstore_service
+    platform_compat_service
+    ctl_apexd_prop
+    dataloader_manager_service
+    device_config_storage_native_boot_prop
+    device_config_sys_traced_prop
+    device_config_window_manager_native_boot_prop
+    device_config_configuration_prop
+    exported_camera_prop
+    file_integrity_service
+    fwk_automotive_display_hwservice
+    gmscore_app
+    hal_can_bus_hwservice
+    hal_can_controller_hwservice
+    hal_identity_service
+    hal_light_service
+    hal_power_service
+    hal_rebootescrow_service
+    hal_tv_tuner_hwservice
+    hal_vibrator_service
+    incremental_control_file
+    incremental_service
+    init_perf_lsm_hooks_prop
+    init_svc_debug_prop
+    iorap_inode2filename
+    iorap_inode2filename_data_file
+    iorap_inode2filename_exec
+    iorap_inode2filename_tmpfs
+    iorap_prefetcherd
+    iorap_prefetcherd_data_file
+    iorap_prefetcherd_exec
+    iorap_prefetcherd_tmpfs
+    mediatranscoding_service
+    mediatranscoding
+    mediatranscoding_exec
+    mediatranscoding_tmpfs
+    mirror_data_file
+    light_service
+    linkerconfig_file
+    media_variant_prop
+    metadata_bootstat_file
+    mnt_pass_through_file
+    mock_ota_prop
+    module_sdkextensions_prop
+    ota_metadata_file
+    ota_prop
+    prereboot_data_file
+    art_apex_dir
+    rebootescrow_hal_prop
+    securityfs
+    service_manager_service
+    service_manager_vndservice
+    simpleperf
+    snapshotctl_log_data_file
+    socket_hook_prop
+    soundtrigger_middleware_service
+    sysfs_dm_verity
+    system_adbd_prop
+    system_config_service
+    system_group_file
+    system_jvmti_agent_prop
+    system_passwd_file
+    system_unsolzygote_socket
+    tethering_service
+    traced_perf
+    traced_perf_enabled_prop
+    traced_perf_socket
+    timezonedetector_service
+    untrusted_app_29
+    usb_serial_device
+    userspace_reboot_config_prop
+    userspace_reboot_exported_prop
+    userspace_reboot_log_prop
+    userspace_reboot_test_prop
+    vehicle_hal_prop
+    tv_tuner_resource_mgr_service
+    vendor_apex_file
+    vendor_boringssl_self_test
+    vendor_install_recovery
+    vendor_install_recovery_exec
+    vendor_socket_hook_prop
+    vendor_socket_hook_prop
+    virtual_ab_prop))
diff --git a/private/coredomain.te b/private/coredomain.te
index 169f6b2..32a1e3f 100644
--- a/private/coredomain.te
+++ b/private/coredomain.te
@@ -25,11 +25,11 @@
         -idmap
         -init
         -installd
-        userdebug_or_eng(`-perfprofd')
         userdebug_or_eng(`-heapprofd')
         -postinstall_dexopt
         -rs # spawned by appdomain, so carryover the exception above
         -system_server
+        -traced_perf
     } vendor_app_file:dir { open read getattr search };
 ')
 
@@ -41,11 +41,11 @@
         -idmap
         -init
         -installd
-        userdebug_or_eng(`-perfprofd')
         userdebug_or_eng(`-heapprofd')
         -postinstall_dexopt
         -rs # spawned by appdomain, so carryover the exception above
         -system_server
+        -traced_perf
         -mediaserver
     } vendor_app_file:file r_file_perms;
 ')
@@ -58,9 +58,12 @@
         -idmap
         -init
         -installd
+        -iorap_inode2filename
+        -iorap_prefetcherd
         -postinstall_dexopt
         -rs # spawned by appdomain, so carryover the exception above
         -system_server
+        -traced_perf
         -app_zygote
         -webview_zygote
         -zygote
@@ -75,9 +78,12 @@
         -idmap
         -init
         -installd
+        -iorap_inode2filename
+        -iorap_prefetcherd
         -postinstall_dexopt
         -rs # spawned by appdomain, so carryover the exception above
         -system_server
+        -traced_perf
         -app_zygote
         -webview_zygote
         -zygote
@@ -126,9 +132,9 @@
     -atrace
     -dumpstate
     -init
-    userdebug_or_eng(`-perfprofd')
     -traced_probes
     -shell
+    -system_server
     -traceur_app
   } debugfs_tracing:file no_rw_file_perms;
 
@@ -190,18 +196,3 @@
 full_treble_only(`
   neverallow coredomain tee_device:chr_file { open read append write ioctl };
 ')
-
-# Allow access to ashmemd to request /dev/ashmem fds.
-allow {
-  coredomain
-  -init
-  -iorapd
-  -perfprofd
-} ashmem_device_service:service_manager find;
-
-binder_call({
-  coredomain
-  -init
-  -iorapd
-  -perfprofd
-}, ashmemd)
diff --git a/private/credstore.te b/private/credstore.te
new file mode 100644
index 0000000..8d87e2f
--- /dev/null
+++ b/private/credstore.te
@@ -0,0 +1,6 @@
+typeattribute credstore coredomain;
+
+init_daemon_domain(credstore)
+
+# talk to Identity Credential
+hal_client_domain(credstore, hal_identity)
diff --git a/private/derive_sdk.te b/private/derive_sdk.te
new file mode 100644
index 0000000..1f60e34
--- /dev/null
+++ b/private/derive_sdk.te
@@ -0,0 +1,12 @@
+
+# Domain for derive_sdk
+type derive_sdk, domain, coredomain;
+type derive_sdk_exec, system_file_type, exec_type, file_type;
+init_daemon_domain(derive_sdk)
+
+# Read /apex
+allow derive_sdk apex_mnt_dir:dir r_dir_perms;
+
+# Prop rules: writable by derive_sdk, readable by bootclasspath (apps)
+set_prop(derive_sdk, module_sdkextensions_prop)
+neverallow { domain -init -derive_sdk } module_sdkextensions_prop:property_service set;
diff --git a/private/dexoptanalyzer.te b/private/dexoptanalyzer.te
index 2c0e1a4..1f92462 100644
--- a/private/dexoptanalyzer.te
+++ b/private/dexoptanalyzer.te
@@ -19,6 +19,9 @@
 allow dexoptanalyzer installd:fd use;
 allow dexoptanalyzer installd:fifo_file { getattr write };
 
+# Acquire advisory lock on /system/framework/arm/*
+allow dexoptanalyzer system_file:file lock;
+
 # Allow reading secondary dex files that were reported by the app to the
 # package manager.
 allow dexoptanalyzer { privapp_data_file app_data_file }:dir { getattr search };
diff --git a/private/domain.te b/private/domain.te
index 209eeb0..3f5bbaa 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -28,6 +28,27 @@
   -vold
 })')
 
+# As above, allow perf profiling most processes on debug builds.
+# zygote is excluded as system-wide profiling could end up with it
+# (unexpectedly) holding an open fd across a fork.
+userdebug_or_eng(`can_profile_perf({
+  domain
+  -bpfloader
+  -init
+  -kernel
+  -keystore
+  -llkd
+  -logd
+  -logpersist
+  -recovery
+  -recovery_persist
+  -recovery_refresh
+  -ueventd
+  -vendor_init
+  -vold
+  -zygote
+})')
+
 # Path resolution access in cgroups.
 allow domain cgroup:dir search;
 allow { domain -appdomain -rs } cgroup:dir w_dir_perms;
@@ -42,6 +63,12 @@
 # if memfd support can be used if device supports it
 get_prop(domain, use_memfd_prop);
 
+# Read access to sdkextensions props
+get_prop(domain, module_sdkextensions_prop)
+
+# Read access to bq configuration values
+get_prop(domain, bq_config_prop);
+
 # For now, everyone can access core property files
 # Device specific properties are not granted by default
 not_compatible_property(`
@@ -70,6 +97,11 @@
     get_prop({coredomain appdomain shell}, exported3_default_prop)
     get_prop({coredomain appdomain shell}, exported3_radio_prop)
     get_prop({coredomain appdomain shell}, exported3_system_prop)
+    get_prop({coredomain appdomain shell}, exported_camera_prop)
+    get_prop({coredomain appdomain shell}, userspace_reboot_config_prop)
+    get_prop({coredomain shell}, userspace_reboot_exported_prop)
+    get_prop({coredomain shell}, userspace_reboot_log_prop)
+    get_prop({coredomain shell}, userspace_reboot_test_prop)
     get_prop({domain -coredomain -appdomain}, vendor_default_prop)
 ')
 
@@ -82,6 +114,13 @@
   allow domain su:key search;
 ')
 
+# Allow access to linkerconfig file
+allow domain linkerconfig_file:dir search;
+allow domain linkerconfig_file:file r_file_perms;
+
+# Allow all processes to check for the existence of the boringssl_self_test_marker files.
+allow domain boringssl_self_test_marker:dir search;
+
 # Limit ability to ptrace or read sensitive /proc/pid files of processes
 # with other UIDs to these whitelisted domains.
 neverallow {
@@ -92,11 +131,10 @@
   userdebug_or_eng(`-incidentd')
   -storaged
   -system_server
-  userdebug_or_eng(`-perfprofd')
 } self:global_capability_class_set sys_ptrace;
 
 # Limit ability to generate hardware unique device ID attestations to priv_apps
-neverallow { domain -priv_app } *:keystore_key gen_unique_id;
+neverallow { domain -priv_app -gmscore_app } *:keystore_key gen_unique_id;
 
 neverallow {
   domain
@@ -127,12 +165,14 @@
   -app_zygote
   -dexoptanalyzer
   -installd
-  userdebug_or_eng(`-perfprofd')
+  -iorap_inode2filename
+  -iorap_prefetcherd
   -profman
   -rs # spawned by appdomain, so carryover the exception above
   -runas
   -system_server
   -viewcompiler
+  -zygote
 } { privapp_data_file app_data_file }:dir *;
 
 # Only apps should be modifying app data. installd is exempted for
@@ -149,7 +189,7 @@
   -appdomain
   -app_zygote
   -installd
-  userdebug_or_eng(`-perfprofd')
+  -iorap_prefetcherd
   -rs # spawned by appdomain, so carryover the exception above
 } { privapp_data_file app_data_file }:file_class_set open;
 
@@ -168,8 +208,8 @@
 # that these files cannot be accessed by other domains to ensure that the files
 # do not change between system_server staging the files and apexd processing
 # the files.
-neverallow { domain -init -system_server -apexd -installd} staging_data_file:dir *;
-neverallow { domain -init -system_app -system_server -apexd -kernel -installd } staging_data_file:file *;
+neverallow { domain -init -system_server -apexd -installd -iorap_inode2filename } staging_data_file:dir *;
+neverallow { domain -init -system_app -system_server -apexd -kernel -installd -iorap_inode2filename } staging_data_file:file *;
 neverallow { domain -init -system_server -installd} staging_data_file:dir no_w_dir_perms;
 # apexd needs the link and unlink permissions, so list every `no_w_file_perms`
 # except for `link` and `unlink`.
@@ -194,6 +234,7 @@
     domain
     -appdomain
     with_asan(`-asan_extract')
+    -iorap_prefetcherd
     -shell
     userdebug_or_eng(`-su')
     -system_server_startup # for memfd backed executable regions
@@ -250,16 +291,15 @@
 # Instead of granting them it is usually better to add the domain to
 # a Unix group or change the permissions of a file.
 define(`dac_override_allowed', `{
+  apexd
   dnsmasq
   dumpstate
   init
   installd
-  install_recovery
   userdebug_or_eng(`llkd')
   lmkd
   migrate_legacy_obb_data
   netd
-  perfprofd
   postinstall_dexopt
   recovery
   rss_hwm_reset
@@ -279,6 +319,9 @@
 # this list should be a superset of the one above.
 neverallow ~{
   dac_override_allowed
+  iorap_inode2filename
+  iorap_prefetcherd
+  traced_perf
   traced_probes
   userdebug_or_eng(`heapprofd')
 } self:global_capability_class_set dac_read_search;
@@ -312,4 +355,17 @@
   -uncrypt
   -tee
   -hal_bootctl_server
+  -fastbootd
 } self:global_capability_class_set sys_rawio;
+
+# Limit directory operations that doesn't need to do app data isolation.
+neverallow {
+  domain
+  -init
+  -installd
+  -zygote
+} mirror_data_file:dir *;
+
+# This property is being removed. Remove remaining access.
+neverallow { domain -init -system_server -vendor_init } net_dns_prop:property_service set;
+neverallow { domain -dumpstate -init -system_server -vendor_init } net_dns_prop:file read;
diff --git a/private/dumpstate.te b/private/dumpstate.te
index 4f6d96a..72e508e 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -44,9 +44,19 @@
 allow dumpstate debugfs_wakeup_sources:file r_file_perms;
 allow dumpstate dev_type:blk_file getattr;
 allow dumpstate webview_zygote:process signal;
-dontaudit dumpstate perfprofd:binder call;
 dontaudit dumpstate update_engine:binder call;
 allow dumpstate proc_net_tcp_udp:file r_file_perms;
 
 # For comminucating with the system process to do confirmation ui.
 binder_call(dumpstate, incidentcompanion_service)
+
+# For dumping dynamic partition information.
+set_prop(dumpstate, lpdumpd_prop)
+binder_call(dumpstate, lpdumpd)
+
+# For dumping device-mapper and snapshot information.
+allow dumpstate gsid_exec:file rx_file_perms;
+set_prop(dumpstate, ctl_gsid_prop)
+binder_call(dumpstate, gsid)
+
+r_dir_file(dumpstate, ota_metadata_file)
diff --git a/private/ephemeral_app.te b/private/ephemeral_app.te
index 1283e21..56d4747 100644
--- a/private/ephemeral_app.te
+++ b/private/ephemeral_app.te
@@ -39,7 +39,6 @@
 allow ephemeral_app cameraserver_service:service_manager find;
 allow ephemeral_app mediaserver_service:service_manager find;
 allow ephemeral_app mediaextractor_service:service_manager find;
-allow ephemeral_app mediacodec_service:service_manager find;
 allow ephemeral_app mediametrics_service:service_manager find;
 allow ephemeral_app mediadrmserver_service:service_manager find;
 allow ephemeral_app drmserver_service:service_manager find;
@@ -52,13 +51,11 @@
 
 # Write app-specific trace data to the Perfetto traced damon. This requires
 # connecting to its producer socket and obtaining a (per-process) tmpfs fd.
-allow ephemeral_app traced:fd use;
-allow ephemeral_app traced_tmpfs:file { read write getattr map };
-unix_socket_connect(ephemeral_app, traced_producer, traced)
+perfetto_producer(ephemeral_app)
 
-# Allow heap profiling if the app opts in by being marked
-# profileable/debuggable.
+# Allow profiling if the app opts in by being marked profileable/debuggable.
 can_profile_heap(ephemeral_app)
+can_profile_perf(ephemeral_app)
 
 # allow ephemeral apps to use UDP sockets provided by the system server but not
 # modify them other than to connect
diff --git a/private/file.te b/private/file.te
index a856792..4492002 100644
--- a/private/file.te
+++ b/private/file.te
@@ -20,3 +20,9 @@
 # /data/misc_[ce|de]/rollback : Used by installd to store snapshots
 # of application data.
 type rollback_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/gsi/ota
+type ota_image_data_file, file_type, data_file_type, core_data_file_type;
+
+# /data/misc/emergencynumberdb
+type emergency_data_file, file_type, data_file_type, core_data_file_type;
diff --git a/private/file_contexts b/private/file_contexts
index 530bd45..9bed5fd 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -24,6 +24,7 @@
 /lost\+found        u:object_r:rootfs:s0
 /acct               u:object_r:cgroup:s0
 /config             u:object_r:rootfs:s0
+/data_mirror        u:object_r:mirror_data_file:s0
 /debug_ramdisk      u:object_r:tmpfs:s0
 /mnt                u:object_r:tmpfs:s0
 /postinstall        u:object_r:postinstall_mnt_dir:s0
@@ -75,6 +76,7 @@
 /dev/adf-interface[0-9]*\.[0-9]*	u:object_r:graphics_device:s0
 /dev/adf-overlay-engine[0-9]*\.[0-9]*	u:object_r:graphics_device:s0
 /dev/ashmem		u:object_r:ashmem_device:s0
+/dev/ashmem(.*)?	u:object_r:ashmem_libcutils_device:s0
 /dev/audio.*		u:object_r:audio_device:s0
 /dev/binder		u:object_r:binder_device:s0
 /dev/block(/.*)?	u:object_r:block_device:s0
@@ -83,6 +85,7 @@
 /dev/block/vold/.+	u:object_r:vold_device:s0
 /dev/block/ram[0-9]*	u:object_r:ram_device:s0
 /dev/block/zram[0-9]*	u:object_r:ram_device:s0
+/dev/boringssl/selftest(/.*)?	u:object_r:boringssl_self_test_marker:s0
 /dev/bus/usb(.*)?       u:object_r:usb_device:s0
 /dev/console		u:object_r:console_device:s0
 /dev/cpu_variant:.*     u:object_r:dev_cpu_variant:s0
@@ -147,8 +150,9 @@
 /dev/socket/tombstoned_crash u:object_r:tombstoned_crash_socket:s0
 /dev/socket/tombstoned_java_trace u:object_r:tombstoned_java_trace_socket:s0
 /dev/socket/tombstoned_intercept u:object_r:tombstoned_intercept_socket:s0
-/dev/socket/traced_producer	u:object_r:traced_producer_socket:s0
 /dev/socket/traced_consumer	u:object_r:traced_consumer_socket:s0
+/dev/socket/traced_perf	u:object_r:traced_perf_socket:s0
+/dev/socket/traced_producer	u:object_r:traced_producer_socket:s0
 /dev/socket/heapprofd	u:object_r:heapprofd_socket:s0
 /dev/socket/uncrypt	u:object_r:uncrypt_socket:s0
 /dev/socket/wpa_eth[0-9] u:object_r:wpa_socket:s0
@@ -161,6 +165,8 @@
 /dev/tty		u:object_r:owntty_device:s0
 /dev/tty[0-9]*		u:object_r:tty_device:s0
 /dev/ttyS[0-9]*		u:object_r:serial_device:s0
+/dev/ttyUSB[0-9]*	u:object_r:usb_serial_device:s0
+/dev/ttyACM[0-9]*	u:object_r:usb_serial_device:s0
 /dev/tun		u:object_r:tun_device:s0
 /dev/uhid		u:object_r:uhid_device:s0
 /dev/uinput		u:object_r:uhid_device:s0
@@ -176,16 +182,21 @@
 /dev/__properties__ u:object_r:properties_device:s0
 /dev/__properties__/property_info   u:object_r:property_info:s0
 #############################
+# Linker configuration
+#
+/linkerconfig(/.*)?          u:object_r:linkerconfig_file:s0
+#############################
 # System files
 #
 /system(/.*)?		u:object_r:system_file:s0
+/system/apex/com.android.art	u:object_r:art_apex_dir:s0
 /system/lib(64)?(/.*)?		u:object_r:system_lib_file:s0
 /system/lib(64)?/bootstrap(/.*)? u:object_r:system_bootstrap_lib_file:s0
 /system/bin/atrace	u:object_r:atrace_exec:s0
-/system/bin/ashmemd	u:object_r:ashmemd_exec:s0
 /system/bin/auditctl	u:object_r:auditctl_exec:s0
 /system/bin/bcc                 u:object_r:rs_exec:s0
 /system/bin/blank_screen	u:object_r:blank_screen_exec:s0
+/system/bin/boringssl_self_test(32|64) u:object_r:boringssl_self_test_exec:s0
 /system/bin/charger		u:object_r:charger_exec:s0
 /system/bin/e2fsdroid		u:object_r:e2fs_exec:s0
 /system/bin/mke2fs		u:object_r:e2fs_exec:s0
@@ -235,11 +246,13 @@
 /system/bin/cameraserver	u:object_r:cameraserver_exec:s0
 /system/bin/mediaextractor	u:object_r:mediaextractor_exec:s0
 /system/bin/mediaswcodec	u:object_r:mediaswcodec_exec:s0
+/system/bin/mediatranscoding	u:object_r:mediatranscoding_exec:s0
 /system/bin/mdnsd	u:object_r:mdnsd_exec:s0
 /system/bin/installd	u:object_r:installd_exec:s0
 /system/bin/otapreopt_chroot   u:object_r:otapreopt_chroot_exec:s0
 /system/bin/otapreopt_slot   u:object_r:otapreopt_slot_exec:s0
 /system/bin/art_apex_boot_integrity   u:object_r:art_apex_boot_integrity_exec:s0
+/system/bin/credstore	u:object_r:credstore_exec:s0
 /system/bin/keystore	u:object_r:keystore_exec:s0
 /system/bin/fingerprintd u:object_r:fingerprintd_exec:s0
 /system/bin/gatekeeperd u:object_r:gatekeeperd_exec:s0
@@ -249,17 +262,18 @@
 /system/bin/recovery-persist     u:object_r:recovery_persist_exec:s0
 /system/bin/recovery-refresh     u:object_r:recovery_refresh_exec:s0
 /system/bin/sdcard      u:object_r:sdcardd_exec:s0
+/system/bin/snapshotctl      u:object_r:snapshotctl_exec:s0
 /system/bin/dhcpcd      u:object_r:dhcp_exec:s0
 /system/bin/dhcpcd-6\.8\.2	u:object_r:dhcp_exec:s0
 /system/bin/mtpd	u:object_r:mtp_exec:s0
 /system/bin/pppd	u:object_r:ppp_exec:s0
 /system/bin/racoon	u:object_r:racoon_exec:s0
 /system/xbin/su		u:object_r:su_exec:s0
-/system/bin/perfprofd  u:object_r:perfprofd_exec:s0
 /system/bin/dnsmasq     u:object_r:dnsmasq_exec:s0
 /system/bin/healthd     u:object_r:healthd_exec:s0
 /system/bin/clatd	u:object_r:clatd_exec:s0
 /system/bin/linker(64)? u:object_r:system_linker_exec:s0
+/system/bin/linkerconfig u:object_r:linkerconfig_exec:s0
 /system/bin/bootstrap/linker(64)? u:object_r:system_linker_exec:s0
 /system/bin/llkd        u:object_r:llkd_exec:s0
 /system/bin/lmkd        u:object_r:lmkd_exec:s0
@@ -270,6 +284,7 @@
 /system/bin/rss_hwm_reset	u:object_r:rss_hwm_reset_exec:s0
 /system/bin/perfetto        u:object_r:perfetto_exec:s0
 /system/bin/traced        u:object_r:traced_exec:s0
+/system/bin/traced_perf        u:object_r:traced_perf_exec:s0
 /system/bin/traced_probes        u:object_r:traced_probes_exec:s0
 /system/bin/heapprofd        u:object_r:heapprofd_exec:s0
 /system/bin/uncrypt     u:object_r:uncrypt_exec:s0
@@ -279,12 +294,13 @@
 /system/bin/cppreopts\.sh   u:object_r:cppreopts_exec:s0
 /system/bin/preloads_copy\.sh u:object_r:preloads_copy_exec:s0
 /system/bin/preopt2cachename u:object_r:preopt2cachename_exec:s0
-/system/bin/install-recovery\.sh u:object_r:install_recovery_exec:s0
 /system/bin/dex2oat(d)?     u:object_r:dex2oat_exec:s0
 /system/bin/dexoptanalyzer(d)?     u:object_r:dexoptanalyzer_exec:s0
 /system/bin/viewcompiler     u:object_r:viewcompiler_exec:s0
 /system/bin/profman(d)?     u:object_r:profman_exec:s0
 /system/bin/iorapd          u:object_r:iorapd_exec:s0
+/system/bin/iorap\.inode2filename u:object_r:iorap_inode2filename_exec:s0
+/system/bin/iorap\.prefetcherd u:object_r:iorap_prefetcherd_exec:s0
 /system/bin/sgdisk      u:object_r:sgdisk_exec:s0
 /system/bin/blkid       u:object_r:blkid_exec:s0
 /system/bin/tzdatacheck u:object_r:tzdatacheck_exec:s0
@@ -300,7 +316,9 @@
 /system/bin/hw/android\.system\.suspend@1\.0-service          u:object_r:system_suspend_exec:s0
 /system/etc/cgroups\.json               u:object_r:cgroup_desc_file:s0
 /system/etc/event-log-tags              u:object_r:system_event_log_tags_file:s0
+/system/etc/group                       u:object_r:system_group_file:s0
 /system/etc/ld\.config.*                u:object_r:system_linker_config_file:s0
+/system/etc/passwd                      u:object_r:system_passwd_file:s0
 /system/etc/seccomp_policy(/.*)?        u:object_r:system_seccomp_policy_file:s0
 /system/etc/security/cacerts(/.*)?      u:object_r:system_security_cacerts_file:s0
 /system/etc/selinux/mapping/[0-9]+\.[0-9]+\.cil       u:object_r:sepolicy_file:s0
@@ -324,9 +342,11 @@
 /system/bin/watchdogd            u:object_r:watchdogd_exec:s0
 /system/bin/apexd                u:object_r:apexd_exec:s0
 /system/bin/gsid                 u:object_r:gsid_exec:s0
+/system/bin/simpleperf           u:object_r:simpleperf_exec:s0
 /system/bin/simpleperf_app_runner    u:object_r:simpleperf_app_runner_exec:s0
 /system/bin/notify_traceur\.sh       u:object_r:notify_traceur_exec:s0
 /system/bin/migrate_legacy_obb_data\.sh u:object_r:migrate_legacy_obb_data_exec:s0
+/system/bin/android\.frameworks\.automotive\.display@1\.0-service u:object_r:automotive_display_service_exec:s0
 
 #############################
 # Vendor files
@@ -351,11 +371,17 @@
 /(vendor|system/vendor)/overlay(/.*)?          u:object_r:vendor_overlay_file:s0
 /(vendor|system/vendor)/framework(/.*)?        u:object_r:vendor_framework_file:s0
 
-/vendor/bin/misc_writer                        u:object_r:vendor_misc_writer_exec:s0
+/(vendor|system/vendor)/apex(/[^/]+){0,2}                      u:object_r:vendor_apex_file:s0
+/(vendor|system/vendor)/bin/misc_writer                        u:object_r:vendor_misc_writer_exec:s0
+/(vendor|system/vendor)/bin/boringssl_self_test(32|64)         u:object_r:vendor_boringssl_self_test_exec:s0
 
 # HAL location
 /(vendor|system/vendor)/lib(64)?/hw            u:object_r:vendor_hal_file:s0
 
+/(vendor|system/vendor)/etc/selinux/(vendor|nonplat)_service_contexts u:object_r:nonplat_service_contexts_file:s0
+
+/(vendor|system/vendor)/bin/install-recovery\.sh u:object_r:vendor_install_recovery_exec:s0
+
 #############################
 # OEM and ODM files
 #
@@ -371,9 +397,9 @@
 /(odm|vendor/odm)/framework(/.*)?             u:object_r:vendor_framework_file:s0
 
 # Input configuration
-/(odm|vendor|vendor/odm)/usr/keylayout(/.*)?\.kl            u:object_r:vendor_keylayout_file:s0
-/(odm|vendor|vendor/odm)/usr/keychars(/.*)?\.kcm            u:object_r:vendor_keychars_file:s0
-/(odm|vendor|vendor/odm)/usr/idc(/.*)?\.idc                 u:object_r:vendor_idc_file:s0
+/(odm|vendor/odm|vendor|system/vendor)/usr/keylayout(/.*)?\.kl        u:object_r:vendor_keylayout_file:s0
+/(odm|vendor/odm|vendor|system/vendor)/usr/keychars(/.*)?\.kcm        u:object_r:vendor_keychars_file:s0
+/(odm|vendor/odm|vendor|system/vendor)/usr/idc(/.*)?\.idc             u:object_r:vendor_idc_file:s0
 
 /oem(/.*)?              u:object_r:oemfs:s0
 /oem/overlay(/.*)?      u:object_r:vendor_overlay_file:s0
@@ -394,6 +420,8 @@
 # Product files
 #
 /(product|system/product)(/.*)?                                 u:object_r:system_file:s0
+/(product|system/product)/etc/group                             u:object_r:system_group_file:s0
+/(product|system/product)/etc/passwd                            u:object_r:system_passwd_file:s0
 /(product|system/product)/overlay(/.*)?                         u:object_r:vendor_overlay_file:s0
 
 /(product|system/product)/etc/selinux/product_file_contexts      u:object_r:file_contexts_file:s0
@@ -403,11 +431,24 @@
 /(product|system/product)/etc/selinux/product_service_contexts   u:object_r:service_contexts_file:s0
 /(product|system/product)/etc/selinux/product_mac_permissions\.xml u:object_r:mac_perms_file:s0
 
+/(product|system/product)/lib(64)?(/.*)?                         u:object_r:system_lib_file:s0
+
 #############################
-# Product-Services files
+# SystemExt files
 #
-/(product_services|system/product_services)(/.*)?               u:object_r:system_file:s0
-/(product_services|system/product_services)/overlay(/.*)?       u:object_r:vendor_overlay_file:s0
+/(system_ext|system/system_ext)(/.*)?               u:object_r:system_file:s0
+/(system_ext|system/system_ext)/etc/group           u:object_r:system_group_file:s0
+/(system_ext|system/system_ext)/etc/passwd          u:object_r:system_passwd_file:s0
+/(system_ext|system/system_ext)/overlay(/.*)?       u:object_r:vendor_overlay_file:s0
+
+/(system_ext|system/system_ext)/etc/selinux/system_ext_file_contexts        u:object_r:file_contexts_file:s0
+/(system_ext|system/system_ext)/etc/selinux/system_ext_hwservice_contexts   u:object_r:hwservice_contexts_file:s0
+/(system_ext|system/system_ext)/etc/selinux/system_ext_property_contexts    u:object_r:property_contexts_file:s0
+/(system_ext|system/system_ext)/etc/selinux/system_ext_seapp_contexts       u:object_r:seapp_contexts_file:s0
+/(system_ext|system/system_ext)/etc/selinux/system_ext_service_contexts     u:object_r:service_contexts_file:s0
+/(system_ext|system/system_ext)/etc/selinux/system_ext_mac_permissions\.xml u:object_r:mac_perms_file:s0
+
+/(system_ext|system/system_ext)/bin/aidl_lazy_test_server   u:object_r:aidl_lazy_test_server_exec:s0
 
 #############################
 # Vendor files from /(product|system/product)/vendor_overlay
@@ -423,13 +464,14 @@
 # NOTE: When modifying existing label rules, changes may also need to
 # propagate to the "Expanded data files" section.
 #
-/data(/.*)?		u:object_r:system_data_file:s0
+/data		u:object_r:system_data_root_file:s0
+/data/(.*)?		u:object_r:system_data_file:s0
 /data/system/packages\.list u:object_r:packages_list_file:s0
-/data/.layout_version		u:object_r:install_data_file:s0
 /data/unencrypted(/.*)?         u:object_r:unencrypted_data_file:s0
 /data/backup(/.*)?		u:object_r:backup_data_file:s0
 /data/secure/backup(/.*)?	u:object_r:backup_data_file:s0
 /data/system/ndebugsocket	u:object_r:system_ndebug_socket:s0
+/data/system/unsolzygotesocket  u:object_r:system_unsolzygote_socket:s0
 /data/drm(/.*)?		u:object_r:drm_data_file:s0
 /data/resource-cache(/.*)? u:object_r:resourcecache_data_file:s0
 /data/dalvik-cache(/.*)? u:object_r:dalvikcache_data_file:s0
@@ -441,12 +483,16 @@
 /data/apex/active/(.*)?		u:object_r:staging_data_file:s0
 /data/apex/backup/(.*)?		u:object_r:staging_data_file:s0
 /data/app(/.*)?                       u:object_r:apk_data_file:s0
+# Traditional /data/app/[packageName]-[randomString]/base.apk location
 /data/app/[^/]+/oat(/.*)?                u:object_r:dalvikcache_data_file:s0
+# /data/app/[randomStringA]/[packageName]-[randomStringB]/base.apk layout
+/data/app/[^/]+/[^/]+/oat(/.*)?                u:object_r:dalvikcache_data_file:s0
 /data/app/vmdl[^/]+\.tmp(/.*)?           u:object_r:apk_tmp_file:s0
 /data/app/vmdl[^/]+\.tmp/oat(/.*)?           u:object_r:dalvikcache_data_file:s0
 /data/app-private(/.*)?               u:object_r:apk_private_data_file:s0
 /data/app-private/vmdl.*\.tmp(/.*)?   u:object_r:apk_private_tmp_file:s0
 /data/gsi(/.*)?        u:object_r:gsi_data_file:s0
+/data/gsi/ota(/.*)?    u:object_r:ota_image_data_file:s0
 /data/tombstones(/.*)?	u:object_r:tombstone_data_file:s0
 /data/vendor/tombstones/wifi(/.*)? u:object_r:tombstone_wifi_data_file:s0
 /data/local/tmp(/.*)?	u:object_r:shell_data_file:s0
@@ -467,6 +513,10 @@
 
 # Misc data
 /data/misc/adb(/.*)?            u:object_r:adb_keys_file:s0
+/data/misc/apexdata(/.*)?       u:object_r:apex_module_data_file:s0
+/data/misc/apexdata/com.android.permission(/.*)?    u:object_r:apex_permission_data_file:s0
+/data/misc/apexdata/com\.android\.wifi(/.*)?    u:object_r:apex_wifi_data_file:s0
+/data/misc/apexrollback(/.*)?   u:object_r:apex_rollback_data_file:s0
 /data/misc/apns(/.*)?           u:object_r:radio_data_file:s0
 /data/misc/audio(/.*)?          u:object_r:audio_data_file:s0
 /data/misc/audioserver(/.*)?    u:object_r:audioserver_data_file:s0
@@ -482,33 +532,39 @@
 /data/misc/carrierid(/.*)?      u:object_r:radio_data_file:s0
 /data/misc/dhcp(/.*)?           u:object_r:dhcp_data_file:s0
 /data/misc/dhcp-6\.8\.2(/.*)?     u:object_r:dhcp_data_file:s0
+/data/misc/emergencynumberdb(/.*)?     u:object_r:emergency_data_file:s0
 /data/misc/gatekeeper(/.*)?     u:object_r:gatekeeper_data_file:s0
 /data/misc/incidents(/.*)?	    u:object_r:incident_data_file:s0
+/data/misc/installd(/.*)?		u:object_r:install_data_file:s0
 /data/misc/keychain(/.*)?       u:object_r:keychain_data_file:s0
+/data/misc/credstore(/.*)?       u:object_r:credstore_data_file:s0
 /data/misc/keystore(/.*)?       u:object_r:keystore_data_file:s0
 /data/misc/logd(/.*)?           u:object_r:misc_logd_file:s0
 /data/misc/media(/.*)?          u:object_r:media_data_file:s0
 /data/misc/net(/.*)?            u:object_r:net_data_file:s0
 /data/misc/network_watchlist(/.*)? u:object_r:network_watchlist_data_file:s0
 /data/misc/perfetto-traces(/.*)? u:object_r:perfetto_traces_data_file:s0
+/data/misc/prereboot(/.*)?      u:object_r:prereboot_data_file:s0
 /data/misc/recovery(/.*)?       u:object_r:recovery_data_file:s0
 /data/misc/shared_relro(/.*)?   u:object_r:shared_relro_file:s0
 /data/misc/sms(/.*)?            u:object_r:radio_data_file:s0
+/data/misc/snapshotctl_log(/.*)?      u:object_r:snapshotctl_log_data_file:s0
 /data/misc/stats-active-metric(/.*)? u:object_r:stats_data_file:s0
 /data/misc/stats-data(/.*)?     u:object_r:stats_data_file:s0
 /data/misc/stats-service(/.*)?  u:object_r:stats_data_file:s0
+/data/misc/stats-metadata(/.*)? u:object_r:stats_data_file:s0
 /data/misc/systemkeys(/.*)?     u:object_r:systemkeys_data_file:s0
 /data/misc/textclassifier(/.*)?       u:object_r:textclassifier_data_file:s0
 /data/misc/train-info(/.*)?     u:object_r:stats_data_file:s0
 /data/misc/user(/.*)?           u:object_r:misc_user_data_file:s0
 /data/misc/vpn(/.*)?            u:object_r:vpn_data_file:s0
 /data/misc/wifi(/.*)?           u:object_r:wifi_data_file:s0
+/data/misc_ce/[0-9]+/wifi(/.*)? u:object_r:wifi_data_file:s0
 /data/misc/wifi/sockets(/.*)?   u:object_r:wpa_socket:s0
 /data/misc/wifi/sockets/wpa_ctrl.*   u:object_r:system_wpa_socket:s0
 /data/misc/zoneinfo(/.*)?       u:object_r:zoneinfo_data_file:s0
 /data/misc/vold(/.*)?           u:object_r:vold_data_file:s0
 /data/misc/iorapd(/.*)?         u:object_r:iorapd_data_file:s0
-/data/misc/perfprofd(/.*)?      u:object_r:perfprofd_data_file:s0
 /data/misc/update_engine(/.*)?  u:object_r:update_engine_data_file:s0
 /data/misc/update_engine_log(/.*)?  u:object_r:update_engine_log_data_file:s0
 /data/system/dropbox(/.*)?      u:object_r:dropbox_data_file:s0
@@ -548,6 +604,23 @@
 /data/misc_de/[0-9]+/rollback(/.*)?       u:object_r:rollback_data_file:s0
 /data/misc_ce/[0-9]+/rollback(/.*)?       u:object_r:rollback_data_file:s0
 
+# Apex data directories
+/data/misc_de/[0-9]+/apexdata(/.*)?       u:object_r:apex_module_data_file:s0
+/data/misc_ce/[0-9]+/apexdata(/.*)?       u:object_r:apex_module_data_file:s0
+/data/misc_de/[0-9]+/apexdata/com.android.permission(/.*)?  u:object_r:apex_permission_data_file:s0
+/data/misc_ce/[0-9]+/apexdata/com.android.permission(/.*)?  u:object_r:apex_permission_data_file:s0
+/data/misc_de/[0-9]+/apexdata/com\.android\.wifi(/.*)?  u:object_r:apex_wifi_data_file:s0
+/data/misc_ce/[0-9]+/apexdata/com\.android\.wifi(/.*)?  u:object_r:apex_wifi_data_file:s0
+
+# Apex rollback directories
+/data/misc_de/[0-9]+/apexrollback(/.*)?   u:object_r:apex_rollback_data_file:s0
+/data/misc_ce/[0-9]+/apexrollback(/.*)?   u:object_r:apex_rollback_data_file:s0
+
+# Incremental directories
+/data/incremental(/.*)?                                 u:object_r:apk_data_file:s0
+/data/incremental/MT_[^/]+/mount/.pending_reads         u:object_r:incremental_control_file:s0
+/data/incremental/MT_[^/]+/mount/.log                   u:object_r:incremental_control_file:s0
+
 #############################
 # Expanded data files
 #
@@ -555,6 +628,8 @@
 /mnt/expand/[^/]+(/.*)?                             u:object_r:system_data_file:s0
 /mnt/expand/[^/]+/app(/.*)?                         u:object_r:apk_data_file:s0
 /mnt/expand/[^/]+/app/[^/]+/oat(/.*)?               u:object_r:dalvikcache_data_file:s0
+# /mnt/expand/..../app/[randomStringA]/[packageName]-[randomStringB]/base.apk layout
+/mnt/expand/[^/]+/app/[^/]+/[^/]+/oat(/.*)?        u:object_r:dalvikcache_data_file:s0
 /mnt/expand/[^/]+/app/vmdl[^/]+\.tmp(/.*)?          u:object_r:apk_tmp_file:s0
 /mnt/expand/[^/]+/app/vmdl[^/]+\.tmp/oat(/.*)?      u:object_r:dalvikcache_data_file:s0
 /mnt/expand/[^/]+/local/tmp(/.*)?                   u:object_r:shell_data_file:s0
@@ -627,7 +702,10 @@
 /metadata/apex(/.*)?      u:object_r:apex_metadata_file:s0
 /metadata/vold(/.*)?      u:object_r:vold_metadata_file:s0
 /metadata/gsi(/.*)?       u:object_r:gsi_metadata_file:s0
+/metadata/gsi/ota(/.*)?   u:object_r:ota_metadata_file:s0
 /metadata/password_slots(/.*)?    u:object_r:password_slot_metadata_file:s0
+/metadata/ota(/.*)?       u:object_r:ota_metadata_file:s0
+/metadata/bootstat(/.*)?  u:object_r:metadata_bootstat_file:s0
 
 #############################
 # asec containers
@@ -640,6 +718,8 @@
 # external storage
 /mnt/media_rw(/.*)?         u:object_r:mnt_media_rw_file:s0
 /mnt/user(/.*)?             u:object_r:mnt_user_file:s0
+/mnt/pass_through(/.*)?     u:object_r:mnt_pass_through_file:s0
+/mnt/sdcard                 u:object_r:mnt_sdcard_file:s0
 /mnt/runtime(/.*)?          u:object_r:storage_file:s0
 /storage(/.*)?              u:object_r:storage_file:s0
 
diff --git a/private/file_contexts_asan b/private/file_contexts_asan
index bd841a3..b37f086 100644
--- a/private/file_contexts_asan
+++ b/private/file_contexts_asan
@@ -4,6 +4,8 @@
 /data/asan/vendor/lib64(/.*)?              u:object_r:system_lib_file:s0
 /data/asan/odm/lib(/.*)?                   u:object_r:system_lib_file:s0
 /data/asan/odm/lib64(/.*)?                 u:object_r:system_lib_file:s0
+/data/asan/product/lib(/.*)?               u:object_r:system_lib_file:s0
+/data/asan/product/lib64(/.*)?             u:object_r:system_lib_file:s0
 /system/asan.options           u:object_r:system_asan_options_file:s0
 /system/bin/asan_extract       u:object_r:asan_extract_exec:s0
 /system/bin/asanwrapper        u:object_r:asanwrapper_exec:s0
diff --git a/private/fs_use b/private/fs_use
index 1964348..6fcc2cc 100644
--- a/private/fs_use
+++ b/private/fs_use
@@ -10,6 +10,7 @@
 fs_use_xattr squashfs u:object_r:labeledfs:s0;
 fs_use_xattr overlay u:object_r:labeledfs:s0;
 fs_use_xattr erofs u:object_r:labeledfs:s0;
+fs_use_xattr incremental-fs u:object_r:labeledfs:s0;
 
 # Label inodes from task label.
 fs_use_task pipefs u:object_r:pipefs:s0;
diff --git a/private/fsverity_init.te b/private/fsverity_init.te
index c6a5edd..2559525 100644
--- a/private/fsverity_init.te
+++ b/private/fsverity_init.te
@@ -3,9 +3,10 @@
 
 init_daemon_domain(fsverity_init)
 
-# Allow this shell script to run and execute toybox
-allow fsverity_init shell_exec:file rx_file_perms;
-allow fsverity_init toolbox_exec:file rx_file_perms;
+# Allow to retrieve keys from keystore.
+binder_use(fsverity_init)
+use_keystore(fsverity_init)
+allow fsverity_init keystore:keystore_key { list get };
 
 # Allow to read /proc/keys for searching key id.
 allow fsverity_init proc_keys:file r_file_perms;
diff --git a/private/genfs_contexts b/private/genfs_contexts
index d2819b1..828929f 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -13,6 +13,7 @@
 genfscon proc /keys u:object_r:proc_keys:s0
 genfscon proc /kmsg u:object_r:proc_kmsg:s0
 genfscon proc /loadavg u:object_r:proc_loadavg:s0
+genfscon proc /lowmemorykiller u:object_r:proc_lowmemorykiller:s0
 genfscon proc /meminfo u:object_r:proc_meminfo:s0
 genfscon proc /misc u:object_r:proc_misc:s0
 genfscon proc /modules u:object_r:proc_modules:s0
@@ -32,6 +33,7 @@
 genfscon proc /stat u:object_r:proc_stat:s0
 genfscon proc /swaps u:object_r:proc_swaps:s0
 genfscon proc /sysrq-trigger u:object_r:proc_sysrq:s0
+genfscon proc /kpageflags u:object_r:proc_kpageflags:s0
 genfscon proc /sys/abi/swp u:object_r:proc_abi:s0
 genfscon proc /sys/fs/pipe-max-size u:object_r:proc_pipe_conf:s0
 genfscon proc /sys/fs/protected_hardlinks u:object_r:proc_security:s0
@@ -113,6 +115,7 @@
 genfscon sysfs /class/rfkill/rfkill3/state        u:object_r:sysfs_bluetooth_writable:s0
 genfscon sysfs /class/rtc                         u:object_r:sysfs_rtc:s0
 genfscon sysfs /class/switch                      u:object_r:sysfs_switch:s0
+genfscon sysfs /class/wakeup                      u:object_r:sysfs_wakeup:s0
 genfscon sysfs /devices/platform/nfc-power/nfc_power u:object_r:sysfs_nfc_power_writable:s0
 genfscon sysfs /devices/virtual/android_usb     u:object_r:sysfs_android_usb:s0
 genfscon sysfs /devices/virtual/block/            u:object_r:sysfs_devices_block:s0
@@ -125,20 +128,24 @@
 genfscon sysfs /devices/virtual/misc/hw_random    u:object_r:sysfs_hwrandom:s0
 genfscon sysfs /devices/virtual/net             u:object_r:sysfs_net:s0
 genfscon sysfs /devices/virtual/switch          u:object_r:sysfs_switch:s0
+genfscon sysfs /devices/virtual/wakeup          u:object_r:sysfs_wakeup:s0
 genfscon sysfs /firmware/devicetree/base/firmware/android u:object_r:sysfs_dt_firmware_android:s0
 genfscon sysfs /fs/ext4/features                  u:object_r:sysfs_fs_ext4_features:s0
 genfscon sysfs /fs/f2fs                           u:object_r:sysfs_fs_f2fs:s0
 genfscon sysfs /power/autosleep u:object_r:sysfs_power:s0
 genfscon sysfs /power/state u:object_r:sysfs_power:s0
+genfscon sysfs /power/suspend_stats u:object_r:sysfs_suspend_stats:s0
 genfscon sysfs /power/wakeup_count u:object_r:sysfs_power:s0
 genfscon sysfs /power/wake_lock u:object_r:sysfs_wake_lock:s0
 genfscon sysfs /power/wake_unlock u:object_r:sysfs_wake_lock:s0
 genfscon sysfs /kernel/memory_state_time u:object_r:sysfs_power:s0
+genfscon sysfs /kernel/ion u:object_r:sysfs_ion:s0
 genfscon sysfs /kernel/ipv4 u:object_r:sysfs_ipv4:s0
 genfscon sysfs /kernel/mm/transparent_hugepage u:object_r:sysfs_transparent_hugepage:s0
 genfscon sysfs /kernel/notes u:object_r:sysfs_kernel_notes:s0
 genfscon sysfs /kernel/uevent_helper u:object_r:sysfs_usermodehelper:s0
 genfscon sysfs /kernel/wakeup_reasons u:object_r:sysfs_wakeup_reasons:s0
+genfscon sysfs /module/dm_verity/parameters/prefetch_cluster u:object_r:sysfs_dm_verity:s0
 genfscon sysfs /module/lowmemorykiller u:object_r:sysfs_lowmemorykiller:s0
 genfscon sysfs /module/tcp_cubic/parameters u:object_r:sysfs_net:s0
 genfscon sysfs /module/wlan/parameters/fwpath u:object_r:sysfs_wlan_fwpath:s0
@@ -284,9 +291,17 @@
 
 genfscon debugfs /kcov								 u:object_r:debugfs_kcov:s0
 
+genfscon securityfs / u:object_r:securityfs:s0
+
+genfscon binder /binder u:object_r:binder_device:s0
+genfscon binder /hwbinder u:object_r:hwbinder_device:s0
+genfscon binder /vndbinder u:object_r:vndbinder_device:s0
+genfscon binder /binder_logs u:object_r:binderfs_logs:s0
+genfscon binder /binder_logs/proc u:object_r:binderfs_logs_proc:s0
 
 genfscon inotifyfs / u:object_r:inotify:s0
 genfscon vfat / u:object_r:vfat:s0
+genfscon binder / u:object_r:binderfs:s0
 genfscon exfat / u:object_r:exfat:s0
 genfscon debugfs / u:object_r:debugfs:s0
 genfscon fuse / u:object_r:fuse:s0
diff --git a/private/gmscore_app.te b/private/gmscore_app.te
new file mode 100644
index 0000000..2355326
--- /dev/null
+++ b/private/gmscore_app.te
@@ -0,0 +1,129 @@
+###
+### A domain for further sandboxing the PrebuiltGMSCore app.
+###
+typeattribute gmscore_app coredomain;
+
+app_domain(gmscore_app)
+
+allow gmscore_app sysfs_type:dir search;
+# Read access to /sys/class/net/wlan*/address
+r_dir_file(gmscore_app, sysfs_net)
+# Read access to /sys/block/zram*/mm_stat
+r_dir_file(gmscore_app, sysfs_zram)
+
+r_dir_file(gmscore_app, rootfs)
+
+# Allow GMS core to open kernel config for OTA matching through libvintf
+allow gmscore_app config_gz:file { open read getattr };
+
+# Allow GMS core to communicate with update_engine for A/B update.
+binder_call(gmscore_app, update_engine)
+allow gmscore_app update_engine_service:service_manager find;
+
+# Allow GMS core to communicate with dumpsys storaged.
+binder_call(gmscore_app, storaged)
+allow gmscore_app storaged_service:service_manager find;
+
+# Allow GMS core to access system_update_service (e.g. to publish pending
+# system update info).
+allow gmscore_app system_update_service:service_manager find;
+
+# Allow GMS core to communicate with statsd.
+binder_call(gmscore_app, statsd)
+
+# Allow GMS core to generate unique hardware IDs
+allow gmscore_app keystore:keystore_key gen_unique_id;
+
+# Allow GMS core to access /sys/fs/selinux/policyvers for compatibility check
+allow gmscore_app selinuxfs:file r_file_perms;
+
+# suppress denials for non-API accesses.
+dontaudit gmscore_app exec_type:file r_file_perms;
+dontaudit gmscore_app device:dir r_dir_perms;
+dontaudit gmscore_app fs_bpf:dir r_dir_perms;
+dontaudit gmscore_app net_dns_prop:file r_file_perms;
+dontaudit gmscore_app proc:file r_file_perms;
+dontaudit gmscore_app proc_interrupts:file r_file_perms;
+dontaudit gmscore_app proc_modules:file r_file_perms;
+dontaudit gmscore_app proc_net:file r_file_perms;
+dontaudit gmscore_app proc_stat:file r_file_perms;
+dontaudit gmscore_app proc_version:file r_file_perms;
+dontaudit gmscore_app sysfs:dir r_dir_perms;
+dontaudit gmscore_app sysfs:file r_file_perms;
+dontaudit gmscore_app sysfs_android_usb:file r_file_perms;
+dontaudit gmscore_app sysfs_dm:file r_file_perms;
+dontaudit gmscore_app sysfs_loop:file r_file_perms;
+dontaudit gmscore_app wifi_prop:file r_file_perms;
+dontaudit gmscore_app { wifi_prop exported_wifi_prop }:file r_file_perms;
+dontaudit gmscore_app mirror_data_file:dir search;
+dontaudit gmscore_app mnt_vendor_file:dir search;
+
+# Access the network
+net_domain(gmscore_app)
+
+# webview crash handling depends on self ptrace (b/27697529, b/20150694, b/19277529#comment7)
+allow gmscore_app self:process ptrace;
+
+# Allow loading executable code from writable priv-app home
+# directories. This is a W^X violation, however, it needs
+# to be supported for now for the following reasons.
+# * /data/user_*/0/*/code_cache/* POSSIBLE uses (b/117841367)
+#   1) com.android.opengl.shaders_cache
+#   2) com.android.skia.shaders_cache
+#   3) com.android.renderscript.cache
+# * /data/user_de/0/com.google.android.gms/app_chimera
+# TODO: Tighten (b/112357170)
+allow gmscore_app privapp_data_file:file execute;
+
+allow gmscore_app privapp_data_file:lnk_file create_file_perms;
+
+# /proc access
+allow gmscore_app proc_vmstat:file r_file_perms;
+
+# Allow interaction with gpuservice
+binder_call(gmscore_app, gpuservice)
+allow gmscore_app gpu_service:service_manager find;
+
+# find services that expose both @SystemAPI and normal APIs.
+allow gmscore_app app_api_service:service_manager find;
+allow gmscore_app system_api_service:service_manager find;
+allow gmscore_app audioserver_service:service_manager find;
+allow gmscore_app cameraserver_service:service_manager find;
+allow gmscore_app drmserver_service:service_manager find;
+allow gmscore_app mediadrmserver_service:service_manager find;
+allow gmscore_app mediaextractor_service:service_manager find;
+allow gmscore_app mediametrics_service:service_manager find;
+allow gmscore_app mediaserver_service:service_manager find;
+allow gmscore_app network_watchlist_service:service_manager find;
+allow gmscore_app nfc_service:service_manager find;
+allow gmscore_app oem_lock_service:service_manager find;
+allow gmscore_app persistent_data_block_service:service_manager find;
+allow gmscore_app radio_service:service_manager find;
+allow gmscore_app recovery_service:service_manager find;
+allow gmscore_app stats_service:service_manager find;
+
+# Used by Finsky / Android "Verify Apps" functionality when
+# running "adb install foo.apk".
+allow gmscore_app shell_data_file:file r_file_perms;
+allow gmscore_app shell_data_file:dir r_dir_perms;
+
+# Write to /cache.
+allow gmscore_app { cache_file cache_recovery_file }:dir create_dir_perms;
+allow gmscore_app { cache_file cache_recovery_file }:file create_file_perms;
+# /cache is a symlink to /data/cache on some devices. Allow reading the link.
+allow gmscore_app cache_file:lnk_file r_file_perms;
+
+# Write to /data/ota_package for OTA packages.
+allow gmscore_app ota_package_file:dir rw_dir_perms;
+allow gmscore_app ota_package_file:file create_file_perms;
+
+# Used by Finsky / Android "Verify Apps" functionality when
+# running "adb install foo.apk".
+allow gmscore_app shell_data_file:file r_file_perms;
+allow gmscore_app shell_data_file:dir r_dir_perms;
+
+# b/18504118: Allow reads from /data/anr/traces.txt
+allow gmscore_app anr_data_file:file r_file_perms;
+
+# b/148974132: com.android.vending needs this
+allow gmscore_app priv_app:tcp_socket { read write };
diff --git a/private/gpuservice.te b/private/gpuservice.te
index 9e17d06..a4d84ea 100644
--- a/private/gpuservice.te
+++ b/private/gpuservice.te
@@ -6,6 +6,7 @@
 
 binder_call(gpuservice, adbd)
 binder_call(gpuservice, shell)
+binder_call(gpuservice, system_server)
 binder_use(gpuservice)
 
 # Access the GPU.
@@ -35,6 +36,12 @@
 allow gpuservice dumpstate:fd use;
 allow gpuservice dumpstate:fifo_file write;
 
+# Needed for stats callback registration to statsd.
+allow gpuservice stats_service:service_manager find;
+allow gpuservice statsmanager_service:service_manager find;
+# TODO(b/146461633): remove this once native pullers talk to StatsManagerService
+binder_call(gpuservice, statsd);
+
 add_service(gpuservice, gpu_service)
 
 # Only uncomment below line when in development
diff --git a/private/gsid.te b/private/gsid.te
index 1a35a4b..3ff9d67 100644
--- a/private/gsid.te
+++ b/private/gsid.te
@@ -17,10 +17,28 @@
 allow gsid self:global_capability_class_set sys_admin;
 dontaudit gsid self:global_capability_class_set dac_override;
 
+# On FBE devices (not using dm-default-key), gsid will use loop devices to map
+# images rather than device-mapper.
+allow gsid loop_control_device:chr_file rw_file_perms;
+allow gsid loop_device:blk_file rw_file_perms;
+allowxperm gsid loop_device:blk_file ioctl {
+  LOOP_GET_STATUS64
+  LOOP_SET_STATUS64
+  LOOP_SET_FD
+  LOOP_SET_BLOCK_SIZE
+  LOOP_SET_DIRECT_IO
+  LOOP_CLR_FD
+  BLKFLSBUF
+};
+
 # libfiemap_writer uses sysfs to derive the bottom of a device-mapper stacking.
 # This requires traversing /sys/block/dm-N/slaves/* and reading the list of
 # file names.
-allow gsid sysfs_dm:dir r_dir_perms;
+r_dir_file(gsid, sysfs_dm)
+
+# libfiemap_writer needs to read /sys/fs/f2fs/<dev>/features to determine
+# whether pin_file support is enabled.
+r_dir_file(gsid, sysfs_fs_f2fs)
 
 # Needed to read fstab, which is used to validate that system verity does not
 # use check_once_at_most for sdcard installs. (Note: proc_cmdline is needed
@@ -56,7 +74,14 @@
 # Needed when running gsi_tool through "su root" rather than adb root.
 allow gsid adbd:unix_stream_socket rw_socket_perms;
 
-neverallow { domain -gsid -init } gsid_prop:property_service set;
+neverallow {
+  domain
+  -gsid
+  -init
+  -update_engine_common
+  -recovery
+  -fastbootd
+} gsid_prop:property_service set;
 
 # gsid needs to store images on /data, but cannot use file I/O. If it did, the
 # underlying blocks would be encrypted, and we couldn't mount the GSI image in
@@ -83,19 +108,41 @@
 #   booted         - An empty file that, if exists, indicates that a GSI is
 #                    currently running.
 #
-allow gsid metadata_file:dir search;
-allow gsid gsi_metadata_file:dir rw_dir_perms;
-allow gsid gsi_metadata_file:file create_file_perms;
+allow gsid metadata_file:dir { search getattr };
+allow gsid {
+    gsi_metadata_file
+}:dir create_dir_perms;
 
-allow gsid gsi_data_file:dir rw_dir_perms;
-allow gsid gsi_data_file:file create_file_perms;
-allowxperm gsid gsi_data_file:file ioctl FS_IOC_FIEMAP;
+allow gsid {
+    ota_metadata_file
+}:dir rw_dir_perms;
+
+allow gsid {
+    gsi_metadata_file
+    ota_metadata_file
+}:file create_file_perms;
+
+allow gsid {
+      gsi_data_file
+      ota_image_data_file
+}:dir rw_dir_perms;
+allow gsid {
+      gsi_data_file
+      ota_image_data_file
+}:file create_file_perms;
+allowxperm gsid {
+      gsi_data_file
+      ota_image_data_file
+}:file ioctl FS_IOC_FIEMAP;
+
+allow gsid system_server:binder call;
 
 neverallow {
     domain
     -init
     -gsid
     -fastbootd
+    -recovery
     -vold
 } gsi_metadata_file:dir *;
 
diff --git a/private/hal_allocator_default.te b/private/hal_allocator_default.te
index 9dbe923..7aa28aa 100644
--- a/private/hal_allocator_default.te
+++ b/private/hal_allocator_default.te
@@ -3,6 +3,3 @@
 
 type hal_allocator_default_exec, system_file_type, exec_type, file_type;
 init_daemon_domain(hal_allocator_default)
-
-# To talk to ashmemd
-binder_use(hal_allocator_default)
diff --git a/private/heapprofd.te b/private/heapprofd.te
index 5330c58..ec3e4d0 100644
--- a/private/heapprofd.te
+++ b/private/heapprofd.te
@@ -35,9 +35,7 @@
 
 # Write trace data to the Perfetto traced daemon. This requires connecting to
 # its producer socket and obtaining a (per-process) tmpfs fd.
-allow heapprofd traced:fd use;
-allow heapprofd traced_tmpfs:file { read write getattr map };
-unix_socket_connect(heapprofd, traced_producer, traced)
+perfetto_producer(heapprofd)
 
 # When handling profiling for all processes, heapprofd needs to read
 # executables/libraries/etc to do stack unwinding.
@@ -50,6 +48,8 @@
   # Some dex files are not world-readable.
   # We are still constrained by the SELinux rules above.
   allow heapprofd self:global_capability_class_set dac_read_search;
+
+  allow heapprofd proc_kpageflags:file r_file_perms;
 ')
 
 # This is going to happen on user but is benign because central heapprofd
diff --git a/private/hwservice_contexts b/private/hwservice_contexts
index f3745a3..6f92556 100644
--- a/private/hwservice_contexts
+++ b/private/hwservice_contexts
@@ -1,3 +1,4 @@
+android.frameworks.automotive.display::IAutomotiveDisplayProxyService u:object_r:fwk_automotive_display_hwservice:s0
 android.frameworks.bufferhub::IBufferHub                        u:object_r:fwk_bufferhub_hwservice:s0
 android.frameworks.cameraservice.service::ICameraService        u:object_r:fwk_camera_hwservice:s0
 android.frameworks.displayservice::IDisplayService              u:object_r:fwk_display_hwservice:s0
@@ -9,6 +10,8 @@
 android.hardware.audio::IDevicesFactory                         u:object_r:hal_audio_hwservice:s0
 android.hardware.authsecret::IAuthSecret                        u:object_r:hal_authsecret_hwservice:s0
 android.hardware.automotive.audiocontrol::IAudioControl         u:object_r:hal_audiocontrol_hwservice:s0
+android.hardware.automotive.can::ICanController                 u:object_r:hal_can_controller_hwservice:s0
+android.hardware.automotive.can::ICanBus                        u:object_r:hal_can_bus_hwservice:s0
 android.hardware.automotive.evs::IEvsEnumerator                 u:object_r:hal_evs_hwservice:s0
 android.hardware.automotive.vehicle::IVehicle                   u:object_r:hal_vehicle_hwservice:s0
 android.hardware.biometrics.face::IBiometricsFace               u:object_r:hal_face_hwservice:s0
@@ -62,6 +65,7 @@
 android.hardware.thermal::IThermalCallback                      u:object_r:thermalcallback_hwservice:s0
 android.hardware.tv.cec::IHdmiCec                               u:object_r:hal_tv_cec_hwservice:s0
 android.hardware.tv.input::ITvInput                             u:object_r:hal_tv_input_hwservice:s0
+android.hardware.tv.tuner::ITuner                             	u:object_r:hal_tv_tuner_hwservice:s0
 android.hardware.usb::IUsb                                      u:object_r:hal_usb_hwservice:s0
 android.hardware.usb.gadget::IUsbGadget                         u:object_r:hal_usb_gadget_hwservice:s0
 android.hardware.vibrator::IVibrator                            u:object_r:hal_vibrator_hwservice:s0
@@ -69,7 +73,6 @@
 android.hardware.weaver::IWeaver                                u:object_r:hal_weaver_hwservice:s0
 android.hardware.wifi::IWifi                                    u:object_r:hal_wifi_hwservice:s0
 android.hardware.wifi.hostapd::IHostapd                         u:object_r:hal_wifi_hostapd_hwservice:s0
-android.hardware.wifi.offload::IOffload                         u:object_r:hal_wifi_offload_hwservice:s0
 android.hardware.wifi.supplicant::ISupplicant                   u:object_r:hal_wifi_supplicant_hwservice:s0
 android.hidl.allocator::IAllocator                              u:object_r:hidl_allocator_hwservice:s0
 android.hidl.base::IBase                                        u:object_r:hidl_base_hwservice:s0
diff --git a/private/incident.te b/private/incident.te
index 98101e0..db9ae86 100644
--- a/private/incident.te
+++ b/private/incident.te
@@ -4,10 +4,17 @@
 
 # switch to incident domain for incident command
 domain_auto_trans(shell, incident_exec, incident)
+domain_auto_trans(dumpstate, incident_exec, incident)
 
 # allow incident access to stdout from its parent shell.
 allow incident shell:fd use;
 
+# allow incident to communicate with dumpstate, and write incident report to
+# /data/data/com.android.shell/files/bugreports/tmp_incident_report
+allow incident dumpstate:fd use;
+allow incident dumpstate:unix_stream_socket { read write };
+allow incident shell_data_file:file write;
+
 # allow incident be able to output data for CTS to fetch.
 allow incident devpts:chr_file { read write };
 
@@ -26,5 +33,5 @@
 binder_call(incident, incidentd)
 allow incident incidentd:fifo_file write;
 
-# only allow incident being called by shell
-neverallow { domain -su -shell -incident } incident_exec:file { execute execute_no_trans };
+# only allow incident being called by shell or dumpstate
+neverallow { domain -su -shell -incident -dumpstate} incident_exec:file { execute execute_no_trans };
diff --git a/private/incidentd.te b/private/incidentd.te
index 0c57f0f..8924d83 100644
--- a/private/incidentd.te
+++ b/private/incidentd.te
@@ -128,10 +128,25 @@
 # Run a shell.
 allow incidentd shell_exec:file rx_file_perms;
 
+# For running am, incident-helper-cmd and similar framework commands.
+# Run /system/bin/app_process.
+allow incidentd zygote_exec:file { rx_file_perms };
+# Access the runtime feature flag properties.
+get_prop(incidentd, device_config_runtime_native_prop)
+get_prop(incidentd, device_config_runtime_native_boot_prop)
+# ART locks profile files.
+allow incidentd system_file:file lock;
+# Incidentd should never exec from the memory (e.g. JIT cache). These denials are expected.
+dontaudit incidentd dalvikcache_data_file:dir r_dir_perms;
+dontaudit incidentd tmpfs:file rwx_file_perms;
+
 # logd access - work to be done is a PII safe log (possibly an event log?)
 userdebug_or_eng(`read_logd(incidentd)')
 # TODO control_logd(incidentd)
 
+# Access /data/misc/logd
+r_dir_file(incidentd, misc_logd_file)
+
 # Allow incidentd to find these standard groups of services.
 # Others can be whitelisted individually.
 allow incidentd {
@@ -150,6 +165,12 @@
 # Allow incident to call back to incident with status updates.
 binder_call(incidentd, incident)
 
+# Read device serial number from system properties
+# This is used to track reports from lab testing devices
+userdebug_or_eng(`
+  get_prop(incidentd, serialno_prop)
+')
+
 ###
 ### neverallow rules
 ###
@@ -162,6 +183,7 @@
   -incident
   -incidentd
   userdebug_or_eng(`-perfetto')
+  -permissioncontroller_app
   -priv_app
   -statsd
   -system_app
diff --git a/private/init.te b/private/init.te
index 374b207..b0e7f80 100644
--- a/private/init.te
+++ b/private/init.te
@@ -15,6 +15,7 @@
   domain_trans(init, rootfs, charger)
   domain_trans(init, rootfs, fastbootd)
   domain_trans(init, rootfs, recovery)
+  domain_trans(init, rootfs, linkerconfig)
 ')
 domain_trans(init, shell_exec, shell)
 domain_trans(init, init_exec, ueventd)
@@ -30,5 +31,30 @@
   allow init su:process { siginh rlimitinh };
 ')
 
+# Allow init to figure out name of dm-device from it's /dev/block/dm-XX path.
+# This is useful in case of remounting ext4 userdata into checkpointing mode,
+# since it potentially requires tearing down dm-devices (e.g. dm-bow, dm-crypto)
+# that userdata is mounted onto.
+allow init sysfs_dm:file read;
+
 # Allow the BoringSSL self test to request a reboot upon failure
 set_prop(init, powerctl_prop)
+
+# Only init is allowed to set userspace reboot related properties.
+set_prop(init, userspace_reboot_exported_prop)
+neverallow { domain -init } userspace_reboot_exported_prop:property_service set;
+
+# Second-stage init performs a test for whether the kernel has SELinux hooks
+# for the perf_event_open() syscall. This is done by testing for the syscall
+# outcomes corresponding to this policy.
+# TODO(b/137092007): this can be removed once the platform stops supporting
+# kernels that precede the perf_event_open hooks (Android common kernels 4.4
+# and 4.9).
+allow init self:perf_event { open cpu };
+neverallow init self:perf_event { kernel tracepoint read write };
+dontaudit init self:perf_event { kernel tracepoint read write };
+
+# Only init is allowed to set the sysprop indicating whether perf_event_open()
+# SELinux hooks were detected.
+set_prop(init, init_perf_lsm_hooks_prop)
+neverallow { domain -init } init_perf_lsm_hooks_prop:property_service set;
diff --git a/private/install_recovery.te b/private/install_recovery.te
deleted file mode 100644
index b79d683..0000000
--- a/private/install_recovery.te
+++ /dev/null
@@ -1,3 +0,0 @@
-typeattribute install_recovery coredomain;
-
-init_daemon_domain(install_recovery)
diff --git a/private/installd.te b/private/installd.te
index b9e67ae..c89ba8b 100644
--- a/private/installd.te
+++ b/private/installd.te
@@ -2,6 +2,10 @@
 
 init_daemon_domain(installd)
 
+# Run migrate_legacy_obb_data.sh in its own sandbox.
+domain_auto_trans(installd, migrate_legacy_obb_data_exec, migrate_legacy_obb_data)
+allow installd shell_exec:file rx_file_perms;
+
 # Run dex2oat in its own sandbox.
 domain_auto_trans(installd, dex2oat_exec, dex2oat)
 
@@ -17,13 +21,6 @@
 # Run idmap in its own sandbox.
 domain_auto_trans(installd, idmap_exec, idmap)
 
-# Run migrate_legacy_obb_data.sh in its own sandbox.
-domain_auto_trans(installd, migrate_legacy_obb_data_exec, migrate_legacy_obb_data)
-allow installd shell_exec:file rx_file_perms;
-
-# Create /data/.layout_version.* file
-type_transition installd system_data_file:file install_data_file;
-
 # For collecting bugreports.
 allow installd dumpstate:fd use;
 allow installd dumpstate:fifo_file r_file_perms;
@@ -40,6 +37,9 @@
 get_prop(installd, device_config_runtime_native_prop)
 get_prop(installd, device_config_runtime_native_boot_prop)
 
+# Allow installd to access apk verity feature flag (for legacy case).
+get_prop(installd, apk_verity_prop)
+
 # Allow installd to delete files in /data/staging
 allow installd staging_data_file:file unlink;
 allow installd staging_data_file:dir { open read remove_name rmdir search write };
diff --git a/private/iorap_inode2filename.te b/private/iorap_inode2filename.te
new file mode 100644
index 0000000..96b7bc2
--- /dev/null
+++ b/private/iorap_inode2filename.te
@@ -0,0 +1,9 @@
+typeattribute iorap_inode2filename coredomain;
+
+# Grant access to open most of the files under /
+allow iorap_inode2filename dalvikcache_data_file:dir { getattr open read search };
+allow iorap_inode2filename dalvikcache_data_file:file { getattr };
+allow iorap_inode2filename dex2oat_exec:lnk_file { getattr open read };
+allow iorap_inode2filename dexoptanalyzer_exec:file { getattr };
+allow iorap_inode2filename storaged_data_file:dir { getattr open read search };
+allow iorap_inode2filename storaged_data_file:file { getattr };
diff --git a/private/iorap_prefecherd.te b/private/iorap_prefecherd.te
new file mode 100644
index 0000000..9ddb512
--- /dev/null
+++ b/private/iorap_prefecherd.te
@@ -0,0 +1,4 @@
+typeattribute iorap_prefetcherd coredomain;
+
+init_daemon_domain(iorap_prefetcherd)
+tmpfs_domain(iorap_prefetcherd)
diff --git a/private/iorapd.te b/private/iorapd.te
index 91f4ddc..73acec9 100644
--- a/private/iorapd.te
+++ b/private/iorapd.te
@@ -2,3 +2,9 @@
 
 init_daemon_domain(iorapd)
 tmpfs_domain(iorapd)
+
+domain_auto_trans(iorapd, iorap_prefetcherd_exec, iorap_prefetcherd)
+domain_auto_trans(iorapd, iorap_inode2filename_exec, iorap_inode2filename)
+
+# Allow iorapd to access the runtime native boot feature flag properties.
+get_prop(iorapd, device_config_runtime_native_boot_prop)
diff --git a/private/isolated_app.te b/private/isolated_app.te
index 94b49b0..4c6c5aa 100644
--- a/private/isolated_app.te
+++ b/private/isolated_app.te
@@ -13,6 +13,10 @@
 # Access already open app data files received over Binder or local socket IPC.
 allow isolated_app { app_data_file privapp_data_file }:file { append read write getattr lock map };
 
+# Allow access to network sockets received over IPC. New socket creation is not
+# permitted.
+allow isolated_app { ephemeral_app priv_app untrusted_app_all }:{ tcp_socket udp_socket } { rw_socket_perms_no_ioctl };
+
 allow isolated_app activity_service:service_manager find;
 allow isolated_app display_service:service_manager find;
 allow isolated_app webviewupdate_service:service_manager find;
@@ -56,15 +60,12 @@
 
 # Write app-specific trace data to the Perfetto traced damon. This requires
 # connecting to its producer socket and obtaining a (per-process) tmpfs fd.
-allow isolated_app traced:fd use;
-allow isolated_app traced_tmpfs:file { read write getattr map };
-unix_socket_connect(isolated_app, traced_producer, traced)
+perfetto_producer(isolated_app)
 
-# Allow heap profiling if the main app has been marked as profileable or
+# Allow profiling if the main app has been marked as profileable or
 # debuggable.
 can_profile_heap(isolated_app)
-
-allow isolated_app ashmem_device:chr_file { getattr read ioctl lock map append write };
+can_profile_perf(isolated_app)
 
 #####
 ##### Neverallow
@@ -92,12 +93,10 @@
 
 # b/17487348
 # Isolated apps can only access three services,
-# activity_service, display_service, webviewupdate_service, and
-# ashmem_device_service.
+# activity_service, display_service, webviewupdate_service.
 neverallow isolated_app {
     service_manager_type
     -activity_service
-    -ashmem_device_service
     -display_service
     -webviewupdate_service
 }:service_manager find;
@@ -136,7 +135,7 @@
 # excluding unix_stream_socket and unix_dgram_socket.
 # Many of these are socket families which have never and will never
 # be compiled into the Android kernel.
-neverallow isolated_app self:{
+neverallow isolated_app { self ephemeral_app priv_app untrusted_app_all }:{
   socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket
   key_socket appletalk_socket netlink_route_socket
   netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket
diff --git a/private/keys.conf b/private/keys.conf
index f517b67..362e73d 100644
--- a/private/keys.conf
+++ b/private/keys.conf
@@ -15,7 +15,7 @@
 ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/media.x509.pem
 
 [@NETWORK_STACK]
-ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/networkstack.x509.pem
+ALL : $MAINLINE_SEPOLICY_DEV_CERTIFICATES/networkstack.x509.pem
 
 [@SHARED]
 ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/shared.x509.pem
diff --git a/private/keystore.te b/private/keystore.te
index 7f71028..ee6dbdf 100644
--- a/private/keystore.te
+++ b/private/keystore.te
@@ -11,9 +11,5 @@
 # This is used for the ConfirmationUI async callback.
 allow keystore platform_app:binder call;
 
-# Offer the Wifi Keystore HwBinder service
-typeattribute keystore wifi_keystore_service_server;
-add_hwservice(keystore, system_wifi_keystore_hwservice)
-
 # Allow to check whether security logging is enabled.
 get_prop(keystore, device_logging_prop)
diff --git a/private/linkerconfig.te b/private/linkerconfig.te
new file mode 100644
index 0000000..414b39f
--- /dev/null
+++ b/private/linkerconfig.te
@@ -0,0 +1,19 @@
+type linkerconfig, domain, coredomain;
+type linkerconfig_exec, exec_type, file_type, system_file_type;
+
+init_daemon_domain(linkerconfig)
+
+## Read and write linkerconfig subdirectory.
+allow linkerconfig linkerconfig_file:dir create_dir_perms;
+allow linkerconfig linkerconfig_file:file create_file_perms;
+
+# Allow linkerconfig to log to the kernel.
+allow linkerconfig kmsg_device:chr_file w_file_perms;
+
+# Allow linkerconfig to be invoked with logwrapper from init.
+allow linkerconfig devpts:chr_file { read write };
+
+# Allow linkerconfig to scan for apex modules
+allow linkerconfig apex_mnt_dir:dir r_dir_perms;
+
+neverallow { domain -init -linkerconfig } linkerconfig_exec:file no_x_file_perms;
diff --git a/private/llkd.te b/private/llkd.te
index 385f930..f218dec 100644
--- a/private/llkd.te
+++ b/private/llkd.te
@@ -7,7 +7,7 @@
 
 allow llkd self:global_capability_class_set kill;
 userdebug_or_eng(`
-  allow llkd self:global_capability_class_set sys_ptrace;
+  allow llkd self:global_capability_class_set { sys_ptrace sys_admin };
   allow llkd self:global_capability_class_set { dac_override dac_read_search };
 ')
 
diff --git a/private/logpersist.te b/private/logpersist.te
index 4187627..ac324df 100644
--- a/private/logpersist.te
+++ b/private/logpersist.te
@@ -24,5 +24,6 @@
   userdebug_or_eng(`-misc_logd_file -coredump_file')
   with_native_coverage(`-method_trace_data_file')
 }:file { create write append };
-neverallow { domain -init userdebug_or_eng(`-logpersist -logd -dumpstate') } misc_logd_file:file no_rw_file_perms;
+neverallow { domain -init -dumpstate -incidentd userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_rw_file_perms;
+neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_w_file_perms;
 neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write };
diff --git a/private/lpdumpd.te b/private/lpdumpd.te
index 458a8f1..3bcd761 100644
--- a/private/lpdumpd.te
+++ b/private/lpdumpd.te
@@ -38,4 +38,5 @@
     -dumpstate
     -lpdumpd
     -shell
+    -servicemanager
 } lpdumpd:binder call;
diff --git a/private/mediaprovider.te b/private/mediaprovider.te
index 30d3fe0..249fee1 100644
--- a/private/mediaprovider.te
+++ b/private/mediaprovider.te
@@ -42,5 +42,3 @@
 # MtpServer sets sys.usb.ffs.mtp.ready
 set_prop(mediaprovider, ffs_prop)
 set_prop(mediaprovider, exported_ffs_prop)
-
-allow mediaprovider ashmem_device:chr_file { getattr read ioctl lock map append write };
diff --git a/private/mediaprovider_app.te b/private/mediaprovider_app.te
new file mode 100644
index 0000000..0b1047a
--- /dev/null
+++ b/private/mediaprovider_app.te
@@ -0,0 +1,42 @@
+###
+### A domain for further sandboxing the MediaProvider mainline module.
+###
+type mediaprovider_app, domain, coredomain;
+
+app_domain(mediaprovider_app)
+
+# Access to /mnt/pass_through.
+allow mediaprovider_app mnt_pass_through_file:dir r_dir_perms;
+
+# Allow MediaProvider to host a FUSE daemon for external storage
+allow mediaprovider_app fuse_device:chr_file { read write ioctl getattr };
+
+# Allow MediaProvider to read/write media_rw_data_file files and dirs
+allow mediaprovider_app media_rw_data_file:file create_file_perms;
+allow mediaprovider_app media_rw_data_file:dir create_dir_perms;
+
+# Talk to the DRM service
+allow mediaprovider_app drmserver_service:service_manager find;
+
+# Talk to the MediaServer service
+allow mediaprovider_app mediaserver_service:service_manager find;
+
+# Talk to regular app services
+allow mediaprovider_app app_api_service:service_manager find;
+
+# Talk to the GPU service
+binder_call(mediaprovider_app, gpuservice)
+
+# read pipe-max-size configuration
+allow mediaprovider_app proc_pipe_conf:file r_file_perms;
+
+# Allow MediaProvider to set extended attributes (such as quota project ID)
+# on media files.
+allowxperm mediaprovider_app media_rw_data_file:{ dir file } ioctl {
+  FS_IOC_FSGETXATTR
+  FS_IOC_FSSETXATTR
+  FS_IOC_GETFLAGS
+  FS_IOC_SETFLAGS
+};
+
+allow mediaprovider_app proc_filesystems:file r_file_perms;
diff --git a/private/mediaserver.te b/private/mediaserver.te
index 635cf4e..c55e54a 100644
--- a/private/mediaserver.te
+++ b/private/mediaserver.te
@@ -2,9 +2,13 @@
 
 init_daemon_domain(mediaserver)
 tmpfs_domain(mediaserver)
+allow mediaserver appdomain_tmpfs:file { getattr map read write };
 
 # allocate and use graphic buffers
 hal_client_domain(mediaserver, hal_graphics_allocator)
+hal_client_domain(mediaserver, hal_configstore)
+hal_client_domain(mediaserver, hal_drm)
 hal_client_domain(mediaserver, hal_omx)
 hal_client_domain(mediaserver, hal_codec2)
 
+allow mediaserver mediatranscoding_service:service_manager find;
diff --git a/private/mediatranscoding.te b/private/mediatranscoding.te
new file mode 100644
index 0000000..e0ad84c
--- /dev/null
+++ b/private/mediatranscoding.te
@@ -0,0 +1,3 @@
+typeattribute mediatranscoding coredomain;
+
+init_daemon_domain(mediatranscoding)
diff --git a/private/netd.te b/private/netd.te
index 4c129b7..41473b7 100644
--- a/private/netd.te
+++ b/private/netd.te
@@ -5,8 +5,9 @@
 # Allow netd to spawn dnsmasq in it's own domain
 domain_auto_trans(netd, dnsmasq_exec, dnsmasq)
 
-# Allow netd to start clatd in its own domain
+# Allow netd to start clatd in its own domain and kill it
 domain_auto_trans(netd, clatd_exec, clatd)
+allow netd clatd:process signal;
 
 # give netd permission to setup iptables rule with xt_bpf, attach program to cgroup, and read/write
 # the map created by bpfloader
diff --git a/private/network_stack.te b/private/network_stack.te
index b214538..1295a07 100644
--- a/private/network_stack.te
+++ b/private/network_stack.te
@@ -28,3 +28,11 @@
 allow network_stack radio_data_file:file create_file_perms;
 
 binder_call(network_stack, netd);
+
+# Create/use netlink_tcpdiag_socket to get tcp info
+allow network_stack self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write };
+############### Tethering Service app - Tethering.apk ##############
+hal_client_domain(network_stack, hal_tetheroffload)
+# Create and share netlink_netfilter_sockets for tetheroffload.
+allow network_stack self:netlink_netfilter_socket create_socket_perms_no_ioctl;
+allow network_stack network_stack_service:service_manager find;
diff --git a/private/nfc.te b/private/nfc.te
index 5e85672..2e48eef 100644
--- a/private/nfc.te
+++ b/private/nfc.te
@@ -15,7 +15,6 @@
 # SoundPool loading and playback
 allow nfc audioserver_service:service_manager find;
 allow nfc drmserver_service:service_manager find;
-allow nfc mediacodec_service:service_manager find;
 allow nfc mediametrics_service:service_manager find;
 allow nfc mediaextractor_service:service_manager find;
 allow nfc mediaserver_service:service_manager find;
diff --git a/private/perfetto.te b/private/perfetto.te
index 419c4b9..2183b6d 100644
--- a/private/perfetto.te
+++ b/private/perfetto.te
@@ -13,10 +13,7 @@
 
 # Connect to the Perfetto traced daemon as a producer. This requires
 # connecting to its producer socket and obtaining a (per-process) tmpfs fd.
-allow perfetto traced:fd use;
-allow perfetto traced_tmpfs:file { read write getattr map };
-unix_socket_connect(perfetto, traced_producer, traced)
-
+perfetto_producer(perfetto)
 
 # Allow to write and unlink traces into /data/misc/perfetto-traces.
 allow perfetto perfetto_traces_data_file:dir rw_dir_perms;
@@ -37,9 +34,12 @@
 allow perfetto adbd:fd use;
 allow perfetto adbd:unix_stream_socket { read write };
 
-# Allow adbd to reap perfetto
+# Allow adbd to reap perfetto.
 allow perfetto adbd:process { sigchld };
 
+# Allow perfetto to write to statsd.
+unix_socket_send(perfetto, statsdw, statsd)
+
 # Allow to access /dev/pts when launched in an adb shell.
 allow perfetto devpts:chr_file rw_file_perms;
 
@@ -69,6 +69,7 @@
 neverallow perfetto {
   data_file_type
   -system_data_file
+  -system_data_root_file
   # TODO(b/72998741) Remove exemption. Further restricted in a subsequent
   # neverallow. Currently only getattr and search are allowed.
   -vendor_data_file
diff --git a/private/perfprofd.te b/private/perfprofd.te
deleted file mode 100644
index c65c6f1..0000000
--- a/private/perfprofd.te
+++ /dev/null
@@ -1,28 +0,0 @@
-userdebug_or_eng(`
-  typeattribute perfprofd coredomain;
-  init_daemon_domain(perfprofd)
-')
-
-neverallow {
-  domain
-  userdebug_or_eng(`
-    -statsd
-    -system_server
-    -system_suspend_server
-    -hal_health_server
-    -hwservicemanager
-  ')
-} perfprofd:binder call;
-
-neverallow perfprofd {
-  domain
-  userdebug_or_eng(`
-    -servicemanager
-    -statsd
-    -su
-    -system_server
-    -system_suspend_server
-    -hal_health_server
-    -hwservicemanager
-  ')
-}:binder call;
diff --git a/private/permissioncontroller_app.te b/private/permissioncontroller_app.te
new file mode 100644
index 0000000..8a6f6aa
--- /dev/null
+++ b/private/permissioncontroller_app.te
@@ -0,0 +1,38 @@
+###
+### A domain for further sandboxing the GooglePermissionController app.
+###
+type permissioncontroller_app, domain, coredomain;
+
+app_domain(permissioncontroller_app)
+
+# Allow interaction with gpuservice
+binder_call(permissioncontroller_app, gpuservice)
+allow permissioncontroller_app gpu_service:service_manager find;
+
+# Allow interaction with role_service
+allow permissioncontroller_app role_service:service_manager find;
+
+# Allow interaction with usagestats_service
+allow permissioncontroller_app usagestats_service:service_manager find;
+
+# Allow interaction with activity_service
+allow permissioncontroller_app activity_service:service_manager find;
+
+allow permissioncontroller_app activity_task_service:service_manager find;
+allow permissioncontroller_app audio_service:service_manager find;
+allow permissioncontroller_app autofill_service:service_manager find;
+allow permissioncontroller_app content_capture_service:service_manager find;
+allow permissioncontroller_app device_policy_service:service_manager find;
+allow permissioncontroller_app incidentcompanion_service:service_manager find;
+allow permissioncontroller_app IProxyService_service:service_manager find;
+allow permissioncontroller_app location_service:service_manager find;
+allow permissioncontroller_app media_session_service:service_manager find;
+allow permissioncontroller_app surfaceflinger_service:service_manager find;
+allow permissioncontroller_app telecom_service:service_manager find;
+allow permissioncontroller_app trust_service:service_manager find;
+
+# Allow the app to request and collect incident reports.
+# (Also requires DUMP and PACKAGE_USAGE_STATS permissions)
+allow permissioncontroller_app incident_service:service_manager find;
+binder_call(permissioncontroller_app, incidentd)
+allow permissioncontroller_app incidentd:fifo_file { read write };
diff --git a/private/platform_app.te b/private/platform_app.te
index bbba1d9..3beec38 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -58,7 +58,6 @@
 allow platform_app mediaserver_service:service_manager find;
 allow platform_app mediametrics_service:service_manager find;
 allow platform_app mediaextractor_service:service_manager find;
-allow platform_app mediacodec_service:service_manager find;
 allow platform_app mediadrmserver_service:service_manager find;
 allow platform_app persistent_data_block_service:service_manager find;
 allow platform_app radio_service:service_manager find;
@@ -74,7 +73,7 @@
 binder_call(platform_app, gpuservice)
 
 # Allow platform apps to log via statsd.
-allow platform_app statsd:binder call;
+binder_call(platform_app, statsd)
 
 # Access to /data/preloads
 allow platform_app preloads_data_file:file r_file_perms;
diff --git a/private/priv_app.te b/private/priv_app.te
index 1bff418..db28bec 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -14,9 +14,6 @@
 # Used by: https://play.privileged.com/store/apps/details?id=jackpal.androidterm
 create_pty(priv_app)
 
-# webview crash handling depends on self ptrace (b/27697529, b/20150694, b/19277529#comment7)
-allow priv_app self:process ptrace;
-
 # Allow loading executable code from writable priv-app home
 # directories. This is a W^X violation, however, it needs
 # to be supported for now for the following reasons.
@@ -37,7 +34,6 @@
 allow priv_app audioserver_service:service_manager find;
 allow priv_app cameraserver_service:service_manager find;
 allow priv_app drmserver_service:service_manager find;
-allow priv_app mediacodec_service:service_manager find;
 allow priv_app mediadrmserver_service:service_manager find;
 allow priv_app mediaextractor_service:service_manager find;
 allow priv_app mediametrics_service:service_manager find;
@@ -60,10 +56,6 @@
 # /cache is a symlink to /data/cache on some devices. Allow reading the link.
 allow priv_app cache_file:lnk_file r_file_perms;
 
-# Write to /data/ota_package for OTA packages.
-allow priv_app ota_package_file:dir rw_dir_perms;
-allow priv_app ota_package_file:file create_file_perms;
-
 # Access to /data/media.
 allow priv_app media_rw_data_file:dir create_dir_perms;
 allow priv_app media_rw_data_file:file create_file_perms;
@@ -80,17 +72,6 @@
 allow priv_app { apk_tmp_file apk_private_tmp_file }:dir r_dir_perms;
 allow priv_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
 
-# b/18504118: Allow reads from /data/anr/traces.txt
-allow priv_app anr_data_file:file r_file_perms;
-
-# Allow GMS core to access perfprofd output, which is stored
-# in /data/misc/perfprofd/. GMS core will need to list all
-# data stored in that directory to process them one by one.
-userdebug_or_eng(`
-  allow priv_app perfprofd_data_file:file r_file_perms;
-  allow priv_app perfprofd_data_file:dir r_dir_perms;
-')
-
 # For AppFuse.
 allow priv_app vold:fd use;
 allow priv_app fuse_device:chr_file { read write };
@@ -108,25 +89,10 @@
 
 r_dir_file(priv_app, rootfs)
 
-# Allow GMS core to open kernel config for OTA matching through libvintf
-allow priv_app config_gz:file { open read getattr };
-
 # access the mac address
 allowxperm priv_app self:udp_socket ioctl SIOCGIFHWADDR;
 
-# Allow GMS core to communicate with update_engine for A/B update.
-binder_call(priv_app, update_engine)
-allow priv_app update_engine_service:service_manager find;
-
-# Allow GMS core to communicate with dumpsys storaged.
-binder_call(priv_app, storaged)
-allow priv_app storaged_service:service_manager find;
-
-# Allow GMS core to access system_update_service (e.g. to publish pending
-# system update info).
-allow priv_app system_update_service:service_manager find;
-
-# Allow GMS core to communicate with statsd.
+# Allow com.android.vending to communicate with statsd.
 binder_call(priv_app, statsd)
 
 # Allow Phone to read/write cached ringtones (opened by system).
@@ -138,19 +104,11 @@
 allow priv_app preloads_media_file:file r_file_perms;
 allow priv_app preloads_media_file:dir r_dir_perms;
 
-# Allow privileged apps (e.g. GMS core) to generate unique hardware IDs
-allow priv_app keystore:keystore_key gen_unique_id;
-
-# Allow GMS core to access /sys/fs/selinux/policyvers for compatibility check
-allow priv_app selinuxfs:file r_file_perms;
-
 read_runtime_log_tags(priv_app)
 
 # Write app-specific trace data to the Perfetto traced damon. This requires
 # connecting to its producer socket and obtaining a (per-process) tmpfs fd.
-allow priv_app traced:fd use;
-allow priv_app traced_tmpfs:file { read write getattr map };
-unix_socket_connect(priv_app, traced_producer, traced)
+perfetto_producer(priv_app)
 
 # Allow priv_apps to request and collect incident reports.
 # (Also requires DUMP and PACKAGE_USAGE_STATS permissions)
@@ -158,9 +116,9 @@
 binder_call(priv_app, incidentd)
 allow priv_app incidentd:fifo_file { read write };
 
-# Allow heap profiling if the app opts in by being marked
-# profileable/debuggable.
+# Allow profiling if the app opts in by being marked profileable/debuggable.
 can_profile_heap(priv_app)
+can_profile_perf(priv_app)
 
 # Allow priv_apps to check whether Dynamic System Update is enabled
 get_prop(priv_app, dynamic_system_prop)
@@ -173,11 +131,13 @@
 dontaudit priv_app proc:file read;
 dontaudit priv_app proc_interrupts:file read;
 dontaudit priv_app proc_modules:file read;
+dontaudit priv_app proc_net:file read;
 dontaudit priv_app proc_stat:file read;
 dontaudit priv_app proc_version:file read;
 dontaudit priv_app sysfs:dir read;
 dontaudit priv_app sysfs:file read;
 dontaudit priv_app sysfs_android_usb:file read;
+dontaudit priv_app sysfs_dm:file r_file_perms;
 dontaudit priv_app wifi_prop:file read;
 dontaudit priv_app { wifi_prop exported_wifi_prop }:file read;
 
@@ -186,6 +146,17 @@
 allow priv_app system_server:udp_socket {
         connect getattr read recvfrom sendto write getopt setopt };
 
+# allow apps like Phonesky to check the file signature of an apk installed on
+# the Incremental File System, and fill missing blocks in the apk
+allowxperm priv_app apk_data_file:file ioctl { INCFS_IOCTL_READ_SIGNATURE INCFS_IOCTL_FILL_BLOCKS };
+
+# allow privileged data loader apps (e.g. com.android.vending) to read logs from Incremental File System
+allow priv_app incremental_control_file:file { read getattr ioctl };
+
+# allow apps like Phonesky to request permission to fill blocks of an apk file
+# on the Incremental File System.
+allowxperm priv_app incremental_control_file:file ioctl INCFS_IOCTL_PERMIT_FILL;
+
 ###
 ### neverallow rules
 ###
diff --git a/private/property_contexts b/private/property_contexts
index cb81ba6..1eb2d70 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -22,6 +22,7 @@
 hw.                     u:object_r:system_prop:s0
 ro.hw.                  u:object_r:system_prop:s0
 sys.                    u:object_r:system_prop:s0
+sys.init.perf_lsm_hooks u:object_r:init_perf_lsm_hooks_prop:s0
 sys.cppreopt            u:object_r:cppreopt_prop:s0
 sys.lpdumpd             u:object_r:lpdumpd_prop:s0
 sys.powerctl            u:object_r:powerctl_prop:s0
@@ -35,6 +36,7 @@
 debug.db.               u:object_r:debuggerd_prop:s0
 dumpstate.              u:object_r:dumpstate_prop:s0
 dumpstate.options       u:object_r:dumpstate_options_prop:s0
+init.svc_debug_pid.     u:object_r:init_svc_debug_prop:s0
 llk.                    u:object_r:llkd_prop:s0
 khungtask.              u:object_r:llkd_prop:s0
 ro.llk.                 u:object_r:llkd_prop:s0
@@ -45,9 +47,13 @@
 security.perf_harden    u:object_r:shell_prop:s0
 service.adb.root        u:object_r:shell_prop:s0
 service.adb.tcp.port    u:object_r:shell_prop:s0
+service.adb.tls.port    u:object_r:adbd_prop:s0
+persist.adb.wifi.       u:object_r:adbd_prop:s0
+persist.adb.tls_server.enable  u:object_r:system_adbd_prop:s0
 
 persist.audio.          u:object_r:audio_prop:s0
 persist.bluetooth.      u:object_r:bluetooth_prop:s0
+persist.nfc_cfg.        u:object_r:nfc_prop:s0
 persist.debug.          u:object_r:persist_debug_prop:s0
 persist.logd.           u:object_r:logd_prop:s0
 ro.logd.                u:object_r:logd_prop:s0
@@ -57,18 +63,21 @@
 persist.log.tag         u:object_r:log_tag_prop:s0
 persist.mmc.            u:object_r:mmc_prop:s0
 persist.netd.stable_secret      u:object_r:netd_stable_secret_prop:s0
+persist.pm.mock-upgrade u:object_r:mock_ota_prop:s0
 persist.sys.            u:object_r:system_prop:s0
 persist.sys.safemode    u:object_r:safemode_prop:s0
 persist.sys.theme       u:object_r:theme_prop:s0
 persist.sys.fflag.override.settings_dynamic_system    u:object_r:dynamic_system_prop:s0
 ro.sys.safemode         u:object_r:safemode_prop:s0
 persist.sys.audit_safemode      u:object_r:safemode_prop:s0
+persist.sys.dalvik.jvmtiagent   u:object_r:system_jvmti_agent_prop:s0
 persist.service.        u:object_r:system_prop:s0
 persist.service.bdroid. u:object_r:bluetooth_prop:s0
 persist.security.       u:object_r:system_prop:s0
 persist.traced.enable   u:object_r:traced_enabled_prop:s0
 traced.lazy.            u:object_r:traced_lazy_prop:s0
 persist.heapprofd.enable u:object_r:heapprofd_enabled_prop:s0
+persist.traced_perf.enable u:object_r:traced_perf_enabled_prop:s0
 persist.vendor.overlay.  u:object_r:overlay_prop:s0
 ro.boot.vendor.overlay.  u:object_r:overlay_prop:s0
 ro.boottime.             u:object_r:boottime_prop:s0
@@ -82,12 +91,14 @@
 sys.boot.reason.last    u:object_r:last_boot_reason_prop:s0
 pm.                     u:object_r:pm_prop:s0
 test.sys.boot.reason    u:object_r:test_boot_reason_prop:s0
+test.userspace_reboot.requested u:object_r:userspace_reboot_test_prop:s0
 sys.lmk.                u:object_r:system_lmk_prop:s0
 sys.trace.              u:object_r:system_trace_prop:s0
 
 # Boolean property set by system server upon boot indicating
-# if device owner is provisioned.
-ro.device_owner         u:object_r:device_logging_prop:s0
+# if device is fully owned by organization instead of being
+# a personal device.
+ro.organization_owned   u:object_r:device_logging_prop:s0
 
 # selinux non-persistent properties
 selinux.restorecon_recursive   u:object_r:restorecon_prop:s0
@@ -135,6 +146,9 @@
 ctl.stop$gsid           u:object_r:ctl_gsid_prop:s0
 ctl.restart$gsid        u:object_r:ctl_gsid_prop:s0
 
+# Restrict access to stopping apexd.
+ctl.stop$apexd          u:object_r:ctl_apexd_prop:s0
+
 # Restrict access to restart dumpstate
 ctl.interface_restart$android.hardware.dumpstate u:object_r:ctl_dumpstate_prop:s0
 
@@ -150,6 +164,7 @@
 ro.dalvik.              u:object_r:dalvik_prop:s0
 
 # Shared between system server and wificond
+wifi.                   u:object_r:wifi_prop:s0
 wlan.                   u:object_r:wifi_prop:s0
 
 # Lowpan properties
@@ -187,6 +202,12 @@
 persist.device_config.runtime_native.        u:object_r:device_config_runtime_native_prop:s0
 persist.device_config.runtime_native_boot.   u:object_r:device_config_runtime_native_boot_prop:s0
 persist.device_config.media_native.          u:object_r:device_config_media_native_prop:s0
+persist.device_config.storage_native_boot.   u:object_r:device_config_storage_native_boot_prop:s0
+persist.device_config.window_manager_native_boot. u:object_r:device_config_window_manager_native_boot_prop:s0
+persist.device_config.configuration. u:object_r:device_config_configuration_prop:s0
+
+# Properties that relate to legacy server configurable flags
+persist.device_config.global_settings.sys_traced u:object_r:device_config_sys_traced_prop:s0
 
 apexd.                  u:object_r:apexd_prop:s0
 persist.apexd.          u:object_r:apexd_prop:s0
@@ -199,3 +220,30 @@
 # Property for disabling NNAPI vendor extensions on product image (used on GSI /product image,
 # which can't use NNAPI vendor extensions).
 ro.nnapi.extensions.deny_on_product                u:object_r:nnapi_ext_deny_product_prop:s0
+
+# Property that is set once ueventd finishes cold boot.
+ro.cold_boot_done       u:object_r:cold_boot_done_prop:s0
+
+# Charger properties
+ro.charger.             u:object_r:charger_prop:s0
+
+# Virtual A/B properties
+ro.virtual_ab.enabled   u:object_r:virtual_ab_prop:s0
+ro.virtual_ab.retrofit  u:object_r:virtual_ab_prop:s0
+
+# Property to set/clear the warm reset flag after an OTA update.
+ota.warm_reset  u:object_r:ota_prop:s0
+
+# Module properties
+com.android.sdkext.                  u:object_r:module_sdkextensions_prop:s0
+persist.com.android.sdkext.          u:object_r:module_sdkextensions_prop:s0
+
+# Userspace reboot properties
+sys.userspace_reboot.log.         u:object_r:userspace_reboot_log_prop:s0
+persist.sys.userspace_reboot.log. u:object_r:userspace_reboot_log_prop:s0
+
+# Integer property which is used in libgui to configure the number of frames
+# tracked by buffer queue's frame event timing history. The property is set
+# by devices with video decoding pipelines long enough to overflow the default
+# history size.
+ro.lib_gui.frame_event_history_size u:object_r:bq_config_prop:s0
diff --git a/private/radio.te b/private/radio.te
index 9ac2cf1..4d48c93 100644
--- a/private/radio.te
+++ b/private/radio.te
@@ -6,3 +6,12 @@
 
 # Telephony code contains time / time zone detection logic so it reads the associated properties.
 get_prop(radio, time_prop)
+
+# allow telephony to access platform compat to log permission denials
+allow radio platform_compat_service:service_manager find;
+
+allow radio uce_service:service_manager find;
+
+# Manage /data/misc/emergencynumberdb
+allow radio emergency_data_file:dir r_dir_perms;
+allow radio emergency_data_file:file r_file_perms;
diff --git a/private/runas_app.te b/private/runas_app.te
index e6fd953..c1b354a 100644
--- a/private/runas_app.te
+++ b/private/runas_app.te
@@ -16,3 +16,17 @@
 # Allow lldb/ndk-gdb/simpleperf to ptrace attach to debuggable app processes.
 allow runas_app untrusted_app_all:process { ptrace signal sigstop };
 allow runas_app untrusted_app_all:unix_stream_socket connectto;
+
+# Allow executing system image simpleperf without a domain transition.
+allow runas_app simpleperf_exec:file rx_file_perms;
+
+# Suppress denial logspam when simpleperf is trying to find a matching process
+# by scanning /proc/<pid>/cmdline files. The /proc/<pid> directories are within
+# the same domain as their respective process, most of which this domain is not
+# allowed to see.
+dontaudit runas_app domain:dir search;
+
+# Allow runas_app to call perf_event_open for profiling debuggable app
+# processes, but not the whole system.
+allow runas_app self:perf_event { open read write kernel };
+neverallow runas_app self:perf_event ~{ open read write kernel };
diff --git a/private/seapp_contexts b/private/seapp_contexts
index ad8a76c..6c3b607 100644
--- a/private/seapp_contexts
+++ b/private/seapp_contexts
@@ -113,9 +113,10 @@
 neverallow user=((?!system).)* domain=system_app
 neverallow user=((?!system).)* type=system_app_data_file
 
-# anything with a non-known uid with a specified name should have a specified seinfo
-neverallow user=_app name=.* seinfo=""
-neverallow user=_app name=.* seinfo=default
+# any non priv-app with a non-known uid with a specified name should have a specified
+# seinfo
+neverallow user=_app isPrivApp=false name=.* seinfo=""
+neverallow user=_app isPrivApp=false name=.* seinfo=default
 
 # neverallow shared relro to any other domain
 # and neverallow any other uid into shared_relro
@@ -156,7 +157,16 @@
 user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
 user=_app isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=all
 user=_app isPrivApp=true domain=priv_app type=privapp_data_file levelFrom=user
-user=_app minTargetSdkVersion=29 domain=untrusted_app type=app_data_file levelFrom=all
+user=_app isPrivApp=true name=com.google.android.permissioncontroller domain=permissioncontroller_app type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.android.providers.media.module domain=mediaprovider_app type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.google.android.providers.media.module domain=mediaprovider_app type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.android.permissioncontroller domain=permissioncontroller_app type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.android.vzwomatrigger domain=vzwomatrigger_app type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.google.android.gms domain=gmscore_app type=privapp_data_file levelFrom=user
+user=_app isPrivApp=true name=com.google.android.gms.* domain=gmscore_app type=privapp_data_file levelFrom=user
+user=_app isPrivApp=true name=com.google.android.gms:* domain=gmscore_app type=privapp_data_file levelFrom=user
+user=_app minTargetSdkVersion=30 domain=untrusted_app type=app_data_file levelFrom=all
+user=_app minTargetSdkVersion=29 domain=untrusted_app_29 type=app_data_file levelFrom=all
 user=_app minTargetSdkVersion=28 domain=untrusted_app_27 type=app_data_file levelFrom=all
 user=_app minTargetSdkVersion=26 domain=untrusted_app_27 type=app_data_file levelFrom=user
 user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user
diff --git a/private/security_classes b/private/security_classes
index 25b4cba..04ed814 100644
--- a/private/security_classes
+++ b/private/security_classes
@@ -139,6 +139,11 @@
 
 class xdp_socket
 
+class perf_event
+
+# Introduced in https://github.com/torvalds/linux/commit/59438b46471ae6cdfb761afc8c9beaf1e428a331
+class lockdown
+
 # Property service
 class property_service          # userspace
 
diff --git a/private/service.te b/private/service.te
index a8ee195..6c17521 100644
--- a/private/service.te
+++ b/private/service.te
@@ -1,7 +1,8 @@
-type ashmem_device_service,         app_api_service, service_manager_type;
 type attention_service,             system_server_service, service_manager_type;
 type dynamic_system_service,        system_api_service, system_server_service, service_manager_type;
 type gsi_service,                   service_manager_type;
 type incidentcompanion_service,     system_api_service, system_server_service, service_manager_type;
 type stats_service,                 service_manager_type;
 type statscompanion_service,        system_server_service, service_manager_type;
+type statsmanager_service,          system_api_service, system_server_service, service_manager_type;
+type uce_service,                   service_manager_type;
diff --git a/private/service_contexts b/private/service_contexts
index 96d553b..f8dbcae 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -1,22 +1,34 @@
+android.hardware.identity.IIdentityCredentialStore/default           u:object_r:hal_identity_service:s0
+android.hardware.light.ILights/default                               u:object_r:hal_light_service:s0
+android.hardware.power.IPower/default                                u:object_r:hal_power_service:s0
+android.hardware.rebootescrow.IRebootEscrow/default                  u:object_r:hal_rebootescrow_service:s0
+android.hardware.vibrator.IVibrator/default                          u:object_r:hal_vibrator_service:s0
+
 accessibility                             u:object_r:accessibility_service:s0
 account                                   u:object_r:account_service:s0
 activity                                  u:object_r:activity_service:s0
 activity_task                             u:object_r:activity_task_service:s0
 adb                                       u:object_r:adb_service:s0
+aidl_lazy_test_1                          u:object_r:aidl_lazy_test_service:s0
+aidl_lazy_test_2                          u:object_r:aidl_lazy_test_service:s0
 alarm                                     u:object_r:alarm_service:s0
 android.os.UpdateEngineService            u:object_r:update_engine_service:s0
+android.security.identity                 u:object_r:credstore_service:s0
 android.security.keystore                 u:object_r:keystore_service:s0
 android.service.gatekeeper.IGateKeeperService    u:object_r:gatekeeper_service:s0
 app_binding                               u:object_r:app_binding_service:s0
+app_integrity                             u:object_r:app_integrity_service:s0
 app_prediction                            u:object_r:app_prediction_service:s0
+app_search                                u:object_r:app_search_service:s0
 apexservice                               u:object_r:apex_service:s0
-ashmem_device_service                     u:object_r:ashmem_device_service:s0
+blob_store                                u:object_r:blob_store_service:s0
 gsiservice                                u:object_r:gsi_service:s0
 appops                                    u:object_r:appops_service:s0
 appwidget                                 u:object_r:appwidget_service:s0
 assetatlas                                u:object_r:assetatlas_service:s0
 attention                                 u:object_r:attention_service:s0
 audio                                     u:object_r:audio_service:s0
+auth                                      u:object_r:auth_service:s0
 autofill                                  u:object_r:autofill_service:s0
 backup                                    u:object_r:backup_service:s0
 batteryproperties                         u:object_r:batteryproperties_service:s0
@@ -32,6 +44,8 @@
 clipboard                                 u:object_r:clipboard_service:s0
 com.android.net.IProxyService             u:object_r:IProxyService_service:s0
 companiondevice                           u:object_r:companion_device_service:s0
+platform_compat                           u:object_r:platform_compat_service:s0
+platform_compat_native                    u:object_r:platform_compat_service:s0
 connectivity                              u:object_r:connectivity_service:s0
 connmetrics                               u:object_r:connmetrics_service:s0
 consumer_ir                               u:object_r:consumer_ir_service:s0
@@ -43,6 +57,7 @@
 coverage                                  u:object_r:coverage_service:s0
 cpuinfo                                   u:object_r:cpuinfo_service:s0
 crossprofileapps                          u:object_r:crossprofileapps_service:s0
+dataloader_manager                        u:object_r:dataloader_manager_service:s0
 dbinfo                                    u:object_r:dbinfo_service:s0
 device_config                             u:object_r:device_config_service:s0
 device_policy                             u:object_r:device_policy_service:s0
@@ -67,6 +82,7 @@
 lowpan                                    u:object_r:lowpan_service:s0
 ethernet                                  u:object_r:ethernet_service:s0
 face                                      u:object_r:face_service:s0
+file_integrity                            u:object_r:file_integrity_service:s0
 fingerprint                               u:object_r:fingerprint_service:s0
 font                                      u:object_r:font_service:s0
 android.hardware.fingerprint.IFingerprintDaemon u:object_r:fingerprintd_service:s0
@@ -90,8 +106,9 @@
 iphonesubinfo                             u:object_r:radio_service:s0
 ims                                       u:object_r:radio_service:s0
 imms                                      u:object_r:imms_service:s0
+incremental                               u:object_r:incremental_service:s0
 ipsec                                     u:object_r:ipsec_service:s0
-ircs                                      u:object_r:radio_service:s0
+ircsmessage                               u:object_r:radio_service:s0
 iris                                      u:object_r:iris_service:s0
 isms_msim                                 u:object_r:radio_service:s0
 isms2                                     u:object_r:radio_service:s0
@@ -99,6 +116,7 @@
 isub                                      u:object_r:radio_service:s0
 jobscheduler                              u:object_r:jobscheduler_service:s0
 launcherapps                              u:object_r:launcherapps_service:s0
+lights                                    u:object_r:light_service:s0
 location                                  u:object_r:location_service:s0
 lock_settings                             u:object_r:lock_settings_service:s0
 looper_stats                              u:object_r:looper_stats_service:s0
@@ -112,7 +130,7 @@
 media.player                              u:object_r:mediaserver_service:s0
 media.metrics                             u:object_r:mediametrics_service:s0
 media.extractor                           u:object_r:mediaextractor_service:s0
-media.codec                               u:object_r:mediacodec_service:s0
+media.transcoding                         u:object_r:mediatranscoding_service:s0
 media.resource_manager                    u:object_r:mediaserver_service:s0
 media.sound_trigger_hw                    u:object_r:audioserver_service:s0
 media.drm                                 u:object_r:mediadrmserver_service:s0
@@ -137,7 +155,6 @@
 overlay                                   u:object_r:overlay_service:s0
 package                                   u:object_r:package_service:s0
 package_native                            u:object_r:package_native_service:s0
-perfprofd                                 u:object_r:perfprofd_service:s0
 permission                                u:object_r:permission_service:s0
 permissionmgr                             u:object_r:permissionmgr_service:s0
 persistent_data_block                     u:object_r:persistent_data_block_service:s0
@@ -169,6 +186,7 @@
 sensor_privacy                            u:object_r:sensor_privacy_service:s0
 serial                                    u:object_r:serial_service:s0
 servicediscovery                          u:object_r:servicediscovery_service:s0
+manager                                   u:object_r:service_manager_service:s0
 settings                                  u:object_r:settings_service:s0
 shortcut                                  u:object_r:shortcut_service:s0
 simphonebook_msim                         u:object_r:radio_service:s0
@@ -178,25 +196,33 @@
 slice                                     u:object_r:slice_service:s0
 stats                                     u:object_r:stats_service:s0
 statscompanion                            u:object_r:statscompanion_service:s0
+statsmanager                              u:object_r:statsmanager_service:s0
 soundtrigger                              u:object_r:voiceinteraction_service:s0
+soundtrigger_middleware                   u:object_r:soundtrigger_middleware_service:s0
 statusbar                                 u:object_r:statusbar_service:s0
 storaged                                  u:object_r:storaged_service:s0
 storaged_pri                              u:object_r:storaged_service:s0
 storagestats                              u:object_r:storagestats_service:s0
 SurfaceFlinger                            u:object_r:surfaceflinger_service:s0
 suspend_control                           u:object_r:system_suspend_control_service:s0
+system_config                             u:object_r:system_config_service:s0
 system_update                             u:object_r:system_update_service:s0
 task                                      u:object_r:task_service:s0
 telecom                                   u:object_r:telecom_service:s0
 telephony.registry                        u:object_r:registry_service:s0
+telephony_ims                             u:object_r:radio_service:s0
 testharness                               u:object_r:testharness_service:s0
+tethering                                 u:object_r:tethering_service:s0
 textclassification                        u:object_r:textclassification_service:s0
 textservices                              u:object_r:textservices_service:s0
 time_detector                             u:object_r:timedetector_service:s0
+time_zone_detector                        u:object_r:timezonedetector_service:s0
 timezone                                  u:object_r:timezone_service:s0
 thermalservice                            u:object_r:thermal_service:s0
 trust                                     u:object_r:trust_service:s0
 tv_input                                  u:object_r:tv_input_service:s0
+tv_tuner_resource_mgr                     u:object_r:tv_tuner_resource_mgr_service:s0
+uce                                       u:object_r:uce_service:s0
 uimode                                    u:object_r:uimode_service:s0
 updatelock                                u:object_r:updatelock_service:s0
 uri_grants                                u:object_r:uri_grants_service:s0
@@ -215,7 +241,7 @@
 wifip2p                                   u:object_r:wifip2p_service:s0
 wifiscanner                               u:object_r:wifiscanner_service:s0
 wifi                                      u:object_r:wifi_service:s0
-wificond                                  u:object_r:wificond_service:s0
+wifinl80211                               u:object_r:wifinl80211_service:s0
 wifiaware                                 u:object_r:wifiaware_service:s0
 wifirtt                                   u:object_r:rttmanager_service:s0
 window                                    u:object_r:window_service:s0
diff --git a/private/servicemanager.te b/private/servicemanager.te
index 9f675a2..6294452 100644
--- a/private/servicemanager.te
+++ b/private/servicemanager.te
@@ -3,3 +3,5 @@
 init_daemon_domain(servicemanager)
 
 read_runtime_log_tags(servicemanager)
+
+set_prop(servicemanager, ctl_interface_start_prop)
diff --git a/private/shell.te b/private/shell.te
index daec360..76ff073 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -34,9 +34,7 @@
 
 # Allow shell binaries to write trace data to Perfetto. Used for testing and
 # cmdline utils.
-allow shell traced:fd use;
-allow shell traced_tmpfs:file { read write getattr map };
-unix_socket_connect(shell, traced_producer, traced)
+perfetto_producer(shell)
 
 domain_auto_trans(shell, vendor_shell_exec, vendor_shell)
 
@@ -74,3 +72,21 @@
 # Allow shell to start and comminicate with lpdumpd.
 set_prop(shell, lpdumpd_prop);
 binder_call(shell, lpdumpd)
+
+# Allow shell to set and read value of properties used for CTS tests of
+# userspace reboot
+set_prop(shell, userspace_reboot_test_prop)
+
+# Allow shell to get encryption policy of /data/local/tmp/, for CTS
+allowxperm shell shell_data_file:dir ioctl {
+  FS_IOC_GET_ENCRYPTION_POLICY
+  FS_IOC_GET_ENCRYPTION_POLICY_EX
+};
+
+# Allow shell to execute simpleperf without a domain transition.
+allow shell simpleperf_exec:file rx_file_perms;
+
+# Allow shell to call perf_event_open for profiling other shell processes, but
+# not the whole system.
+allow shell self:perf_event { open read write kernel };
+neverallow shell self:perf_event ~{ open read write kernel };
diff --git a/private/simpleperf.te b/private/simpleperf.te
new file mode 100644
index 0000000..0639c11
--- /dev/null
+++ b/private/simpleperf.te
@@ -0,0 +1,37 @@
+# Domain used when running /system/bin/simpleperf to profile a specific app.
+# Entered either by the app itself exec-ing the binary, or through
+# simpleperf_app_runner (with shell as its origin). Certain other domains
+# (runas_app, shell) can also exec this binary without a domain transition.
+typeattribute simpleperf coredomain;
+type simpleperf_exec, system_file_type, exec_type, file_type;
+
+domain_auto_trans({ untrusted_app_all -runas_app }, simpleperf_exec, simpleperf)
+
+# When running in this domain, simpleperf is scoped to profiling an individual
+# app. The necessary MAC permissions for profiling are more maintainable and
+# consistent if simpleperf is marked as an app domain as well (as, for example,
+# it will then see the same set of system libraries as the app).
+app_domain(simpleperf)
+untrusted_app_domain(simpleperf)
+
+# Allow ptrace attach to the target app, for reading JIT debug info (using
+# process_vm_readv) during unwinding and symbolization.
+allow simpleperf untrusted_app_all:process ptrace;
+
+# Allow using perf_event_open syscall for profiling the target app.
+allow simpleperf self:perf_event { open read write kernel };
+
+# Allow /proc/<pid> access for the target app (for example, when trying to
+# discover it by cmdline).
+r_dir_file(simpleperf, untrusted_app_all)
+
+# Suppress denial logspam when simpleperf is trying to find a matching process
+# by scanning /proc/<pid>/cmdline files. The /proc/<pid> directories are within
+# the same domain as their respective processes, most of which this domain is
+# not allowed to see.
+dontaudit simpleperf domain:dir search;
+
+# Neverallows:
+
+# Profiling must be confined to the scope of an individual app.
+neverallow simpleperf self:perf_event ~{ open read write kernel };
diff --git a/private/snapshotctl.te b/private/snapshotctl.te
new file mode 100644
index 0000000..fb2bbca
--- /dev/null
+++ b/private/snapshotctl.te
@@ -0,0 +1,45 @@
+type snapshotctl, domain, coredomain;
+type snapshotctl_exec, system_file_type, exec_type, file_type;
+
+# Allow init to run snapshotctl and do auto domain transfer.
+init_daemon_domain(snapshotctl);
+
+# Allow to start gsid service.
+set_prop(snapshotctl, ctl_gsid_prop)
+
+# Allow to talk to gsid.
+binder_use(snapshotctl)
+allow snapshotctl gsi_service:service_manager find;
+binder_call(snapshotctl, gsid)
+
+# Allow to create/read/write/delete OTA metadata files for snapshot status and COW file status.
+allow snapshotctl metadata_file:dir search;
+allow snapshotctl ota_metadata_file:dir rw_dir_perms;
+allow snapshotctl ota_metadata_file:file create_file_perms;
+
+# Allow to get A/B slot suffix from device tree or kernel cmdline.
+r_dir_file(snapshotctl, sysfs_dt_firmware_android);
+allow snapshotctl proc_cmdline:file r_file_perms;
+
+# Needed to (re-)map logical partitions.
+allow snapshotctl block_device:dir r_dir_perms;
+allow snapshotctl super_block_device:blk_file r_file_perms;
+
+# Interact with device-mapper to collapse snapshots.
+allow snapshotctl dm_device:chr_file rw_file_perms;
+
+# Needed to mutate device-mapper nodes.
+allow snapshotctl self:global_capability_class_set sys_admin;
+
+# Snapshotctl talk to boot control HAL to set merge status.
+hwbinder_use(snapshotctl)
+hal_client_domain(snapshotctl, hal_bootctl)
+
+# Allow snapshotctl to write to statsd socket.
+unix_socket_send(snapshotctl, statsdw, statsd)
+
+# Logging
+userdebug_or_eng(`
+  allow snapshotctl snapshotctl_log_data_file:dir rw_dir_perms;
+  allow snapshotctl snapshotctl_log_data_file:file create_file_perms;
+')
diff --git a/private/stats.te b/private/stats.te
index 81ec1cf..3e8a3d5 100644
--- a/private/stats.te
+++ b/private/stats.te
@@ -40,12 +40,15 @@
 neverallow {
   domain
   -dumpstate
+  -gmscore_app
+  -gpuservice
   -incidentd
   -platform_app
   -priv_app
   -shell
   -stats
   -statsd
+  -surfaceflinger
   -system_app
   -system_server
   -traceur_app
diff --git a/private/statsd.te b/private/statsd.te
index 9d250bd..1483156 100644
--- a/private/statsd.te
+++ b/private/statsd.te
@@ -1,10 +1,7 @@
 typeattribute statsd coredomain;
-typeattribute statsd stats_service_server;
 
 init_daemon_domain(statsd)
 
-binder_call(statsd, statscompanion_service)
-
 # Allow to exec the perfetto cmdline client and pass it the trace config on
 # stdint through a pipe. It allows statsd to  capture traces and hand them
 # to Android dropbox.
@@ -21,3 +18,6 @@
 
 # Allow StatsCompanionService to pipe data to statsd.
 allow statsd system_server:fifo_file { read getattr };
+
+# Allow statsd to retrieve SF statistics over binder
+binder_call(statsd, surfaceflinger);
diff --git a/private/storaged.te b/private/storaged.te
index 3ed24b2..b7d4ae9 100644
--- a/private/storaged.te
+++ b/private/storaged.te
@@ -30,6 +30,12 @@
 
 # Needed for GMScore to call dumpsys storaged
 allow storaged priv_app:fd use;
+# b/142672293: No other priv-app should need this allow rule now that GMS core runs in its own domain.
+# Remove after no logs are seen for this rule.
+userdebug_or_eng(`
+  auditallow storaged priv_app:fd use;
+')
+allow storaged gmscore_app:fd use;
 allow storaged { privapp_data_file app_data_file }:file write;
 allow storaged permission_service:service_manager find;
 
diff --git a/private/surfaceflinger.te b/private/surfaceflinger.te
index 1236627..97203ba 100644
--- a/private/surfaceflinger.te
+++ b/private/surfaceflinger.te
@@ -19,6 +19,7 @@
 hal_client_domain(surfaceflinger, hal_omx)
 hal_client_domain(surfaceflinger, hal_configstore)
 hal_client_domain(surfaceflinger, hal_power)
+hal_client_domain(surfaceflinger, hal_bufferhub)
 allow surfaceflinger hidl_token_hwservice:hwservice_manager find;
 
 # Perform Binder IPC.
@@ -26,6 +27,7 @@
 binder_call(surfaceflinger, binderservicedomain)
 binder_call(surfaceflinger, appdomain)
 binder_call(surfaceflinger, bootanim)
+binder_call(surfaceflinger, system_server);
 binder_service(surfaceflinger)
 
 # Binder IPC to bu, presently runs in adbd domain.
@@ -66,6 +68,9 @@
   allow surfaceflinger wm_trace_data_file:file { getattr setattr create w_file_perms };
 ')
 
+# Needed to register as a Perfetto producer.
+perfetto_producer(surfaceflinger)
+
 # Use socket supplied by adbd, for cmd gpu vkjson etc.
 allow surfaceflinger adbd:unix_stream_socket { read write getattr };
 
@@ -110,6 +115,17 @@
 pdx_client(surfaceflinger, bufferhub_client)
 pdx_client(surfaceflinger, performance_client)
 
+# Allow supplying timestats statistics to statsd
+allow surfaceflinger stats_service:service_manager find;
+allow surfaceflinger statsmanager_service:service_manager find;
+# TODO(146461633): remove this once native pullers talk to StatsManagerService
+binder_call(surfaceflinger, statsd);
+
+# Allow pushing jank event atoms to statsd
+userdebug_or_eng(`
+    unix_socket_send(surfaceflinger, statsdw, statsd)
+')
+
 ###
 ### Neverallow rules
 ###
diff --git a/private/system_app.te b/private/system_app.te
index 9ed1d36..e59e7ad 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -69,6 +69,12 @@
 # Settings need to access app name and icon from asec
 allow system_app asec_apk_file:file r_file_perms;
 
+# Allow system_app (adb data loader) to write data to /data/incremental
+allow system_app apk_data_file:file write;
+
+# Allow system app (adb data loader) to read logs
+allow system_app incremental_control_file:file r_file_perms;
+
 # Allow system apps (like Settings) to interact with statsd
 binder_call(system_app, statsd)
 
@@ -78,6 +84,9 @@
 # Allow system apps to interact with gpuservice
 binder_call(system_app, gpuservice)
 
+# Allow system app to interact with Dumpstate HAL
+hal_client_domain(system_app, hal_dumpstate)
+
 allow system_app servicemanager:service_manager list;
 # TODO: scope this down? Too broad?
 allow system_app {
@@ -93,6 +102,7 @@
   -virtual_touchpad_service
   -vold_service
   -vr_hwc_service
+  -default_android_service
 }:service_manager find;
 # suppress denials for services system_app should not be accessing.
 dontaudit system_app {
@@ -149,3 +159,10 @@
 
 # app domains which access /dev/fuse should not run as system_app
 neverallow system_app fuse_device:chr_file *;
+
+# Apps which run as UID=system should not rely on any attacker controlled
+# filesystem locations, such as /data/local/tmp. For /data/local/tmp, we
+# allow writes to files passed by file descriptor to support dumpstate and
+# bug reports, but not reads.
+neverallow system_app shell_data_file:dir { no_w_dir_perms open search read };
+neverallow system_app shell_data_file:file { open read ioctl lock };
diff --git a/private/system_server.te b/private/system_server.te
index 73891c9..5533d42 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -7,6 +7,7 @@
 typeattribute system_server mlstrustedsubject;
 typeattribute system_server scheduler_service_server;
 typeattribute system_server sensor_service_server;
+typeattribute system_server stats_service_server;
 
 # Define a type for tmpfs-backed ashmem regions.
 tmpfs_domain(system_server)
@@ -14,9 +15,22 @@
 # Create a socket for connections from crash_dump.
 type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";
 
+# Create a socket for connections from zygotes.
+type_transition system_server system_data_file:sock_file system_unsolzygote_socket "unsolzygotesocket";
+
 allow system_server zygote_tmpfs:file read;
 allow system_server appdomain_tmpfs:file { getattr map read write };
 
+# For Incremental Service to check if incfs is available
+allow system_server proc_filesystems:file r_file_perms;
+
+# To create files and get permission to fill blocks on Incremental File System
+allow system_server incremental_control_file:file { ioctl r_file_perms };
+allowxperm system_server incremental_control_file:file ioctl { INCFS_IOCTL_CREATE_FILE INCFS_IOCTL_PERMIT_FILL };
+
+# To get signature of an APK installed on Incremental File System and fill in data blocks
+allowxperm system_server apk_data_file:file ioctl { INCFS_IOCTL_READ_SIGNATURE INCFS_IOCTL_FILL_BLOCKS };
+
 # For art.
 allow system_server dalvikcache_data_file:dir r_dir_perms;
 allow system_server dalvikcache_data_file:file r_file_perms;
@@ -37,10 +51,12 @@
 allow system_server zygote:process sigchld;
 
 # May kill zygote on crashes.
-allow system_server zygote:process sigkill;
-allow system_server crash_dump:process sigkill;
-allow system_server webview_zygote:process sigkill;
-allow system_server app_zygote:process sigkill;
+allow system_server {
+  app_zygote
+  crash_dump
+  webview_zygote
+  zygote
+}:process { sigkill signull };
 
 # Read /system/bin/app_process.
 allow system_server zygote_exec:file r_file_perms;
@@ -110,6 +126,8 @@
 
 # Kill apps.
 allow system_server appdomain:process { getpgid sigkill signal };
+# signull allowed for kill(pid, 0) existence test.
+allow system_server appdomain:process { signull };
 
 # Set scheduling info for apps.
 allow system_server appdomain:process { getsched setsched };
@@ -125,6 +143,7 @@
 allow system_server bootanim:process { getsched setsched };
 
 # Set scheduling info for psi monitor thread.
+# TODO: delete this line b/131761776
 allow system_server kernel:process { getsched setsched };
 
 # Allow system_server to write to /proc/<pid>/*
@@ -152,6 +171,9 @@
 # Read /sys/kernel/debug/wakeup_sources.
 allow system_server debugfs_wakeup_sources:file r_file_perms;
 
+# Read /sys/kernel/ion/*.
+allow system_server sysfs_ion:file r_file_perms;
+
 # The DhcpClient and WifiWatchdog use packet_sockets
 allow system_server self:packet_socket create_socket_perms_no_ioctl;
 
@@ -198,13 +220,11 @@
 binder_call(system_server, vold)
 binder_call(system_server, wificond)
 binder_call(system_server, wpantund)
-userdebug_or_eng(`
-  binder_call(system_server, perfprofd)
-')
 binder_service(system_server)
 
 # Use HALs
 hal_client_domain(system_server, hal_allocator)
+hal_client_domain(system_server, hal_audio)
 hal_client_domain(system_server, hal_authsecret)
 hal_client_domain(system_server, hal_broadcastradio)
 hal_client_domain(system_server, hal_codec2)
@@ -224,6 +244,7 @@
 hal_client_domain(system_server, hal_omx)
 hal_client_domain(system_server, hal_power)
 hal_client_domain(system_server, hal_power_stats)
+hal_client_domain(system_server, hal_rebootescrow)
 hal_client_domain(system_server, hal_sensors)
 hal_client_domain(system_server, hal_tetheroffload)
 hal_client_domain(system_server, hal_thermal)
@@ -236,7 +257,6 @@
 hal_client_domain(system_server, hal_weaver)
 hal_client_domain(system_server, hal_wifi)
 hal_client_domain(system_server, hal_wifi_hostapd)
-hal_client_domain(system_server, hal_wifi_offload)
 hal_client_domain(system_server, hal_wifi_supplicant)
 
 # Talk with graphics composer fences
@@ -267,6 +287,7 @@
   mediametrics
   mediaserver
   mediaswcodec
+  netd
   sdcardd
   statsd
   surfaceflinger
@@ -279,6 +300,7 @@
   hal_camera_server
   hal_codec2_server
   hal_face_server
+  hal_fingerprint_server
   hal_graphics_allocator_server
   hal_graphics_composer_server
   hal_health_server
@@ -286,6 +308,7 @@
   hal_power_stats_server
   hal_sensors_server
   hal_vr_server
+  system_suspend_server
 }:process { signal };
 
 # Use sockets received over binder from various services.
@@ -298,6 +321,8 @@
 allow system_server mediadrmserver:tcp_socket rw_socket_perms;
 allow system_server mediadrmserver:udp_socket rw_socket_perms;
 
+userdebug_or_eng(`perfetto_producer({ system_server })')
+
 # Get file context
 allow system_server file_contexts_file:file r_file_perms;
 # access for mac_permissions
@@ -320,7 +345,6 @@
 r_dir_file(system_server, sysfs_wakeup_reasons)
 
 allow system_server sysfs_nfc_power_writable:file rw_file_perms;
-allow system_server sysfs_mac_address:file r_file_perms;
 allow system_server sysfs_power:dir search;
 allow system_server sysfs_power:file rw_file_perms;
 allow system_server sysfs_thermal:dir search;
@@ -424,17 +448,15 @@
 # with no DAC access to it, for dropbox to read.
 allow system_server incident_data_file:file read;
 
+# Manage /data/misc/prereboot.
+allow system_server prereboot_data_file:dir rw_dir_perms;
+allow system_server prereboot_data_file:file create_file_perms;
+
 # Allow dropbox to read /data/misc/perfetto-traces. Only the fd is sent over
 # binder.
 allow system_server perfetto_traces_data_file:file read;
 allow system_server perfetto:fd use;
 
-# Allow dropbox to read /data/misc/perfprofd. Only the fd is sent over binder.
-userdebug_or_eng(`
-  allow system_server perfprofd_data_file:file { getattr read };
-  allow system_server perfprofd:fd use;
-')
-
 # Manage /data/backup.
 allow system_server backup_data_file:dir create_dir_perms;
 allow system_server backup_data_file:file create_file_perms;
@@ -451,6 +473,10 @@
 allow system_server adb_keys_file:dir create_dir_perms;
 allow system_server adb_keys_file:file create_file_perms;
 
+# Manage /data/misc/emergencynumberdb
+allow system_server emergency_data_file:dir create_dir_perms;
+allow system_server emergency_data_file:file create_file_perms;
+
 # Manage /data/misc/network_watchlist
 allow system_server network_watchlist_data_file:dir create_dir_perms;
 allow system_server network_watchlist_data_file:file create_file_perms;
@@ -589,6 +615,7 @@
 set_prop(system_server, exported_overlay_prop)
 set_prop(system_server, pm_prop)
 set_prop(system_server, exported_pm_prop)
+set_prop(system_server, socket_hook_prop)
 userdebug_or_eng(`set_prop(system_server, wifi_log_prop)')
 
 # ctl interface
@@ -606,6 +633,10 @@
 set_prop(system_server, device_config_runtime_native_boot_prop)
 set_prop(system_server, device_config_runtime_native_prop)
 set_prop(system_server, device_config_media_native_prop)
+set_prop(system_server, device_config_storage_native_boot_prop)
+set_prop(system_server, device_config_sys_traced_prop)
+set_prop(system_server, device_config_window_manager_native_boot_prop)
+set_prop(system_server, device_config_configuration_prop)
 
 # BootReceiver to read ro.boot.bootreason
 get_prop(system_server, bootloader_boot_reason_prop)
@@ -635,9 +666,21 @@
 # Read gsid.image_running.
 get_prop(system_server, gsid_prop)
 
+# Read the property that mocks an OTA
+get_prop(system_server, mock_ota_prop)
+
+# Read the property as feature flag for protecting apks with fs-verity.
+get_prop(system_server, apk_verity_prop)
+
+# Read wifi.interface
+get_prop(system_server, wifi_prop)
+
 # Create a socket for connections from debuggerd.
 allow system_server system_ndebug_socket:sock_file create_file_perms;
 
+# Create a socket for connections from zygotes.
+allow system_server system_unsolzygote_socket:sock_file create_file_perms;
+
 # Manage cache files.
 allow system_server cache_file:lnk_file r_file_perms;
 allow system_server { cache_file cache_recovery_file }:dir { relabelfrom create_dir_perms };
@@ -704,6 +747,7 @@
 allow system_server audioserver_service:service_manager find;
 allow system_server batteryproperties_service:service_manager find;
 allow system_server cameraserver_service:service_manager find;
+allow system_server dataloader_manager_service:service_manager find;
 allow system_server dnsresolver_service:service_manager find;
 allow system_server drmserver_service:service_manager find;
 allow system_server dumpstate_service:service_manager find;
@@ -714,13 +758,13 @@
 allow system_server hal_fingerprint_service:service_manager find;
 allow system_server idmap_service:service_manager find;
 allow system_server incident_service:service_manager find;
+allow system_server incremental_service:service_manager find;
 allow system_server installd_service:service_manager find;
 allow system_server iorapd_service:service_manager find;
 allow system_server keystore_service:service_manager find;
 allow system_server mediaserver_service:service_manager find;
 allow system_server mediametrics_service:service_manager find;
 allow system_server mediaextractor_service:service_manager find;
-allow system_server mediacodec_service:service_manager find;
 allow system_server mediadrmserver_service:service_manager find;
 allow system_server netd_service:service_manager find;
 allow system_server nfc_service:service_manager find;
@@ -730,10 +774,7 @@
 allow system_server surfaceflinger_service:service_manager find;
 allow system_server update_engine_service:service_manager find;
 allow system_server vold_service:service_manager find;
-allow system_server wificond_service:service_manager find;
-userdebug_or_eng(`
-  allow system_server perfprofd_service:service_manager find;
-')
+allow system_server wifinl80211_service:service_manager find;
 
 add_service(system_server, batteryproperties_service)
 
@@ -786,9 +827,6 @@
 allow system_server fingerprintd_data_file:dir { r_dir_perms remove_name rmdir relabelto write };
 allow system_server fingerprintd_data_file:file { getattr unlink };
 
-# Allow system process to read network MAC address
-allow system_server sysfs_mac_address:file r_file_perms;
-
 userdebug_or_eng(`
   # Allow system server to create and write method traces in /data/misc/trace.
   allow system_server method_trace_data_file:dir w_dir_perms;
@@ -817,6 +855,12 @@
 allow system_server adbd:fd use;
 allow system_server adbd:unix_stream_socket { getattr getopt ioctl read write shutdown };
 
+# Read service.adb.tls.port, persist.adb.wifi. properties
+get_prop(system_server, adbd_prop)
+
+# Set persist.adb.tls_server.enable property
+set_prop(system_server, system_adbd_prop)
+
 # Allow invoking tools like "timeout"
 allow system_server toolbox_exec:file rx_file_perms;
 
@@ -872,6 +916,9 @@
 allow system_server debugfs_wifi_tracing:dir search;
 allow system_server debugfs_wifi_tracing:file rw_file_perms;
 
+# Allow system_server to read tracepoint ids in order to attach BPF programs to them.
+allow system_server debugfs_tracing:file r_file_perms;
+
 # allow system_server to exec shell, asanwrapper & zygote(app_process) on ASAN builds. Needed to run
 # asanwrapper.
 with_asan(`
@@ -881,10 +928,11 @@
 ')
 
 # allow system_server to read the eBPF maps that stores the traffic stats information and update
-# the map after snapshot is recorded
+# the map after snapshot is recorded, and to read, update and run the maps and programs used for
+# time in state accounting
 allow system_server fs_bpf:dir search;
 allow system_server fs_bpf:file { read write };
-allow system_server bpfloader:bpf { map_read map_write };
+allow system_server bpfloader:bpf { map_read map_write prog_run };
 
 # ART Profiles.
 # Allow system_server to open profile snapshots for read.
@@ -902,6 +950,8 @@
 userdebug_or_eng(`
   allow system_server user_profile_data_file:file create_file_perms;
 ')
+# Allow system server to load JVMTI agents under control of a property.
+get_prop(system_server,system_jvmti_agent_prop)
 
 # UsbDeviceManager uses /dev/usb-ffs
 allow system_server functionfs:dir search;
@@ -910,6 +960,10 @@
 # system_server contains time / time zone detection logic so reads the associated properties.
 get_prop(system_server, time_prop)
 
+# system_server reads this property to know it should expect the lmkd sends notification to it
+# on low memory kills.
+get_prop(system_server, system_lmk_prop)
+
 ###
 ### Neverallow rules
 ###
@@ -952,6 +1006,16 @@
 # Only allow crash_dump to connect to system_ndebug_socket.
 neverallow { domain -init -system_server -crash_dump } system_ndebug_socket:sock_file { open write };
 
+# Only allow zygotes to connect to system_unsolzygote_socket.
+neverallow {
+  domain
+  -init
+  -system_server
+  -zygote
+  -app_zygote
+  -webview_zygote
+} system_unsolzygote_socket:sock_file { open write };
+
 # Only allow init, system_server, flags_health_check to set properties for server configurable flags
 neverallow {
   domain
@@ -965,6 +1029,9 @@
   device_config_runtime_native_boot_prop
   device_config_runtime_native_prop
   device_config_media_native_prop
+  device_config_storage_native_boot_prop
+  device_config_sys_traced_prop
+  device_config_window_manager_native_boot_prop
 }:property_service set;
 
 # system_server should never be executing dex2oat. This is either
@@ -986,8 +1053,13 @@
 # system_server should never use JIT functionality
 # See https://googleprojectzero.blogspot.com/2016/12/bitunmap-attacking-android-ashmem.html
 # in the section titled "A Short ROP Chain" for why.
-neverallow system_server self:process execmem;
-neverallow system_server ashmem_device:chr_file execute;
+# However, in emulator builds without OpenGL passthrough, we use software
+# rendering via SwiftShader, which requires JIT support. These builds are
+# never shipped to users.
+ifelse(target_requires_insecure_execmem_for_swiftshader, `true',
+  `allow system_server self:process execmem;',
+  `neverallow system_server self:process execmem;')
+neverallow system_server { ashmem_device ashmem_libcutils_device }:chr_file execute;
 
 # TODO: deal with tmpfs_domain pub/priv split properly
 neverallow system_server system_server_tmpfs:file execute;
@@ -1001,6 +1073,9 @@
 allow system_server apex_service:service_manager find;
 allow system_server apexd:binder call;
 
+# Allow system server to scan /apex for flattened APEXes
+allow system_server apex_mnt_dir:dir r_dir_perms;
+
 # Allow system server to communicate to system-suspend's control interface
 allow system_server system_suspend_control_service:service_manager find;
 binder_call(system_server, system_suspend)
@@ -1016,12 +1091,39 @@
 allow system_server apex_data_file:dir { getattr search };
 allow system_server apex_data_file:file r_file_perms;
 
+# Allow the system server to read files under /vendor/apex. This is where
+# vendor APEX packages might be installed and system_server needs to parse
+# these packages to inspect the signatures and other metadata.
+allow system_server vendor_apex_file:dir { getattr search };
+allow system_server vendor_apex_file:file r_file_perms;
+
+# Allow the system server to manage relevant apex module data files.
+allow system_server apex_module_data_file:dir { getattr search };
+allow system_server apex_permission_data_file:dir create_dir_perms;
+allow system_server apex_permission_data_file:file create_file_perms;
+allow system_server apex_wifi_data_file:dir create_dir_perms;
+allow system_server apex_wifi_data_file:file create_file_perms;
+
 # Allow PasswordSlotManager rw access to /metadata/password_slots, so GSIs and the host image can
 # communicate which slots are available for use.
 allow system_server metadata_file:dir search;
 allow system_server password_slot_metadata_file:dir rw_dir_perms;
 allow system_server password_slot_metadata_file:file create_file_perms;
 
+# Allow init to set sysprop used to compute stats about userspace reboot.
+set_prop(system_server, userspace_reboot_log_prop)
+
+# JVMTI agent settings are only readable from the system server.
+neverallow {
+  domain
+  -system_server
+  -dumpstate
+  -init
+  -vendor_init
+} {
+  system_jvmti_agent_prop
+}:file no_rw_file_perms;
+
 # Read/Write /proc/pressure/memory
 allow system_server proc_pressure_mem:file rw_file_perms;
 
@@ -1044,3 +1146,16 @@
   -system_server
 } password_slot_metadata_file:notdevfile_class_set ~{ relabelto getattr };
 neverallow { domain -init -system_server } password_slot_metadata_file:notdevfile_class_set *;
+
+# Allow systemserver to read/write the invalidation property
+set_prop(system_server, binder_cache_system_server_prop)
+neverallow { domain -system_server -init }
+    binder_cache_system_server_prop:property_service set;
+
+# Allow system server to attach BPF programs to tracepoints. Deny read permission so that
+# system_server cannot use this access to read perf event data like process stacks.
+allow system_server self:perf_event { open write cpu kernel };
+neverallow system_server self:perf_event ~{ open write cpu kernel };
+
+# Do not allow any domain other than init or system server to set the property
+neverallow { domain -init -system_server } socket_hook_prop:property_service set;
diff --git a/private/system_server_startup.te b/private/system_server_startup.te
index f1427a9..902941e 100644
--- a/private/system_server_startup.te
+++ b/private/system_server_startup.te
@@ -7,13 +7,6 @@
 allow system_server_startup self:process execmem;
 allow system_server_startup system_server_startup_tmpfs:file { execute read write open map };
 
-# Allow to pick up integrity-checked artifacts from the dalvik cache.
-allow system_server_startup dalvikcache_data_file:dir r_dir_perms;
-allow system_server_startup dalvikcache_data_file:file { r_file_perms execute };
-
-# While doing the above, will touch the apex mount dir.
-allow system_server_startup mnt_expand_file:dir getattr;
-
 # Allow system_server_startup to run setcon() and enter the
 # system_server domain
 allow system_server_startup self:process setcurrent;
diff --git a/private/system_suspend.te b/private/system_suspend.te
index 961cd67..d33dc8e 100644
--- a/private/system_suspend.te
+++ b/private/system_suspend.te
@@ -10,10 +10,11 @@
 # Access to /sys/power/{ wakeup_count, state } suspend interface.
 allow system_suspend sysfs_power:file rw_file_perms;
 
-# TODO(b/128923994): remove once all debugging info moves to SystemSuspend.
-# Access to /sys/power/{ wake_lock, wake_unlock } suspend blocker interface.
-allow system_suspend self:global_capability2_class_set block_suspend;
-allow system_suspend sysfs_wake_lock:file rw_file_perms;
+# Access to wakeup and suspend stats.
+r_dir_file(system_suspend, sysfs_suspend_stats)
+r_dir_file(system_suspend, sysfs_wakeup)
+# To resolve arbitrary sysfs paths from /sys/class/wakeup/* symlinks.
+allow system_suspend sysfs_type:dir search;
 
 neverallow {
     domain
diff --git a/private/technical_debt.cil b/private/technical_debt.cil
index 289f69e..fdcd0a3 100644
--- a/private/technical_debt.cil
+++ b/private/technical_debt.cil
@@ -20,6 +20,10 @@
 ; Unfortunately, we can't currently express this in module policy language:
 (typeattributeset hal_codec2_client ((and (appdomain) ((not (isolated_app))))))
 
+; Apps, except isolated apps, are clients of Drm-related services
+; Unfortunately, we can't currently express this in module policy language:
+(typeattributeset hal_drm_client ((and (appdomain) ((not (isolated_app))))))
+
 ; Apps, except isolated apps, are clients of Configstore HAL
 ; Unfortunately, we can't currently express this in module policy language:
 ;     typeattribute { appdomain -isolated_app } hal_configstore_client;
diff --git a/private/traced.te b/private/traced.te
index 2d7d07f..7ecfb7f 100644
--- a/private/traced.te
+++ b/private/traced.te
@@ -36,6 +36,23 @@
 allow traced iorapd:fd use;
 allow traced iorapd_tmpfs:file { read write };
 
+# Allow traced to use shared memory supplied by producers. Typically, traced
+# (i.e. the tracing service) creates the shared memory used for data transfer
+# from the producer. This rule allows an alternative scheme, where the producer
+# creates the shared memory, that is then adopted by traced (after validating
+# that it is appropriately sealed).
+# This list has to replicate the tmpfs domains of all applicable domains that
+# have perfetto_producer() macro applied to them.
+# perfetto_tmpfs excluded as it should never need to use the producer-supplied
+# shared memory scheme.
+allow traced  {
+  appdomain_tmpfs
+  heapprofd_tmpfs
+  surfaceflinger_tmpfs
+  traced_probes_tmpfs
+  userdebug_or_eng(`system_server_tmpfs')
+}:file { getattr map read write };
+
 # Allow traced to notify Traceur when a trace ends by setting the
 # sys.trace.trace_end_signal property.
 set_prop(traced, system_trace_prop)
@@ -62,6 +79,7 @@
 neverallow traced {
   data_file_type
   -system_data_file
+  -system_data_root_file
   # TODO(b/72998741) Remove vendor_data_file exemption. Further restricted in a
   # subsequent neverallow. Currently only getattr and search are allowed.
   -vendor_data_file
diff --git a/private/traced_perf.te b/private/traced_perf.te
new file mode 100644
index 0000000..9483e6c
--- /dev/null
+++ b/private/traced_perf.te
@@ -0,0 +1,58 @@
+# Performance profiler, backed by perf_event_open(2).
+# See go/perfetto-perf-android.
+typeattribute traced_perf coredomain;
+typeattribute traced_perf mlstrustedsubject;
+
+type traced_perf_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(traced_perf)
+perfetto_producer(traced_perf)
+
+# Allow traced_perf full use of perf_event_open(2). It will perform cpu-wide
+# profiling, but retain samples only for profileable processes.
+# Thread-specific profiling is still disallowed due to a PTRACE_MODE_ATTACH
+# check (which would require a process:attach SELinux allow-rule).
+allow traced_perf self:perf_event { open cpu kernel read write tracepoint };
+
+# Allow CAP_KILL for delivery of dedicated signal to obtain proc-fds from a
+# process. Allow CAP_DAC_READ_SEARCH for stack unwinding and symbolization of
+# sampled stacks, which requires opening the backing libraries/executables (as
+# symbols are usually not mapped into the process space). Not all such files
+# are world-readable, e.g. odex files that included user profiles during
+# profile-guided optimization.
+allow traced_perf self:capability { kill dac_read_search };
+
+# Allow reading /system/data/packages.list.
+allow traced_perf packages_list_file:file r_file_perms;
+
+# Allow reading files for stack unwinding and symbolization.
+r_dir_file(traced_perf, nativetest_data_file)
+r_dir_file(traced_perf, system_file_type)
+r_dir_file(traced_perf, apk_data_file)
+r_dir_file(traced_perf, dalvikcache_data_file)
+r_dir_file(traced_perf, vendor_file_type)
+
+# Do not audit the cases where traced_perf attempts to access /proc/[pid] for
+# domains that it cannot read.
+dontaudit traced_perf domain:dir { search getattr open };
+
+# Do not audit failures to signal a process, as there are cases when this is
+# expected (native processes on debug builds use the policy for enforcing which
+# processes are profileable).
+dontaudit traced_perf domain:process signal;
+
+# Never allow access to app data files
+neverallow traced_perf { app_data_file privapp_data_file system_app_data_file }:file *;
+
+# Never allow profiling highly privileged processes.
+never_profile_heap(`{
+  bpfloader
+  init
+  kernel
+  keystore
+  llkd
+  logd
+  ueventd
+  vendor_init
+  vold
+}')
diff --git a/private/traced_probes.te b/private/traced_probes.te
index 4820e3f..dd6ece0 100644
--- a/private/traced_probes.te
+++ b/private/traced_probes.te
@@ -1,14 +1,14 @@
 # Perfetto tracing probes, has tracefs access.
 type traced_probes_exec, system_file_type, exec_type, file_type;
+type traced_probes_tmpfs, file_type;
 
 # Allow init to exec the daemon.
 init_daemon_domain(traced_probes)
+tmpfs_domain(traced_probes)
 
 # Write trace data to the Perfetto traced damon. This requires connecting to its
 # producer socket and obtaining a (per-process) tmpfs fd.
-allow traced_probes traced:fd use;
-allow traced_probes traced_tmpfs:file { read write getattr map };
-unix_socket_connect(traced_probes, traced_producer, traced)
+perfetto_producer(traced_probes)
 
 # Allow traced_probes to access tracefs.
 allow traced_probes debugfs_tracing:dir r_dir_perms;
@@ -74,6 +74,9 @@
 hal_client_domain(traced_probes, hal_health)
 hal_client_domain(traced_probes, hal_power_stats)
 
+# Allow access to Atrace HAL for enabling vendor/device specific tracing categories.
+hal_client_domain(traced_probes, hal_atrace)
+
 # On debug builds allow to ingest system logs into the trace.
 userdebug_or_eng(`read_logd(traced_probes)')
 
@@ -98,6 +101,7 @@
   -apk_data_file
   -dalvikcache_data_file
   -system_data_file
+  -system_data_root_file
   -system_app_data_file
   -backup_data_file
   -bootstat_data_file
diff --git a/private/untrusted_app.te b/private/untrusted_app.te
index c15fa22..6e7a99c 100644
--- a/private/untrusted_app.te
+++ b/private/untrusted_app.te
@@ -1,20 +1,11 @@
 ###
 ### Untrusted apps.
 ###
-### This file defines the rules for untrusted apps.
-### Apps are labeled based on mac_permissions.xml (maps signer and
-### optionally package name to seinfo value) and seapp_contexts (maps UID
-### and optionally seinfo value to domain for process and type for data
-### directory).  The untrusted_app domain is the default assignment in
-### seapp_contexts for any app with UID between APP_AID (10000)
-### and AID_ISOLATED_START (99000) if the app has no specific seinfo
-### value as determined from mac_permissions.xml.  In current AOSP, this
-### domain is assigned to all non-system apps as well as to any system apps
-### that are not signed by the platform key.  To move
-### a system app into a specific domain, add a signer entry for it to
-### mac_permissions.xml and assign it one of the pre-existing seinfo values
-### or define and use a new seinfo value in both mac_permissions.xml and
-### seapp_contexts.
+### This file defines the rules for untrusted apps running with
+### targetSdkVersion >= 30.
+###
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
 ###
 
 typeattribute untrusted_app coredomain;
diff --git a/private/untrusted_app_25.te b/private/untrusted_app_25.te
index a35d81b..a1abc41 100644
--- a/private/untrusted_app_25.te
+++ b/private/untrusted_app_25.te
@@ -4,19 +4,8 @@
 ### This file defines the rules for untrusted apps running with
 ### targetSdkVersion <= 25.
 ###
-### Apps are labeled based on mac_permissions.xml (maps signer and
-### optionally package name to seinfo value) and seapp_contexts (maps UID
-### and optionally seinfo value to domain for process and type for data
-### directory).  The untrusted_app domain is the default assignment in
-### seapp_contexts for any app with UID between APP_AID (10000)
-### and AID_ISOLATED_START (99000) if the app has no specific seinfo
-### value as determined from mac_permissions.xml.  In current AOSP, this
-### domain is assigned to all non-system apps as well as to any system apps
-### that are not signed by the platform key.  To move
-### a system app into a specific domain, add a signer entry for it to
-### mac_permissions.xml and assign it one of the pre-existing seinfo values
-### or define and use a new seinfo value in both mac_permissions.xml and
-### seapp_contexts.
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
 ###
 
 typeattribute untrusted_app_25 coredomain;
@@ -26,11 +15,6 @@
 net_domain(untrusted_app_25)
 bluetooth_domain(untrusted_app_25)
 
-# b/34115651, b/33308258 - net.dns* properties read
-# This will go away in a future Android release
-get_prop(untrusted_app_25, net_dns_prop)
-auditallow untrusted_app_25 net_dns_prop:file read;
-
 # b/35917228 - /proc/misc access
 # This will go away in a future Android release
 allow untrusted_app_25 proc_misc:file r_file_perms;
@@ -61,3 +45,9 @@
 # ASharedMemory instead.
 allow untrusted_app_25 ashmem_device:chr_file rw_file_perms;
 auditallow untrusted_app_25 ashmem_device:chr_file open;
+
+# Read /mnt/sdcard symlink.
+allow untrusted_app_25 mnt_sdcard_file:lnk_file r_file_perms;
+
+# allow binding to netlink route sockets and sending RTM_GETLINK messages.
+allow untrusted_app_25 self:netlink_route_socket { bind nlmsg_readpriv };
diff --git a/private/untrusted_app_27.te b/private/untrusted_app_27.te
index eaa1791..b7b6d72 100644
--- a/private/untrusted_app_27.te
+++ b/private/untrusted_app_27.te
@@ -4,20 +4,8 @@
 ### This file defines the rules for untrusted apps running with
 ### 25 < targetSdkVersion <= 28.
 ###
-### This file defines the rules for untrusted apps.
-### Apps are labeled based on mac_permissions.xml (maps signer and
-### optionally package name to seinfo value) and seapp_contexts (maps UID
-### and optionally seinfo value to domain for process and type for data
-### directory).  The untrusted_app_27 domain is the default assignment in
-### seapp_contexts for any app with UID between APP_AID (10000)
-### and AID_ISOLATED_START (99000) if the app has no specific seinfo
-### value as determined from mac_permissions.xml.  In current AOSP, this
-### domain is assigned to all non-system apps as well as to any system apps
-### that are not signed by the platform key.  To move
-### a system app into a specific domain, add a signer entry for it to
-### mac_permissions.xml and assign it one of the pre-existing seinfo values
-### or define and use a new seinfo value in both mac_permissions.xml and
-### seapp_contexts.
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
 ###
 
 typeattribute untrusted_app_27 coredomain;
@@ -45,3 +33,9 @@
 # ASharedMemory instead.
 allow untrusted_app_27 ashmem_device:chr_file rw_file_perms;
 auditallow untrusted_app_27 ashmem_device:chr_file open;
+
+# Read /mnt/sdcard symlink.
+allow untrusted_app_27 mnt_sdcard_file:lnk_file r_file_perms;
+
+# allow binding to netlink route sockets and sending RTM_GETLINK messages.
+allow untrusted_app_27 self:netlink_route_socket { bind nlmsg_readpriv };
diff --git a/private/untrusted_app_29.te b/private/untrusted_app_29.te
new file mode 100644
index 0000000..344ae89
--- /dev/null
+++ b/private/untrusted_app_29.te
@@ -0,0 +1,19 @@
+###
+### Untrusted_29.
+###
+### This file defines the rules for untrusted apps running with
+### targetSdkVersion = 29.
+###
+### See public/untrusted_app.te for more information about which apps are
+### placed in this selinux domain.
+###
+
+typeattribute untrusted_app_29 coredomain;
+
+app_domain(untrusted_app_29)
+untrusted_app_domain(untrusted_app_29)
+net_domain(untrusted_app_29)
+bluetooth_domain(untrusted_app_29)
+
+# allow binding to netlink route sockets and sending RTM_GETLINK messages.
+allow untrusted_app_29 self:netlink_route_socket { bind nlmsg_readpriv };
diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index 89fb6cb..d9fd5a1 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -92,7 +92,6 @@
 allow untrusted_app_all drmserver_service:service_manager find;
 allow untrusted_app_all mediaserver_service:service_manager find;
 allow untrusted_app_all mediaextractor_service:service_manager find;
-allow untrusted_app_all mediacodec_service:service_manager find;
 allow untrusted_app_all mediametrics_service:service_manager find;
 allow untrusted_app_all mediadrmserver_service:service_manager find;
 allow untrusted_app_all nfc_service:service_manager find;
@@ -104,14 +103,6 @@
 # Allow untrusted apps to interact with gpuservice
 binder_call(untrusted_app_all, gpuservice)
 
-# Allow GMS core to access perfprofd output, which is stored
-# in /data/misc/perfprofd/. GMS core will need to list all
-# data stored in that directory to process them one by one.
-userdebug_or_eng(`
-  allow untrusted_app_all perfprofd_data_file:file r_file_perms;
-  allow untrusted_app_all perfprofd_data_file:dir r_dir_perms;
-')
-
 # gdbserver for ndk-gdb ptrace attaches to app process.
 allow untrusted_app_all self:process ptrace;
 
@@ -144,13 +135,11 @@
 
 # Write app-specific trace data to the Perfetto traced damon. This requires
 # connecting to its producer socket and obtaining a (per-process) tmpfs fd.
-allow untrusted_app_all traced:fd use;
-allow untrusted_app_all traced_tmpfs:file { read write getattr map };
-unix_socket_connect(untrusted_app_all, traced_producer, traced)
+perfetto_producer(untrusted_app_all)
 
-# Allow heap profiling if the app opts in by being marked
-# profileable/debuggable.
+# Allow profiling if the app opts in by being marked profileable/debuggable.
 can_profile_heap(untrusted_app_all)
+can_profile_perf(untrusted_app_all)
 
 # allow untrusted apps to use UDP sockets provided by the system server but not
 # modify them other than to connect
@@ -180,6 +169,7 @@
   allowxperm untrusted_app_all debugfs_kcov:file ioctl { KCOV_INIT_TRACE KCOV_ENABLE KCOV_DISABLE };
 ')
 
-# Allow access to ashmemd to request /dev/ashmem fds.
-binder_call(untrusted_app_all, ashmemd)
-allow untrusted_app_all ashmem_device:chr_file { getattr read ioctl lock map append write };
+# Allow signalling simpleperf domain, which is the domain that the simpleperf
+# profiler runs as when executed by the app. The signals are used to control
+# the profiler (which would be profiling the app that is sending the signal).
+allow untrusted_app_all simpleperf:process signal;
diff --git a/private/update_engine.te b/private/update_engine.te
index 5af7db6..e4e7009 100644
--- a/private/update_engine.te
+++ b/private/update_engine.te
@@ -1,3 +1,7 @@
 typeattribute update_engine coredomain;
 
 init_daemon_domain(update_engine);
+
+# Allow to talk to gsid.
+allow update_engine gsi_service:service_manager find;
+binder_call(update_engine, gsid)
diff --git a/private/vendor_init.te b/private/vendor_init.te
index 50efc22..6a68f1f 100644
--- a/private/vendor_init.te
+++ b/private/vendor_init.te
@@ -2,3 +2,6 @@
 # Sometimes we have to write to non-existent files to avoid conditional
 # init behavior. See b/35303861 for an example.
 dontaudit vendor_init sysfs:dir write;
+
+# TODO(b/140259336) We want to remove vendor_init in the long term but allow for now
+allow vendor_init system_data_root_file:dir rw_dir_perms;
diff --git a/private/viewcompiler.te b/private/viewcompiler.te
index 3c9c1ee..d1f0964 100644
--- a/private/viewcompiler.te
+++ b/private/viewcompiler.te
@@ -17,7 +17,7 @@
 allow viewcompiler app_data_file:file { getattr write };
 
 # Allow the view compiler to read resources from the apps APK.
-allow viewcompiler apk_data_file:file read;
+allow viewcompiler apk_data_file:file { read map };
 
 # priv-apps are moving to a world where they can only execute
 # signed code. Make sure viewcompiler never can write to privapp
diff --git a/private/vold_prepare_subdirs.te b/private/vold_prepare_subdirs.te
index 348d3ce..f3ec058 100644
--- a/private/vold_prepare_subdirs.te
+++ b/private/vold_prepare_subdirs.te
@@ -14,6 +14,10 @@
   vendor_data_file
 }:dir { open read write add_name remove_name rmdir relabelfrom };
 allow vold_prepare_subdirs {
+    apex_module_data_file
+    apex_permission_data_file
+    apex_rollback_data_file
+    apex_wifi_data_file
     backup_data_file
     face_vendor_data_file
     fingerprint_vendor_data_file
@@ -23,6 +27,10 @@
     vold_data_file
 }:dir { create_dir_perms relabelto };
 allow vold_prepare_subdirs {
+    apex_module_data_file
+    apex_permission_data_file
+    apex_rollback_data_file
+    apex_wifi_data_file
     backup_data_file
     face_vendor_data_file
     fingerprint_vendor_data_file
@@ -32,5 +40,6 @@
     system_data_file
     vold_data_file
 }:file { getattr unlink };
+allow vold_prepare_subdirs apex_mnt_dir:dir { open read };
 
 dontaudit vold_prepare_subdirs { proc unlabeled }:file r_file_perms;
diff --git a/private/vzwomatrigger_app.te b/private/vzwomatrigger_app.te
new file mode 100644
index 0000000..8deb22b
--- /dev/null
+++ b/private/vzwomatrigger_app.te
@@ -0,0 +1,6 @@
+###
+### A domain for further sandboxing the VzwOmaTrigger app.
+###
+type vzwomatrigger_app, domain;
+
+app_domain(vzwomatrigger_app)
diff --git a/private/webview_zygote.te b/private/webview_zygote.te
index 2f5007a..969ab9c 100644
--- a/private/webview_zygote.te
+++ b/private/webview_zygote.te
@@ -64,8 +64,8 @@
 # Directory listing in /system.
 allow webview_zygote system_file:dir r_dir_perms;
 
-# Read system properties managed by zygote.
-allow webview_zygote zygote_tmpfs:file read;
+# Read and inspect temporary files (like system properties) managed by zygote.
+allow webview_zygote zygote_tmpfs:file { read getattr };
 # Child of zygote.
 allow webview_zygote zygote:fd use;
 allow webview_zygote zygote:process sigchld;
@@ -77,6 +77,9 @@
 
 allow webview_zygote system_data_file:lnk_file r_file_perms;
 
+# Send unsolicited message to system_server
+unix_socket_send(webview_zygote, system_unsolzygote, system_server)
+
 #####
 ##### Neverallow
 #####
@@ -113,7 +116,6 @@
 neverallow webview_zygote {
     service_manager_type
     -activity_service
-    -ashmem_device_service
     -webviewupdate_service
 }:service_manager find;
 
diff --git a/private/wificond.te b/private/wificond.te
index cc76447..5476e33 100644
--- a/private/wificond.te
+++ b/private/wificond.te
@@ -1,4 +1,3 @@
 typeattribute wificond coredomain;
 
 init_daemon_domain(wificond)
-hal_client_domain(wificond, hal_wifi_offload)
diff --git a/private/zygote.te b/private/zygote.te
index 0466372..f27005e 100644
--- a/private/zygote.te
+++ b/private/zygote.te
@@ -3,6 +3,7 @@
 typeattribute zygote mlstrustedsubject;
 
 init_daemon_domain(zygote)
+tmpfs_domain(zygote)
 
 read_runtime_log_tags(zygote)
 
@@ -49,8 +50,49 @@
 # is ensured by fsverity protection (checked in art_apex_boot_integrity).
 allow zygote dalvikcache_data_file:file execute;
 
+# Bind mount on /data/data and mounted volumes
+allow zygote { system_data_file mnt_expand_file }:dir mounton;
+
+# Relabel /data/user /data/user_de and /data/data
+allow zygote tmpfs:{ dir lnk_file } relabelfrom;
+allow zygote system_data_file:{ dir lnk_file } relabelto;
+
+# Zygote opens /mnt/expand to mount CE DE storage on each vol
+allow zygote mnt_expand_file:dir { open read search relabelto };
+
+# Bind mount subdirectories on /data/misc/profiles/cur
+allow zygote { user_profile_data_file }:dir { mounton search };
+
+# Create and bind dirs on /data/data
+allow zygote tmpfs:dir { create_dir_perms mounton };
+
+# Goes into media directory and bind mount obb directory
+allow zygote media_rw_data_file:dir { getattr search };
+
+# Read if sdcardfs is supported
+allow zygote proc_filesystems:file r_file_perms;
+
+# Create symlink for /data/user/0
+allow zygote tmpfs:lnk_file create;
+
+allow zygote mirror_data_file:dir r_dir_perms;
+
+# Get inode of data directories
+allow zygote {
+  system_data_file
+  radio_data_file
+  app_data_file
+  shell_data_file
+  bluetooth_data_file
+  privapp_data_file
+  nfc_data_file
+  mnt_expand_file
+}:dir getattr;
+
 # Allow zygote to create JIT memory.
 allow zygote self:process execmem;
+allow zygote zygote_tmpfs:file execute;
+allow zygote ashmem_libcutils_device:chr_file execute;
 
 # Execute idmap and dex2oat within zygote's own domain.
 # TODO:  Should either of these be transitioned to the same domain
@@ -93,18 +135,16 @@
 allow zygote mnt_user_file:dir { create_dir_perms mounton };
 allow zygote mnt_user_file:lnk_file create_file_perms;
 allow zygote mnt_user_file:file create_file_perms;
+
+# Allow mounting user-specific storage source if started before vold.
+allow zygote mnt_pass_through_file:dir { create_dir_perms mounton };
+
 # Allowed to mount user-specific storage into place
 allow zygote storage_file:dir { search mounton };
 
 # Allow mounting and creating files, dirs on sdcardfs.
-# TODO: reduce this back to only sdcardfs once b/123533205 is root-caused
-# (Technically "sdcardfs" and "media_rw_data_file" are equivalent, since
-# sdcardfs simply wraps files stored under /data/media.)
-allow zygote { sdcard_type media_rw_data_file }:dir { create_dir_perms mounton };
-allow zygote { sdcard_type media_rw_data_file }:file { create_file_perms };
-
-# Allow zygote to expand app files while preloading libraries
-allow zygote mnt_expand_file:dir getattr;
+allow zygote { sdcard_type }:dir { create_dir_perms mounton };
+allow zygote { sdcard_type }:file { create_file_perms };
 
 # Handle --invoke-with command when launching Zygote with a wrapper command.
 allow zygote zygote_exec:file rx_file_perms;
@@ -140,9 +180,22 @@
 get_prop(zygote, device_config_runtime_native_prop)
 get_prop(zygote, device_config_runtime_native_boot_prop)
 
+# Allow the zygote to access window manager native boot feature flags
+# to initialize WindowManager static properties.
+get_prop(zygote, device_config_window_manager_native_boot_prop)
+
 # ingore spurious denials
 dontaudit zygote self:global_capability_class_set sys_resource;
 
+# Allow zygote to use ashmem fds from system_server.
+allow zygote system_server:fd use;
+
+# Send unsolicited message to system_server
+unix_socket_send(zygote, system_unsolzygote, system_server)
+
+# Allow zygote to access media_variant_prop for static initialization
+get_prop(zygote, media_variant_prop)
+
 ###
 ### neverallow rules
 ###
@@ -174,3 +227,9 @@
   bluetooth_prop
   exported_bluetooth_prop
 }:file create_file_perms;
+
+# Zygote should not be able to access app private data.
+neverallow zygote {
+  privapp_data_file
+  app_data_file
+}:dir ~getattr;
diff --git a/property_contexts.mk b/property_contexts.mk
deleted file mode 100644
index eb19d20..0000000
--- a/property_contexts.mk
+++ /dev/null
@@ -1,170 +0,0 @@
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := plat_property_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-plat_pcfiles := $(call build_policy, property_contexts, $(PLAT_PRIVATE_POLICY))
-ifeq ($(PRODUCT_COMPATIBLE_PROPERTY),true)
-plat_pcfiles += $(LOCAL_PATH)/public/property_contexts
-endif
-
-plat_property_contexts.tmp := $(intermediates)/plat_property_contexts.tmp
-$(plat_property_contexts.tmp): PRIVATE_PC_FILES := $(plat_pcfiles)
-$(plat_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(plat_property_contexts.tmp): $(plat_pcfiles)
-	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): $(plat_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/property_info_checker
-	@mkdir -p $(dir $@)
-	$(hide) cp -f $< $@
-	$(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $(PRIVATE_SEPOLICY) $@
-
-built_plat_pc := $(LOCAL_BUILT_MODULE)
-plat_pcfiles :=
-plat_property_contexts.tmp :=
-
-##################################
-include $(CLEAR_VARS)
-LOCAL_MODULE := product_property_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-product_pcfiles := $(call build_policy, property_contexts, $(PRODUCT_PRIVATE_POLICY))
-
-product_property_contexts.tmp := $(intermediates)/product_property_contexts.tmp
-$(product_property_contexts.tmp): PRIVATE_PC_FILES := $(product_pcfiles)
-$(product_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(product_property_contexts.tmp): $(product_pcfiles)
-	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
-
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): $(product_property_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/property_info_checker
-	@mkdir -p $(dir $@)
-	$(hide) cp -f $< $@
-	$(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $(PRIVATE_SEPOLICY) $@
-
-built_product_pc := $(LOCAL_BUILT_MODULE)
-product_pcfiles :=
-product_property_contexts.tmp :=
-
-##################################
-include $(CLEAR_VARS)
-LOCAL_MODULE := vendor_property_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT_VENDOR)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-vendor_pcfiles := $(call build_policy, property_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
-
-vendor_property_contexts.tmp := $(intermediates)/vendor_property_contexts.tmp
-$(vendor_property_contexts.tmp): PRIVATE_PC_FILES := $(vendor_pcfiles)
-$(vendor_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(vendor_property_contexts.tmp): $(vendor_pcfiles)
-	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
-
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): PRIVATE_BUILT_PLAT_PC := $(built_plat_pc)
-$(LOCAL_BUILT_MODULE): $(vendor_property_contexts.tmp) $(built_sepolicy) $(built_plat_pc) $(HOST_OUT_EXECUTABLES)/property_info_checker
-	@mkdir -p $(dir $@)
-	$(hide) cp -f $< $@
-	$(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $(PRIVATE_SEPOLICY) $(PRIVATE_BUILT_PLAT_PC) $@
-
-built_vendor_pc := $(LOCAL_BUILT_MODULE)
-vendor_pcfiles :=
-vendor_property_contexts.tmp :=
-
-##################################
-include $(CLEAR_VARS)
-LOCAL_MODULE := odm_property_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT_ODM)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-odm_pcfiles := $(call build_policy, property_contexts, $(BOARD_ODM_SEPOLICY_DIRS))
-
-odm_property_contexts.tmp := $(intermediates)/odm_property_contexts.tmp
-$(odm_property_contexts.tmp): PRIVATE_PC_FILES := $(odm_pcfiles)
-$(odm_property_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(odm_property_contexts.tmp): $(odm_pcfiles)
-	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_PC_FILES) > $@
-
-
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): PRIVATE_BUILT_PLAT_PC := $(built_plat_pc)
-$(LOCAL_BUILT_MODULE): PRIVATE_BUILT_VENDOR_PC := $(built_vendor_pc)
-$(LOCAL_BUILT_MODULE): $(odm_property_contexts.tmp) $(built_sepolicy) $(built_plat_pc) $(built_vendor_pc) $(HOST_OUT_EXECUTABLES)/property_info_checker
-	@mkdir -p $(dir $@)
-	$(hide) cp -f $< $@
-	$(hide) $(HOST_OUT_EXECUTABLES)/property_info_checker $(PRIVATE_SEPOLICY) $(PRIVATE_BUILT_PLAT_PC) $(PRIVATE_BUILT_VENDOR_PC) $@
-
-built_odm_pc := $(LOCAL_BUILT_MODULE)
-odm_pcfiles :=
-odm_property_contexts.tmp :=
-
-##################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := plat_property_contexts.recovery
-LOCAL_MODULE_STEM := plat_property_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-$(LOCAL_BUILT_MODULE): $(built_plat_pc)
-	$(hide) cp -f $< $@
-
-##################################
-include $(CLEAR_VARS)
-LOCAL_MODULE := product_property_contexts.recovery
-LOCAL_MODULE_STEM := product_property_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-$(LOCAL_BUILT_MODULE): $(built_product_pc)
-	$(hide) cp -f $< $@
-
-##################################
-include $(CLEAR_VARS)
-LOCAL_MODULE := vendor_property_contexts.recovery
-LOCAL_MODULE_STEM := vendor_property_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-$(LOCAL_BUILT_MODULE): $(built_vendor_pc)
-	$(hide) cp -f $< $@
-
-##################################
-include $(CLEAR_VARS)
-LOCAL_MODULE := odm_property_contexts.recovery
-LOCAL_MODULE_STEM := odm_property_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-$(LOCAL_BUILT_MODULE): $(built_odm_pc)
-	$(hide) cp -f $< $@
diff --git a/public/aidl_lazy_test_server.te b/public/aidl_lazy_test_server.te
new file mode 100644
index 0000000..626d008
--- /dev/null
+++ b/public/aidl_lazy_test_server.te
@@ -0,0 +1,9 @@
+type aidl_lazy_test_server, domain;
+type aidl_lazy_test_server_exec, exec_type, file_type, system_file_type;
+
+userdebug_or_eng(`
+  binder_use(aidl_lazy_test_server)
+  binder_call(aidl_lazy_test_server, binderservicedomain)
+
+  add_service(aidl_lazy_test_server, aidl_lazy_test_service)
+')
diff --git a/public/apexd.te b/public/apexd.te
index 3957ed6..93c257f 100644
--- a/public/apexd.te
+++ b/public/apexd.te
@@ -7,7 +7,7 @@
 set_prop(apexd, apexd_prop)
 
 neverallow { domain -init -apexd -system_server } apex_service:service_manager find;
-neverallow { domain -init -apexd -system_server } apexd:binder call;
+neverallow { domain -init -apexd -system_server -servicemanager } apexd:binder call;
 
 neverallow { domain userdebug_or_eng(`-crash_dump') } apexd:process ptrace;
 
diff --git a/public/app.te b/public/app.te
index 5c48e71..e5b9fd6 100644
--- a/public/app.te
+++ b/public/app.te
@@ -11,7 +11,7 @@
 # WebView and other application-specific JIT compilers
 allow appdomain self:process execmem;
 
-allow appdomain ashmem_device:chr_file execute;
+allow appdomain { ashmem_device ashmem_libcutils_device }:chr_file execute;
 
 # Receive and use open file descriptors inherited from zygote.
 allow appdomain zygote:fd use;
@@ -293,6 +293,8 @@
 
 use_keystore({ appdomain -isolated_app -ephemeral_app })
 
+use_credstore({ appdomain -isolated_app -ephemeral_app })
+
 allow appdomain console_device:chr_file { read write };
 
 # only allow unprivileged socket ioctl commands
@@ -315,7 +317,7 @@
 allow appdomain proc_meminfo:file r_file_perms;
 
 # For app fuse.
-allow appdomain app_fuse_file:file { getattr read append write };
+allow appdomain app_fuse_file:file { getattr read append write map };
 
 pdx_client({ appdomain -isolated_app -ephemeral_app }, display_client)
 pdx_client({ appdomain -isolated_app -ephemeral_app }, display_manager)
@@ -357,9 +359,6 @@
 allow appdomain system_server_tmpfs:file { getattr map read write };
 allow appdomain zygote_tmpfs:file { map read };
 
-# Allow vendor apps access to ashmemd to request /dev/ashmem fds.
-binder_call({ appdomain -coredomain }, ashmemd)
-
 ###
 ### Neverallow rules
 ###
@@ -393,7 +392,7 @@
 neverallow appdomain tee_device:chr_file { read write };
 
 # Privileged netlink socket interfaces.
-neverallow appdomain
+neverallow { appdomain -network_stack }
     domain:{
         netlink_tcpdiag_socket
         netlink_nflog_socket
@@ -467,10 +466,10 @@
 # Write to various other parts of /data.
 neverallow appdomain drm_data_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
-neverallow { appdomain -platform_app }
+neverallow { appdomain -platform_app -system_app }
     apk_data_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
-neverallow { appdomain -platform_app }
+neverallow { appdomain -platform_app -system_app }
     apk_tmp_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
 neverallow { appdomain -platform_app }
@@ -485,6 +484,7 @@
 neverallow { appdomain -bluetooth }
     bluetooth_data_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
+neverallow { domain -credstore -init } credstore_data_file:dir_file_class_set *;
 neverallow appdomain
     keystore_data_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
diff --git a/public/ashmemd.te b/public/ashmemd.te
deleted file mode 100644
index 542f093..0000000
--- a/public/ashmemd.te
+++ /dev/null
@@ -1 +0,0 @@
-type ashmemd, domain;
diff --git a/public/attributes b/public/attributes
index 857efc5..19623af 100644
--- a/public/attributes
+++ b/public/attributes
@@ -86,6 +86,41 @@
 # These properties are not accessible from device-specific domains
 attribute extended_core_property_type;
 
+# Properties used for representing ownership. All properties should have one
+# of: system_property_type, product_property_type, or vendor_property_type.
+
+# All properties defined by /system.
+attribute system_property_type;
+
+# All /system-defined properties used only in /system.
+attribute system_internal_property_type;
+
+# All /system-defined properties which can't be written outside /system.
+attribute system_restricted_property_type;
+
+# All /system-defined properties with no restrictions.
+attribute system_public_property_type;
+
+# All properties defined by /product.
+# Currently there are no enforcements between /system and /product, so for now
+# /product attributes are just replaced to /system attributes.
+define(`product_property_type',   `system_property_type')
+define(`product_internal_type',   `system_internal_property_type')
+define(`product_restricted_type', `system_restricted_property_type')
+define(`product_public_type',     `system_public_property_type')
+
+# All properties defined by /vendor.
+attribute vendor_property_type;
+
+# All /vendor-defined properties used only in /vendor.
+attribute vendor_internal_property_type;
+
+# All /vendor-defined properties which can't be written outside /vendor.
+attribute vendor_restricted_property_type;
+
+# All /vendor-defined properties with no restrictions.
+attribute vendor_public_property_type;
+
 # All service_manager types created by system_server
 attribute system_server_service;
 
@@ -98,6 +133,12 @@
 # services which export only system_api
 attribute system_api_service;
 
+# services which served by vendor and also using the copy of libbinder on
+# system (for instance via libbinder_ndk). services using a different copy
+# of libbinder currently need their own context manager (e.g.
+# vndservicemanager)
+attribute vendor_service;
+
 # All types used for services managed by servicemanager.
 # On change, update CHECK_SC_ASSERT_ATTRS
 # definition in tools/checkfc.c.
@@ -114,6 +155,9 @@
 # All HwBinder services guaranteed to be offered only by core domain components
 attribute coredomain_hwservice;
 
+# All HwBinder services that untrusted apps can't directly access
+attribute protected_hwservice;
+
 # All types used for services managed by vndservicemanager
 attribute vndservice_manager_type;
 
@@ -251,6 +295,8 @@
 hal_attribute(bufferhub);
 hal_attribute(broadcastradio);
 hal_attribute(camera);
+hal_attribute(can_bus);
+hal_attribute(can_controller);
 hal_attribute(cas);
 hal_attribute(codec2);
 hal_attribute(configstore);
@@ -267,6 +313,7 @@
 hal_attribute(graphics_composer);
 hal_attribute(health);
 hal_attribute(health_storage);
+hal_attribute(identity);
 hal_attribute(input_classifier);
 hal_attribute(ir);
 hal_attribute(keymaster);
@@ -279,6 +326,7 @@
 hal_attribute(omx);
 hal_attribute(power);
 hal_attribute(power_stats);
+hal_attribute(rebootescrow);
 hal_attribute(secure_element);
 hal_attribute(sensors);
 hal_attribute(telephony);
@@ -286,6 +334,7 @@
 hal_attribute(thermal);
 hal_attribute(tv_cec);
 hal_attribute(tv_input);
+hal_attribute(tv_tuner);
 hal_attribute(usb);
 hal_attribute(usb_gadget);
 hal_attribute(vehicle);
@@ -294,7 +343,6 @@
 hal_attribute(weaver);
 hal_attribute(wifi);
 hal_attribute(wifi_hostapd);
-hal_attribute(wifi_offload);
 hal_attribute(wifi_supplicant);
 
 # HwBinder services offered across the core-vendor boundary
@@ -304,6 +352,7 @@
 # from one core domain to another, without having to update the vendor image
 # which contains clients of this service.
 
+attribute automotive_display_service_server;
 attribute camera_service_server;
 attribute display_service_server;
 attribute scheduler_service_server;
diff --git a/public/audioserver.te b/public/audioserver.te
index 2ad86e3..a8a33cc 100644
--- a/public/audioserver.te
+++ b/public/audioserver.te
@@ -1,3 +1,6 @@
 # audioserver - audio services daemon
 type audioserver, domain;
 type audioserver_tmpfs, file_type;
+
+# Allow audioserver to signal audio HAL processes and dump their stacks.
+allow audioserver hal_audio_server:process signal;
diff --git a/public/bootstat.te b/public/bootstat.te
index a2a060b..6143a7d 100644
--- a/public/bootstat.te
+++ b/public/bootstat.te
@@ -15,6 +15,9 @@
 set_prop(bootstat, bootloader_boot_reason_prop)
 set_prop(bootstat, system_boot_reason_prop)
 set_prop(bootstat, last_boot_reason_prop)
+allow bootstat metadata_file:dir search;
+allow bootstat metadata_bootstat_file:dir rw_dir_perms;
+allow bootstat metadata_bootstat_file:file create_file_perms;
 
 # ToDo: TBI move access for the following to a system health HAL
 
diff --git a/public/charger.te b/public/charger.te
index 238b413..4b341ea 100644
--- a/public/charger.te
+++ b/public/charger.te
@@ -42,3 +42,7 @@
 set_prop(charger, exported_system_prop)
 set_prop(charger, exported2_system_prop)
 set_prop(charger, exported3_system_prop)
+
+get_prop(charger, charger_prop)
+
+hal_client_domain(charger, hal_health)
diff --git a/public/clatd.te b/public/clatd.te
deleted file mode 100644
index 35d6190..0000000
--- a/public/clatd.te
+++ /dev/null
@@ -1,36 +0,0 @@
-# 464xlat daemon
-type clatd, domain;
-type clatd_exec, system_file_type, exec_type, file_type;
-
-net_domain(clatd)
-
-r_dir_file(clatd, proc_net_type)
-userdebug_or_eng(`
-  auditallow clatd proc_net_type:{ dir file lnk_file } { getattr open read };
-')
-
-# Access objects inherited from netd.
-allow clatd netd:fd use;
-allow clatd netd:fifo_file { read write };
-# TODO: Check whether some or all of these sockets should be close-on-exec.
-allow clatd netd:netlink_kobject_uevent_socket { read write };
-allow clatd netd:netlink_nflog_socket { read write };
-allow clatd netd:netlink_route_socket { read write };
-allow clatd netd:udp_socket { read write };
-allow clatd netd:unix_stream_socket { read write };
-allow clatd netd:unix_dgram_socket { read write };
-
-allow clatd self:global_capability_class_set { net_admin net_raw setuid setgid };
-
-# clatd calls mmap(MAP_LOCKED) with a 1M buffer. MAP_LOCKED first checks
-# capable(CAP_IPC_LOCK), and then checks to see the requested amount is
-# under RLIMIT_MEMLOCK. If the latter check succeeds clatd won't have
-# needed CAP_IPC_LOCK. But this is not guaranteed to succeed on all devices
-# so we permit any requests we see from clatd asking for this capability.
-# See https://android-review.googlesource.com/127940 and
-# https://b.corp.google.com/issues/21736319
-allow clatd self:global_capability_class_set ipc_lock;
-
-allow clatd self:netlink_route_socket nlmsg_write;
-allow clatd self:{ packet_socket rawip_socket } create_socket_perms_no_ioctl;
-allow clatd tun_device:chr_file rw_file_perms;
\ No newline at end of file
diff --git a/public/credstore.te b/public/credstore.te
new file mode 100644
index 0000000..db16a8d
--- /dev/null
+++ b/public/credstore.te
@@ -0,0 +1,16 @@
+type credstore, domain;
+type credstore_exec, system_file_type, exec_type, file_type;
+
+# credstore daemon
+binder_use(credstore)
+binder_service(credstore)
+binder_call(credstore, system_server)
+
+allow credstore credstore_data_file:dir create_dir_perms;
+allow credstore credstore_data_file:file create_file_perms;
+
+add_service(credstore, credstore_service)
+allow credstore sec_key_att_app_id_provider_service:service_manager find;
+allow credstore dropbox_service:service_manager find;
+
+r_dir_file(credstore, cgroup)
diff --git a/public/device.te b/public/device.te
index e20a68b..32563d6 100644
--- a/public/device.te
+++ b/public/device.te
@@ -1,6 +1,7 @@
 # Device types
 type device, dev_type, fs_type;
 type ashmem_device, dev_type, mlstrustedobject;
+type ashmem_libcutils_device, dev_type, mlstrustedobject;
 type audio_device, dev_type;
 type binder_device, dev_type, mlstrustedobject;
 type hwbinder_device, dev_type, mlstrustedobject;
@@ -50,6 +51,7 @@
 type tun_device, dev_type, mlstrustedobject;
 type usbaccessory_device, dev_type, mlstrustedobject;
 type usb_device, dev_type, mlstrustedobject;
+type usb_serial_device, dev_type;
 type properties_device, dev_type;
 type properties_serial, dev_type;
 type property_info, dev_type;
diff --git a/public/dnsmasq.te b/public/dnsmasq.te
index d189c89..86f1eb1 100644
--- a/public/dnsmasq.te
+++ b/public/dnsmasq.te
@@ -23,3 +23,6 @@
 allow dnsmasq netd:unix_stream_socket { getattr read write };
 allow dnsmasq netd:unix_dgram_socket { read write };
 allow dnsmasq netd:udp_socket { read write };
+
+# sometimes a network device vanishes and we try to load module netdev-{devicename}
+dontaudit dnsmasq kernel:system module_request;
diff --git a/public/domain.te b/public/domain.te
index f348701..c7f851d 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -70,28 +70,20 @@
 allow domain owntty_device:chr_file rw_file_perms;
 allow domain null_device:chr_file rw_file_perms;
 allow domain zero_device:chr_file rw_file_perms;
-allow {
-  domain
-  # TODO(b/113362644): route coredomain to ashmemd
-  #-coredomain
-  -mediaprovider
-  -ephemeral_app
-  -isolated_app
-  -untrusted_app_all
-} ashmem_device:chr_file rw_file_perms;
 
-# Allow using fds to /dev/ashmem.
-allow domain ashmemd:fd use;
+# /dev/ashmem is being deprecated by means of constraining and eventually
+# removing all "open" permissions. We preserve the other permissions.
+allow domain ashmem_device:chr_file { getattr read ioctl lock map append write };
+# This device is used by libcutils, which is accessible to everyone.
+allow domain ashmem_libcutils_device:chr_file rw_file_perms;
 
-# /dev/binder can be accessed by non-vendor domains and by apps
-allow {
-  coredomain
-  appdomain
-  binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
-  -hwservicemanager
-} binder_device:chr_file rw_file_perms;
-# Devices which are not full TREBLE have fewer restrictions on access to /dev/binder
-not_full_treble(`allow { domain -hwservicemanager -vndservicemanager } binder_device:chr_file rw_file_perms;')
+# /dev/binder can be accessed by ... everyone! :)
+allow { domain -hwservicemanager -vndservicemanager } binder_device:chr_file rw_file_perms;
+
+# /dev/binderfs needs to be accessed by everyone too!
+allow domain binderfs:dir { getattr search };
+allow domain binderfs_logs_proc:dir search;
+
 allow { domain -servicemanager -vndservicemanager -isolated_app } hwbinder_device:chr_file rw_file_perms;
 allow domain ptmx_device:chr_file rw_file_perms;
 allow domain random_device:chr_file rw_file_perms;
@@ -113,6 +105,13 @@
 get_prop(domain, exported_vold_prop)
 get_prop(domain, exported2_default_prop)
 get_prop(domain, logd_prop)
+get_prop(domain, socket_hook_prop)
+get_prop(domain, vendor_socket_hook_prop)
+get_prop(domain, vndk_prop)
+
+# Binder cache properties are world-readable
+get_prop(domain, binder_cache_bluetooth_server_prop)
+get_prop(domain, binder_cache_system_server_prop)
 
 # Let everyone read log properties, so that liblog can avoid sending unloggable
 # messages to logd.
@@ -136,10 +135,12 @@
 allow domain system_file:lnk_file { getattr read };
 
 # Global access to /system/etc/security/cacerts/*, /system/etc/seccomp_policy/*, /system/lib[64]/*,
-# linker and its config.
+# /(system|product|system_ext)/etc/(group|passwd), linker and its config.
 allow domain system_seccomp_policy_file:file r_file_perms;
 # cacerts are accessible from public Java API.
 allow domain system_security_cacerts_file:file r_file_perms;
+allow domain system_group_file:file r_file_perms;
+allow domain system_passwd_file:file r_file_perms;
 allow domain system_linker_exec:file { execute read open getattr map };
 allow domain system_linker_config_file:file r_file_perms;
 allow domain system_lib_file:file { execute read open getattr map };
@@ -221,8 +222,9 @@
   allow domain system_data_file:dir getattr;
 ')
 allow { coredomain appdomain } system_data_file:dir getattr;
-# /data has the label system_data_file. Vendor components need the search
-# permission on system_data_file for path traversal to /data/vendor.
+# /data has the label system_data_root_file. Vendor components need the search
+# permission on system_data_root_file for path traversal to /data/vendor.
+allow domain system_data_root_file:dir { search getattr } ;
 allow domain system_data_file:dir search;
 # TODO restrict this to non-coredomain
 allow domain vendor_data_file:dir { getattr search };
@@ -236,9 +238,6 @@
 # /dev/cpu_variant:.*
 allow domain dev_cpu_variant:file r_file_perms;
 
-# jemalloc needs to read /proc/sys/vm/overcommit_memory
-allow domain proc_overcommit_memory:file r_file_perms;
-
 # profiling needs to read /proc/sys/kernel/perf_event_max_sample_rate
 allow domain proc_perf:file r_file_perms;
 
@@ -421,11 +420,9 @@
 neverallow { domain -init -ueventd } sysfs_usermodehelper:file { append write };
 neverallow { domain -init -vendor_init } proc_security:file { append open read write };
 
-# Nobody is allowed to make binder calls into init.
-# Only servicemanager may transfer binder references to init
-# vendor_init shouldn't use binder at all.
-neverallow * init:binder ~{ transfer };
-neverallow { domain -servicemanager } init:binder { transfer };
+# Init can't do anything with binder calls. If this neverallow rule is being
+# triggered, it's probably due to a service with no SELinux domain.
+neverallow * init:binder *;
 neverallow * vendor_init:binder *;
 
 # Don't allow raw read/write/open access to block_device
@@ -506,9 +503,9 @@
 # system_app_service rather than the generic type.
 # New service_types are defined in {,hw,vnd}service.te and new mappings
 # from service name to service_type are defined in {,hw,vnd}service_contexts.
-neverallow * default_android_service:service_manager add;
-neverallow * default_android_vndservice:service_manager { add find };
-neverallow * default_android_hwservice:hwservice_manager { add find };
+neverallow * default_android_service:service_manager *;
+neverallow * default_android_vndservice:service_manager *;
+neverallow * default_android_hwservice:hwservice_manager *;
 
 # Looking up the base class/interface of all HwBinder services is a bad idea.
 # hwservicemanager currently offer such lookups only to make it so that security
@@ -523,6 +520,7 @@
 # anyone but init to modify unknown properties.
 neverallow { domain -init -vendor_init } default_prop:property_service set;
 neverallow { domain -init -vendor_init } mmc_prop:property_service set;
+neverallow { domain -init -vendor_init } vndk_prop:property_service set;
 
 compatible_property_only(`
     neverallow { domain -init } default_prop:property_service set;
@@ -553,8 +551,10 @@
   -hal_camera_server
   -hal_cas_server
   -hal_drm_server
+  userdebug_or_eng(`-incidentd')
   -init
   -mediadrmserver
+  -mediaserver
   -recovery
   -shell
   -system_server
@@ -625,30 +625,23 @@
 neverallow vndservicemanager binder_device:chr_file no_rw_file_perms;
 neverallow vndservicemanager hwbinder_device:chr_file no_rw_file_perms;
 
-# On full TREBLE devices, only core components and apps can use Binder and servicemanager. Non-core
-# domain apps need this because Android framework offers many of its services to apps as Binder
-# services.
+# system services cant add vendor services
+neverallow {
+  coredomain
+} vendor_service:service_manager add;
+
 full_treble_only(`
+  # vendor services cant add system services
   neverallow {
     domain
     -coredomain
-    -appdomain
-    -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
-  } binder_device:chr_file rw_file_perms;
+    -binder_in_vendor_violators # TODO(b/131617943) remove once all violators are gone
+  } {
+    service_manager_type
+    -vendor_service
+  }:service_manager add;
 ')
 
-# libcutils can probe for /dev/binder permissions with access(). Ignore
-# generated denials. See b/129073672 for details.
-dontaudit domain binder_device:chr_file audit_access;
-
-full_treble_only(`
-  neverallow {
-    domain
-    -coredomain
-    -appdomain # restrictions for vendor apps are declared lower down
-    -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
-  } service_manager_type:service_manager find;
-')
 full_treble_only(`
   # Vendor apps are permited to use only stable public services. If they were to use arbitrary
   # services which can change any time framework/core is updated, breakage is likely.
@@ -662,6 +655,8 @@
     -audioserver_service # TODO(b/36783122) remove exemptions below once app_api_service is fixed
     -cameraserver_service
     -drmserver_service
+    -hal_light_service # TODO(b/148154485) remove once all violators are gone
+    -credstore_service
     -keystore_service
     -mediadrmserver_service
     -mediaextractor_service
@@ -674,14 +669,6 @@
     -vr_manager_service
   }:service_manager find;
 ')
-full_treble_only(`
-  neverallow {
-    domain
-    -coredomain
-    -appdomain
-    -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
-  } servicemanager:binder { call transfer };
-')
 
 # On full TREBLE devices, only vendor components, shell, and su can use VendorBinder.
 full_treble_only(`
@@ -745,20 +732,11 @@
     userdebug_or_eng(`-su') # communications with su are permitted only on userdebug or eng builds
     -init
     -tombstoned # linker to tombstoned
-    userdebug_or_eng('-heapprofd`)
+    userdebug_or_eng(`-heapprofd')
+    userdebug_or_eng(`-traced_perf')
   });
 ')
 
-  # Vendor domains (except netdomain) are not permitted to initiate communications to netd sockets
-full_treble_only(`
-  neverallow_establish_socket_comms({
-    domain
-    -coredomain
-    -netdomain
-    -socket_between_core_and_vendor_violators
-  }, netd);
-')
-
   # Vendor domains are not permitted to initiate create/open sockets owned by core domains
 full_treble_only(`
   neverallow {
@@ -884,6 +862,7 @@
   } {
     core_data_file_type
     -system_data_file # default label for files on /data. Covered below...
+    -system_data_root_file
     -vendor_data_file
     -zoneinfo_data_file
     with_native_coverage(`-method_trace_data_file')
@@ -895,6 +874,7 @@
     core_data_file_type
     -unencrypted_data_file
     -system_data_file
+    -system_data_root_file
     -vendor_data_file
     -zoneinfo_data_file
     with_native_coverage(`-method_trace_data_file')
@@ -946,6 +926,7 @@
         coredomain
         -init
         -shell
+        -ueventd
     } vendor_shell_exec:file { execute execute_no_trans };
 ')
 
@@ -963,6 +944,8 @@
         -system_lib_file
         -system_linker_exec
         -crash_dump_exec
+        -iorap_prefetcherd_exec
+        -iorap_inode2filename_exec
         -netutils_wrapper_exec
         userdebug_or_eng(`-tcpdump_exec')
     }:file { entrypoint execute execute_no_trans };
@@ -976,6 +959,7 @@
       -init
       -shell
       -system_executes_vendor_violators
+      -ueventd
     } {
       vendor_file_type
       -same_process_hal_file
@@ -1004,16 +988,20 @@
     # TODO(b/37168747): clean up fwk access to /vendor
     -crash_dump
     -init # starts vendor executables
+    -iorap_inode2filename
+    -iorap_prefetcherd
     -kernel # loads /vendor/firmware
-    userdebug_or_eng(`-perfprofd')
     userdebug_or_eng(`-heapprofd')
     -shell
     -system_executes_vendor_violators
+    -traced_perf # library/binary access for symbolization
     -ueventd # reads /vendor/ueventd.rc
+    -vold # loads incremental fs driver
   } {
     vendor_file_type
     -same_process_hal_file
     -vendor_app_file
+    -vendor_apex_file
     -vendor_configs_file
     -vendor_framework_file
     -vendor_idc_file
@@ -1041,13 +1029,16 @@
     system_file_type
     -crash_dump_exec
     -file_contexts_file
+    -iorap_inode2filename_exec
     -netutils_wrapper_exec
     -property_contexts_file
     -system_event_log_tags_file
+    -system_group_file
     -system_lib_file
     with_asan(`-system_asan_options_file')
     -system_linker_exec
     -system_linker_config_file
+    -system_passwd_file
     -system_seccomp_policy_file
     -system_security_cacerts_file
     -system_zoneinfo_file
@@ -1169,6 +1160,7 @@
   -appdomain # finer-grained rules for appdomain are listed below
   -system_server #populate com.android.providers.settings/databases/settings.db.
   -installd # creation of app sandbox
+  -iorap_inode2filename
   -traced_probes # resolve inodes for i/o tracing.
                  # only needs open and read, the rest is neverallow in
                  # traced_probes.te.
@@ -1193,10 +1185,11 @@
   -zygote
 } shell:process { transition dyntransition };
 
-# Only domains spawned from zygote, runas and simpleperf_app_runner may have the appdomain
-# attribute.
+# Only domains spawned from zygote, runas and simpleperf_app_runner may have
+# the appdomain attribute. simpleperf is excluded as a domain transitioned to
+# when running an app-scoped profiling session.
 neverallow { domain -simpleperf_app_runner -runas -app_zygote -webview_zygote -zygote } {
-  appdomain -shell userdebug_or_eng(`-su')
+  appdomain -shell -simpleperf userdebug_or_eng(`-su')
 }:process { transition dyntransition };
 
 # Minimize read access to shell- or app-writable symlinks.
@@ -1302,7 +1295,7 @@
 # Enforce restrictions on kernel module origin.
 # Do not allow kernel module loading except from system,
 # vendor, and boot partitions.
-neverallow * ~{ system_file vendor_file rootfs }:system module_load;
+neverallow * ~{ system_file_type vendor_file_type rootfs }:system module_load;
 
 # Only allow filesystem caps to be set at build time. Runtime changes
 # to filesystem capabilities are not permitted.
@@ -1328,10 +1321,12 @@
     -appdomain
     -bootanim
     -crash_dump
-    -init
-    -kernel
-    -perfprofd
     -heapprofd
+    -init
+    -iorap_inode2filename
+    -iorap_prefetcherd
+    -kernel
+    -traced_perf
     -ueventd
   } vendor_file:file { no_w_file_perms no_x_file_perms open };
 ')
@@ -1408,3 +1403,12 @@
   -hal_codec2_server
   -hal_omx_server
 } hal_codec2_hwservice:hwservice_manager add;
+
+# Only apps targetting < Q are allowed to open /dev/ashmem directly.
+# Apps must use ASharedMemory NDK API. Native code must use libcutils API.
+neverallow {
+  domain
+  -ephemeral_app # We don't distinguish ephemeral apps based on target API.
+  -untrusted_app_25
+  -untrusted_app_27
+} ashmem_device:chr_file open;
diff --git a/public/drmserver.te b/public/drmserver.te
index b7b641c..12c080a 100644
--- a/public/drmserver.te
+++ b/public/drmserver.te
@@ -10,6 +10,7 @@
 binder_use(drmserver)
 binder_call(drmserver, system_server)
 binder_call(drmserver, appdomain)
+binder_call(drmserver, mediametrics)
 binder_service(drmserver)
 # Inherit or receive open files from system_server.
 allow drmserver system_server:fd use;
@@ -50,6 +51,7 @@
 
 add_service(drmserver, drmserver_service)
 allow drmserver permission_service:service_manager find;
+allow drmserver mediametrics_service:service_manager find;
 
 selinux_check_access(drmserver)
 
diff --git a/public/dumpstate.te b/public/dumpstate.te
index c89d200..9823f4a 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -81,6 +81,7 @@
   hal_codec2_server
   hal_drm_server
   hal_face_server
+  hal_fingerprint_server
   hal_graphics_allocator_server
   hal_graphics_composer_server
   hal_health_server
@@ -90,6 +91,7 @@
   hal_sensors_server
   hal_thermal_server
   hal_vr_server
+  system_suspend_server
 }:process signal;
 
 # Connect to tombstoned to intercept dumps.
@@ -214,10 +216,12 @@
 ')
 
 # Access /data/misc/logd
-userdebug_or_eng(`
-  allow dumpstate misc_logd_file:dir r_dir_perms;
-  allow dumpstate misc_logd_file:file r_file_perms;
-')
+allow dumpstate misc_logd_file:dir r_dir_perms;
+allow dumpstate misc_logd_file:file r_file_perms;
+
+# Access /data/misc/prereboot
+allow dumpstate prereboot_data_file:dir r_dir_perms;
+allow dumpstate prereboot_data_file:file r_file_perms;
 
 allow dumpstate app_fuse_file:dir r_dir_perms;
 allow dumpstate overlayfs_file:dir r_dir_perms;
@@ -231,6 +235,7 @@
   -virtual_touchpad_service
   -vold_service
   -vr_hwc_service
+  -default_android_service
 }:service_manager find;
 # suppress denials for services dumpstate should not be accessing.
 dontaudit dumpstate {
@@ -277,6 +282,10 @@
 # Allow dumpstate to run top
 allow dumpstate proc_stat:file r_file_perms;
 
+allow dumpstate proc_pressure_cpu:file r_file_perms;
+allow dumpstate proc_pressure_mem:file r_file_perms;
+allow dumpstate proc_pressure_io:file r_file_perms;
+
 # Allow dumpstate to talk to installd over binder
 binder_call(dumpstate, installd);
 
@@ -291,9 +300,21 @@
 # Allow dumpstate to run ss
 allow dumpstate { domain pdx_channel_socket_type pdx_endpoint_socket_type }:socket_class_set getattr;
 
+# Allow dumpstate to read linkerconfig directory
+allow dumpstate linkerconfig_file:dir { read open };
+
 # For when dumpstate runs df
-dontaudit dumpstate mnt_vendor_file:dir search;
-dontaudit dumpstate apex_mnt_dir:dir getattr;
+dontaudit dumpstate {
+  mnt_vendor_file
+  mirror_data_file
+  mnt_user_file
+}:dir search;
+dontaudit dumpstate {
+  apex_mnt_dir
+  linkerconfig_file
+  mirror_data_file
+  mnt_user_file
+}:dir getattr;
 
 # Allow dumpstate to talk to bufferhubd over binder
 binder_call(dumpstate, bufferhubd);
@@ -301,9 +322,22 @@
 # Allow dumpstate to talk to mediaswcodec over binder
 binder_call(dumpstate, mediaswcodec);
 
+# Allow dumpstate to talk to these stable AIDL services over binder
+binder_call(dumpstate, hal_rebootescrow_server)
+allow hal_rebootescrow_server dumpstate:fifo_file write;
+allow hal_rebootescrow_server dumpstate:fd use;
+
 # Allow dumpstate to kill vendor dumpstate service by init
 set_prop(dumpstate, ctl_dumpstate_prop)
 
+#Access /data/misc/snapshotctl_log
+allow dumpstate snapshotctl_log_data_file:dir r_dir_perms;
+allow dumpstate snapshotctl_log_data_file:file r_file_perms;
+
+#Allow access to /dev/binderfs/binder_logs
+allow dumpstate binderfs_logs:dir r_dir_perms;
+allow dumpstate binderfs_logs:file r_file_perms;
+
 ###
 ### neverallow rules
 ###
diff --git a/public/fastbootd.te b/public/fastbootd.te
index 8ebe387..a0152d4 100644
--- a/public/fastbootd.te
+++ b/public/fastbootd.te
@@ -53,12 +53,13 @@
     userdata_block_device
   }:blk_file { w_file_perms getattr ioctl };
 
-  # For disabling/wiping GSI.
+  # For disabling/wiping GSI, and for modifying/deleting files created via
+  # libfiemap.
   allow fastbootd metadata_block_device:blk_file r_file_perms;
   allow fastbootd {rootfs tmpfs}:dir mounton;
-  allow fastbootd metadata_file:dir search;
-  allow fastbootd gsi_metadata_file:dir r_dir_perms;
-  allow fastbootd gsi_metadata_file:file rw_file_perms;
+  allow fastbootd metadata_file:dir { search getattr };
+  allow fastbootd gsi_metadata_file:dir rw_dir_perms;
+  allow fastbootd gsi_metadata_file:file create_file_perms;
 
   allowxperm fastbootd super_block_device_type:blk_file ioctl { BLKIOMIN BLKALIGNOFF };
 
@@ -77,6 +78,9 @@
   allow fastbootd sysfs_dt_firmware_android:file r_file_perms;
   allow fastbootd sysfs_dt_firmware_android:dir r_dir_perms;
 
+  # Needed because libdm reads sysfs to validate when a dm path is ready.
+  r_dir_file(fastbootd, sysfs_dm)
+
   # Needed for realpath() call to resolve symlinks.
   allow fastbootd block_device:dir getattr;
   userdebug_or_eng(`
@@ -104,6 +108,16 @@
     allow fastbootd labeledfs:filesystem { mount unmount };
     get_prop(fastbootd, persistent_properties_ready_prop)
   ')
+
+  # Allow using libfiemap/gsid directly (no binder in recovery).
+  set_prop(fastbootd, gsid_prop)
+  allow fastbootd gsi_metadata_file:dir search;
+  allow fastbootd ota_metadata_file:dir rw_dir_perms;
+  allow fastbootd ota_metadata_file:file create_file_perms;
+
+  # Determine allocation scheme (whether B partitions needs to be
+  # at the second half of super.
+  get_prop(fastbootd, virtual_ab_prop)
 ')
 
 ###
diff --git a/public/file.te b/public/file.te
index da990e3..462e71d 100644
--- a/public/file.te
+++ b/public/file.te
@@ -4,11 +4,15 @@
 type sockfs, fs_type;
 type rootfs, fs_type;
 type proc, fs_type, proc_type;
+type binderfs, fs_type;
+type binderfs_logs, fs_type;
+type binderfs_logs_proc, fs_type;
 # Security-sensitive proc nodes that should not be writable to most.
 type proc_security, fs_type, proc_type;
 type proc_drop_caches, fs_type, proc_type;
 type proc_overcommit_memory, fs_type, proc_type;
 type proc_min_free_order_shift, fs_type, proc_type;
+type proc_kpageflags, fs_type, proc_type;
 # proc, sysfs, or other nodes that permit configuration of kernel usermodehelpers.
 type usermodehelper, fs_type, proc_type;
 type sysfs_usermodehelper, fs_type, sysfs_type;
@@ -32,6 +36,7 @@
 type proc_keys, fs_type, proc_type;
 type proc_kmsg, fs_type, proc_type;
 type proc_loadavg, fs_type, proc_type;
+type proc_lowmemorykiller, fs_type, proc_type;
 type proc_max_map_count, fs_type, proc_type;
 type proc_meminfo, fs_type, proc_type;
 type proc_misc, fs_type, proc_type;
@@ -79,8 +84,10 @@
 type sysfs_bluetooth_writable, fs_type, sysfs_type, mlstrustedobject;
 type sysfs_devices_block, fs_type, sysfs_type;
 type sysfs_dm, fs_type, sysfs_type;
+type sysfs_dm_verity, fs_type, sysfs_type;
 type sysfs_dt_firmware_android, fs_type, sysfs_type;
 type sysfs_extcon, fs_type, sysfs_type;
+type sysfs_ion, fs_type, sysfs_type;
 type sysfs_ipv4, fs_type, sysfs_type;
 type sysfs_kernel_notes, fs_type, sysfs_type, mlstrustedobject;
 type sysfs_leds, fs_type, sysfs_type;
@@ -88,13 +95,14 @@
 type sysfs_hwrandom, fs_type, sysfs_type;
 type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject;
 type sysfs_wake_lock, fs_type, sysfs_type;
-type sysfs_mac_address, fs_type, sysfs_type;
 type sysfs_net, fs_type, sysfs_type;
 type sysfs_power, fs_type, sysfs_type;
 type sysfs_rtc, fs_type, sysfs_type;
+type sysfs_suspend_stats, fs_type, sysfs_type;
 type sysfs_switch, fs_type, sysfs_type;
 type sysfs_transparent_hugepage, fs_type, sysfs_type;
 type sysfs_usb, fs_type, sysfs_type;
+type sysfs_wakeup, fs_type, sysfs_type;
 type sysfs_wakeup_reasons, fs_type, sysfs_type;
 type sysfs_fs_ext4_features, sysfs_type, fs_type;
 type sysfs_fs_f2fs, sysfs_type, fs_type;
@@ -129,6 +137,7 @@
 type debugfs_tracing_instances, fs_type, debugfs_type;
 type debugfs_wakeup_sources, fs_type, debugfs_type;
 type debugfs_wifi_tracing, fs_type, debugfs_type;
+type securityfs, fs_type;
 
 type pstorefs, fs_type;
 type functionfs, fs_type, mlstrustedobject;
@@ -150,10 +159,14 @@
 type system_lib_file, system_file_type, file_type;
 # system libraries that are available only to bootstrap processes
 type system_bootstrap_lib_file, system_file_type, file_type;
+# Default type for the group file /system/etc/group.
+type system_group_file, system_file_type, file_type;
 # Default type for linker executable /system/bin/linker[64].
 type system_linker_exec, system_file_type, file_type;
 # Default type for linker config /system/etc/ld.config.*.
 type system_linker_config_file, system_file_type, file_type;
+# Default type for the passwd file /system/etc/passwd.
+type system_passwd_file, system_file_type, file_type;
 # Default type for linker config /system/etc/seccomp_policy/*.
 type system_seccomp_policy_file, system_file_type, file_type;
 # Default type for cacerts in /system/etc/security/cacerts/*.
@@ -170,6 +183,12 @@
 type task_profiles_file, system_file_type, file_type;
 # Vendor task profiles file under /vendor/etc/task_profiles.json
 type vendor_task_profiles_file, vendor_file_type, file_type;
+# Type for /system/apex/com.android.art
+type art_apex_dir, system_file_type, file_type;
+# /linkerconfig(/.*)?
+type linkerconfig_file, file_type;
+# Control files under /data/incremental
+type incremental_control_file, file_type, data_file_type, core_data_file_type;
 
 # Default type for directories search for
 # HAL implementations
@@ -208,6 +227,10 @@
 type password_slot_metadata_file, file_type;
 # APEX files within /metadata
 type apex_metadata_file, file_type;
+# libsnapshot files within /metadata
+type ota_metadata_file, file_type;
+# property files within /metadata/bootstat
+type metadata_bootstat_file, file_type;
 
 # Type for /dev/cpu_variant:.*.
 type dev_cpu_variant, file_type;
@@ -219,6 +242,8 @@
 type cgroup_rc_file, file_type;
 # /cores for coredumps on userdebug / eng builds
 type coredump_file, file_type;
+# Type of /data itself
+type system_data_root_file, file_type, data_file_type, core_data_file_type;
 # Default type for anything under /data.
 type system_data_file, file_type, data_file_type, core_data_file_type;
 # Type for /data/system/packages.list.
@@ -229,8 +254,7 @@
 type vendor_data_file, file_type, data_file_type;
 # Unencrypted data
 type unencrypted_data_file, file_type, data_file_type, core_data_file_type;
-# /data/.layout_version or other installd-created files that
-# are created in a system_data_file directory.
+# installd-create files in /data/misc/installd such as layout_version
 type install_data_file, file_type, data_file_type, core_data_file_type;
 # /data/drm - DRM plugin data
 type drm_data_file, file_type, data_file_type, core_data_file_type;
@@ -260,6 +284,8 @@
 type user_profile_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
 # /data/misc/profman
 type profman_dump_data_file, file_type, data_file_type, core_data_file_type;
+# /data/misc/prereboot
+type prereboot_data_file, file_type, data_file_type, core_data_file_type;
 # /data/resource-cache
 type resourcecache_data_file, file_type, data_file_type, core_data_file_type;
 # /data/local - writable by shell
@@ -286,11 +312,15 @@
 type server_configurable_flags_data_file, file_type, data_file_type, core_data_file_type;
 # /data/app-staging
 type staging_data_file, file_type, data_file_type, core_data_file_type;
+# /vendor/apex
+type vendor_apex_file, vendor_file_type, file_type;
 
 # Mount locations managed by vold
 type mnt_media_rw_file, file_type;
 type mnt_user_file, file_type;
+type mnt_pass_through_file, file_type;
 type mnt_expand_file, file_type;
+type mnt_sdcard_file, file_type;
 type storage_file, file_type;
 
 # Label for storage dirs which are just mount stubs
@@ -313,8 +343,15 @@
 # /postinstall/apex: Mount point used for APEX images within /postinstall.
 type postinstall_apex_mnt_dir, file_type;
 
+# /data_mirror: Contains mirror directory for storing all apps data.
+type mirror_data_file, file_type, core_data_file_type;
+
 # /data/misc subdirectories
 type adb_keys_file, file_type, data_file_type, core_data_file_type;
+type apex_module_data_file, file_type, data_file_type, core_data_file_type;
+type apex_permission_data_file, file_type, data_file_type, core_data_file_type;
+type apex_rollback_data_file, file_type, data_file_type, core_data_file_type;
+type apex_wifi_data_file, file_type, data_file_type, core_data_file_type;
 type audio_data_file, file_type, data_file_type, core_data_file_type;
 type audioserver_data_file, file_type, data_file_type, core_data_file_type;
 type bluetooth_data_file, file_type, data_file_type, core_data_file_type;
@@ -322,6 +359,7 @@
 type bootstat_data_file, file_type, data_file_type, core_data_file_type;
 type boottrace_data_file, file_type, data_file_type, core_data_file_type;
 type camera_data_file, file_type, data_file_type, core_data_file_type;
+type credstore_data_file, file_type, data_file_type, core_data_file_type;
 type gatekeeper_data_file, file_type, data_file_type, core_data_file_type;
 type incident_data_file, file_type, data_file_type, core_data_file_type;
 type keychain_data_file, file_type, data_file_type, core_data_file_type;
@@ -335,6 +373,7 @@
 type radio_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
 type recovery_data_file, file_type, data_file_type, core_data_file_type;
 type shared_relro_file, file_type, data_file_type, core_data_file_type;
+type snapshotctl_log_data_file, file_type, data_file_type, core_data_file_type;
 type stats_data_file, file_type, data_file_type, core_data_file_type;
 type systemkeys_data_file, file_type, data_file_type, core_data_file_type;
 type textclassifier_data_file, file_type, data_file_type, core_data_file_type;
@@ -344,7 +383,6 @@
 type zoneinfo_data_file, file_type, data_file_type, core_data_file_type;
 type vold_data_file, file_type, data_file_type, core_data_file_type;
 type iorapd_data_file, file_type, data_file_type, core_data_file_type;
-type perfprofd_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
 type tee_data_file, file_type, data_file_type;
 type update_engine_data_file, file_type, data_file_type, core_data_file_type;
 type update_engine_log_data_file, file_type, data_file_type, core_data_file_type;
@@ -422,11 +460,13 @@
 type statsdw_socket, file_type, coredomain_socket, mlstrustedobject;
 type system_wpa_socket, file_type, data_file_type, core_data_file_type, coredomain_socket;
 type system_ndebug_socket, file_type, data_file_type, core_data_file_type, coredomain_socket, mlstrustedobject;
+type system_unsolzygote_socket, file_type, data_file_type, core_data_file_type, coredomain_socket, mlstrustedobject;
 type tombstoned_crash_socket, file_type, coredomain_socket, mlstrustedobject;
 type tombstoned_java_trace_socket, file_type, mlstrustedobject;
 type tombstoned_intercept_socket, file_type, coredomain_socket;
-type traced_producer_socket, file_type, coredomain_socket, mlstrustedobject;
 type traced_consumer_socket, file_type, coredomain_socket, mlstrustedobject;
+type traced_perf_socket, file_type, coredomain_socket, mlstrustedobject;
+type traced_producer_socket, file_type, coredomain_socket, mlstrustedobject;
 type uncrypt_socket, file_type, coredomain_socket;
 type wpa_socket, file_type, data_file_type, core_data_file_type;
 type zygote_socket, file_type, coredomain_socket;
@@ -465,7 +505,7 @@
 type service_contexts_file, system_file_type, file_type;
 
 # nonplat service_contexts file (only accessible on non full-treble devices)
-type nonplat_service_contexts_file, file_type;
+type nonplat_service_contexts_file, vendor_file_type, file_type;
 
 # hwservice_contexts file
 type hwservice_contexts_file, system_file_type, file_type;
diff --git a/public/flags_health_check.te b/public/flags_health_check.te
index 151c7c0..6315d44 100644
--- a/public/flags_health_check.te
+++ b/public/flags_health_check.te
@@ -10,6 +10,10 @@
 set_prop(flags_health_check, device_config_netd_native_prop)
 set_prop(flags_health_check, device_config_activity_manager_native_boot_prop)
 set_prop(flags_health_check, device_config_media_native_prop)
+set_prop(flags_health_check, device_config_storage_native_boot_prop)
+set_prop(flags_health_check, device_config_sys_traced_prop)
+set_prop(flags_health_check, device_config_window_manager_native_boot_prop)
+set_prop(flags_health_check, device_config_configuration_prop)
 
 allow flags_health_check server_configurable_flags_data_file:dir rw_dir_perms;
 allow flags_health_check server_configurable_flags_data_file:file create_file_perms;
diff --git a/public/global_macros b/public/global_macros
index 1a1d593..2c87fde 100644
--- a/public/global_macros
+++ b/public/global_macros
@@ -22,7 +22,7 @@
 # Common groupings of permissions.
 #
 define(`x_file_perms', `{ getattr execute execute_no_trans map }')
-define(`r_file_perms', `{ getattr open read ioctl lock map }')
+define(`r_file_perms', `{ getattr open read ioctl lock map watch watch_reads }')
 define(`w_file_perms', `{ open append write lock map }')
 define(`rx_file_perms', `{ r_file_perms x_file_perms }')
 define(`ra_file_perms', `{ r_file_perms append }')
@@ -30,7 +30,7 @@
 define(`rwx_file_perms', `{ rw_file_perms x_file_perms }')
 define(`create_file_perms', `{ create rename setattr unlink rw_file_perms }')
 
-define(`r_dir_perms', `{ open getattr read search ioctl lock }')
+define(`r_dir_perms', `{ open getattr read search ioctl lock watch watch_reads }')
 define(`w_dir_perms', `{ open search write add_name remove_name lock }')
 define(`ra_dir_perms', `{ r_dir_perms add_name write }')
 define(`rw_dir_perms', `{ r_dir_perms w_dir_perms }')
diff --git a/public/gmscore_app.te b/public/gmscore_app.te
new file mode 100644
index 0000000..b574bf3
--- /dev/null
+++ b/public/gmscore_app.te
@@ -0,0 +1,5 @@
+###
+### A domain for further sandboxing the PrebuiltGMSCore app.
+###
+
+type gmscore_app, domain;
diff --git a/public/hal_can.te b/public/hal_can.te
new file mode 100644
index 0000000..c75495b
--- /dev/null
+++ b/public/hal_can.te
@@ -0,0 +1,9 @@
+# CAN controller
+binder_call(hal_can_controller_client, hal_can_controller_server)
+add_hwservice(hal_can_controller_server, hal_can_controller_hwservice)
+allow hal_can_controller_client hal_can_controller_hwservice:hwservice_manager find;
+
+# CAN bus
+binder_call(hal_can_bus_client, hal_can_bus_server)
+add_hwservice(hal_can_bus_server, hal_can_bus_hwservice)
+allow hal_can_bus_client hal_can_bus_hwservice:hwservice_manager find;
diff --git a/public/hal_codec2.te b/public/hal_codec2.te
index 60cd3b0..8c7816a 100644
--- a/public/hal_codec2.te
+++ b/public/hal_codec2.te
@@ -1,3 +1,6 @@
+get_prop(hal_codec2_client, media_variant_prop)
+get_prop(hal_codec2_server, media_variant_prop)
+
 binder_call(hal_codec2_client, hal_codec2_server)
 binder_call(hal_codec2_server, hal_codec2_client)
 
diff --git a/public/hal_configstore.te b/public/hal_configstore.te
index 1a95b72..069da47 100644
--- a/public/hal_configstore.te
+++ b/public/hal_configstore.te
@@ -34,6 +34,7 @@
   userdebug_or_eng(`-su')
   -tombstoned
   userdebug_or_eng(`-heapprofd')
+  userdebug_or_eng(`-traced_perf')
 }:{ unix_dgram_socket unix_stream_socket } *;
 
 # Should never need access to anything on /data
diff --git a/public/hal_drm.te b/public/hal_drm.te
index bfee2d3..d86edaf 100644
--- a/public/hal_drm.te
+++ b/public/hal_drm.te
@@ -31,6 +31,8 @@
 
 allow hal_drm tee_device:chr_file rw_file_perms;
 
+allow hal_drm_server { appdomain -isolated_app }:fd use;
+
 # only allow unprivileged socket ioctl commands
 allowxperm hal_drm self:{ rawip_socket tcp_socket udp_socket }
   ioctl { unpriv_sock_ioctls unpriv_tty_ioctls };
diff --git a/public/hal_evs.te b/public/hal_evs.te
index bf2e38b..789333a 100644
--- a/public/hal_evs.te
+++ b/public/hal_evs.te
@@ -2,4 +2,4 @@
 hwbinder_use(hal_evs_server)
 binder_call(hal_evs_client, hal_evs_server)
 binder_call(hal_evs_server, hal_evs_client)
-allow hal_evs_client hal_evs_hwservice:hwservice_manager find;
+hal_attribute_hwservice(hal_evs, hal_evs_hwservice)
diff --git a/public/hal_identity.te b/public/hal_identity.te
new file mode 100644
index 0000000..3a95743
--- /dev/null
+++ b/public/hal_identity.te
@@ -0,0 +1,7 @@
+# HwBinder IPC from client to server
+binder_call(hal_identity_client, hal_identity_server)
+
+add_service(hal_identity_server, hal_identity_service)
+binder_call(hal_identity_server, servicemanager)
+
+allow hal_identity_client hal_identity_service:service_manager find;
diff --git a/public/hal_light.te b/public/hal_light.te
index 333fcac..1e70b74 100644
--- a/public/hal_light.te
+++ b/public/hal_light.te
@@ -4,6 +4,13 @@
 
 hal_attribute_hwservice(hal_light, hal_light_hwservice)
 
+add_service(hal_light_server, hal_light_service)
+binder_call(hal_light_server, servicemanager)
+
+allow hal_light_client hal_light_service:service_manager find;
+
+allow hal_light_server dumpstate:fifo_file write;
+
 allow hal_light sysfs_leds:lnk_file read;
 allow hal_light sysfs_leds:file rw_file_perms;
 allow hal_light sysfs_leds:dir r_dir_perms;
diff --git a/public/hal_neuralnetworks.te b/public/hal_neuralnetworks.te
index 1ef6cad..f8d6ff5 100644
--- a/public/hal_neuralnetworks.te
+++ b/public/hal_neuralnetworks.te
@@ -5,6 +5,8 @@
 hal_attribute_hwservice(hal_neuralnetworks, hal_neuralnetworks_hwservice)
 allow hal_neuralnetworks hidl_memory_hwservice:hwservice_manager find;
 allow hal_neuralnetworks hal_allocator:fd use;
+allow hal_neuralnetworks hal_graphics_mapper_hwservice:hwservice_manager find;
+allow hal_neuralnetworks hal_graphics_allocator:fd use;
 
 # Allow NN HAL service to use a client-provided fd residing in /data/data/.
 allow hal_neuralnetworks_server app_data_file:file { read write getattr map };
@@ -13,6 +15,9 @@
 # Allow NN HAL service to use a client-provided fd residing in /data/local/tmp/.
 allow hal_neuralnetworks_server shell_data_file:file { read write getattr map };
 
+# Allow NN HAL service to read a client-provided ION memory fd.
+allow hal_neuralnetworks_server ion_device:chr_file r_file_perms;
+
 # Allow NN HAL client to check the ro.nnapi.extensions.deny_on_product
 # property to determine whether to deny NNAPI extensions use for apps
 # on product partition (apps in GSI are not allowed to use NNAPI extensions).
diff --git a/public/hal_neverallows.te b/public/hal_neverallows.te
index 0f05d8a..4117878 100644
--- a/public/hal_neverallows.te
+++ b/public/hal_neverallows.te
@@ -3,6 +3,7 @@
 neverallow {
   halserverdomain
   -hal_bluetooth_server
+  -hal_can_controller_server
   -hal_wifi_server
   -hal_wifi_hostapd_server
   -hal_wifi_supplicant_server
@@ -18,6 +19,7 @@
 neverallow {
   halserverdomain
   -hal_automotive_socket_exemption
+  -hal_can_controller_server
   -hal_tetheroffload_server
   -hal_wifi_server
   -hal_wifi_hostapd_server
diff --git a/public/hal_omx.te b/public/hal_omx.te
index 707cae8..8e74383 100644
--- a/public/hal_omx.te
+++ b/public/hal_omx.te
@@ -22,6 +22,9 @@
 
 allow hal_omx_client hidl_token_hwservice:hwservice_manager find;
 
+get_prop(hal_omx_client, media_variant_prop)
+get_prop(hal_omx_server, media_variant_prop)
+
 binder_call(hal_omx_client, hal_omx_server)
 binder_call(hal_omx_server, hal_omx_client)
 
diff --git a/public/hal_power.te b/public/hal_power.te
index 028011a..c94771b 100644
--- a/public/hal_power.te
+++ b/public/hal_power.te
@@ -3,3 +3,8 @@
 binder_call(hal_power_server, hal_power_client)
 
 hal_attribute_hwservice(hal_power, hal_power_hwservice)
+
+add_service(hal_power_server, hal_power_service)
+binder_call(hal_power_server, servicemanager)
+binder_call(hal_power_client, servicemanager)
+allow hal_power_client hal_power_service:service_manager find;
diff --git a/public/hal_rebootescrow.te b/public/hal_rebootescrow.te
new file mode 100644
index 0000000..4352630
--- /dev/null
+++ b/public/hal_rebootescrow.te
@@ -0,0 +1,7 @@
+# HwBinder IPC from client to server
+binder_call(hal_rebootescrow_client, hal_rebootescrow_server)
+
+add_service(hal_rebootescrow_server, hal_rebootescrow_service)
+binder_use(hal_rebootescrow_server)
+
+allow hal_rebootescrow_client hal_rebootescrow_service:service_manager find;
diff --git a/public/hal_tv_tuner.te b/public/hal_tv_tuner.te
new file mode 100644
index 0000000..0da4ec7
--- /dev/null
+++ b/public/hal_tv_tuner.te
@@ -0,0 +1,4 @@
+binder_call(hal_tv_tuner_client, hal_tv_tuner_server)
+binder_call(hal_tv_tuner_server, hal_tv_tuner_client)
+
+hal_attribute_hwservice(hal_tv_tuner, hal_tv_tuner_hwservice)
diff --git a/public/hal_vibrator.te b/public/hal_vibrator.te
index ab6138d..a34621d 100644
--- a/public/hal_vibrator.te
+++ b/public/hal_vibrator.te
@@ -1,8 +1,16 @@
-# HwBinder IPC from client to server
+# HwBinder IPC client/server
 binder_call(hal_vibrator_client, hal_vibrator_server)
+binder_call(hal_vibrator_server, hal_vibrator_client);
 
 hal_attribute_hwservice(hal_vibrator, hal_vibrator_hwservice)
 
+add_service(hal_vibrator_server, hal_vibrator_service)
+binder_call(hal_vibrator_server, servicemanager)
+
+allow hal_vibrator_client hal_vibrator_service:service_manager find;
+
+allow hal_vibrator_server dumpstate:fifo_file write;
+
 # vibrator sysfs rw access
 allow hal_vibrator sysfs_vibrator:file rw_file_perms;
 allow hal_vibrator sysfs_vibrator:dir search;
diff --git a/public/hal_wifi_offload.te b/public/hal_wifi_offload.te
deleted file mode 100644
index 765e72a..0000000
--- a/public/hal_wifi_offload.te
+++ /dev/null
@@ -1,8 +0,0 @@
-## HwBinder IPC from client to server, and callbacks
-binder_call(hal_wifi_offload_client, hal_wifi_offload_server)
-binder_call(hal_wifi_offload_server, hal_wifi_offload_client)
-
-hal_attribute_hwservice(hal_wifi_offload, hal_wifi_offload_hwservice)
-
-r_dir_file(hal_wifi_offload, proc_net_type)
-r_dir_file(hal_wifi_offload, sysfs_type)
diff --git a/public/healthd.te b/public/healthd.te
index 5fe4add..7ea23e1 100644
--- a/public/healthd.te
+++ b/public/healthd.te
@@ -46,7 +46,6 @@
 allow healthd input_device:chr_file r_file_perms;
 allow healthd tty_device:chr_file rw_file_perms;
 allow healthd ashmem_device:chr_file execute;
-allow healthd self:process execmem;
 allow healthd proc_sysrq:file rw_file_perms;
 
 # Healthd needs to tell init to continue the boot
diff --git a/public/hwservice.te b/public/hwservice.te
index 7425878..6f223dd 100644
--- a/public/hwservice.te
+++ b/public/hwservice.te
@@ -1,74 +1,96 @@
-type default_android_hwservice, hwservice_manager_type;
+# hwservice types. By default most of the HALs are protected_hwservice, which means
+# access from untrusted apps is prohibited.
+type default_android_hwservice, hwservice_manager_type, protected_hwservice;
+type fwk_camera_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type fwk_display_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type fwk_scheduler_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type fwk_sensor_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type fwk_stats_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type fwk_automotive_display_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type hal_atrace_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_audio_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_audiocontrol_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_authsecret_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_bluetooth_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_bootctl_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_broadcastradio_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_camera_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_can_bus_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_can_controller_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_confirmationui_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_contexthub_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_dumpstate_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_evs_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_face_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_fingerprint_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_gatekeeper_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_gnss_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_graphics_composer_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_health_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_health_storage_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_input_classifier_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_ir_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_keymaster_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_light_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_lowpan_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_memtrack_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_nfc_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_oemlock_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_power_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_power_stats_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_secure_element_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_sensors_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_telephony_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_tetheroffload_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_thermal_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_tv_cec_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_tv_input_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_tv_tuner_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_usb_gadget_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_usb_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_vehicle_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_vibrator_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_vr_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_weaver_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_wifi_hostapd_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_wifi_hwservice, hwservice_manager_type, protected_hwservice;
+type hal_wifi_supplicant_hwservice, hwservice_manager_type, protected_hwservice;
+type system_net_netd_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type system_suspend_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type system_wifi_keystore_hwservice, hwservice_manager_type, coredomain_hwservice, protected_hwservice;
+type thermalcallback_hwservice, hwservice_manager_type, protected_hwservice;
+
+# Following is the hwservices that are explicitly not marked with protected_hwservice.
+# These are directly accessible from untrusted apps.
+# - same process services: because they by definition run in the process
+#   of the client and thus have the same access as the client domain in which
+#   the process runs
+# - coredomain_hwservice: are considered safer than ordinary hwservices which
+#   are from vendor partition
+# - hal_configstore_ISurfaceFlingerConfigs:  becuase it has specifically been
+#   designed for use by any domain.
+# - hal_graphics_allocator_hwservice: because these operations are also offered
+#   by surfaceflinger Binder service, which apps are permitted to access
+# - hal_omx_hwservice: because this is a HwBinder version of the mediacodec
+#   Binder service which apps were permitted to access.
+# - hal_codec2_hwservice: because this is a newer version of hal_omx_hwservice.
+# - hal_drm_hwservice: versions > API 29 are designed specifically with
+#   untrusted app access in mind.
 type fwk_bufferhub_hwservice, hwservice_manager_type, coredomain_hwservice;
-type fwk_camera_hwservice, hwservice_manager_type, coredomain_hwservice;
-type fwk_display_hwservice, hwservice_manager_type, coredomain_hwservice;
-type fwk_scheduler_hwservice, hwservice_manager_type, coredomain_hwservice;
-type fwk_sensor_hwservice, hwservice_manager_type, coredomain_hwservice;
-type fwk_stats_hwservice, hwservice_manager_type, coredomain_hwservice;
-type hal_atrace_hwservice, hwservice_manager_type;
-type hal_audiocontrol_hwservice, hwservice_manager_type;
-type hal_audio_hwservice, hwservice_manager_type;
-type hal_authsecret_hwservice, hwservice_manager_type;
-type hal_bluetooth_hwservice, hwservice_manager_type;
-type hal_bootctl_hwservice, hwservice_manager_type;
-type hal_broadcastradio_hwservice, hwservice_manager_type;
-type hal_camera_hwservice, hwservice_manager_type;
+type hal_cas_hwservice, hwservice_manager_type;
 type hal_codec2_hwservice, hwservice_manager_type;
 type hal_configstore_ISurfaceFlingerConfigs, hwservice_manager_type;
-type hal_confirmationui_hwservice, hwservice_manager_type;
-type hal_contexthub_hwservice, hwservice_manager_type;
 type hal_drm_hwservice, hwservice_manager_type;
-type hal_cas_hwservice, hwservice_manager_type;
-type hal_dumpstate_hwservice, hwservice_manager_type;
-type hal_evs_hwservice, hwservice_manager_type;
-type hal_face_hwservice, hwservice_manager_type;
-type hal_fingerprint_hwservice, hwservice_manager_type;
-type hal_gatekeeper_hwservice, hwservice_manager_type;
-type hal_gnss_hwservice, hwservice_manager_type;
 type hal_graphics_allocator_hwservice, hwservice_manager_type;
-type hal_graphics_composer_hwservice, hwservice_manager_type;
 type hal_graphics_mapper_hwservice, hwservice_manager_type, same_process_hwservice;
-type hal_health_hwservice, hwservice_manager_type;
-type hal_health_storage_hwservice, hwservice_manager_type;
-type hal_input_classifier_hwservice, hwservice_manager_type;
-type hal_ir_hwservice, hwservice_manager_type;
-type hal_keymaster_hwservice, hwservice_manager_type;
-type hal_light_hwservice, hwservice_manager_type;
-type hal_lowpan_hwservice, hwservice_manager_type;
-type hal_memtrack_hwservice, hwservice_manager_type;
 type hal_neuralnetworks_hwservice, hwservice_manager_type;
-type hal_nfc_hwservice, hwservice_manager_type;
-type hal_oemlock_hwservice, hwservice_manager_type;
 type hal_omx_hwservice, hwservice_manager_type;
-type hal_power_hwservice, hwservice_manager_type;
-type hal_power_stats_hwservice, hwservice_manager_type;
 type hal_renderscript_hwservice, hwservice_manager_type, same_process_hwservice;
-type hal_secure_element_hwservice, hwservice_manager_type;
-type hal_sensors_hwservice, hwservice_manager_type;
-type hal_telephony_hwservice, hwservice_manager_type;
-type hal_tetheroffload_hwservice, hwservice_manager_type;
-type hal_thermal_hwservice, hwservice_manager_type;
-type hal_tv_cec_hwservice, hwservice_manager_type;
-type hal_tv_input_hwservice, hwservice_manager_type;
-type hal_usb_hwservice, hwservice_manager_type;
-type hal_usb_gadget_hwservice, hwservice_manager_type;
-type hal_vehicle_hwservice, hwservice_manager_type;
-type hal_vibrator_hwservice, hwservice_manager_type;
-type hal_vr_hwservice, hwservice_manager_type;
-type hal_weaver_hwservice, hwservice_manager_type;
-type hal_wifi_hwservice, hwservice_manager_type;
-type hal_wifi_hostapd_hwservice, hwservice_manager_type;
-type hal_wifi_offload_hwservice, hwservice_manager_type;
-type hal_wifi_supplicant_hwservice, hwservice_manager_type;
 type hidl_allocator_hwservice, hwservice_manager_type, coredomain_hwservice;
 type hidl_base_hwservice, hwservice_manager_type;
 type hidl_manager_hwservice, hwservice_manager_type, coredomain_hwservice;
 type hidl_memory_hwservice, hwservice_manager_type, coredomain_hwservice;
 type hidl_token_hwservice, hwservice_manager_type, coredomain_hwservice;
-type system_net_netd_hwservice, hwservice_manager_type, coredomain_hwservice;
-type system_suspend_hwservice, hwservice_manager_type, coredomain_hwservice;
-type system_wifi_keystore_hwservice, hwservice_manager_type, coredomain_hwservice;
-type thermalcallback_hwservice, hwservice_manager_type;
 
 ###
 ### Neverallow rules
diff --git a/public/idmap.te b/public/idmap.te
index 92c649c..f41f573 100644
--- a/public/idmap.te
+++ b/public/idmap.te
@@ -27,4 +27,5 @@
 
 # Allow the idmap2d binary to register as a service and communicate via AIDL
 binder_use(idmap)
+binder_service(idmap)
 add_service(idmap, idmap_service)
diff --git a/public/init.te b/public/init.te
index 6fd4780..403b4c5 100644
--- a/public/init.te
+++ b/public/init.te
@@ -14,7 +14,7 @@
 allow init kmsg_device:chr_file { getattr write relabelto };
 # /dev/kmsg_debug
 userdebug_or_eng(`
-  allow init kmsg_debug_device:chr_file { write relabelto };
+  allow init kmsg_debug_device:chr_file { open write relabelto };
 ')
 # /dev/__properties__
 allow init properties_device:dir relabelto;
@@ -28,6 +28,8 @@
 allow init runtime_event_log_tags_file:file { open write setattr relabelto create };
 # /dev/socket
 allow init { device socket_device }:dir relabelto;
+# allow init to establish connection and communicate with lmkd
+unix_socket_connect(init, lmkd, lmkd)
 # Relabel /dev nodes created in first stage init, /dev/null, /dev/ptmx, /dev/random, /dev/urandom
 allow init { null_device ptmx_device random_device } : chr_file relabelto;
 # /dev/device-mapper, /dev/block(/.*)?
@@ -48,6 +50,9 @@
 
 allow init super_block_device:lnk_file relabelto;
 
+# Create /mnt/sdcard -> /storage/self/primary symlink.
+allow init mnt_sdcard_file:lnk_file create;
+
 # setrlimit
 allow init self:global_capability_class_set sys_resource;
 
@@ -77,7 +82,20 @@
 
 # Create and mount on directories in /.
 allow init rootfs:dir create_dir_perms;
-allow init { rootfs cache_file cgroup storage_file system_data_file system_file vendor_file postinstall_mnt_dir }:dir mounton;
+allow init {
+    rootfs
+    cache_file
+    cgroup
+    linkerconfig_file
+    storage_file
+    mnt_user_file
+    system_data_file
+    system_data_root_file
+    system_file
+    vendor_file
+    postinstall_mnt_dir
+    mirror_data_file
+}:dir mounton;
 allow init cgroup_bpf:dir { create mounton };
 
 # Mount bpf fs on sys/fs/bpf
@@ -89,6 +107,9 @@
 # Mount tmpfs on /apex
 allow init apex_mnt_dir:dir mounton;
 
+# Bind-mount on /system/apex/com.android.art
+allow init art_apex_dir:dir mounton;
+
 # Create and remove symlinks in /.
 allow init rootfs:lnk_file { create unlink };
 
@@ -168,6 +189,7 @@
   -app_data_file
   -exec_type
   -iorapd_data_file
+  -credstore_data_file
   -keystore_data_file
   -misc_logd_file
   -nativetest_data_file
@@ -185,6 +207,7 @@
   -exec_type
   -gsi_data_file
   -iorapd_data_file
+  -credstore_data_file
   -keystore_data_file
   -misc_logd_file
   -nativetest_data_file
@@ -203,6 +226,7 @@
   -exec_type
   -gsi_data_file
   -iorapd_data_file
+  -credstore_data_file
   -keystore_data_file
   -misc_logd_file
   -nativetest_data_file
@@ -221,6 +245,7 @@
   -exec_type
   -gsi_data_file
   -iorapd_data_file
+  -credstore_data_file
   -keystore_data_file
   -misc_logd_file
   -nativetest_data_file
@@ -269,7 +294,6 @@
 allow init { fs_type -contextmount_type -sdcard_type -rootfs }:dir  { open read setattr search };
 
 allow init {
-  ashmem_device
   binder_device
   console_device
   devpts
@@ -334,7 +358,7 @@
   proc_net_type
   proc_max_map_count
   proc_min_free_order_shift
-  proc_overcommit_memory
+  proc_overcommit_memory      # /proc/sys/vm/overcommit_memory
   proc_panic
   proc_page_cluster
   proc_perf
@@ -361,6 +385,7 @@
 # init access to /sys files.
 allow init {
   sysfs_android_usb
+  sysfs_dm_verity
   sysfs_leds
   sysfs_power
   sysfs_fs_f2fs
@@ -420,6 +445,11 @@
 allow init self:global_capability_class_set kill;
 allow init domain:process { getpgid sigkill signal };
 
+# Init creates credstore's directory on boot, and walks through
+# the directory as part of a recursive restorecon.
+allow init credstore_data_file:dir { open create read getattr setattr search };
+allow init credstore_data_file:file { getattr };
+
 # Init creates keystore's directory on boot, and walks through
 # the directory as part of a recursive restorecon.
 allow init keystore_data_file:dir { open create read getattr setattr search };
@@ -484,6 +514,7 @@
 allow init self:global_capability_class_set net_raw;
 
 # Set scheduling info for psi monitor thread.
+# TODO: delete or revise this line b/131761776
 allow init kernel:process { getsched setsched };
 
 # swapon() needs write access to swap device
@@ -524,14 +555,11 @@
 allow init unencrypted_data_file:dir create_dir_perms;
 
 # Set encryption policy on dirs in /data
-allowxperm init data_file_type:dir ioctl {
+allowxperm init { data_file_type unlabeled }:dir ioctl {
   FS_IOC_GET_ENCRYPTION_POLICY
   FS_IOC_SET_ENCRYPTION_POLICY
 };
 
-# Allow init to write to /proc/sys/vm/overcommit_memory
-allow init proc_overcommit_memory:file { write };
-
 # Raw writes to misc block device
 allow init misc_block_device:blk_file w_file_perms;
 
@@ -547,14 +575,8 @@
 # Metadata setup
 allow init vold_metadata_file:dir create_dir_perms;
 allow init vold_metadata_file:file getattr;
-
-# Allow init to use binder
-binder_use(init);
-allow init apex_service:service_manager find;
-# Allow servicemanager to pass it
-allow servicemanager init:binder transfer;
-# Allow calls from init to apexd
-allow init apexd:binder call;
+allow init metadata_bootstat_file:dir create_dir_perms;
+allow init metadata_bootstat_file:file w_file_perms;
 
 # Allow init to touch PSI monitors
 allow init proc_pressure_mem:file { rw_file_perms setattr };
@@ -563,6 +585,9 @@
 allow init system_bootstrap_lib_file:dir r_dir_perms;
 allow init system_bootstrap_lib_file:file { execute read open getattr map };
 
+# stat the root dir of fuse filesystems (for the mount handler)
+allow init fuse:dir { search getattr };
+
 ###
 ### neverallow rules
 ###
@@ -580,10 +605,17 @@
 # init should never execute a program without changing to another domain.
 neverallow init { file_type fs_type }:file execute_no_trans;
 
-# init can only find the APEX service
-neverallow init { service_manager_type -apex_service }:service_manager { find };
+# The use of sensitive environment variables, such as LD_PRELOAD, is disallowed
+# when init is executing other binaries. The use of LD_PRELOAD for init spawned
+# services is generally considered a no-no, as it injects libraries which the
+# binary was not expecting. This is especially problematic for APEXes. The use
+# of LD_PRELOAD via APEXes is a layering violation, and inappropriately loads
+# code into a process which wasn't expecting that code, with potentially
+# unexpected side effects. (b/140789528)
+neverallow init *:process noatsecure;
+
 # init can never add binder services
-neverallow init service_manager_type:service_manager { add };
+neverallow init service_manager_type:service_manager { add find };
 # init can never list binder services
 neverallow init servicemanager:service_manager list;
 
@@ -595,3 +627,8 @@
 
 # No domain should be allowed to ptrace init.
 neverallow * init:process ptrace;
+
+# init owns the root of /data
+# TODO(b/140259336) We want to remove vendor_init
+# TODO(b/141108496) We want to remove toolbox
+neverallow { domain -init -toolbox -vendor_init -vold } system_data_root_file:dir { write add_name remove_name };
diff --git a/public/install_recovery.te b/public/install_recovery.te
deleted file mode 100644
index 0aee9ab..0000000
--- a/public/install_recovery.te
+++ /dev/null
@@ -1,27 +0,0 @@
-# service flash_recovery in init.rc
-type install_recovery, domain;
-type install_recovery_exec, system_file_type, exec_type, file_type;
-
-allow install_recovery self:global_capability_class_set { dac_override dac_read_search };
-
-# /system/bin/install-recovery.sh is a shell script.
-# Needs to execute /system/bin/sh
-allow install_recovery shell_exec:file rx_file_perms;
-
-# Execute /system/bin/applypatch
-allow install_recovery system_file:file rx_file_perms;
-not_full_treble(`allow install_recovery vendor_file:file rx_file_perms;')
-
-allow install_recovery toolbox_exec:file rx_file_perms;
-
-# Update the recovery block device based off a diff of the boot block device
-allow install_recovery block_device:dir search;
-allow install_recovery boot_block_device:blk_file r_file_perms;
-allow install_recovery recovery_block_device:blk_file rw_file_perms;
-
-# Create and delete /cache/saved.file
-allow install_recovery cache_file:dir rw_dir_perms;
-allow install_recovery cache_file:file create_file_perms;
-
-# Write to /proc/sys/vm/drop_caches
-allow install_recovery proc_drop_caches:file w_file_perms;
diff --git a/public/installd.te b/public/installd.te
index f0ac52a..c8cc89d 100644
--- a/public/installd.te
+++ b/public/installd.te
@@ -57,6 +57,9 @@
 # optimizing application code.
 allow installd system_data_file:lnk_file { create getattr read setattr unlink };
 
+# Manage lower filesystem via pass_through mounts
+allow installd mnt_pass_through_file:dir r_dir_perms;
+
 # Upgrade /data/media for multi-user if necessary.
 allow installd media_rw_data_file:dir create_dir_perms;
 allow installd media_rw_data_file:file { getattr unlink };
@@ -70,14 +73,18 @@
 allow installd sdcard_type:dir { search open read write remove_name getattr rmdir };
 allow installd sdcard_type:file { getattr unlink };
 
+# Create app's mirror data directory in /data_mirror, and bind mount the real directory to it
+allow installd mirror_data_file:dir { create_dir_perms mounton };
+
 # Upgrade /data/misc/keychain for multi-user if necessary.
 allow installd misc_user_data_file:dir create_dir_perms;
 allow installd misc_user_data_file:file create_file_perms;
 allow installd keychain_data_file:dir create_dir_perms;
 allow installd keychain_data_file:file {r_file_perms unlink};
 
-# Create /data/.layout_version.* file
+# Create /data/misc/installd/layout_version.* file
 allow installd install_data_file:file create_file_perms;
+allow installd install_data_file:dir rw_dir_perms;
 
 # Create files under /data/dalvik-cache.
 allow installd dalvikcache_data_file:dir create_dir_perms;
@@ -104,6 +111,7 @@
 # upon creation via setfilecon or running restorecon_recursive,
 # setting owner/mode, creating symlinks within them, and deleting them
 # upon package uninstall.
+
 # Types extracted from seapp_contexts type= fields.
 allow installd {
     system_app_data_file
@@ -125,6 +133,9 @@
     privapp_data_file
 }:notdevfile_class_set { create_file_perms relabelfrom relabelto };
 
+# Allow zygote to unmount mirror directories
+allow installd labeledfs:filesystem unmount;
+
 # Similar for the files under /data/misc/profiles/
 allow installd user_profile_data_file:dir create_dir_perms;
 allow installd user_profile_data_file:file create_file_perms;
@@ -161,16 +172,18 @@
 allow installd preloads_media_file:file { r_file_perms unlink };
 allow installd preloads_media_file:dir { r_dir_perms write remove_name rmdir };
 
+# Allow installd to read /proc/filesystems
+allow installd proc_filesystems:file r_file_perms;
+
 ###
 ### Neverallow rules
 ###
 
-# only system_server, installd and dumpstate may interact with installd over binder
+# only system_server, installd, dumpstate, and servicemanager may interact with installd over binder
 neverallow { domain -system_server -dumpstate -installd } installd_service:service_manager find;
-neverallow { domain -system_server -dumpstate } installd:binder call;
+neverallow { domain -system_server -dumpstate -servicemanager } installd:binder call;
 neverallow installd {
     domain
-    -ashmemd
     -system_server
     -servicemanager
     userdebug_or_eng(`-su')
diff --git a/public/ioctl_defines b/public/ioctl_defines
index c5b412b..4cc3bba 100644
--- a/public/ioctl_defines
+++ b/public/ioctl_defines
@@ -801,13 +801,18 @@
 define(`FS_IOC32_GETVERSION', `0x80047601')
 define(`FS_IOC32_SETFLAGS', `0x40046602')
 define(`FS_IOC32_SETVERSION', `0x40047602')
+define(`FS_IOC_ADD_ENCRYPTION_KEY', `0xc0506617')
 define(`FS_IOC_ENABLE_VERITY', `0x6685')
 define(`FS_IOC_FIEMAP', `0xc020660b')
+define(`FS_IOC_FSGETXATTR', `0x801c581f')
+define(`FS_IOC_FSSETXATTR', `0x401c5820')
 define(`FS_IOC_GET_ENCRYPTION_POLICY', `0x400c6615')
+define(`FS_IOC_GET_ENCRYPTION_POLICY_EX', `0xc0096616')
 define(`FS_IOC_GET_ENCRYPTION_PWSALT', `0x40106614')
 define(`FS_IOC_GETFLAGS', `0x80086601')
 define(`FS_IOC_GETVERSION', `0x80087601')
 define(`FS_IOC_MEASURE_VERITY', `0x6686')
+define(`FS_IOC_REMOVE_ENCRYPTION_KEY', `0xc0406618')
 define(`FS_IOC_SET_ENCRYPTION_POLICY', `0x800c6613')
 define(`FS_IOC_SETFLAGS', `0x40086602')
 define(`FS_IOC_SETVERSION', `0x40087602')
@@ -1050,6 +1055,10 @@
 define(`IMGETVERSION', `0x80044942')
 define(`IMHOLD_L1', `0x80044948')
 define(`IMSETDEVNAME', `0x80184947')
+define(`INCFS_IOCTL_CREATE_FILE', `0x0000671e')
+define(`INCFS_IOCTL_READ_SIGNATURE', `0x0000671f')
+define(`INCFS_IOCTL_FILL_BLOCKS', `0x00006720')
+define(`INCFS_IOCTL_PERMIT_FILL', `0x00006721')
 define(`IOCTL_EVTCHN_BIND_INTERDOMAIN', `0x00084501')
 define(`IOCTL_EVTCHN_BIND_UNBOUND_PORT', `0x00044502')
 define(`IOCTL_EVTCHN_BIND_VIRQ', `0x00044500')
diff --git a/public/iorap_inode2filename.te b/public/iorap_inode2filename.te
new file mode 100644
index 0000000..4041ddd
--- /dev/null
+++ b/public/iorap_inode2filename.te
@@ -0,0 +1,77 @@
+# iorap.inode2filename -> look up file paths from an inode
+type iorap_inode2filename, domain;
+type iorap_inode2filename_exec, exec_type, file_type, system_file_type;
+type iorap_inode2filename_tmpfs, file_type;
+
+r_dir_file(iorap_inode2filename, rootfs)
+
+# Allow usage of pipes (child stdout -> parent pipe).
+allow iorap_inode2filename iorapd:fd use;
+allow iorap_inode2filename iorapd:fifo_file { read write getattr };
+
+# Allow reading most files under / ignoring usual access controls.
+allow iorap_inode2filename self:capability dac_read_search;
+
+typeattribute iorap_inode2filename mlstrustedsubject;
+
+# Grant access to open most of the files under /
+allow iorap_inode2filename apex_data_file:dir { getattr open read search };
+allow iorap_inode2filename apex_data_file:file { getattr };
+allow iorap_inode2filename apex_mnt_dir:dir { getattr open read search };
+allow iorap_inode2filename apex_mnt_dir:file { getattr };
+allow iorap_inode2filename apk_data_file:dir { getattr open read search };
+allow iorap_inode2filename apk_data_file:file { getattr };
+allow iorap_inode2filename app_data_file:dir { getattr open read search };
+allow iorap_inode2filename app_data_file:file { getattr };
+allow iorap_inode2filename backup_data_file:dir  { getattr open read search };
+allow iorap_inode2filename backup_data_file:file  { getattr };
+allow iorap_inode2filename bluetooth_data_file:dir { getattr open read search };
+allow iorap_inode2filename bluetooth_data_file:file { getattr };
+allow iorap_inode2filename bootchart_data_file:dir { getattr open read search };
+allow iorap_inode2filename bootchart_data_file:file { getattr };
+allow iorap_inode2filename metadata_file:dir { getattr open read search search };
+allow iorap_inode2filename metadata_file:file { getattr };
+allow iorap_inode2filename packages_list_file:dir { getattr open read search };
+allow iorap_inode2filename packages_list_file:file { getattr };
+allow iorap_inode2filename privapp_data_file:dir { getattr open read search };
+allow iorap_inode2filename privapp_data_file:file { getattr };
+allow iorap_inode2filename property_data_file:dir { getattr open read search };
+allow iorap_inode2filename property_data_file:file { getattr };
+allow iorap_inode2filename radio_data_file:dir { getattr open read search };
+allow iorap_inode2filename radio_data_file:file { getattr };
+allow iorap_inode2filename resourcecache_data_file:dir { getattr open read search };
+allow iorap_inode2filename resourcecache_data_file:file { getattr };
+allow iorap_inode2filename recovery_data_file:dir { getattr open read search };
+allow iorap_inode2filename ringtone_file:dir { getattr open read search };
+allow iorap_inode2filename ringtone_file:file { getattr };
+allow iorap_inode2filename same_process_hal_file:dir { getattr open read search };
+allow iorap_inode2filename same_process_hal_file:file { getattr };
+allow iorap_inode2filename sepolicy_file:file { getattr };
+allow iorap_inode2filename staging_data_file:dir { getattr open read search };
+allow iorap_inode2filename staging_data_file:file { getattr };
+allow iorap_inode2filename system_bootstrap_lib_file:dir { getattr open read search };
+allow iorap_inode2filename system_bootstrap_lib_file:file { getattr };
+allow iorap_inode2filename system_app_data_file:dir { getattr open read search };
+allow iorap_inode2filename system_app_data_file:file { getattr };
+allow iorap_inode2filename system_data_file:dir { getattr open read search };
+allow iorap_inode2filename system_data_file:file { getattr };
+allow iorap_inode2filename system_data_file:lnk_file { getattr open read };
+allow iorap_inode2filename system_data_root_file:dir { getattr open read search };
+allow iorap_inode2filename textclassifier_data_file:dir { getattr open read search };
+allow iorap_inode2filename textclassifier_data_file:file { getattr };
+allow iorap_inode2filename toolbox_exec:file getattr;
+allow iorap_inode2filename user_profile_data_file:dir { getattr open read search };
+allow iorap_inode2filename user_profile_data_file:file { getattr };
+allow iorap_inode2filename unencrypted_data_file:dir { getattr open read search };
+allow iorap_inode2filename unlabeled:file { getattr };
+allow iorap_inode2filename vendor_file:dir { getattr open read search };
+allow iorap_inode2filename vendor_file:file { getattr };
+allow iorap_inode2filename vendor_overlay_file:file { getattr };
+allow iorap_inode2filename zygote_exec:file { getattr };
+
+###
+### neverallow rules
+###
+
+neverallow { domain -init -iorapd } iorap_inode2filename:process { transition dyntransition };
+neverallow iorap_inode2filename domain:{ tcp_socket udp_socket rawip_socket } *;
diff --git a/public/iorap_prefetcherd.te b/public/iorap_prefetcherd.te
new file mode 100644
index 0000000..ad9db14
--- /dev/null
+++ b/public/iorap_prefetcherd.te
@@ -0,0 +1,54 @@
+# volume manager
+type iorap_prefetcherd, domain;
+type iorap_prefetcherd_exec, exec_type, file_type, system_file_type;
+type iorap_prefetcherd_tmpfs, file_type;
+
+r_dir_file(iorap_prefetcherd, rootfs)
+
+# Allow read/write /proc/sys/vm/drop/caches
+allow iorap_prefetcherd proc_drop_caches:file rw_file_perms;
+
+# iorap_prefetcherd temporarily changes its priority when running benchmarks
+allow iorap_prefetcherd self:global_capability_class_set sys_nice;
+
+# Allow usage of pipes (--input-fd=# and --output-fd=# command line parameters).
+allow iorap_prefetcherd iorapd:fd use;
+allow iorap_prefetcherd iorapd:fifo_file { read write };
+
+# Allow reading most files under / ignoring usual access controls.
+allow iorap_prefetcherd self:capability dac_read_search;
+
+typeattribute iorap_prefetcherd mlstrustedsubject;
+
+# Grant logcat access
+allow iorap_prefetcherd logcat_exec:file { open read };
+
+# Grant access to open most of the files under /
+allow iorap_prefetcherd apk_data_file:dir { open read search };
+allow iorap_prefetcherd apk_data_file:file { open read };
+allow iorap_prefetcherd app_data_file:dir { open read search };
+allow iorap_prefetcherd app_data_file:file { open read };
+allow iorap_prefetcherd dalvikcache_data_file:dir { open read search };
+allow iorap_prefetcherd dalvikcache_data_file:file{ open read };
+allow iorap_prefetcherd packages_list_file:dir { open read search };
+allow iorap_prefetcherd packages_list_file:file { open read };
+allow iorap_prefetcherd privapp_data_file:dir { open read search };
+allow iorap_prefetcherd privapp_data_file:file { open read };
+allow iorap_prefetcherd same_process_hal_file:dir{ open read search };
+allow iorap_prefetcherd same_process_hal_file:file { open read };
+allow iorap_prefetcherd system_data_file:dir { open read search };
+allow iorap_prefetcherd system_data_file:file { open read };
+allow iorap_prefetcherd system_data_file:lnk_file { open read };
+allow iorap_prefetcherd user_profile_data_file:dir { open read search };
+allow iorap_prefetcherd user_profile_data_file:file { open read };
+allow iorap_prefetcherd vendor_overlay_file:dir { open read search };
+allow iorap_prefetcherd vendor_overlay_file:file { open read };
+# Note: Do not add any /vendor labels because they can be customized
+# by the vendor and we won't know about them beforehand.
+
+###
+### neverallow rules
+###
+
+neverallow { domain -init -iorapd } iorap_prefetcherd:process { transition dyntransition };
+neverallow iorap_prefetcherd domain:{ tcp_socket udp_socket rawip_socket } *;
diff --git a/public/iorapd.te b/public/iorapd.te
index abf7adb..4c08c72 100644
--- a/public/iorapd.te
+++ b/public/iorapd.te
@@ -36,6 +36,9 @@
 # tracing sessions and read trace data.
 unix_socket_connect(iorapd, traced_consumer, traced)
 
+# Allow iorapd to execute compilation (iorap.cmd.compiler) in idle time.
+allow iorapd system_file:file rx_file_perms;
+
 ###
 ### neverallow rules
 ###
diff --git a/public/kernel.te b/public/kernel.te
index 804b631..42fe2c4 100644
--- a/public/kernel.te
+++ b/public/kernel.te
@@ -85,8 +85,11 @@
 # Needed because APEX uses the loopback driver, which issues requests from
 # a kernel thread in earlier kernel version.
 allow kernel apexd:fd use;
-allow kernel apex_data_file:file read;
-allow kernel staging_data_file:file read;
+allow kernel {
+  apex_data_file
+  staging_data_file
+  vendor_apex_file
+}:file read;
 
 # Allow the first-stage init (which is running in the kernel domain) to execute the
 # dynamic linker when it re-executes /init to switch into the second stage.
@@ -104,7 +107,7 @@
 ')
 
 # required by VTS lidbm unit test
-allow kernel appdomain_tmpfs:file read;
+allow kernel appdomain_tmpfs:file { read write };
 
 ###
 ### neverallow rules
diff --git a/public/keystore.te b/public/keystore.te
index e869f32..27c4624 100644
--- a/public/keystore.te
+++ b/public/keystore.te
@@ -6,6 +6,7 @@
 binder_use(keystore)
 binder_service(keystore)
 binder_call(keystore, system_server)
+binder_call(keystore, wificond)
 
 allow keystore keystore_data_file:dir create_dir_perms;
 allow keystore keystore_data_file:notdevfile_class_set create_file_perms;
diff --git a/public/lmkd.te b/public/lmkd.te
index 51d1aa2..b852f44 100644
--- a/public/lmkd.te
+++ b/public/lmkd.te
@@ -10,19 +10,18 @@
 # b/16236289
 allow lmkd self:global_capability_class_set ipc_lock;
 
-## Open and write to /proc/PID/oom_score_adj
+## Open and write to /proc/PID/oom_score_adj and /proc/PID/timerslack_ns
 ## TODO: maybe scope this down?
-r_dir_file(lmkd, appdomain)
-allow lmkd appdomain:file write;
-r_dir_file(lmkd, system_server)
-allow lmkd system_server:file write;
+r_dir_file(lmkd, domain)
+allow lmkd domain:file write;
 
 ## Writes to /sys/module/lowmemorykiller/parameters/minfree
 r_dir_file(lmkd, sysfs_lowmemorykiller)
 allow lmkd sysfs_lowmemorykiller:file w_file_perms;
 
-# setsched and send kill signals
-allow lmkd appdomain:process { setsched sigkill };
+# setsched and send kill signals to any registered process
+allow lmkd domain:process { setsched sigkill };
+# TODO: delete this line b/131761776
 allow lmkd kernel:process { setsched };
 
 # Clean up old cgroups
@@ -35,6 +34,7 @@
 allow lmkd self:global_capability_class_set sys_nice;
 
 allow lmkd proc_zoneinfo:file r_file_perms;
+allow lmkd proc_vmstat:file r_file_perms;
 
 # Set sys.lmk.* properties.
 set_prop(lmkd, system_lmk_prop)
@@ -47,6 +47,9 @@
 # reboot because orderly shutdown may not be possible.
 allow lmkd proc_sysrq:file rw_file_perms;
 
+# Read /proc/lowmemorykiller
+allow lmkd proc_lowmemorykiller:file r_file_perms;
+
 # Read /proc/meminfo
 allow lmkd proc_meminfo:file r_file_perms;
 
@@ -64,3 +67,4 @@
 
 # never honor LD_PRELOAD
 neverallow * lmkd:process noatsecure;
+neverallow lmkd self:global_capability_class_set sys_ptrace;
diff --git a/public/logpersist.te b/public/logpersist.te
index c7cab80..c8e6af4 100644
--- a/public/logpersist.te
+++ b/public/logpersist.te
@@ -1,6 +1,10 @@
 # android debug logging, logpersist domains
 type logpersist, domain;
 
+# logcatd is a shell script that execs logcat with various parameters.
+allow logpersist shell_exec:file rx_file_perms;
+allow logpersist logcat_exec:file rx_file_perms;
+
 ###
 ### Neverallow rules
 ###
diff --git a/public/mediaserver.te b/public/mediaserver.te
index 70d0a55..02a0eb0 100644
--- a/public/mediaserver.te
+++ b/public/mediaserver.te
@@ -74,7 +74,6 @@
 allow mediaserver batterystats_service:service_manager find;
 allow mediaserver drmserver_service:service_manager find;
 allow mediaserver mediaextractor_service:service_manager find;
-allow mediaserver mediacodec_service:service_manager find;
 allow mediaserver mediametrics_service:service_manager find;
 allow mediaserver media_session_service:service_manager find;
 allow mediaserver permission_service:service_manager find;
diff --git a/public/mediatranscoding.te b/public/mediatranscoding.te
new file mode 100644
index 0000000..386535b
--- /dev/null
+++ b/public/mediatranscoding.te
@@ -0,0 +1,26 @@
+# mediatranscoding - daemon for transcoding video and image.
+type mediatranscoding, domain;
+type mediatranscoding_exec, system_file_type, exec_type, file_type;
+
+binder_use(mediatranscoding)
+binder_service(mediatranscoding)
+
+add_service(mediatranscoding, mediatranscoding_service)
+
+allow mediatranscoding system_server:fd use;
+
+# mediatranscoding should never execute any executable without a
+# domain transition
+neverallow mediatranscoding { file_type fs_type }:file execute_no_trans;
+
+# The goal of the mediaserver split is to place media processing code into
+# restrictive sandboxes with limited responsibilities and thus limited
+# permissions. Example: Audioserver is only responsible for controlling audio
+# hardware and processing audio content. Cameraserver does the same for camera
+# hardware/content. Etc.
+#
+# Media processing code is inherently risky and thus should have limited
+# permissions and be isolated from the rest of the system and network.
+# Lengthier explanation here:
+# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
+neverallow mediatranscoding domain:{ tcp_socket udp_socket rawip_socket } *;
diff --git a/public/net.te b/public/net.te
index afa2a9c..e90715e 100644
--- a/public/net.te
+++ b/public/net.te
@@ -18,7 +18,16 @@
 allow {netdomain -ephemeral_app} port_type:udp_socket name_bind;
 allow {netdomain -ephemeral_app} port_type:tcp_socket name_bind;
 # See changes to the routing table.
-allow netdomain self:netlink_route_socket { create read getattr write setattr lock append bind connect getopt setopt shutdown nlmsg_read };
+allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read };
+# b/141455849 gate RTM_GETLINK with a new permission nlmsg_readpriv and block access from
+# untrusted_apps. Some untrusted apps (e.g. untrusted_app_25-29) are granted access elsewhere
+# to avoid app-compat breakage.
+allow {
+  netdomain
+  -ephemeral_app
+  -mediaprovider
+  -untrusted_app_all
+} self:netlink_route_socket { bind nlmsg_readpriv };
 
 # Talks to netd via dnsproxyd socket.
 unix_socket_connect(netdomain, dnsproxyd, netd)
diff --git a/public/netd.te b/public/netd.te
index c8877b2..8005406 100644
--- a/public/netd.te
+++ b/public/netd.te
@@ -63,7 +63,7 @@
 r_dir_file(netd, cgroup_bpf)
 
 allow netd fs_bpf:dir search;
-allow netd fs_bpf:file { read write setattr };
+allow netd fs_bpf:file { read write };
 
 # TODO: netd previously thought it needed these permissions to do WiFi related
 #       work.  However, after all the WiFi stuff is gone, we still need them.
@@ -81,9 +81,6 @@
 # Allow netd to spawn dnsmasq in it's own domain
 allow netd dnsmasq:process signal;
 
-# Allow netd to start clatd in its own domain
-allow netd clatd:process signal;
-
 set_prop(netd, ctl_mdnsd_prop)
 set_prop(netd, netd_stable_secret_prop)
 
@@ -176,3 +173,13 @@
 
 neverallow netd sysfs_net:dir no_w_dir_perms;
 dontaudit netd sysfs_net:dir write;
+
+# Netd should not have SYS_ADMIN privs.
+neverallow netd self:capability sys_admin;
+dontaudit netd self:capability sys_admin;
+
+# Netd should not have SYS_MODULE privs, nor should it be requesting module loads
+# (things it requires should be built directly into the kernel)
+dontaudit netd self:capability sys_module;
+
+dontaudit netd kernel:system module_request;
diff --git a/public/neverallow_macros b/public/neverallow_macros
index e2b6ed1..59fa441 100644
--- a/public/neverallow_macros
+++ b/public/neverallow_macros
@@ -1,7 +1,7 @@
 #
 # Common neverallow permissions
 define(`no_w_file_perms', `{ append create link unlink relabelfrom rename setattr write }')
-define(`no_rw_file_perms', `{ no_w_file_perms open read ioctl lock }')
+define(`no_rw_file_perms', `{ no_w_file_perms open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads }')
 define(`no_x_file_perms', `{ execute execute_no_trans }')
 define(`no_w_dir_perms',  `{ add_name create link relabelfrom remove_name rename reparent rmdir setattr write }')
 
diff --git a/public/perfprofd.te b/public/perfprofd.te
deleted file mode 100644
index 47dfbf2..0000000
--- a/public/perfprofd.te
+++ /dev/null
@@ -1,121 +0,0 @@
-# perfprofd - perf profile collection daemon
-type perfprofd, domain;
-type perfprofd_exec, system_file_type, exec_type, file_type;
-
-userdebug_or_eng(`
-
-  typeattribute perfprofd coredomain;
-  typeattribute perfprofd mlstrustedsubject;
-
-  # perfprofd access to sysfs directory structure.
-  allow perfprofd sysfs_type:dir search;
-
-  # perfprofd needs to control CPU hot-plug in order to avoid kernel
-  # perfevents problems in cases where CPU goes on/off during measurement;
-  # this means read access to /sys/devices/system/cpu/possible
-  # and read/write access to /sys/devices/system/cpu/cpu*/online
-  allow perfprofd sysfs_devices_system_cpu:file rw_file_perms;
-
-  # perfprofd checks for the existence of and then invokes simpleperf;
-  # simpleperf retains perfprofd domain after exec
-  allow perfprofd system_file:file rx_file_perms;
-
-  # perfprofd reads a config file from /data/data/com.google.android.gms/files
-  allow perfprofd { privapp_data_file app_data_file }:file r_file_perms;
-  allow perfprofd { privapp_data_file app_data_file }:dir search;
-  allow perfprofd self:global_capability_class_set { dac_override dac_read_search };
-
-  # perfprofd opens a file for writing in /data/misc/perfprofd
-  allow perfprofd perfprofd_data_file:file create_file_perms;
-  allow perfprofd perfprofd_data_file:dir rw_dir_perms;
-
-  # perfprofd uses the system log
-  read_logd(perfprofd);
-  write_logd(perfprofd);
-
-  # perfprofd inspects /sys/power/wake_unlock
-  wakelock_use(perfprofd);
-
-  # perfprofd looks at thermals.
-  allow perfprofd sysfs_thermal:dir r_dir_perms;
-
-  # perfprofd gets charging status.
-  hal_client_domain(perfprofd, hal_health)
-
-  # simpleperf reads kernel notes.
-  allow perfprofd sysfs_kernel_notes:file r_file_perms;
-
-  # Simpleperf & perfprofd query a range of proc stats.
-  allow perfprofd proc_loadavg:file r_file_perms;
-  allow perfprofd proc_stat:file r_file_perms;
-  allow perfprofd proc_modules:file r_file_perms;
-
-  # simpleperf writes to perf_event_paranoid under /proc.
-  allow perfprofd proc_perf:file write;
-
-  # Simpleperf: kptr_restrict. This would be required to dump kernel symbols.
-  dontaudit perfprofd proc_security:file *;
-
-  # simpleperf uses ioctl() to turn on kernel perf events measurements
-  allow perfprofd self:global_capability_class_set sys_admin;
-
-  # simpleperf needs to examine /proc to collect task/thread info
-  r_dir_file(perfprofd, domain)
-
-  # simpleperf needs to access /proc/<pid>/exec
-  allow perfprofd self:global_capability_class_set { sys_resource sys_ptrace };
-  neverallow perfprofd domain:process ptrace;
-
-  # simpleperf needs open/read any file that turns up in a profile
-  # to see whether it has a build ID
-  allow perfprofd exec_type:file r_file_perms;
-  # App & ART artifacts.
-  r_dir_file(perfprofd, apk_data_file)
-  r_dir_file(perfprofd, dalvikcache_data_file)
-  # Vendor libraries.
-  r_dir_file(perfprofd, vendor_file)
-  # Vendor apps.
-  r_dir_file(perfprofd, vendor_app_file)
-  # SP HAL files.
-  r_dir_file(perfprofd, same_process_hal_file)
-
-  # simpleperf will set security.perf_harden to enable access to perf_event_open()
-  set_prop(perfprofd, shell_prop)
-
-  # simpleperf examines debugfs on startup to collect tracepoint event types
-  r_dir_file(perfprofd, debugfs_tracing)
-  r_dir_file(perfprofd, debugfs_tracing_debug)
-
-  # simpleperf is going to execute "sleep"
-  allow perfprofd toolbox_exec:file rx_file_perms;
-  # simpleperf is going to execute "mv" on a temp file
-  allow perfprofd shell_exec:file rx_file_perms;
-
-  # needed for simpleperf on some kernels
-  allow perfprofd self:global_capability_class_set ipc_lock;
-
-  # simpleperf attempts to put a temp file into /data/local/tmp. Do not allow,
-  # use the fallback cwd code, do not spam the log. But ensure this is correctly
-  # removed at some point. b/70232908.
-  dontaudit perfprofd shell_data_file:dir *;
-  dontaudit perfprofd shell_data_file:file *;
-
-  # Allow perfprofd to publish a binder service and make binder calls.
-  binder_use(perfprofd)
-  add_service(perfprofd, perfprofd_service)
-
-  # Use devpts for streams from cmd.
-  #
-  # This is normally granted to binderservicedomain, but this service
-  # has tighter restrictions on the callers (see below), so must enable
-  # this manually.
-  allow perfprofd devpts:chr_file rw_file_perms;
-
-  # Use socket & pipe supplied by su, for cmd perfprofd dump.
-  allow perfprofd su:unix_stream_socket { read write getattr sendto };
-  allow perfprofd su:fifo_file r_file_perms;
-
-  # Allow perfprofd to submit to dropbox.
-  allow perfprofd dropbox_service:service_manager find;
-  binder_call(perfprofd, system_server)
-')
diff --git a/public/property.te b/public/property.te
index e166c00..d403d82 100644
--- a/public/property.te
+++ b/public/property.te
@@ -1,130 +1,291 @@
-type apexd_prop, property_type;
-type audio_prop, property_type, core_property_type;
-type boottime_prop, property_type;
-type bluetooth_a2dp_offload_prop, property_type;
-type bluetooth_audio_hal_prop, property_type;
-type bluetooth_prop, property_type;
-type bpf_progs_loaded_prop, property_type;
-type bootloader_boot_reason_prop, property_type;
-type config_prop, property_type, core_property_type;
-type cppreopt_prop, property_type, core_property_type;
-type cpu_variant_prop, property_type;
-type ctl_adbd_prop, property_type;
-type ctl_bootanim_prop, property_type;
-type ctl_bugreport_prop, property_type;
-type ctl_console_prop, property_type;
-type ctl_default_prop, property_type;
-type ctl_dumpstate_prop, property_type;
-type ctl_fuse_prop, property_type;
-type ctl_gsid_prop, property_type;
-type ctl_interface_restart_prop, property_type;
-type ctl_interface_start_prop, property_type;
-type ctl_interface_stop_prop, property_type;
-type ctl_mdnsd_prop, property_type;
-type ctl_restart_prop, property_type;
-type ctl_rildaemon_prop, property_type;
-type ctl_sigstop_prop, property_type;
-type ctl_start_prop, property_type;
-type ctl_stop_prop, property_type;
-type dalvik_prop, property_type, core_property_type;
-type debuggerd_prop, property_type, core_property_type;
-type debug_prop, property_type, core_property_type;
-type default_prop, property_type, core_property_type;
-type device_config_activity_manager_native_boot_prop, property_type;
-type device_config_boot_count_prop, property_type;
-type device_config_reset_performed_prop, property_type;
-type device_config_input_native_boot_prop, property_type;
-type device_config_netd_native_prop, property_type;
-type device_config_runtime_native_boot_prop, property_type;
-type device_config_runtime_native_prop, property_type;
-type device_config_media_native_prop, property_type;
-type device_logging_prop, property_type;
-type dhcp_prop, property_type, core_property_type;
-type dumpstate_options_prop, property_type;
-type dumpstate_prop, property_type, core_property_type;
-type dynamic_system_prop, property_type;
-type exported_secure_prop, property_type;
-type ffs_prop, property_type, core_property_type;
-type fingerprint_prop, property_type, core_property_type;
-type firstboot_prop, property_type;
-type gsid_prop, property_type;
-type heapprofd_enabled_prop, property_type;
-type heapprofd_prop, property_type;
-type hwservicemanager_prop, property_type;
-type last_boot_reason_prop, property_type;
-type system_lmk_prop, property_type;
-type llkd_prop, property_type;
-type logd_prop, property_type, core_property_type;
-type logpersistd_logging_prop, property_type;
-type log_prop, property_type, log_property_type;
-type log_tag_prop, property_type, log_property_type;
-type lowpan_prop, property_type;
-type lpdumpd_prop, property_type;
-type mmc_prop, property_type;
-type net_dns_prop, property_type;
-type net_radio_prop, property_type, core_property_type;
-type netd_stable_secret_prop, property_type;
-type nfc_prop, property_type, core_property_type;
-type nnapi_ext_deny_product_prop, property_type;
-type overlay_prop, property_type;
-type pan_result_prop, property_type, core_property_type;
-type persist_debug_prop, property_type, core_property_type;
-type persistent_properties_ready_prop, property_type;
-type pm_prop, property_type;
-type powerctl_prop, property_type, core_property_type;
-type radio_prop, property_type, core_property_type;
-type restorecon_prop, property_type, core_property_type;
-type safemode_prop, property_type;
-type serialno_prop, property_type;
-type shell_prop, property_type, core_property_type;
-type system_boot_reason_prop, property_type;
-type system_prop, property_type, core_property_type;
-type system_radio_prop, property_type, core_property_type;
-type system_trace_prop, property_type;
-type test_boot_reason_prop, property_type;
-type test_harness_prop, property_type;
-type theme_prop, property_type;
-type time_prop, property_type;
-type traced_enabled_prop, property_type;
-type traced_lazy_prop, property_type;
-type use_memfd_prop, property_type;
-type vold_prop, property_type, core_property_type;
-type wifi_log_prop, property_type, log_property_type;
-type wifi_prop, property_type;
-type vendor_security_patch_level_prop, property_type;
+# Properties used only in /system
+system_internal_prop(apexd_prop)
+system_internal_prop(bootloader_boot_reason_prop)
+system_internal_prop(device_config_activity_manager_native_boot_prop)
+system_internal_prop(device_config_boot_count_prop)
+system_internal_prop(device_config_input_native_boot_prop)
+system_internal_prop(device_config_media_native_prop)
+system_internal_prop(device_config_netd_native_prop)
+system_internal_prop(device_config_reset_performed_prop)
+system_internal_prop(device_config_runtime_native_boot_prop)
+system_internal_prop(device_config_runtime_native_prop)
+system_internal_prop(device_config_storage_native_boot_prop)
+system_internal_prop(device_config_sys_traced_prop)
+system_internal_prop(device_config_window_manager_native_boot_prop)
+system_internal_prop(device_config_configuration_prop)
+system_internal_prop(firstboot_prop)
+system_internal_prop(gsid_prop)
+system_internal_prop(init_perf_lsm_hooks_prop)
+system_internal_prop(init_svc_debug_prop)
+system_internal_prop(last_boot_reason_prop)
+system_internal_prop(netd_stable_secret_prop)
+system_internal_prop(pm_prop)
+system_internal_prop(userspace_reboot_log_prop)
+system_internal_prop(userspace_reboot_test_prop)
+system_internal_prop(system_adbd_prop)
+system_internal_prop(adbd_prop)
+system_internal_prop(traced_perf_enabled_prop)
 
-# Properties for whitelisting
-type exported_audio_prop, property_type;
-type exported_bluetooth_prop, property_type;
-type exported_config_prop, property_type;
-type exported_dalvik_prop, property_type;
-type exported_default_prop, property_type;
-type exported_dumpstate_prop, property_type;
-type exported_ffs_prop, property_type;
-type exported_fingerprint_prop, property_type;
-type exported_overlay_prop, property_type;
-type exported_pm_prop, property_type;
-type exported_radio_prop, property_type;
-type exported_system_prop, property_type;
-type exported_system_radio_prop, property_type;
-type exported_vold_prop, property_type;
-type exported_wifi_prop, property_type;
-type exported2_config_prop, property_type;
-type exported2_default_prop, property_type;
-type exported2_radio_prop, property_type;
-type exported2_system_prop, property_type;
-type exported2_vold_prop, property_type;
-type exported3_default_prop, property_type;
-type exported3_radio_prop, property_type;
-type exported3_system_prop, property_type;
+compatible_property_only(`
+    # DO NOT ADD ANY PROPERTIES HERE
+    system_internal_prop(boottime_prop)
+    system_internal_prop(bpf_progs_loaded_prop)
+    system_internal_prop(charger_prop)
+    system_internal_prop(cold_boot_done_prop)
+    system_internal_prop(ctl_adbd_prop)
+    system_internal_prop(ctl_apexd_prop)
+    system_internal_prop(ctl_bootanim_prop)
+    system_internal_prop(ctl_bugreport_prop)
+    system_internal_prop(ctl_console_prop)
+    system_internal_prop(ctl_dumpstate_prop)
+    system_internal_prop(ctl_fuse_prop)
+    system_internal_prop(ctl_gsid_prop)
+    system_internal_prop(ctl_interface_restart_prop)
+    system_internal_prop(ctl_interface_stop_prop)
+    system_internal_prop(ctl_mdnsd_prop)
+    system_internal_prop(ctl_restart_prop)
+    system_internal_prop(ctl_rildaemon_prop)
+    system_internal_prop(ctl_sigstop_prop)
+    system_internal_prop(dynamic_system_prop)
+    system_internal_prop(heapprofd_enabled_prop)
+    system_internal_prop(llkd_prop)
+    system_internal_prop(lpdumpd_prop)
+    system_internal_prop(mmc_prop)
+    system_internal_prop(mock_ota_prop)
+    system_internal_prop(net_dns_prop)
+    system_internal_prop(overlay_prop)
+    system_internal_prop(persistent_properties_ready_prop)
+    system_internal_prop(safemode_prop)
+    system_internal_prop(system_lmk_prop)
+    system_internal_prop(system_trace_prop)
+    system_internal_prop(test_boot_reason_prop)
+    system_internal_prop(time_prop)
+    system_internal_prop(traced_enabled_prop)
+    system_internal_prop(traced_lazy_prop)
+')
+
+# Properties which can't be written outside system
+
+# Properties used by binder caches
+system_restricted_prop(binder_cache_bluetooth_server_prop)
+system_restricted_prop(binder_cache_system_server_prop)
+system_restricted_prop(boottime_public_prop)
+system_restricted_prop(bq_config_prop)
+system_restricted_prop(module_sdkextensions_prop)
+system_restricted_prop(nnapi_ext_deny_product_prop)
+system_restricted_prop(restorecon_prop)
+system_restricted_prop(socket_hook_prop)
+system_restricted_prop(system_boot_reason_prop)
+system_restricted_prop(system_jvmti_agent_prop)
+system_restricted_prop(userspace_reboot_exported_prop)
+
+compatible_property_only(`
+    # DO NOT ADD ANY PROPERTIES HERE
+    system_restricted_prop(config_prop)
+    system_restricted_prop(cppreopt_prop)
+    system_restricted_prop(dalvik_prop)
+    system_restricted_prop(debuggerd_prop)
+    system_restricted_prop(default_prop)
+    system_restricted_prop(device_logging_prop)
+    system_restricted_prop(dhcp_prop)
+    system_restricted_prop(dumpstate_prop)
+    system_restricted_prop(exported2_default_prop)
+    system_restricted_prop(exported3_system_prop)
+    system_restricted_prop(exported_dumpstate_prop)
+    system_restricted_prop(exported_fingerprint_prop)
+    system_restricted_prop(exported_secure_prop)
+    system_restricted_prop(exported_vold_prop)
+    system_restricted_prop(ffs_prop)
+    system_restricted_prop(fingerprint_prop)
+    system_restricted_prop(heapprofd_prop)
+    system_restricted_prop(net_radio_prop)
+    system_restricted_prop(pan_result_prop)
+    system_restricted_prop(persist_debug_prop)
+    system_restricted_prop(shell_prop)
+    system_restricted_prop(system_radio_prop)
+    system_restricted_prop(test_harness_prop)
+    system_restricted_prop(theme_prop)
+    system_restricted_prop(use_memfd_prop)
+    system_restricted_prop(vold_prop)
+')
+
+# Properties which can be written only by vendor_init
+system_vendor_config_prop(apk_verity_prop)
+system_vendor_config_prop(cpu_variant_prop)
+system_vendor_config_prop(exported_audio_prop)
+system_vendor_config_prop(exported_camera_prop)
+system_vendor_config_prop(exported_config_prop)
+system_vendor_config_prop(exported_default_prop)
+system_vendor_config_prop(exported3_default_prop)
+system_vendor_config_prop(media_variant_prop)
+system_vendor_config_prop(userspace_reboot_config_prop)
+system_vendor_config_prop(vehicle_hal_prop)
+system_vendor_config_prop(vendor_security_patch_level_prop)
+system_vendor_config_prop(vendor_socket_hook_prop)
+system_vendor_config_prop(vndk_prop)
+system_vendor_config_prop(virtual_ab_prop)
+
+# Properties with no restrictions
+system_public_prop(audio_prop)
+system_public_prop(bluetooth_a2dp_offload_prop)
+system_public_prop(bluetooth_audio_hal_prop)
+system_public_prop(bluetooth_prop)
+system_public_prop(ctl_default_prop)
+system_public_prop(ctl_interface_start_prop)
+system_public_prop(ctl_start_prop)
+system_public_prop(ctl_stop_prop)
+system_public_prop(debug_prop)
+system_public_prop(dumpstate_options_prop)
+system_public_prop(exported_system_prop)
+system_public_prop(exported2_config_prop)
+system_public_prop(exported2_radio_prop)
+system_public_prop(exported2_system_prop)
+system_public_prop(exported2_vold_prop)
+system_public_prop(exported3_radio_prop)
+system_public_prop(exported_bluetooth_prop)
+system_public_prop(exported_dalvik_prop)
+system_public_prop(exported_ffs_prop)
+system_public_prop(exported_overlay_prop)
+system_public_prop(exported_pm_prop)
+system_public_prop(exported_radio_prop)
+system_public_prop(exported_system_radio_prop)
+system_public_prop(exported_wifi_prop)
+system_public_prop(sota_prop)
+system_public_prop(hwservicemanager_prop)
+system_public_prop(logd_prop)
+system_public_prop(logpersistd_logging_prop)
+system_public_prop(log_prop)
+system_public_prop(log_tag_prop)
+system_public_prop(lowpan_prop)
+system_public_prop(nfc_prop)
+system_public_prop(ota_prop)
+system_public_prop(powerctl_prop)
+system_public_prop(radio_prop)
+system_public_prop(serialno_prop)
+system_public_prop(system_prop)
+system_public_prop(wifi_log_prop)
+system_public_prop(wifi_prop)
+
+# Properties used in default HAL implementations
+vendor_internal_prop(rebootescrow_hal_prop)
+
+# Properties which are public for devices launching with Android O or earlier
+# This should not be used for any new properties.
+not_compatible_property(`
+    # DO NOT ADD ANY PROPERTIES HERE
+    system_public_prop(boottime_prop)
+    system_public_prop(bpf_progs_loaded_prop)
+    system_public_prop(charger_prop)
+    system_public_prop(cold_boot_done_prop)
+    system_public_prop(ctl_adbd_prop)
+    system_public_prop(ctl_apexd_prop)
+    system_public_prop(ctl_bootanim_prop)
+    system_public_prop(ctl_bugreport_prop)
+    system_public_prop(ctl_console_prop)
+    system_public_prop(ctl_dumpstate_prop)
+    system_public_prop(ctl_fuse_prop)
+    system_public_prop(ctl_gsid_prop)
+    system_public_prop(ctl_interface_restart_prop)
+    system_public_prop(ctl_interface_stop_prop)
+    system_public_prop(ctl_mdnsd_prop)
+    system_public_prop(ctl_restart_prop)
+    system_public_prop(ctl_rildaemon_prop)
+    system_public_prop(ctl_sigstop_prop)
+    system_public_prop(dynamic_system_prop)
+    system_public_prop(heapprofd_enabled_prop)
+    system_public_prop(llkd_prop)
+    system_public_prop(lpdumpd_prop)
+    system_public_prop(mmc_prop)
+    system_public_prop(mock_ota_prop)
+    system_public_prop(net_dns_prop)
+    system_public_prop(overlay_prop)
+    system_public_prop(persistent_properties_ready_prop)
+    system_public_prop(safemode_prop)
+    system_public_prop(system_lmk_prop)
+    system_public_prop(system_trace_prop)
+    system_public_prop(test_boot_reason_prop)
+    system_public_prop(time_prop)
+    system_public_prop(traced_enabled_prop)
+    system_public_prop(traced_lazy_prop)
+
+    system_public_prop(config_prop)
+    system_public_prop(cppreopt_prop)
+    system_public_prop(dalvik_prop)
+    system_public_prop(debuggerd_prop)
+    system_public_prop(default_prop)
+    system_public_prop(device_logging_prop)
+    system_public_prop(dhcp_prop)
+    system_public_prop(dumpstate_prop)
+    system_public_prop(exported2_default_prop)
+    system_public_prop(exported3_system_prop)
+    system_public_prop(exported_dumpstate_prop)
+    system_public_prop(exported_fingerprint_prop)
+    system_public_prop(exported_secure_prop)
+    system_public_prop(exported_vold_prop)
+    system_public_prop(ffs_prop)
+    system_public_prop(fingerprint_prop)
+    system_public_prop(heapprofd_prop)
+    system_public_prop(net_radio_prop)
+    system_public_prop(pan_result_prop)
+    system_public_prop(persist_debug_prop)
+    system_public_prop(shell_prop)
+    system_public_prop(system_radio_prop)
+    system_public_prop(test_harness_prop)
+    system_public_prop(theme_prop)
+    system_public_prop(use_memfd_prop)
+    system_public_prop(vold_prop)
+')
+
 type vendor_default_prop, property_type;
 
+typeattribute log_prop log_property_type;
+typeattribute log_tag_prop log_property_type;
+typeattribute wifi_log_prop log_property_type;
+
 allow property_type tmpfs:filesystem associate;
 
 ###
 ### Neverallow rules
 ###
 
+treble_sysprop_neverallow(`
+
+# TODO(b/131162102): uncomment these after assigning ownership attributes to all properties
+# neverallow domain {
+#   property_type
+#   -system_property_type
+#   -product_property_type
+#   -vendor_property_type
+# }:file no_rw_file_perms;
+
+neverallow { domain -coredomain } {
+  system_property_type
+  system_internal_property_type
+  -system_restricted_property_type
+  -system_public_property_type
+}:file no_rw_file_perms;
+
+neverallow { domain -coredomain } {
+  system_property_type
+  -system_public_property_type
+}:property_service set;
+
+# init is in coredomain, but should be able to read/write all props.
+# dumpstate is also in coredomain, but should be able to read all props.
+neverallow { coredomain -init -dumpstate } {
+  vendor_property_type
+  vendor_internal_property_type
+  -vendor_restricted_property_type
+  -vendor_public_property_type
+}:file no_rw_file_perms;
+
+neverallow { coredomain -init } {
+  vendor_property_type
+  -vendor_public_property_type
+}:property_service set;
+
+')
+
 # There is no need to perform ioctl or advisory locking operations on
 # property files. If this neverallow is being triggered, it is
 # likely that the policy is using r_file_perms directly instead of
@@ -138,6 +299,31 @@
 # New properties should have appropriate read / write access
 # control rules written.
 
+typeattribute audio_prop         core_property_type;
+typeattribute config_prop        core_property_type;
+typeattribute cppreopt_prop      core_property_type;
+typeattribute dalvik_prop        core_property_type;
+typeattribute debuggerd_prop     core_property_type;
+typeattribute debug_prop         core_property_type;
+typeattribute default_prop       core_property_type;
+typeattribute dhcp_prop          core_property_type;
+typeattribute dumpstate_prop     core_property_type;
+typeattribute ffs_prop           core_property_type;
+typeattribute fingerprint_prop   core_property_type;
+typeattribute logd_prop          core_property_type;
+typeattribute net_radio_prop     core_property_type;
+typeattribute nfc_prop           core_property_type;
+typeattribute ota_prop           core_property_type;
+typeattribute pan_result_prop    core_property_type;
+typeattribute persist_debug_prop core_property_type;
+typeattribute powerctl_prop      core_property_type;
+typeattribute radio_prop         core_property_type;
+typeattribute restorecon_prop    core_property_type;
+typeattribute shell_prop         core_property_type;
+typeattribute system_prop        core_property_type;
+typeattribute system_radio_prop  core_property_type;
+typeattribute vold_prop          core_property_type;
+
 neverallow * {
   core_property_type
   -audio_prop
@@ -154,6 +340,7 @@
   -logd_prop
   -net_radio_prop
   -nfc_prop
+  -ota_prop
   -pan_result_prop
   -persist_debug_prop
   -powerctl_prop
@@ -186,6 +373,18 @@
   ctl_rildaemon_prop
 }:property_service set;
 
+neverallow {
+  domain
+  -init
+} init_svc_debug_prop:property_service set;
+
+neverallow {
+  domain
+  -init
+  -dumpstate
+  userdebug_or_eng(`-su')
+} init_svc_debug_prop:file no_rw_file_perms;
+
 compatible_property_only(`
 # Prevent properties from being set
   neverallow {
@@ -268,6 +467,16 @@
   neverallow {
     domain
     -coredomain
+    -hal_camera_server
+    -cameraserver
+    -vendor_init
+  } {
+    exported_camera_prop
+  }:property_service set;
+
+  neverallow {
+    domain
+    -coredomain
     -hal_wifi_server
     -wificond
   } {
@@ -353,119 +562,38 @@
     -system_writes_vendor_properties_violators
   } {
     property_type
-    -apexd_prop
-    -audio_prop
-    -bluetooth_a2dp_offload_prop
-    -bluetooth_audio_hal_prop
-    -bluetooth_prop
-    -bootloader_boot_reason_prop
-    -boottime_prop
-    -bpf_progs_loaded_prop
-    -config_prop
-    -cppreopt_prop
-    -ctl_adbd_prop
-    -ctl_bootanim_prop
-    -ctl_bugreport_prop
-    -ctl_console_prop
-    -ctl_default_prop
-    -ctl_dumpstate_prop
-    -ctl_fuse_prop
-    -ctl_gsid_prop
-    -ctl_interface_restart_prop
-    -ctl_interface_start_prop
-    -ctl_interface_stop_prop
-    -ctl_mdnsd_prop
-    -ctl_restart_prop
-    -ctl_rildaemon_prop
-    -ctl_sigstop_prop
-    -ctl_start_prop
-    -ctl_stop_prop
-    -dalvik_prop
-    -debug_prop
-    -debuggerd_prop
-    -default_prop
-    -device_logging_prop
-    -dhcp_prop
-    -dumpstate_options_prop
-    -dumpstate_prop
-    -exported2_config_prop
-    -exported2_default_prop
-    -exported2_radio_prop
-    -exported2_system_prop
-    -exported2_vold_prop
-    -exported3_default_prop
-    -exported3_radio_prop
-    -exported3_system_prop
-    -exported_bluetooth_prop
-    -exported_config_prop
-    -exported_dalvik_prop
-    -exported_default_prop
-    -exported_dumpstate_prop
-    -exported_ffs_prop
-    -exported_fingerprint_prop
-    -exported_overlay_prop
-    -exported_pm_prop
-    -exported_radio_prop
-    -exported_secure_prop
-    -exported_system_prop
-    -exported_system_radio_prop
-    -exported_vold_prop
-    -exported_wifi_prop
+    -system_property_type
     -extended_core_property_type
-    -ffs_prop
-    -fingerprint_prop
-    -firstboot_prop
-    -device_config_activity_manager_native_boot_prop
-    -device_config_reset_performed_prop
-    -device_config_boot_count_prop
-    -device_config_input_native_boot_prop
-    -device_config_netd_native_prop
-    -device_config_runtime_native_boot_prop
-    -device_config_runtime_native_prop
-    -device_config_media_native_prop
-    -dynamic_system_prop
-    -gsid_prop
-    -heapprofd_enabled_prop
-    -heapprofd_prop
-    -hwservicemanager_prop
-    -last_boot_reason_prop
-    -system_lmk_prop
-    -log_prop
-    -log_tag_prop
-    -logd_prop
-    -logpersistd_logging_prop
-    -lowpan_prop
-    -lpdumpd_prop
-    -mmc_prop
-    -net_dns_prop
-    -net_radio_prop
-    -netd_stable_secret_prop
-    -nfc_prop
-    -overlay_prop
-    -pan_result_prop
-    -persist_debug_prop
-    -persistent_properties_ready_prop
-    -pm_prop
-    -powerctl_prop
-    -radio_prop
-    -restorecon_prop
-    -safemode_prop
-    -serialno_prop
-    -shell_prop
-    -system_boot_reason_prop
-    -system_prop
-    -system_radio_prop
-    -system_trace_prop
-    -test_boot_reason_prop
-    -test_harness_prop
-    -theme_prop
-    -time_prop
-    -traced_enabled_prop
-    -traced_lazy_prop
-    -vendor_default_prop
-    -vendor_security_patch_level_prop
-    -vold_prop
-    -wifi_log_prop
-    -wifi_prop
   }:property_service set;
 ')
+
+neverallow {
+  -init
+  -system_server
+} {
+  userspace_reboot_log_prop
+}:property_service set;
+
+neverallow {
+  # Only allow init and system_server to set system_adbd_prop
+  -init
+  -system_server
+} {
+  system_adbd_prop
+}:property_service set;
+
+neverallow {
+  # Only allow init and adbd to set adbd_prop
+  -init
+  -adbd
+} {
+  adbd_prop
+}:property_service set;
+
+neverallow {
+  # Only allow init and shell to set userspace_reboot_test_prop
+  -init
+  -shell
+} {
+  userspace_reboot_test_prop
+}:property_service set;
diff --git a/public/property_contexts b/public/property_contexts
index 46819af..b48bb62 100644
--- a/public/property_contexts
+++ b/public/property_contexts
@@ -65,7 +65,7 @@
 dalvik.vm.method-trace-file-siz u:object_r:exported_dalvik_prop:s0 exact int
 dalvik.vm.method-trace-stream u:object_r:exported_dalvik_prop:s0 exact bool
 dalvik.vm.profilesystemserver u:object_r:exported_dalvik_prop:s0 exact bool
-dalvik.vm.profilebootimage u:object_r:exported_dalvik_prop:s0 exact bool
+dalvik.vm.profilebootclasspath u:object_r:exported_dalvik_prop:s0 exact bool
 dalvik.vm.usejit u:object_r:exported_dalvik_prop:s0 exact bool
 dalvik.vm.usejitprofiles u:object_r:exported_dalvik_prop:s0 exact bool
 dalvik.vm.zygote.max-boot-retry u:object_r:exported_dalvik_prop:s0 exact int
@@ -99,6 +99,7 @@
 pm.dexopt.install u:object_r:exported_pm_prop:s0 exact string
 pm.dexopt.shared u:object_r:exported_pm_prop:s0 exact string
 ro.af.client_heap_size_kbyte u:object_r:exported3_default_prop:s0 exact int
+ro.apk_verity.mode u:object_r:apk_verity_prop:s0 exact int
 ro.audio.monitorRotation u:object_r:exported3_default_prop:s0 exact bool
 ro.bluetooth.a2dp_offload.supported u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
 ro.boot.vendor.overlay.theme u:object_r:exported_overlay_prop:s0 exact string
@@ -111,21 +112,40 @@
 ro.config.alarm_alert u:object_r:exported2_config_prop:s0 exact string
 ro.config.media_vol_steps u:object_r:exported2_config_prop:s0 exact int
 ro.config.notification_sound u:object_r:exported2_config_prop:s0 exact string
+ro.config.per_app_memcg u:object_r:exported3_default_prop:s0 exact bool
 ro.config.ringtone u:object_r:exported2_config_prop:s0 exact string
 ro.control_privapp_permissions u:object_r:exported3_default_prop:s0 exact string
 ro.cp_system_other_odex u:object_r:exported3_default_prop:s0 exact int
 ro.crypto.allow_encrypt_override u:object_r:exported2_vold_prop:s0 exact bool
+ro.crypto.fde_algorithm u:object_r:exported2_vold_prop:s0 exact string
+ro.crypto.fde_sector_size u:object_r:exported2_vold_prop:s0 exact int
 ro.crypto.scrypt_params u:object_r:exported2_vold_prop:s0 exact string
+ro.crypto.set_dun u:object_r:exported2_vold_prop:s0 exact bool
+ro.crypto.volume.contents_mode u:object_r:exported2_vold_prop:s0 exact string
 ro.crypto.volume.filenames_mode u:object_r:exported2_vold_prop:s0 exact string
+ro.crypto.volume.metadata.encryption u:object_r:exported2_vold_prop:s0 exact string
+ro.crypto.volume.metadata.method u:object_r:exported2_vold_prop:s0 exact string
+ro.crypto.volume.options u:object_r:exported2_vold_prop:s0 exact string
 ro.dalvik.vm.native.bridge u:object_r:exported_dalvik_prop:s0 exact string
 ro.enable_boot_charger_mode u:object_r:exported3_default_prop:s0 exact bool
 ro.gfx.driver.0 u:object_r:exported3_default_prop:s0 exact string
 ro.gfx.angle.supported u:object_r:exported3_default_prop:s0 exact bool
 ro.hdmi.device_type u:object_r:exported3_default_prop:s0 exact string
 ro.hdmi.wake_on_hotplug u:object_r:exported3_default_prop:s0 exact bool
+ro.lmk.critical u:object_r:exported3_default_prop:s0 exact int
 ro.lmk.critical_upgrade u:object_r:exported3_default_prop:s0 exact bool
+ro.lmk.debug u:object_r:exported3_default_prop:s0 exact bool
 ro.lmk.downgrade_pressure u:object_r:exported3_default_prop:s0 exact int
 ro.lmk.kill_heaviest_task u:object_r:exported3_default_prop:s0 exact bool
+ro.lmk.kill_timeout_ms u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.low u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.medium u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.psi_partial_stall_ms u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.psi_complete_stall_ms u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.swap_free_low_percentage u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.thrashing_limit u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.thrashing_limit_decay u:object_r:exported3_default_prop:s0 exact int
+ro.lmk.use_minfree_levels u:object_r:exported3_default_prop:s0 exact bool
 ro.lmk.upgrade_pressure u:object_r:exported3_default_prop:s0 exact int
 ro.minui.default_rotation u:object_r:exported3_default_prop:s0 exact string
 ro.minui.overscan_percent u:object_r:exported3_default_prop:s0 exact int
@@ -133,6 +153,7 @@
 ro.oem_unlock_supported u:object_r:exported3_default_prop:s0 exact int
 ro.opengles.version u:object_r:exported3_default_prop:s0 exact int
 ro.radio.noril u:object_r:exported3_default_prop:s0 exact string
+ro.rebootescrow.device u:object_r:rebootescrow_hal_prop:s0 exact string
 ro.retaildemo.video_path u:object_r:exported3_default_prop:s0 exact string
 ro.statsd.enable u:object_r:exported3_default_prop:s0 exact bool
 ro.sf.disable_triple_buffer u:object_r:exported3_default_prop:s0 exact bool
@@ -141,9 +162,11 @@
 ro.telephony.call_ring.multiple u:object_r:exported3_default_prop:s0 exact bool
 ro.telephony.default_cdma_sub u:object_r:exported3_default_prop:s0 exact int
 ro.telephony.default_network u:object_r:exported3_default_prop:s0 exact string
-ro.url.legal u:object_r:exported3_default_prop:s0 exact string
-ro.url.legal.android_privacy u:object_r:exported3_default_prop:s0 exact string
+ro.vehicle.hal u:object_r:vehicle_hal_prop:s0 exact string
 ro.vendor.build.security_patch u:object_r:vendor_security_patch_level_prop:s0 exact string
+ro.media.xml_variant.codecs u:object_r:media_variant_prop:s0 exact string
+ro.media.xml_variant.codecs_performance u:object_r:media_variant_prop:s0 exact string
+ro.media.xml_variant.profiles u:object_r:media_variant_prop:s0 exact string
 ro.zram.mark_idle_delay_mins u:object_r:exported3_default_prop:s0 exact int
 ro.zram.first_wb_delay_mins u:object_r:exported3_default_prop:s0 exact int
 ro.zram.periodic_wb_delay_hours u:object_r:exported3_default_prop:s0 exact int
@@ -161,6 +184,7 @@
 vold.post_fs_data_done u:object_r:exported2_vold_prop:s0 exact int
 vts.native_server.on u:object_r:exported3_default_prop:s0 exact bool
 wlan.driver.status u:object_r:exported_wifi_prop:s0 exact enum ok unloaded
+zram.force_writeback u:object_r:exported3_default_prop:s0 exact bool
 
 # vendor-init-readable
 apexd.status u:object_r:apexd_prop:s0 exact enum starting ready
@@ -184,6 +208,7 @@
 aac_drc_enc_target_level u:object_r:exported2_default_prop:s0 exact int
 aac_drc_heavy u:object_r:exported2_default_prop:s0 exact int
 aac_drc_reference_level u:object_r:exported2_default_prop:s0 exact int
+build.version.extensions. u:object_r:module_sdkextensions_prop:s0 prefix int
 ro.aac_drc_effect_type u:object_r:exported2_default_prop:s0 exact int
 drm.64bit.enabled u:object_r:exported2_default_prop:s0 exact bool
 dumpstate.dry_run u:object_r:exported_dumpstate_prop:s0 exact bool
@@ -199,6 +224,7 @@
 libc.debug.malloc.options u:object_r:exported2_default_prop:s0 exact string
 libc.debug.malloc.program u:object_r:exported2_default_prop:s0 exact string
 libc.debug.hooks.enable u:object_r:exported2_default_prop:s0 exact string
+net.redirect_socket_calls.hooked u:object_r:socket_hook_prop:s0 exact bool
 persist.sys.locale u:object_r:exported_system_prop:s0 exact string
 persist.sys.timezone u:object_r:exported_system_prop:s0 exact string
 persist.sys.test_harness u:object_r:test_harness_prop:s0 exact bool
@@ -211,6 +237,8 @@
 ro.boot.bootdevice u:object_r:exported2_default_prop:s0 exact string
 ro.boot.bootloader u:object_r:exported2_default_prop:s0 exact string
 ro.boot.boottime u:object_r:exported2_default_prop:s0 exact string
+ro.boottime.init.mount.data u:object_r:boottime_public_prop:s0 exact string
+ro.boottime.init.fsck.data u:object_r:boottime_public_prop:s0 exact string
 ro.boot.console u:object_r:exported2_default_prop:s0 exact string
 ro.boot.hardware u:object_r:exported2_default_prop:s0 exact string
 ro.boot.hardware.color u:object_r:exported2_default_prop:s0 exact string
@@ -239,6 +267,7 @@
 ro.build.version.incremental u:object_r:exported2_default_prop:s0 exact string
 ro.build.version.preview_sdk u:object_r:exported2_default_prop:s0 exact int
 ro.build.version.release u:object_r:exported2_default_prop:s0 exact string
+ro.build.version.release_or_codename u:object_r:exported2_default_prop:s0 exact string
 ro.build.version.sdk u:object_r:exported2_default_prop:s0 exact int
 ro.build.version.security_patch u:object_r:exported2_default_prop:s0 exact string
 ro.crypto.state u:object_r:exported_vold_prop:s0 exact string
@@ -255,8 +284,10 @@
 ro.property_service.version u:object_r:exported2_default_prop:s0 exact int
 ro.revision u:object_r:exported2_default_prop:s0 exact string
 ro.secure u:object_r:exported_secure_prop:s0 exact int
+ro.vendor.redirect_socket_calls u:object_r:vendor_socket_hook_prop:s0 exact bool
 service.bootanim.exit u:object_r:exported_system_prop:s0 exact int
 sys.boot_from_charger_mode u:object_r:exported_system_prop:s0 exact int
+sys.init.userspace_reboot.in_progress u:object_r:userspace_reboot_exported_prop:s0 exact bool
 sys.use_memfd u:object_r:use_memfd_prop:s0 exact bool
 vold.decrypt u:object_r:exported_vold_prop:s0 exact string
 
@@ -267,6 +298,7 @@
 aaudio.mmap_exclusive_policy u:object_r:exported_default_prop:s0 exact int
 aaudio.mmap_policy u:object_r:exported_default_prop:s0 exact int
 aaudio.wakeup_delay_usec u:object_r:exported_default_prop:s0 exact int
+config.disable_cameraservice u:object_r:exported_camera_prop:s0 exact bool
 gsm.sim.operator.numeric u:object_r:exported_radio_prop:s0 exact string
 media.mediadrmservice.enable u:object_r:exported_default_prop:s0 exact bool
 persist.rcs.supported u:object_r:exported_default_prop:s0 exact int
@@ -279,10 +311,13 @@
 ro.boot.fake_battery u:object_r:exported_default_prop:s0 exact int
 ro.boot.hardware.revision u:object_r:exported_default_prop:s0 exact string
 ro.boot.product.hardware.sku u:object_r:exported_default_prop:s0 exact string
+ro.boot.product.vendor.sku u:object_r:exported_default_prop:s0 exact string
 ro.boot.slot_suffix u:object_r:exported_default_prop:s0 exact string
 ro.bootimage.build.date u:object_r:exported_default_prop:s0 exact string
 ro.bootimage.build.date.utc u:object_r:exported_default_prop:s0 exact int
 ro.bootimage.build.fingerprint u:object_r:exported_default_prop:s0 exact string
+ro.boringcrypto.hwrand u:object_r:exported_default_prop:s0 exact bool
+ro.build.ab_update u:object_r:exported_default_prop:s0 exact string
 ro.build.expect.baseband u:object_r:exported_default_prop:s0 exact string
 ro.build.expect.bootloader u:object_r:exported_default_prop:s0 exact string
 ro.carrier u:object_r:exported_default_prop:s0 exact string
@@ -336,6 +371,7 @@
 ro.odm.build.date u:object_r:exported_default_prop:s0 exact string
 ro.odm.build.date.utc u:object_r:exported_default_prop:s0 exact int
 ro.odm.build.fingerprint u:object_r:exported_default_prop:s0 exact string
+ro.odm.build.version.incremental u:object_r:exported_default_prop:s0 exact string
 ro.oem.key1 u:object_r:exported_default_prop:s0 exact string
 ro.product.board u:object_r:exported_default_prop:s0 exact string
 ro.product.cpu.abilist32 u:object_r:exported_default_prop:s0 exact string
@@ -351,18 +387,21 @@
 ro.product.vendor.manufacturer u:object_r:exported_default_prop:s0 exact string
 ro.product.vendor.model u:object_r:exported_default_prop:s0 exact string
 ro.product.vendor.name u:object_r:exported_default_prop:s0 exact string
+ro.product.vndk.version u:object_r:vndk_prop:s0 exact string
 ro.telephony.iwlan_operation_mode u:object_r:exported_radio_prop:s0 exact enum default legacy AP-assisted
 ro.vendor.build.date u:object_r:exported_default_prop:s0 exact string
 ro.vendor.build.date.utc u:object_r:exported_default_prop:s0 exact int
 ro.vendor.build.fingerprint u:object_r:exported_default_prop:s0 exact string
-ro.vndk.lite u:object_r:exported_default_prop:s0 exact bool
-ro.vndk.version u:object_r:exported_default_prop:s0 exact string
+ro.vendor.build.version.incremental u:object_r:exported_default_prop:s0 exact string
+ro.vndk.lite u:object_r:vndk_prop:s0 exact bool
+ro.vndk.version u:object_r:vndk_prop:s0 exact string
 ro.vts.coverage u:object_r:exported_default_prop:s0 exact int
 wifi.active.interface u:object_r:exported_wifi_prop:s0 exact string
 wifi.concurrent.interface u:object_r:exported_default_prop:s0 exact string
 wifi.direct.interface u:object_r:exported_default_prop:s0 exact string
 wifi.interface u:object_r:exported_default_prop:s0 exact string
 ro.apex.updatable u:object_r:exported_default_prop:s0 exact bool
+ro.init.userspace_reboot.is_supported u:object_r:userspace_reboot_config_prop:s0 exact bool
 
 # public-readable
 ro.boot.revision u:object_r:exported2_default_prop:s0 exact string
@@ -377,6 +416,8 @@
 ro.surface_flinger.has_HDR_display u:object_r:exported_default_prop:s0 exact bool
 ro.surface_flinger.has_wide_color_display u:object_r:exported_default_prop:s0 exact bool
 ro.surface_flinger.max_frame_buffer_acquired_buffers u:object_r:exported_default_prop:s0 exact int
+ro.surface_flinger.max_graphics_height u:object_r:exported3_default_prop:s0 exact int
+ro.surface_flinger.max_graphics_width u:object_r:exported3_default_prop:s0 exact int
 ro.surface_flinger.max_virtual_display_dimension u:object_r:exported_default_prop:s0 exact int
 ro.surface_flinger.primary_display_orientation u:object_r:exported_default_prop:s0 exact string
 ro.surface_flinger.present_time_offset_from_vsync_ns u:object_r:exported_default_prop:s0 exact int
@@ -399,5 +440,23 @@
 ro.surface_flinger.set_display_power_timer_ms u:object_r:exported_default_prop:s0 exact int
 ro.surface_flinger.support_kernel_idle_timer u:object_r:exported_default_prop:s0 exact bool
 ro.surface_flinger.use_smart_90_for_video u:object_r:exported_default_prop:s0 exact bool
+ro.surface_flinger.use_content_detection_for_refresh_rate u:object_r:exported_default_prop:s0 exact bool
 ro.surface_flinger.color_space_agnostic_dataspace u:object_r:exported_default_prop:s0 exact int
 ro.surface_flinger.refresh_rate_switching u:object_r:exported_default_prop:s0 exact bool
+
+# Binder cache properties.  These are world-readable
+cache_key.app_inactive                   u:object_r:binder_cache_system_server_prop:s0
+cache_key.is_compat_change_enabled       u:object_r:binder_cache_system_server_prop:s0
+cache_key.bluetooth.get_bond_state       u:object_r:binder_cache_bluetooth_server_prop:s0
+cache_key.bluetooth.get_profile_connection_state     u:object_r:binder_cache_bluetooth_server_prop:s0
+cache_key.bluetooth.get_state            u:object_r:binder_cache_bluetooth_server_prop:s0
+cache_key.bluetooth.is_offloaded_filtering_supported u:object_r:binder_cache_bluetooth_server_prop:s0
+cache_key.get_packages_for_uid           u:object_r:binder_cache_system_server_prop:s0
+cache_key.has_system_feature             u:object_r:binder_cache_system_server_prop:s0
+cache_key.is_interactive                 u:object_r:binder_cache_system_server_prop:s0
+cache_key.is_power_save_mode             u:object_r:binder_cache_system_server_prop:s0
+cache_key.is_user_unlocked               u:object_r:binder_cache_system_server_prop:s0
+cache_key.volume_list                    u:object_r:binder_cache_system_server_prop:s0
+cache_key.display_info                   u:object_r:binder_cache_system_server_prop:s0
+cache_key.location_enabled               u:object_r:binder_cache_system_server_prop:s0
+cache_key.package_info                   u:object_r:binder_cache_system_server_prop:s0
diff --git a/public/radio.te b/public/radio.te
index 4527707..34eaf83 100644
--- a/public/radio.te
+++ b/public/radio.te
@@ -35,6 +35,7 @@
 allow radio app_api_service:service_manager find;
 allow radio system_api_service:service_manager find;
 allow radio timedetector_service:service_manager find;
+allow radio timezonedetector_service:service_manager find;
 
 # Perform HwBinder IPC.
 hwbinder_use(radio)
diff --git a/public/recovery.te b/public/recovery.te
index 2b77bc3..55568d4 100644
--- a/public/recovery.te
+++ b/public/recovery.te
@@ -85,7 +85,7 @@
   allow recovery device:dir r_dir_perms;
   allow recovery block_device:dir r_dir_perms;
   allow recovery dev_type:blk_file rw_file_perms;
-  allowxperm recovery { userdata_block_device metadata_block_device }:blk_file ioctl BLKPBSZGET;
+  allowxperm recovery { userdata_block_device metadata_block_device cache_block_device }:blk_file ioctl BLKPBSZGET;
 
   # GUI
   allow recovery graphics_device:chr_file rw_file_perms;
@@ -142,6 +142,15 @@
   # These are needed to update dynamic partitions in recovery.
   r_dir_file(recovery, sysfs_dm)
   allowxperm recovery super_block_device_type:blk_file ioctl { BLKIOMIN BLKALIGNOFF };
+
+  # Allow using libfiemap/gsid directly (no binder in recovery).
+  set_prop(recovery, gsid_prop)
+  allow recovery gsi_metadata_file:dir search;
+  allow recovery ota_metadata_file:dir rw_dir_perms;
+  allow recovery ota_metadata_file:file create_file_perms;
+
+  # Allow mounting /metadata for writing update states
+  allow recovery metadata_file:dir { getattr mounton };
 ')
 
 ###
diff --git a/public/sdcardd.te b/public/sdcardd.te
index 83c1840..1ae3770 100644
--- a/public/sdcardd.te
+++ b/public/sdcardd.te
@@ -22,8 +22,9 @@
 allow sdcardd system_data_file:file r_file_perms;
 allow sdcardd packages_list_file:file r_file_perms;
 
-# Read /data/.layout_version
+# Read /data/misc/installd/layout_version
 allow sdcardd install_data_file:file r_file_perms;
+allow sdcardd install_data_file:dir search;
 
 # Allow stdin/out back to vold
 allow sdcardd vold:fd use;
diff --git a/public/service.te b/public/service.te
index a2193d0..91eb6ae 100644
--- a/public/service.te
+++ b/public/service.te
@@ -1,3 +1,4 @@
+type aidl_lazy_test_service,    service_manager_type;
 type apex_service,              service_manager_type;
 type audioserver_service,       service_manager_type;
 type batteryproperties_service, app_api_service, ephemeral_app_api_service, service_manager_type;
@@ -15,18 +16,19 @@
 type iorapd_service,            service_manager_type;
 type incident_service,          service_manager_type;
 type installd_service,          service_manager_type;
+type credstore_service,         app_api_service, service_manager_type;
 type keystore_service,          service_manager_type;
 type lpdump_service,            service_manager_type;
 type mediaserver_service,       service_manager_type;
 type mediametrics_service,      service_manager_type;
 type mediaextractor_service,    service_manager_type;
-type mediacodec_service,        service_manager_type;
 type mediadrmserver_service,    service_manager_type;
+type mediatranscoding_service,  app_api_service, service_manager_type;
 type netd_service,              service_manager_type;
 type nfc_service,               service_manager_type;
-type perfprofd_service,         service_manager_type;
 type radio_service,             service_manager_type;
 type secure_element_service,    service_manager_type;
+type service_manager_service,   service_manager_type;
 type storaged_service,          service_manager_type;
 type surfaceflinger_service,    app_api_service, ephemeral_app_api_service, service_manager_type;
 type system_app_service,        service_manager_type;
@@ -45,16 +47,20 @@
 type adb_service, system_api_service, system_server_service, service_manager_type;
 type alarm_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type app_binding_service, system_server_service, service_manager_type;
+type app_integrity_service, system_api_service, system_server_service, service_manager_type;
 type app_prediction_service, app_api_service, system_server_service, service_manager_type;
+type app_search_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type appops_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type appwidget_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type assetatlas_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type audio_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type auth_service, app_api_service, system_server_service, service_manager_type;
 type autofill_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type backup_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type batterystats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type battery_service, system_server_service, service_manager_type;
 type binder_calls_stats_service, system_server_service, service_manager_type;
+type blob_store_service, app_api_service, system_server_service, service_manager_type;
 type bluetooth_manager_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type broadcastradio_service, system_server_service, service_manager_type;
 type cameraproxy_service, system_server_service, service_manager_type;
@@ -74,6 +80,7 @@
 # with EMMA_INSTRUMENT=true. We should consider locking this down in the future.
 type coverage_service, system_server_service, service_manager_type;
 type cpuinfo_service, system_api_service, system_server_service, service_manager_type;
+type dataloader_manager_service, system_server_service, service_manager_type;
 type dbinfo_service, system_api_service, system_server_service, service_manager_type;
 type device_config_service, system_server_service, service_manager_type;
 type device_policy_service, app_api_service, system_server_service, service_manager_type;
@@ -84,6 +91,7 @@
 type display_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type color_display_service, system_api_service, system_server_service, service_manager_type;
 type external_vibrator_service, system_server_service, service_manager_type;
+type file_integrity_service, app_api_service, system_server_service, service_manager_type;
 type font_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type netd_listener_service, system_server_service, service_manager_type;
 type network_watchlist_service, system_server_service, service_manager_type;
@@ -94,6 +102,7 @@
 type ethernet_service, app_api_service, system_server_service, service_manager_type;
 type biometric_service, app_api_service, system_server_service, service_manager_type;
 type bugreport_service, system_api_service, system_server_service, service_manager_type;
+type platform_compat_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type face_service, app_api_service, system_server_service, service_manager_type;
 type fingerprint_service, app_api_service, system_server_service, service_manager_type;
 type gfxinfo_service, system_api_service, system_server_service, service_manager_type;
@@ -102,12 +111,14 @@
 type hardware_properties_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type hdmi_control_service, system_api_service, system_server_service, service_manager_type;
 type imms_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type incremental_service, system_server_service, service_manager_type;
 type input_method_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type input_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type ipsec_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type iris_service, app_api_service, system_server_service, service_manager_type;
 type jobscheduler_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type launcherapps_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type light_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type location_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type lock_settings_service, system_api_service, system_server_service, service_manager_type;
 type looper_stats_service, system_server_service, service_manager_type;
@@ -157,7 +168,9 @@
 type slice_service, app_api_service, system_server_service, service_manager_type;
 type statusbar_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type storagestats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type system_config_service, system_api_service, system_server_service, service_manager_type;
 type system_update_service, system_server_service, service_manager_type;
+type soundtrigger_middleware_service, system_server_service, service_manager_type;
 type task_service, system_server_service, service_manager_type;
 type testharness_service, system_server_service, service_manager_type;
 type textclassification_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
@@ -166,8 +179,10 @@
 type thermal_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type timedetector_service, system_server_service, service_manager_type;
 type timezone_service, system_server_service, service_manager_type;
+type timezonedetector_service, system_server_service, service_manager_type;
 type trust_service, app_api_service, system_server_service, service_manager_type;
 type tv_input_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+type tv_tuner_resource_mgr_service, system_server_service, service_manager_type;
 type uimode_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type updatelock_service, system_api_service, system_server_service, service_manager_type;
 type uri_grants_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
@@ -182,11 +197,22 @@
 type wifip2p_service, app_api_service, system_server_service, service_manager_type;
 type wifiscanner_service, system_api_service, system_server_service, service_manager_type;
 type wifi_service, app_api_service, system_server_service, service_manager_type;
-type wificond_service, service_manager_type;
+type wifinl80211_service, service_manager_type;
 type wifiaware_service, app_api_service, system_server_service, service_manager_type;
 type window_service, system_api_service, system_server_service, service_manager_type;
 type inputflinger_service, system_api_service, system_server_service, service_manager_type;
 type wpantund_service, system_api_service, service_manager_type;
+type tethering_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+
+###
+### HAL Services
+###
+
+type hal_identity_service, vendor_service, service_manager_type;
+type hal_light_service, vendor_service, service_manager_type;
+type hal_power_service, vendor_service, service_manager_type;
+type hal_rebootescrow_service, vendor_service, service_manager_type;
+type hal_vibrator_service, vendor_service, service_manager_type;
 
 ###
 ### Neverallow rules
diff --git a/public/servicemanager.te b/public/servicemanager.te
index df20941..10347d9 100644
--- a/public/servicemanager.te
+++ b/public/servicemanager.te
@@ -21,5 +21,7 @@
 # nonplat_service_contexts only accessible on non full-treble devices
 not_full_treble(`allow servicemanager nonplat_service_contexts_file:file r_file_perms;')
 
+add_service(servicemanager, service_manager_service)
+
 # Check SELinux permissions.
 selinux_check_access(servicemanager)
diff --git a/public/shell.te b/public/shell.te
index 56196c3..79d5c89 100644
--- a/public/shell.te
+++ b/public/shell.te
@@ -78,10 +78,15 @@
 # Allow shell to start/stop heapprofd via the persist.heapprofd.enable
 # property.
 set_prop(shell, heapprofd_enabled_prop)
+# Allow shell to start/stop traced_perf via the persist.traced_perf.enable
+# property.
+set_prop(shell, traced_perf_enabled_prop)
 # Allow shell to start/stop gsid via ctl.start|stop|restart gsid.
 set_prop(shell, ctl_gsid_prop)
 # Allow shell to enable Dynamic System Update
 set_prop(shell, dynamic_system_prop)
+# Allow shell to mock an OTA using persist.pm.mock-upgrade
+set_prop(shell, mock_ota_prop)
 
 userdebug_or_eng(`
   # "systrace --boot" support - allow boottrace service to run
@@ -104,6 +109,9 @@
 get_prop(shell, last_boot_reason_prop)
 get_prop(shell, system_boot_reason_prop)
 
+# Allow reading the outcome of perf_event_open LSM support test for CTS.
+get_prop(shell, init_perf_lsm_hooks_prop)
+
 # allow shell access to services
 allow shell servicemanager:service_manager list;
 # don't allow shell to access GateKeeper service
@@ -122,6 +130,7 @@
   -virtual_touchpad_service
   -vold_service
   -vr_hwc_service
+  -default_android_service
 }:service_manager find;
 allow shell dumpstate:binder call;
 
diff --git a/public/simpleperf.te b/public/simpleperf.te
new file mode 100644
index 0000000..218fee7
--- /dev/null
+++ b/public/simpleperf.te
@@ -0,0 +1 @@
+type simpleperf, domain;
diff --git a/public/statsd.te b/public/statsd.te
index 089cae9..435bbdf 100644
--- a/public/statsd.te
+++ b/public/statsd.te
@@ -27,9 +27,6 @@
 binder_call(statsd, appdomain)
 binder_call(statsd, healthd)
 binder_call(statsd, incidentd)
-userdebug_or_eng(`
-  binder_call(statsd, perfprofd)
-')
 binder_call(statsd, system_server)
 
 # Allow statsd to interact with gpuservice
@@ -44,9 +41,6 @@
 allow statsd {
   app_api_service
   incident_service
-  userdebug_or_eng(`
-    perfprofd_service
-  ')
   system_api_service
 }:service_manager find;
 
diff --git a/public/su.te b/public/su.te
index a2f435e..99d4603 100644
--- a/public/su.te
+++ b/public/su.te
@@ -52,6 +52,7 @@
   dontaudit su postinstall_file:filesystem *;
   dontaudit su domain:bpf *;
   dontaudit su unlabeled:vsock_socket *;
+  dontaudit su self:perf_event *;
 
   # VTS tests run in the permissive su domain on debug builds, but the HALs
   # being tested run in enforcing mode. Because hal_foo_server is enforcing
@@ -86,6 +87,7 @@
   typeattribute su hal_nfc_client;
   typeattribute su hal_oemlock_client;
   typeattribute su hal_power_client;
+  typeattribute su hal_rebootescrow_client;
   typeattribute su hal_secure_element_client;
   typeattribute su hal_sensors_client;
   typeattribute su hal_telephony_client;
@@ -93,12 +95,12 @@
   typeattribute su hal_thermal_client;
   typeattribute su hal_tv_cec_client;
   typeattribute su hal_tv_input_client;
+  typeattribute su hal_tv_tuner_client;
   typeattribute su hal_usb_client;
   typeattribute su hal_vibrator_client;
   typeattribute su hal_vr_client;
   typeattribute su hal_weaver_client;
   typeattribute su hal_wifi_client;
   typeattribute su hal_wifi_hostapd_client;
-  typeattribute su hal_wifi_offload_client;
   typeattribute su hal_wifi_supplicant_client;
 ')
diff --git a/public/te_macros b/public/te_macros
index 85783dc..5afb791 100644
--- a/public/te_macros
+++ b/public/te_macros
@@ -171,16 +171,17 @@
 # Label tmpfs objects for all apps.
 type_transition $1 tmpfs:file appdomain_tmpfs;
 allow $1 appdomain_tmpfs:file { execute getattr map read write };
-neverallow { $1 -runas_app -shell } { domain -$1 }:file no_rw_file_perms;
-neverallow { appdomain -runas_app -shell -$1 } $1:file no_rw_file_perms;
+neverallow { $1 -runas_app -shell -simpleperf } { domain -$1 }:file no_rw_file_perms;
+neverallow { appdomain -runas_app -shell -simpleperf -$1 } $1:file no_rw_file_perms;
 # The Android security model guarantees the confidentiality and integrity
 # of application data and execution state. Ptrace bypasses those
-# confidentiality guarantees. Disallow ptrace access from system components
-# to apps. Crash_dump is excluded, as it needs ptrace access to
-# produce stack traces.  llkd is excluded, as it needs to inspect
-# the kernel stack for live lock conditions. runas_app is excluded, as it can
-# only access debuggable apps.
-neverallow { domain -$1 -crash_dump userdebug_or_eng(`-llkd') -runas_app } $1:process ptrace;
+# confidentiality guarantees. Disallow ptrace access from system components to
+# apps. crash_dump is excluded, as it needs ptrace access to produce stack
+# traces. runas_app is excluded, as it operates only on debuggable apps.
+# simpleperf is excluded, as it operates only on debuggable or profileable
+# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for
+# live lock conditions.
+neverallow { domain -$1 -crash_dump userdebug_or_eng(`-llkd') -runas_app -simpleperf } $1:process ptrace;
 ')
 
 #####################################
@@ -337,6 +338,8 @@
 define(`binder_use', `
 # Call the servicemanager and transfer references to it.
 allow $1 servicemanager:binder { call transfer };
+# Allow servicemanager to send out callbacks
+allow servicemanager $1:binder { call transfer };
 # servicemanager performs getpidcon on clients.
 allow servicemanager $1:dir search;
 allow servicemanager $1:file { read open };
@@ -596,6 +599,18 @@
   binder_call(keystore, $1)
 ')
 
+#####################################
+# use_credstore(domain)
+# Ability to use credstore.
+define(`use_credstore', `
+  allow credstore $1:dir search;
+  allow credstore $1:file { read open };
+  allow credstore $1:process getattr;
+  allow $1 credstore_service:service_manager find;
+  binder_call($1, credstore)
+  binder_call(credstore, $1)
+')
+
 ###########################################
 # use_drmservice(domain)
 # Ability to use DrmService which requires
@@ -692,10 +707,15 @@
     # Use shared memory received over the unix socket.
     allow $1 heapprofd:fd use;
 
-    # To read from the received file descriptors.
+    # To read and write from the received file descriptors.
     # /proc/[pid]/maps and /proc/[pid]/mem have the same SELinux label as the
     # process they relate to.
-    allow heapprofd $1:file r_file_perms;
+    # We need to write to /proc/$PID/page_idle to find idle allocations.
+    # The client only opens /proc/self/page_idle with RDWR, everything else
+    # with RDONLY.
+    # heapprofd cannot open /proc/$PID/mem itself, as it does not have
+    # sys_ptrace.
+    allow heapprofd $1:file rw_file_perms;
     # Allow searching the /proc/[pid] directory for cmdline.
     allow heapprofd $1:dir r_dir_perms;
   ')
@@ -708,3 +728,198 @@
   neverallow heapprofd $1:file read;
   neverallow heapprofd $1:process signal;
 ')
+
+###################################
+# can_profile_perf(domain)
+# Allow processes within the domain to be profiled, and have their stacks
+# sampled, by traced_perf.
+define(`can_profile_perf', `
+  # Allow directory & file read to traced_perf, as it stat(2)s /proc/[pid], and
+  # reads /proc/[pid]/cmdline.
+  allow traced_perf $1:file r_file_perms;
+  allow traced_perf $1:dir r_dir_perms;
+
+  # Allow central daemon to send signal to request /proc/[pid]/maps and
+  # /proc/[pid]/mem fds from this process.
+  allow traced_perf $1:process signal;
+
+  # Allow connecting to the daemon.
+  unix_socket_connect($1, traced_perf, traced_perf)
+  # Allow daemon to use the passed fds.
+  allow traced_perf $1:fd use;
+')
+
+###################################
+# never_profile_perf(domain)
+# Opt out of profiling by traced_perf.
+define(`never_profile_perf', `
+  neverallow traced_perf $1:file read;
+  neverallow traced_perf $1:process signal;
+')
+
+###################################
+# perfetto_producer(domain)
+# Allow processes within the domain to write data to Perfetto.
+# When applying this macro, you might need to also allow traced to use the
+# producer tmpfs domain, if the producer will be the one creating the shared
+# memory.
+define(`perfetto_producer', `
+  allow $1 traced:fd use;
+  allow $1 traced_tmpfs:file { read write getattr map };
+  unix_socket_connect($1, traced_producer, traced)
+
+  # Also allow the service to use the producer file descriptors. This is
+  # necessary when the producer is creating the shared memory, as it will be
+  # passed to the service as a file descriptor (obtained from memfd_create).
+  allow traced $1:fd use;
+')
+
+###########################################
+# dump_hal(hal_type)
+# Ability to dump the hal debug info
+#
+define(`dump_hal', `
+  hal_client_domain(dumpstate, $1);
+  allow $1_server dumpstate:fifo_file write;
+  allow $1_server dumpstate:fd use;
+')
+
+#####################################
+# treble_sysprop_neverallow(rules)
+# SELinux neverallow rules which enforces the owner of each property and accessibility
+# outside the owner.
+#
+# For devices launching with R or later, all properties must be explicitly marked as one of:
+# system_property_type, vendor_property_type, or product_property_type.
+# Also, exported properties must be explicitly marked as "restricted" or "public",
+# depending on the accessibility outside the owner.
+# For devices launching with Q or eariler, this neverallow rules can be relaxed with defining
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true on BoardConfig.mk.
+# See {partition}_{accessibility}_prop macros below.
+#
+# CTS uses these rules only for devices launching with R or later.
+#
+define(`treble_sysprop_neverallow', ifelse(target_treble_sysprop_neverallow, `true', $1,
+ifelse(target_treble_sysprop_neverallow, `cts',
+# BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+$1
+# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify
+, )))
+
+###########################################
+# define_prop(name, owner, scope)
+# Define a property with given owner and scope
+#
+define(`define_prop', `
+  type $1, property_type, $2_property_type, $2_$3_property_type;
+')
+
+###########################################
+# system_internal_prop(name)
+# Define a /system-owned property used only in /system
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+define(`system_internal_prop', `
+  define_prop($1, system, internal)
+  treble_sysprop_neverallow(`
+    neverallow { domain -coredomain } $1:file no_rw_file_perms;
+  ')
+')
+
+###########################################
+# system_restricted_prop(name)
+# Define a /system-owned property which can't be written outside /system
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+define(`system_restricted_prop', `
+  define_prop($1, system, restricted)
+  treble_sysprop_neverallow(`
+    neverallow { domain -coredomain } $1:property_service set;
+  ')
+')
+
+###########################################
+# system_public_prop(name)
+# Define a /system-owned property with no restrictions
+#
+define(`system_public_prop', `define_prop($1, system, public)')
+
+###########################################
+# system_vendor_config_prop(name)
+# Define a /system-owned property which can only be written by vendor_init
+# This is a macro for vendor-specific configuration properties which is meant
+# to be set once from vendor_init.
+#
+define(`system_vendor_config_prop', `
+  system_public_prop($1)
+  set_prop(vendor_init, $1)
+  neverallow { domain -init -vendor_init } $1:property_service set;
+')
+
+###########################################
+# product_internal_prop(name)
+# Define a /product-owned property used only in /product
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+define(`product_internal_prop', `
+  define_prop($1, product, internal)
+  treble_sysprop_neverallow(`
+    neverallow { domain -coredomain } $1:file no_rw_file_perms;
+  ')
+')
+
+###########################################
+# product_restricted_prop(name)
+# Define a /product-owned property which can't be written outside /product
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+define(`product_restricted_prop', `
+  define_prop($1, product, restricted)
+  treble_sysprop_neverallow(`
+    neverallow { domain -coredomain } $1:property_service set;
+  ')
+')
+
+###########################################
+# product_public_prop(name)
+# Define a /product-owned property with no restrictions
+#
+define(`product_public_prop', `define_prop($1, product, public)')
+
+###########################################
+# vendor_internal_prop(name)
+# Define a /vendor-owned property used only in /vendor
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+define(`vendor_internal_prop', `
+  define_prop($1, vendor, internal)
+  treble_sysprop_neverallow(`
+# init and dumpstate are in coredomain, but should be able to read all props.
+    neverallow { coredomain -init -dumpstate } $1:file no_rw_file_perms;
+  ')
+')
+
+###########################################
+# vendor_restricted_prop(name)
+# Define a /vendor-owned property which can't be written outside /vendor
+# For devices launching with Q or eariler, this restriction can be relaxed with
+# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true
+#
+define(`vendor_restricted_prop', `
+  define_prop($1, vendor, restricted)
+  treble_sysprop_neverallow(`
+# init is in coredomain, but should be able to write all props.
+    neverallow { coredomain -init } $1:property_service set;
+  ')
+')
+
+###########################################
+# vendor_public_prop(name)
+# Define a /vendor-owned property with no restrictions
+#
+define(`vendor_public_prop', `define_prop($1, vendor, public)')
diff --git a/public/toolbox.te b/public/toolbox.te
index fcf0ec3..4c2cc3e 100644
--- a/public/toolbox.te
+++ b/public/toolbox.te
@@ -24,5 +24,15 @@
 neverallow toolbox { file_type fs_type -toolbox_exec}:file entrypoint;
 
 # rm -rf directories in /data
+allow toolbox system_data_root_file:dir { remove_name write };
 allow toolbox system_data_file:dir { rmdir rw_dir_perms };
 allow toolbox system_data_file:file { getattr unlink };
+
+# chattr +F and chattr +P /data/media in init
+allow toolbox media_rw_data_file:dir { r_dir_perms setattr };
+allowxperm toolbox media_rw_data_file:dir ioctl {
+  FS_IOC_FSGETXATTR
+  FS_IOC_FSSETXATTR
+  FS_IOC_GETFLAGS
+  FS_IOC_SETFLAGS
+};
diff --git a/public/traced_perf.te b/public/traced_perf.te
new file mode 100644
index 0000000..f9a0324
--- /dev/null
+++ b/public/traced_perf.te
@@ -0,0 +1 @@
+type traced_perf, domain;
diff --git a/public/traceur_app.te b/public/traceur_app.te
index 5333015..7e2cc84 100644
--- a/public/traceur_app.te
+++ b/public/traceur_app.te
@@ -21,6 +21,7 @@
   -virtual_touchpad_service
   -vold_service
   -vr_hwc_service
+  -default_android_service
 }:service_manager find;
 
 # Allow traceur_app to use atrace HAL
diff --git a/public/ueventd.te b/public/ueventd.te
index 98e3bda..fc503b8 100644
--- a/public/ueventd.te
+++ b/public/ueventd.te
@@ -6,7 +6,7 @@
 # Write to /dev/kmsg.
 allow ueventd kmsg_device:chr_file rw_file_perms;
 
-allow ueventd self:global_capability_class_set { chown mknod net_admin setgid fsetid sys_rawio dac_override dac_read_search fowner };
+allow ueventd self:global_capability_class_set { chown mknod net_admin setgid fsetid sys_rawio dac_override dac_read_search fowner setuid };
 allow ueventd device:file create_file_perms;
 
 r_dir_file(ueventd, rootfs)
@@ -59,17 +59,17 @@
 allow ueventd system_bootstrap_lib_file:dir r_dir_perms;
 allow ueventd system_bootstrap_lib_file:file { execute read open getattr map };
 
+# ueventd can set properties, particularly it sets ro.cold_boot_done to signal
+# to init that cold boot has completed.
+set_prop(ueventd, cold_boot_done_prop)
+
+# Allow ueventd to run shell scripts from vendor
+allow ueventd vendor_shell_exec:file execute;
+
 #####
 ##### neverallow rules
 #####
 
-# ueventd must never set properties, otherwise deadlocks may occur.
-# https://android-review.googlesource.com/#/c/133120/6/init/devices.cpp@941
-# No writing to the property socket, connecting to init, or setting properties.
-neverallow ueventd property_socket:sock_file write;
-neverallow ueventd init:unix_stream_socket connectto;
-neverallow ueventd property_type:property_service set;
-
 # Restrict ueventd access on block devices to maintenence operations.
 neverallow ueventd dev_type:blk_file ~{ getattr relabelfrom relabelto create setattr unlink };
 
@@ -78,3 +78,6 @@
 
 # Nobody should be able to ptrace ueventd
 neverallow * ueventd:process ptrace;
+
+# ueventd should never execute a program without changing to another domain.
+neverallow ueventd { file_type fs_type }:file execute_no_trans;
diff --git a/public/untrusted_app.te b/public/untrusted_app.te
index 5289bf9..43fe19a 100644
--- a/public/untrusted_app.te
+++ b/public/untrusted_app.te
@@ -16,6 +16,15 @@
 ### seapp_contexts.
 ###
 
+# This file defines the rules for untrusted apps running with
+# targetSdkVersion >= 30.
 type untrusted_app, domain;
+# This file defines the rules for untrusted apps running with
+# targetSdkVersion = 29.
+type untrusted_app_29, domain;
+# This file defines the rules for untrusted apps running with
+# 25 < targetSdkVersion <= 28.
 type untrusted_app_27, domain;
+# This file defines the rules for untrusted apps running with
+# targetSdkVersion <= 25.
 type untrusted_app_25, domain;
diff --git a/public/update_engine.te b/public/update_engine.te
index 7bcaca6..078e494 100644
--- a/public/update_engine.te
+++ b/public/update_engine.te
@@ -36,8 +36,16 @@
 binder_use(update_engine)
 add_service(update_engine, update_engine_service)
 
-# Allow update_engine to call the callback function provided by priv_app.
+# Allow update_engine to call the callback function provided by priv_app/GMS core.
 binder_call(update_engine, priv_app)
+# b/142672293: No other priv-app should need this rule now that GMS core runs in its own domain.
+userdebug_or_eng(`
+  auditallow update_engine priv_app:binder { call transfer };
+  auditallow priv_app update_engine:binder transfer;
+  auditallow update_engine priv_app:fd use;
+')
+
+binder_call(update_engine, gmscore_app)
 
 # Allow update_engine to call the callback function provided by system_server.
 binder_call(update_engine, system_server)
@@ -54,3 +62,23 @@
 
 # read directories on /system and /vendor
 allow update_engine system_file:dir r_dir_perms;
+
+# Allow to start gsid service.
+set_prop(update_engine, ctl_gsid_prop)
+
+# Allow to set the OTA related properties, e.g. ota.warm_reset.
+set_prop(update_engine, ota_prop)
+
+# update_engine tries to determine the parent path for all devices (e.g.
+# /dev/block/by-name) by reading the default fstab and looking for the misc
+# device. ReadDefaultFstab() checks whether a GSI is running by checking
+# gsi_metadata_file. We never apply OTAs when GSI is running, so just deny
+# the access.
+dontaudit update_engine gsi_metadata_file:dir search;
+
+# Allow to write to snapshotctl_log logs.
+# TODO(b/148818798) revert when parent bug is fixed.
+userdebug_or_eng(`
+allow update_engine snapshotctl_log_data_file:dir rw_dir_perms;
+allow update_engine snapshotctl_log_data_file:file create_file_perms;
+')
diff --git a/public/update_engine_common.te b/public/update_engine_common.te
index a326d4c..57d8e7e 100644
--- a/public/update_engine_common.te
+++ b/public/update_engine_common.te
@@ -56,6 +56,9 @@
 # Read files in /sys/firmware/devicetree/base/firmware/android/
 r_dir_file(update_engine_common, sysfs_dt_firmware_android)
 
+# Needed because libdm reads sysfs to validate when a dm path is ready.
+r_dir_file(update_engine_common, sysfs_dm)
+
 # read / write on /dev/device-mapper to map / unmap devices
 allow update_engine_common dm_device:chr_file rw_file_perms;
 
@@ -73,3 +76,11 @@
 
 # Allow update_engine_common to write to statsd socket.
 unix_socket_send(update_engine_common, statsdw, statsd)
+
+# Allow to read Virtual A/B feature flags.
+get_prop(update_engine_common, virtual_ab_prop)
+
+# Allow to read/write/create OTA metadata files for snapshot status and COW file status.
+allow update_engine_common metadata_file:dir search;
+allow update_engine_common ota_metadata_file:dir rw_dir_perms;
+allow update_engine_common ota_metadata_file:file create_file_perms;
diff --git a/public/update_verifier.te b/public/update_verifier.te
index 8d40cdd..f881aeb 100644
--- a/public/update_verifier.te
+++ b/public/update_verifier.te
@@ -27,6 +27,9 @@
 # Allow update_verifier to reboot the device.
 set_prop(update_verifier, powerctl_prop)
 
+# Allow to set the OTA related properties e.g. ota.warm_reset.
+set_prop(update_verifier, ota_prop)
+
 # Use Boot Control HAL
 hal_client_domain(update_verifier, hal_bootctl)
 
diff --git a/public/vendor_init.te b/public/vendor_init.te
index 375673c..935c314 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -51,6 +51,7 @@
   -system_file_type
   -mnt_product_file
   -password_slot_metadata_file
+  -ota_metadata_file
   -unlabeled
   -vendor_file_type
   -vold_metadata_file
@@ -65,6 +66,7 @@
   -core_data_file_type
   -exec_type
   -password_slot_metadata_file
+  -ota_metadata_file
   -runtime_event_log_tags_file
   -system_file_type
   -unlabeled
@@ -79,6 +81,7 @@
   -core_data_file_type
   -exec_type
   -password_slot_metadata_file
+  -ota_metadata_file
   -system_file_type
   -unlabeled
   -vendor_file_type
@@ -93,6 +96,7 @@
   -core_data_file_type
   -exec_type
   -password_slot_metadata_file
+  -ota_metadata_file
   -system_file_type
   -unlabeled
   -vendor_file_type
@@ -107,6 +111,7 @@
   -exec_type
   -mnt_product_file
   -password_slot_metadata_file
+  -ota_metadata_file
   -system_file_type
   -vendor_file_type
   -vold_metadata_file
@@ -193,36 +198,22 @@
 not_compatible_property(`
     set_prop(vendor_init, {
       property_type
-      -device_config_activity_manager_native_boot_prop
-      -device_config_boot_count_prop
-      -device_config_reset_performed_prop
-      -device_config_input_native_boot_prop
-      -device_config_netd_native_prop
-      -device_config_runtime_native_boot_prop
-      -device_config_runtime_native_prop
-      -device_config_media_native_prop
-      -restorecon_prop
-      -netd_stable_secret_prop
-      -firstboot_prop
-      -pm_prop
-      -system_boot_reason_prop
-      -bootloader_boot_reason_prop
-      -last_boot_reason_prop
-      -apexd_prop
-      -gsid_prop
-      -nnapi_ext_deny_product_prop
+      -system_internal_property_type
+      -system_restricted_property_type
     })
 ')
 
 # Get file context
 allow vendor_init file_contexts_file:file r_file_perms;
 
+set_prop(vendor_init, apk_verity_prop)
 set_prop(vendor_init, bluetooth_a2dp_offload_prop)
 set_prop(vendor_init, bluetooth_audio_hal_prop)
 set_prop(vendor_init, cpu_variant_prop)
 set_prop(vendor_init, debug_prop)
 set_prop(vendor_init, exported_audio_prop)
 set_prop(vendor_init, exported_bluetooth_prop)
+set_prop(vendor_init, exported_camera_prop)
 set_prop(vendor_init, exported_config_prop)
 set_prop(vendor_init, exported_dalvik_prop)
 set_prop(vendor_init, exported_default_prop)
@@ -240,15 +231,22 @@
 set_prop(vendor_init, logd_prop)
 set_prop(vendor_init, log_tag_prop)
 set_prop(vendor_init, log_prop)
+set_prop(vendor_init, rebootescrow_hal_prop)
 set_prop(vendor_init, serialno_prop)
+set_prop(vendor_init, userspace_reboot_config_prop)
+set_prop(vendor_init, vehicle_hal_prop)
 set_prop(vendor_init, vendor_default_prop)
 set_prop(vendor_init, vendor_security_patch_level_prop)
+set_prop(vendor_init, vndk_prop)
+set_prop(vendor_init, virtual_ab_prop)
 set_prop(vendor_init, wifi_log_prop)
 
 get_prop(vendor_init, exported2_radio_prop)
 get_prop(vendor_init, exported3_system_prop)
 get_prop(vendor_init, theme_prop)
 
+get_prop(vendor_init, ota_prop)
+
 ###
 ### neverallow rules
 ###
diff --git a/public/vendor_misc_writer.te b/public/vendor_misc_writer.te
index 7093fec..dee9941 100644
--- a/public/vendor_misc_writer.te
+++ b/public/vendor_misc_writer.te
@@ -6,6 +6,8 @@
 allow vendor_misc_writer misc_block_device:blk_file w_file_perms;
 allow vendor_misc_writer block_device:dir r_dir_perms;
 
-# Silence the denial when calling libfstab's ReadDefaultFstab.
+# Silence the denial when calling libfstab's ReadDefaultFstab, which tries to
+# load DT fstab.
 dontaudit vendor_misc_writer proc_cmdline:file read;
 dontaudit vendor_misc_writer metadata_file:dir search;
+dontaudit vendor_misc_writer sysfs_dt_firmware_android:dir search;
diff --git a/public/vndservice.te b/public/vndservice.te
index 0d309bf..efd9adf 100644
--- a/public/vndservice.te
+++ b/public/vndservice.te
@@ -1 +1,2 @@
+type service_manager_vndservice, vndservice_manager_type;
 type default_android_vndservice, vndservice_manager_type;
diff --git a/public/vold.te b/public/vold.te
index 2a278eb..9391649 100644
--- a/public/vold.te
+++ b/public/vold.te
@@ -43,12 +43,29 @@
 # allowxperm still requires the ioctl permission for the individual type
 allowxperm vold { fs_type file_type }:dir ioctl FITRIM;
 
-# Get encryption policy for dirs in /data
+# Get/set file-based encryption policies on dirs in /data and adoptable storage,
+# and add/remove file-based encryption keys.
 allowxperm vold data_file_type:dir ioctl {
   FS_IOC_GET_ENCRYPTION_POLICY
   FS_IOC_SET_ENCRYPTION_POLICY
+  FS_IOC_ADD_ENCRYPTION_KEY
+  FS_IOC_REMOVE_ENCRYPTION_KEY
 };
 
+# Only vold and init should ever set file-based encryption policies.
+neverallowxperm {
+  domain
+  -vold
+  -init
+  -vendor_init
+} data_file_type:dir ioctl { FS_IOC_SET_ENCRYPTION_POLICY };
+
+# Only vold should ever add/remove file-based encryption keys.
+neverallowxperm {
+  domain
+  -vold
+} data_file_type:dir ioctl { FS_IOC_ADD_ENCRYPTION_KEY FS_IOC_REMOVE_ENCRYPTION_KEY };
+
 # Find the location on the raw block device where the
 # crypto key is stored so it can be destroyed
 allowxperm vold vold_data_file:file ioctl {
@@ -75,6 +92,17 @@
 # Access to storage that backs emulated FUSE daemons for migration optimization
 allow vold media_rw_data_file:dir create_dir_perms;
 allow vold media_rw_data_file:file create_file_perms;
+# Allow mounting (lower filesystem) on parts of media for performance
+allow vold media_rw_data_file:dir mounton;
+
+# Allow setting extended attributes (for project quota IDs) on files and dirs
+# and to enable project ID inheritance through FS_IOC_SETFLAGS
+allowxperm vold media_rw_data_file:{ dir file } ioctl {
+  FS_IOC_FSGETXATTR
+  FS_IOC_FSSETXATTR
+  FS_IOC_GETFLAGS
+  FS_IOC_SETFLAGS
+};
 
 # Allow mounting of storage devices
 allow vold { mnt_media_rw_stub_file storage_stub_file }:dir { mounton create rmdir getattr setattr };
@@ -84,11 +112,24 @@
 allow vold mnt_user_file:lnk_file create_file_perms;
 allow vold mnt_user_file:file create_file_perms;
 
+# Manage per-user pass_through primary symlinks
+allow vold mnt_pass_through_file:dir { create_dir_perms mounton };
+allow vold mnt_pass_through_file:lnk_file create_file_perms;
+
 # Allow to create and mount expanded storage
 allow vold mnt_expand_file:dir { create_dir_perms mounton };
 allow vold apk_data_file:dir { create getattr setattr };
 allow vold shell_data_file:dir { create getattr setattr };
 
+# Allow to mount incremental file system on /data/incremental and create files
+allow vold apk_data_file:dir { mounton rw_dir_perms };
+# Allow to create and write files in /data/incremental
+allow vold apk_data_file:file rw_file_perms;
+# Allow to bind-mount incremental file system on /data/app/vmdl*.tmp and read files
+allow vold apk_tmp_file:dir { mounton r_dir_perms };
+# Allow to read incremental control file and call selinux restorecon on it
+allow vold incremental_control_file:file { r_file_perms relabelto };
+
 allow vold tmpfs:filesystem { mount unmount };
 allow vold tmpfs:dir create_dir_perms;
 allow vold tmpfs:dir mounton;
@@ -135,7 +176,10 @@
 allow vold efs_file:file rw_file_perms;
 
 # Create and mount on /data/tmp_mnt and management of expansion mounts
-allow vold system_data_file:dir { create rw_dir_perms mounton setattr rmdir };
+allow vold {
+    system_data_file
+    system_data_root_file
+}:dir { create rw_dir_perms mounton setattr rmdir };
 allow vold system_data_file:lnk_file getattr;
 
 # Vold create users in /data/vendor_{ce,de}/[0-9]+
@@ -154,6 +198,9 @@
 set_prop(vold, powerctl_prop)
 set_prop(vold, ctl_fuse_prop)
 set_prop(vold, restorecon_prop)
+set_prop(vold, ota_prop)
+set_prop(vold, boottime_prop)
+set_prop(vold, boottime_public_prop)
 
 # ASEC
 allow vold asec_image_file:file create_file_perms;
@@ -302,7 +349,6 @@
 
 neverallow vold {
   domain
-  -ashmemd
   -hal_health_storage_server
   -hal_keymaster_server
   -system_suspend_server
diff --git a/public/wificond.te b/public/wificond.te
index 656abad..b429884 100644
--- a/public/wificond.te
+++ b/public/wificond.te
@@ -4,8 +4,9 @@
 
 binder_use(wificond)
 binder_call(wificond, system_server)
+binder_call(wificond, keystore)
 
-add_service(wificond, wificond_service)
+add_service(wificond, wifinl80211_service)
 
 set_prop(wificond, exported_wifi_prop)
 set_prop(wificond, wifi_prop)
@@ -29,3 +30,13 @@
 # dumpstate support
 allow wificond dumpstate:fd use;
 allow wificond dumpstate:fifo_file write;
+
+#### Offer the Wifi Keystore HwBinder service ###
+hwbinder_use(wificond)
+get_prop(wificond, hwservicemanager_prop)
+typeattribute wificond wifi_keystore_service_server;
+add_hwservice(wificond, system_wifi_keystore_hwservice)
+
+# Allow keystore binder access to serve the HwBinder service.
+allow wificond keystore_service:service_manager find;
+allow wificond keystore:keystore_key get;
diff --git a/seapp_contexts.mk b/seapp_contexts.mk
index 9c22099..462fa27 100644
--- a/seapp_contexts.mk
+++ b/seapp_contexts.mk
@@ -19,6 +19,29 @@
 
 ##################################
 include $(CLEAR_VARS)
+LOCAL_MODULE := system_ext_seapp_contexts
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_TAGS := optional
+LOCAL_MODULE_PATH := $(TARGET_OUT_SYSTEM_EXT)/etc/selinux
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+system_ext_sc_files := $(call build_policy, seapp_contexts, $(SYSTEM_EXT_PRIVATE_POLICY))
+plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY))
+
+$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
+$(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(system_ext_sc_files)
+$(LOCAL_BUILT_MODULE): PRIVATE_SC_NEVERALLOW_FILES := $(plat_sc_neverallow_files)
+$(LOCAL_BUILT_MODULE): $(built_sepolicy) $(system_ext_sc_files) $(HOST_OUT_EXECUTABLES)/checkseapp $(plat_sc_neverallow_files)
+	@mkdir -p $(dir $@)
+	$(hide) grep -ihe '^neverallow' $(PRIVATE_SC_NEVERALLOW_FILES) > $@.tmp
+	$(hide) $(HOST_OUT_EXECUTABLES)/checkseapp -p $(PRIVATE_SEPOLICY) -o $@ $(PRIVATE_SC_FILES) $@.tmp
+
+system_ext_sc_files :=
+plat_sc_neverallow_files :=
+
+##################################
+include $(CLEAR_VARS)
 LOCAL_MODULE := product_seapp_contexts
 LOCAL_MODULE_CLASS := ETC
 LOCAL_MODULE_TAGS := optional
@@ -50,7 +73,7 @@
 include $(BUILD_SYSTEM)/base_rules.mk
 
 vendor_sc_files := $(call build_policy, seapp_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
-plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
+plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
 
 $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
 $(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(vendor_sc_files)
@@ -73,7 +96,7 @@
 include $(BUILD_SYSTEM)/base_rules.mk
 
 odm_sc_files := $(call build_policy, seapp_contexts, $(BOARD_ODM_SEPOLICY_DIRS))
-plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
+plat_sc_neverallow_files := $(call build_policy, seapp_contexts, $(PLAT_PRIVATE_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) $(PRODUCT_PRIVATE_POLICY))
 
 $(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
 $(LOCAL_BUILT_MODULE): PRIVATE_SC_FILES := $(odm_sc_files)
diff --git a/service_contexts.mk b/service_contexts.mk
deleted file mode 100644
index da2bc23..0000000
--- a/service_contexts.mk
+++ /dev/null
@@ -1,89 +0,0 @@
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := plat_service_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-plat_svcfiles := $(call build_policy, service_contexts, $(PLAT_PRIVATE_POLICY))
-
-plat_service_contexts.tmp := $(intermediates)/plat_service_contexts.tmp
-$(plat_service_contexts.tmp): PRIVATE_SVC_FILES := $(plat_svcfiles)
-$(plat_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(plat_service_contexts.tmp): $(plat_svcfiles)
-	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
-
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): $(plat_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
-	@mkdir -p $(dir $@)
-	sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
-	$(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
-
-built_plat_svc := $(LOCAL_BUILT_MODULE)
-plat_svcfiles :=
-plat_service_contexts.tmp :=
-
-##################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := product_service_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT)/etc/selinux
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-product_svcfiles := $(call build_policy, service_contexts, $(PRODUCT_PRIVATE_POLICY))
-
-product_service_contexts.tmp := $(intermediates)/product_service_contexts.tmp
-$(product_service_contexts.tmp): PRIVATE_SVC_FILES := $(product_svcfiles)
-$(product_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(product_service_contexts.tmp): $(product_svcfiles)
-	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
-
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): $(product_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc
-	@mkdir -p $(dir $@)
-	sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
-	$(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
-
-product_svcfiles :=
-product_service_contexts.tmp :=
-
-##################################
-# nonplat_service_contexts is only allowed on non-full-treble devices
-ifneq ($(PRODUCT_SEPOLICY_SPLIT),true)
-
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := vendor_service_contexts
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-vendor_svcfiles := $(call build_policy, service_contexts, $(PLAT_VENDOR_POLICY) $(BOARD_VENDOR_SEPOLICY_DIRS) $(REQD_MASK_POLICY))
-
-vendor_service_contexts.tmp := $(intermediates)/vendor_service_contexts.tmp
-$(vendor_service_contexts.tmp): PRIVATE_SVC_FILES := $(vendor_svcfiles)
-$(vendor_service_contexts.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(vendor_service_contexts.tmp): $(vendor_svcfiles)
-	@mkdir -p $(dir $@)
-	$(hide) m4 --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_SVC_FILES) > $@
-
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): $(vendor_service_contexts.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/checkfc $(ACP)
-	@mkdir -p $(dir $@)
-	sed -e 's/#.*$$//' -e '/^$$/d' $< > $@
-	$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -s $(PRIVATE_SEPOLICY) $@
-
-built_vendor_svc := $(LOCAL_BUILT_MODULE)
-vendor_svcfiles :=
-vendor_service_contexts.tmp :=
-
-endif
diff --git a/tests/Android.bp b/tests/Android.bp
index a7d7023..926b5e4 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -11,7 +11,6 @@
         "libbase",
         "libsepol",
     ],
-    stl: "libc++_static",
     sanitize: {
         never: true,
     },
@@ -33,7 +32,7 @@
 python_binary_host {
     name: "treble_sepolicy_tests",
     srcs: [
-        "FcSort.py",
+        "fc_sort.py",
         "mini_parser.py",
         "policy.py",
         "treble_sepolicy_tests.py",
@@ -45,7 +44,7 @@
 python_binary_host {
     name: "sepolicy_tests",
     srcs: [
-        "FcSort.py",
+        "fc_sort.py",
         "policy.py",
         "sepolicy_tests.py",
     ],
@@ -56,7 +55,7 @@
 python_binary_host {
     name: "searchpolicy",
     srcs: [
-        "FcSort.py",
+        "fc_sort.py",
         "policy.py",
         "searchpolicy.py",
     ],
@@ -72,3 +71,11 @@
     ],
     defaults: ["py2_only"],
 }
+
+python_binary_host {
+    name: "fc_sort",
+    srcs: [
+        "fc_sort.py",
+    ],
+    defaults: ["py2_only"],
+}
diff --git a/tests/combine_maps.py b/tests/combine_maps.py
index a2bf38d..1a7dfaa 100644
--- a/tests/combine_maps.py
+++ b/tests/combine_maps.py
@@ -18,7 +18,8 @@
 mapping files from x to y (top) and y to z (bottom), it's possible to construct
 a mapping file from x to z. We do the following to combine two maps.
 1. Add all new types declarations from top to bottom.
-2. Say, a new type "bar" in top is mapped like this "foo_V_v<-bar", then we map
+2. Add all new typeattribute declarations from top to bottom.
+3. Say, a new type "bar" in top is mapped like this "foo_V_v<-bar", then we map
 "bar" to whatever "foo" is mapped to in the bottom map. We do this for all new
 types in the top map.
 
@@ -33,6 +34,7 @@
 
 def Combine(top, bottom):
     bottom.types.update(top.types)
+    bottom.typeattributes.update(top.typeattributes)
 
     for top_ta in top.typeattributesets:
         top_type_set = top.typeattributesets[top_ta]
@@ -43,6 +45,11 @@
         # Typeattributes in V.v.cil have _V_v suffix, but not in V.v.ignore.cil
         bottom_type = m.group(1) if m else top_ta
 
+        # If type doesn't exist in bottom map, no need to maintain mappings to
+        # that type.
+        if bottom_type not in bottom.rTypeattributesets.keys():
+            continue
+
         for bottom_ta in bottom.rTypeattributesets[bottom_type]:
             bottom.typeattributesets[bottom_ta].update(top_type_set)
 
diff --git a/tests/FcSort.py b/tests/fc_sort.py
similarity index 80%
rename from tests/FcSort.py
rename to tests/fc_sort.py
index 7cf1998..cbb0e5e 100755
--- a/tests/FcSort.py
+++ b/tests/fc_sort.py
@@ -1,6 +1,7 @@
 #!/usr/bin/env python
 import sys
 import os
+import argparse
 
 class FileContextsNode:
     path = None
@@ -11,7 +12,8 @@
     stemLen = None
     strLen = None
     Type = None
-    def __init__(self, path, fileType, context, meta, stemLen, strLen):
+    line = None
+    def __init__(self, path, fileType, context, meta, stemLen, strLen, line):
         self.path = path
         self.fileType = fileType
         self.context = context
@@ -19,6 +21,7 @@
         self.stemLen = stemLen
         self.strlen = strLen
         self.Type = context.split(":")[2]
+        self.line = line
 
 metaChars = frozenset(['.', '^', '$', '?', '*', '+', '|', '[', '(', '{'])
 escapedMetaChars = frozenset(['\.', '\^', '\$', '\?', '\*', '\+', '\|', '\[', '\(', '\{'])
@@ -65,7 +68,7 @@
     stemLen = getStemLen(path)
     strLen = len(path.replace("\\", ""))
 
-    return FileContextsNode(path, fileType, context, meta, stemLen, strLen)
+    return FileContextsNode(path, fileType, context, meta, stemLen, strLen, line)
 
 def ReadFileContexts(files):
     fc = []
@@ -118,8 +121,22 @@
 
     return Fc
 
-if __name__ == '__main__':
-    if len(sys.argv) < 2:
-        sys.exit("Usage: fc_sort.py <file_contexts 1> <file_contexts 2> <file_contexts 3>")
+def PrintFc(Fc, out):
+    if not out:
+        f = sys.stdout
+    else:
+        f = open(out, "w")
+    for node in Fc:
+        f.write(node.line + "\n")
 
-    FcSorted = FcSort(sys.argv[1:])
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description="SELinux file_contexts sorting tool.")
+    parser.add_argument("-i", dest="input", help="Path to the file_contexts file(s).", nargs="?", action='append')
+    parser.add_argument("-o", dest="output", help="Path to the output file", nargs=1)
+    args = parser.parse_args()
+    if not args.input:
+        parser.error("Must include path to policy")
+    if not not args.output:
+        args.output = args.output[0]
+
+    PrintFc(FcSort(args.input),args.output)
diff --git a/tests/policy.py b/tests/policy.py
index 90e387f..0f51e2f 100644
--- a/tests/policy.py
+++ b/tests/policy.py
@@ -3,7 +3,7 @@
 import os
 import sys
 import platform
-import FcSort
+import fc_sort
 
 ###
 # Check whether the regex will match a file path starting with the provided
@@ -413,7 +413,7 @@
                     self.__FcDict[t] = [rec[0]]
             except:
                 pass
-        self.__FcSorted = FcSort.FcSort(FcPaths)
+        self.__FcSorted = fc_sort.FcSort(FcPaths)
 
     # load policy
     def __InitPolicy(self, PolicyPath):
diff --git a/tests/treble_sepolicy_tests.py b/tests/treble_sepolicy_tests.py
index 0851d3b..cf1e856 100644
--- a/tests/treble_sepolicy_tests.py
+++ b/tests/treble_sepolicy_tests.py
@@ -244,8 +244,8 @@
         ret += "latest API level.\n"
         ret += " ".join(str(x) for x in sorted(violators)) + "\n\n"
         ret += "See examples of how to fix this:\n"
-        ret += "https://android-review.git.corp.google.com/c/platform/system/sepolicy/+/781036\n"
-        ret += "https://android-review.git.corp.google.com/c/platform/system/sepolicy/+/852612\n"
+        ret += "https://android-review.googlesource.com/c/platform/system/sepolicy/+/781036\n"
+        ret += "https://android-review.googlesource.com/c/platform/system/sepolicy/+/852612\n"
     return ret
 
 ###
@@ -270,7 +270,7 @@
         ret += "latest API level.\n"
         ret += " ".join(str(x) for x in sorted(violators)) + "\n\n"
         ret += "See examples of how to fix this:\n"
-        ret += "https://android-review.git.corp.google.com/c/platform/system/sepolicy/+/822743\n"
+        ret += "https://android-review.googlesource.com/c/platform/system/sepolicy/+/822743\n"
     return ret
 
 def TestTrebleCompatMapping():
diff --git a/tools/fc_sort/Android.bp b/tools/fc_sort/Android.bp
deleted file mode 100644
index d0a391b..0000000
--- a/tools/fc_sort/Android.bp
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright (C) 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-cc_binary_host {
-    name: "fc_sort",
-    srcs: ["fc_sort.c"],
-    stl: "none",
-    cflags: [
-        "-Wall",
-        "-Werror",
-    ],
-}
diff --git a/tools/fc_sort/MODULE_LICENSE_GPL b/tools/fc_sort/MODULE_LICENSE_GPL
deleted file mode 100644
index e69de29..0000000
--- a/tools/fc_sort/MODULE_LICENSE_GPL
+++ /dev/null
diff --git a/tools/fc_sort/NOTICE b/tools/fc_sort/NOTICE
deleted file mode 100644
index 5b6e7c6..0000000
--- a/tools/fc_sort/NOTICE
+++ /dev/null
@@ -1,340 +0,0 @@
-		    GNU GENERAL PUBLIC LICENSE
-		       Version 2, June 1991
-
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.
-                       59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-			    Preamble
-
-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Library General Public License instead.)  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-
-  To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
-
-  We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-
-  Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-
-  Finally, any free program is threatened constantly by software
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-		    GNU GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-  0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License.  The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language.  (Hereinafter, translation is included without limitation in
-the term "modification".)  Each licensee is addressed as "you".
-
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-
-  1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
-  2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-
-    a) You must cause the modified files to carry prominent notices
-    stating that you changed the files and the date of any change.
-
-    b) You must cause any work that you distribute or publish, that in
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
-
-    c) If the modified program normally reads commands interactively
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
-
-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-
-  3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
-    a) Accompany it with the complete corresponding machine-readable
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software interchange; or,
-
-    b) Accompany it with a written offer, valid for at least three
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
-
-    c) Accompany it with the information you received as to the offer
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-
-  4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License.  Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-
-  5. You are not required to accept this License, since you have not
-signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-
-  6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-
-  7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
-
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices.  Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-
-  8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded.  In such case, this License incorporates
-the limitation as if written in the body of this License.
-
-  9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-Each version is given a distinguishing version number.  If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation.  If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-
-  10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission.  For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this.  Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-
-			    NO WARRANTY
-
-  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-
-  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-
-		     END OF TERMS AND CONDITIONS
-
-	    How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-
-
-Also add information on how to contact you by electronic and paper mail.
-
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
-    Gnomovision version 69, Copyright (C) year name of author
-    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary.  Here is a sample; alter the names:
-
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-  `Gnomovision' (which makes passes at compilers) written by James Hacker.
-
-  <signature of Ty Coon>, 1 April 1989
-  Ty Coon, President of Vice
-
-This General Public License does not permit incorporating your program into
-proprietary programs.  If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Library General
-Public License instead of this License.
diff --git a/tools/fc_sort/README b/tools/fc_sort/README
deleted file mode 100644
index 0210dc7..0000000
--- a/tools/fc_sort/README
+++ /dev/null
@@ -1,9 +0,0 @@
-fc_sort is a tool used for sorting the file_contexts entries based on a heuristic that is
- covered by a Fedora document. That document can be found here:
- * https://fedoraproject.org/wiki/SELinux/ManagingFileContext
-
-The tool itself originates from:
- * https://github.com/TresysTechnology/refpolicy
-
-It can be updated to the current tip of master branch with the below command:
-$ wget https://raw.githubusercontent.com/TresysTechnology/refpolicy/master/support/fc_sort.c
diff --git a/tools/fc_sort/fc_sort.c b/tools/fc_sort/fc_sort.c
deleted file mode 100644
index c7a4c90..0000000
--- a/tools/fc_sort/fc_sort.c
+++ /dev/null
@@ -1,625 +0,0 @@
-/* Copyright 2005,2013 Tresys Technology
- *
- * Some parts of this came from matchpathcon.c in libselinux
- */
-
-/* PURPOSE OF THIS PROGRAM
- * The original setfiles sorting algorithm did not take into
- * account regular expression specificity. With the current
- * strict and targeted policies this is not an issue because
- * the file contexts are partially hand sorted and concatenated
- * in the right order so that the matches are generally correct.
- * The way reference policy and loadable policy modules handle
- * file contexts makes them come out in an unpredictable order
- * and therefore setfiles (or this standalone tool) need to sort
- * the regular expressions in a deterministic and stable way.
- */
-
-#define BUF_SIZE 4096;
-#define _GNU_SOURCE
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <ctype.h>
-
-typedef unsigned char bool_t;
-
-/* file_context_node
- * A node used in a linked list of file contexts.c
- * Each node contains the regular expression, the type and
- *  the context, as well as information about the regular
- *  expression. The regular expression data (meta, stem_len
- *  and str_len) can be filled in by using the fc_fill_data
- *  function after the regular expression has been loaded.
- * next points to the next node in the linked list.
- */
-typedef struct file_context_node {
-	char *path;
-	char *file_type;
-	char *context;
-	char *extra;
-	bool_t meta;
-	int stem_len;
-	int str_len;
-	struct file_context_node *next;
-} file_context_node_t;
-
-void file_context_node_destroy(file_context_node_t *x)
-{
-	if (!x)
-		return;
-
-	free(x->path);
-	free(x->file_type);
-	free(x->context);
-}
-
-
-
-/* file_context_bucket
- * A node used in a linked list of buckets that contain
- *  file_context_node's.
- * Each node contains a pointer to a file_context_node which
- *  is the header of its linked list. This linked list is the
- *  content of this bucket.
- * next points to the next bucket in the linked list.
- */
-typedef struct file_context_bucket {
-	file_context_node_t *data;
-	struct file_context_bucket *next;
-} file_context_bucket_t;
-
-
-
-/* fc_compare
- * Compares two file contexts' regular expressions and returns:
- *    -1 if a is less specific than b
- *     0 if a and be are equally specific
- *     1 if a is more specific than b
- * The comparison is based on the following statements,
- *  in order from most important to least important, given a and b:
- *     If a is a regular expression and b is not,
- *      -> a is less specific than b.
- *     If a's stem length is shorter than b's stem length,
- *      -> a is less specific than b.
- *     If a's string length is shorter than b's string length,
- *      -> a is less specific than b.
- *     If a does not have a specified type and b does,
- *      -> a is less specific than b.
- */
-int fc_compare(file_context_node_t *a, file_context_node_t *b)
-{
-	/* Check to see if either a or b have meta characters
-	 *  and the other doesn't. */
-	if (a->meta && !b->meta)
-		return -1;
-	if (b->meta && !a->meta)
-		return 1;
-
-	/* Check to see if either a or b have a shorter stem
-	 *  length than the other. */
-	if (a->stem_len < b->stem_len)
-		return -1;
-	if (b->stem_len < a->stem_len)
-		return 1;
-
-	/* Check to see if either a or b have a shorter string
-	 *  length than the other. */
-	if (a->str_len < b->str_len)
-		return -1;
-	if (b->str_len < a->str_len)
-		return 1;
-
-	/* Check to see if either a or b has a specified type
-	 *  and the other doesn't. */
-	if (!a->file_type && b->file_type)
-		return -1;
-	if (!b->file_type && a->file_type)
-		return 1;
-
-	/* If none of the above conditions were satisfied,
-	 * then a and b are equally specific. */
-	return 0;
-}
-
-
-
-/* fc_merge
- * Merges two sorted file context linked lists into one
- *  sorted one.
- * Pass two lists a and b, and after the completion of fc_merge,
- *  the final list is contained in a, and b is empty.
- */
-file_context_node_t *fc_merge(file_context_node_t *a,
-				   file_context_node_t *b)
-{
-	file_context_node_t *a_current;
-	file_context_node_t *b_current;
-	file_context_node_t *temp;
-	file_context_node_t *jumpto;
-
-	/* If a is a empty list, and b is not,
-	 *  set a as b and proceed to the end. */
-	if (!a && b)
-		a = b;
-	/* If b is an empty list, leave a as it is. */
-	else if (!b) {
-	} else {
-		/* Make it so the list a has the lesser
-		 *  first element always. */
-		if (fc_compare(a, b) == 1) {
-			temp = a;
-			a = b;
-			b = temp;
-		}
-		a_current = a;
-		b_current = b;
-
-		/* Merge by inserting b's nodes in between a's nodes. */
-		while (a_current->next && b_current) {
-			jumpto = a_current->next;
-
-			/* Insert b's nodes in between the current a node
-			 *  and the next a node.*/
-			while (b_current && a_current->next &&
-			       fc_compare(a_current->next,
-					  b_current) != -1) {
-
-				temp = a_current->next;
-				a_current->next = b_current;
-				b_current = b_current->next;
-				a_current->next->next = temp;
-				a_current = a_current->next;
-			}
-
-			/* Skip all the inserted node from b to the
-			 *  next node in the original a. */
-			a_current = jumpto;
-		}
-
-		/* if there is anything left in b to be inserted,
-		   put it on the end */
-		if (b_current) {
-			a_current->next = b_current;
-		}
-	}
-
-	return a;
-}
-
-
-
-/* fc_merge_sort
- * Sorts file contexts from least specific to more specific.
- * The bucket linked list is passed and after the completion
- *  of the fc_merge_sort function, there is only one bucket
- *  (pointed to by master) that contains a linked list
- *  of all the file contexts, in sorted order.
- * Explanation of the algorithm:
- *  The algorithm implemented in fc_merge_sort is an iterative
- *   implementation of merge sort.
- *  At first, each bucket has a linked list of file contexts
- *   that are 1 element each.
- *  Each pass, each odd numbered bucket is merged into the bucket
- *   before it. This halves the number of buckets each pass.
- *  It will continue passing over the buckets (as described above)
- *   until there is only  one bucket left, containing the list of
- *   file contexts, sorted.
- */
-void fc_merge_sort(file_context_bucket_t *master)
-{
-	file_context_bucket_t *current;
-	file_context_bucket_t *temp;
-
-	if (!master)
-		return;
-
-	/* Loop until master is the only bucket left
-	 * so that this will stop when master contains
-	 * the sorted list. */
-	while (master->next) {
-		current = master;
-
-		/* This loop merges buckets two-by-two. */
-		while (current) {
-			if (current->next) {
-				current->data =
-				    fc_merge(current->data,
-					     current->next->data);
-
-				temp = current->next;
-				current->next = current->next->next;
-
-				free(temp);
-			}
-
-			current = current->next;
-		}
-	}
-}
-
-
-
-/* fc_fill_data
- * This processes a regular expression in a file context
- *  and sets the data held in file_context_node, namely
- *  meta, str_len and stem_len.
- * The following changes are made to fc_node after the
- *  the completion of the function:
- *     fc_node->meta =		1 if path has a meta character, 0 if not.
- *     fc_node->str_len =	The string length of the entire path
- *     fc_node->stem_len = 	The number of characters up until
- *				 the first meta character.
- */
-void fc_fill_data(file_context_node_t *fc_node)
-{
-	int c = 0;
-
-	fc_node->meta = 0;
-	fc_node->stem_len = 0;
-	fc_node->str_len = 0;
-
-	/* Process until the string termination character
-	 *  has been reached.
-	 * Note: this while loop has been adapted from
-	 *  spec_hasMetaChars in matchpathcon.c from
-	 *  libselinux-1.22. */
-	while (fc_node->path[c] != '\0') {
-		switch (fc_node->path[c]) {
-		case '.':
-		case '^':
-		case '$':
-		case '?':
-		case '*':
-		case '+':
-		case '|':
-		case '[':
-		case '(':
-		case '{':
-			/* If a meta character is found,
-			 *  set meta to one */
-			fc_node->meta = 1;
-			break;
-		case '\\':
-			/* If a escape character is found,
-			 *  skip the next character. */
-			c++;
-			break;
-		default:
-			break;
-		}
-
-		/* If no meta character has been found yet,
-		 * add one to the stem length. */
-		if (!fc_node->meta)
-			fc_node->stem_len++;
-
-		fc_node->str_len++;
-		c++;
-	}
-}
-
-
-
-/* fc_free_file_context_node_list
- * Free the memory allocated to the linked list and its elements.
- */
-void fc_free_file_context_node_list(struct file_context_node *node)
-{
-	struct file_context_node *next;
-
-	while (node) {
-		next = node->next;
-		file_context_node_destroy(node);
-		free(node);
-		node = next;
-	}
-}
-
-
-
-/* main
- * This program takes in two arguments, the input filename and the
- *  output filename. The input file should be syntactically correct.
- * Overall what is done in the main is read in the file and store each
- *  line of code, sort it, then output it to the output file.
- */
-int main(int argc, char *argv[])
-{
-	int lines;
-	size_t start, finish, regex_len, context_len;
-	size_t line_len, buf_len, i;
-	char *input_name, *output_name, *line_buf;
-
-	file_context_node_t *temp;
-	file_context_node_t *head;
-	file_context_node_t *current;
-	file_context_bucket_t *master;
-	file_context_bucket_t *bcurrent;
-
-	FILE *in_file, *out_file;
-
-	/* Check for the correct number of command line arguments. */
-	if (argc < 2 || argc > 3) {
-		fprintf(stderr, "Usage: %s <infile> [<outfile>]\n",argv[0]);
-		return 1;
-	}
-
-	input_name = argv[1];
-	output_name = (argc >= 3) ? argv[2] : NULL;
-
-	lines = 0;
-
-	/* Open the input file. */
-	if (!(in_file = fopen(input_name, "r"))) {
-		fprintf(stderr, "Error: failure opening input file for read.\n");
-		return 1;
-	}
-
-	/* Initialize the head of the linked list. */
-	head = current = (file_context_node_t*)calloc(1, sizeof(file_context_node_t));
-	if (!head) {
-		fprintf(stderr, "Error: failure allocating memory.\n");
-		return 1;
-	}
-
-	/* Parse the file into a file_context linked list. */
-	line_buf = NULL;
-
-	while ( getline(&line_buf, &buf_len, in_file) != -1 ){
-		line_len = strlen(line_buf);
-
-		if( line_len == 0 || line_len == 1)
-			continue;
-
-		/* Get rid of whitespace from the front of the line. */
-		for (i = 0; i < line_len; i++) {
-			if (!isspace(line_buf[i]))
-				break;
-		}
-
-		if (i >= line_len)
-			continue;
-
-		/* Check if the line isn't empty and isn't a comment */
-		if (line_buf[i] == '#')
-			continue;
-
-		/* We have a valid line - allocate a new node. */
-		temp = (file_context_node_t *)calloc(1, sizeof(file_context_node_t));
-		if (!temp) {
-			free(line_buf);
-			fprintf(stderr, "Error: failure allocating memory.\n");
-			fc_free_file_context_node_list(head);
-			return 1;
-		}
-
-		/* Parse out the regular expression from the line. */
-		start = i;
-
-		while (i < line_len && (!isspace(line_buf[i])))
-			i++;
-		finish = i;
-
-		regex_len = finish - start;
-
-		if (regex_len == 0) {
-			file_context_node_destroy(temp);
-			free(temp);
-			continue;
-		}
-
-		temp->path = (char*)strndup(&line_buf[start], regex_len);
-		if (!temp->path) {
-			file_context_node_destroy(temp);
-			free(temp);
-			free(line_buf);
-			fprintf(stderr, "Error: failure allocating memory.\n");
-			fc_free_file_context_node_list(head);
-			return 1;
-		}
-
-		/* Get rid of whitespace after the regular expression. */
-		for (; i < line_len; i++) {
-			if (!isspace(line_buf[i]))
-				break;
-		}
-
-		if (i == line_len) {
-			file_context_node_destroy(temp);
-			free(temp);
-			continue;
-		}
-
-		/* Parse out the type from the line (if it
-		 * is there). */
-		if (line_buf[i] == '-') {
-			temp->file_type = (char *)malloc(sizeof(char) * 3);
-			if (!(temp->file_type)) {
-				file_context_node_destroy(temp);
-				free(temp);
-				free(line_buf);
-				fprintf(stderr, "Error: failure allocating memory.\n");
-				fc_free_file_context_node_list(head);
-				return 1;
-			}
-
-			if( i + 2 >= line_len ) {
-				file_context_node_destroy(temp);
-				free(temp);
-				continue;
-			}
-
-			/* Fill the type into the array. */
-			temp->file_type[0] = line_buf[i];
-			temp->file_type[1] = line_buf[i + 1];
-			i += 2;
-			temp->file_type[2] = 0;
-
-			/* Get rid of whitespace after the type. */
-			for (; i < line_len; i++) {
-				if (!isspace(line_buf[i]))
-					break;
-			}
-
-			if (i == line_len) {
-				file_context_node_destroy(temp);
-				free(temp);
-				continue;
-			}
-		}
-
-		/* Parse out the context from the line. */
-		start = i;
-		while (i < line_len && (!isspace(line_buf[i])))
-			i++;
-		finish = i;
-
-		context_len = finish - start;
-
-		temp->context = (char*)strndup(&line_buf[start], context_len);
-		if (!temp->context) {
-			file_context_node_destroy(temp);
-			free(temp);
-			free(line_buf);
-			fprintf(stderr, "Error: failure allocating memory.\n");
-			fc_free_file_context_node_list(head);
-			return 1;
-		}
-
-		/* Get rid of whitespace after the context. */
-		for (; i < line_len; i++) {
-			if (!isspace(line_buf[i]))
-				break;
-		}
-
-		/* Parse out the extra from the line. */
-		start = i;
-		finish = line_len;
-		while (start < finish && (!isspace(line_buf[i - 1])))
-			finish--;
-
-		if (start < finish && line_buf[start] != '#') {
-			temp->extra = (char*)strndup(&line_buf[start], finish - start);
-			if (!(temp->extra)) {
-				file_context_node_destroy(temp);
-				free(temp);
-				free(line_buf);
-				fprintf(stderr, "Error: failure allocating memory.\n");
-				fc_free_file_context_node_list(head);
-				return 1;
-			}
-		}
-
-		/* Set all the data about the regular
-		 * expression. */
-		fc_fill_data(temp);
-
-		/* Link this line of code at the end of
-		 * the linked list. */
-		current->next = temp;
-		current = current->next;
-		lines++;
-	}
-	free(line_buf);
-	fclose(in_file);
-
-	/* Create the bucket linked list from the earlier linked list. */
-	current = head->next;
-	bcurrent = master =
-	    (file_context_bucket_t *)
-	    malloc(sizeof(file_context_bucket_t));
-	if (!bcurrent) {
-		printf
-		    ("Error: failure allocating memory.\n");
-		fc_free_file_context_node_list(head);
-		return -1;
-	}
-	bcurrent->next = NULL;
-	bcurrent->data = NULL;
-
-	/* Go until all the nodes have been put in individual buckets. */
-	while (current) {
-		/* Copy over the file context line into the bucket. */
-		bcurrent->data = current;
-		current = current->next;
-
-		/* Detach the node in the bucket from the old list. */
-		bcurrent->data->next = NULL;
-
-		/* If there should be another bucket, put one at the end. */
-		if (current) {
-			bcurrent->next =
-			    (file_context_bucket_t *)
-			    malloc(sizeof(file_context_bucket_t));
-			if (!(bcurrent->next)) {
-				printf
-				    ("Error: failure allocating memory.\n");
-				free(head);
-				fc_free_file_context_node_list(current);
-				fc_merge_sort(master);
-				fc_free_file_context_node_list(master->data);
-				free(master);
-				return -1;
-			}
-
-			/* Make sure the new bucket thinks it's the end of the
-			 * list. */
-			bcurrent->next->next = NULL;
-
-			bcurrent = bcurrent->next;
-		}
-	}
-
-	/* Sort the bucket list. */
-	fc_merge_sort(master);
-
-	free(head);
-
-	/* Open the output file. */
-	if (output_name) {
-		if (!(out_file = fopen(output_name, "w"))) {
-			printf("Error: failure opening output file for write.\n");
-			fc_free_file_context_node_list(master->data);
-			free(master);
-			return -1;
-		}
-	} else {
-		out_file = stdout;
-	}
-
-	/* Output the sorted file_context linked list to the output file. */
-	current = master->data;
-
-	while (current) {
-		/* Output the path. */
-		fprintf(out_file, "%s\t\t", current->path);
-
-		/* Output the type, if there is one. */
-		if (current->file_type) {
-			fprintf(out_file, "%s\t", current->file_type);
-		}
-
-		/* Output the context. */
-		fprintf(out_file, "%s", current->context);
-
-		/* Output the extra, if there is one. */
-		if (current->extra) {
-			fprintf(out_file, "\t%s", current->extra);
-		}
-
-		fprintf(out_file, "\n");
-
-		current = current->next;
-	}
-
-	fc_free_file_context_node_list(master->data);
-	free(master);
-
-	if (output_name) {
-		fclose(out_file);
-	}
-
-	return 0;
-}
diff --git a/tools/sepolicy-analyze/Android.bp b/tools/sepolicy-analyze/Android.bp
new file mode 100644
index 0000000..ff40c16
--- /dev/null
+++ b/tools/sepolicy-analyze/Android.bp
@@ -0,0 +1,15 @@
+cc_binary_host {
+    name: "sepolicy-analyze",
+    defaults: ["sepolicy_tools_defaults"],
+
+    srcs: [
+        "sepolicy-analyze.c",
+        "dups.c",
+        "neverallow.c",
+        "perm.c",
+        "typecmp.c",
+        "booleans.c",
+        "attribute.c",
+        "utils.c",
+    ],
+}
diff --git a/tools/sepolicy-analyze/Android.mk b/tools/sepolicy-analyze/Android.mk
deleted file mode 100644
index 56204a5..0000000
--- a/tools/sepolicy-analyze/Android.mk
+++ /dev/null
@@ -1,15 +0,0 @@
-LOCAL_PATH:= $(call my-dir)
-
-###################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := sepolicy-analyze
-LOCAL_MODULE_TAGS := optional
-LOCAL_CFLAGS := -Wall -Werror
-LOCAL_SRC_FILES := sepolicy-analyze.c dups.c neverallow.c perm.c typecmp.c booleans.c attribute.c utils.c
-LOCAL_STATIC_LIBRARIES := libsepol
-LOCAL_CXX_STL := none
-
-LOCAL_COMPATIBILITY_SUITE := ats cts gts vts sts
-
-include $(BUILD_HOST_EXECUTABLE)
diff --git a/tools/sepolicy-analyze/neverallow.c b/tools/sepolicy-analyze/neverallow.c
index 0209678..a55a921 100644
--- a/tools/sepolicy-analyze/neverallow.c
+++ b/tools/sepolicy-analyze/neverallow.c
@@ -378,7 +378,7 @@
 {
     const char *keyword = "neverallow";
     size_t keyword_size = strlen(keyword), len;
-    struct avrule *neverallows = NULL, *avrule;
+    struct avrule *neverallows = NULL, *avrule = NULL;
     char *p, *start;
     int result;
 
diff --git a/tools/sepolicy-analyze/sepolicy-analyze.c b/tools/sepolicy-analyze/sepolicy-analyze.c
index b4571a6..1b7bcdb 100644
--- a/tools/sepolicy-analyze/sepolicy-analyze.c
+++ b/tools/sepolicy-analyze/sepolicy-analyze.c
@@ -50,7 +50,7 @@
     if (argc < 3)
         usage(argv[0]);
     policy = argv[1];
-    if(load_policy(policy, &policydb, &pf))
+    if(!load_policy(policy, &policydb, &pf))
         exit(1);
     for(i = 0; i < NUM_COMPONENTS; i++) {
         if (!strcmp(analyze_components[i].key, argv[2])) {
diff --git a/tools/sepolicy-analyze/utils.c b/tools/sepolicy-analyze/utils.c
index 5e52f59..af93f71 100644
--- a/tools/sepolicy-analyze/utils.c
+++ b/tools/sepolicy-analyze/utils.c
@@ -22,28 +22,26 @@
            (policydb, key->target_class, perms));
 }
 
-int load_policy(char *filename, policydb_t * policydb, struct policy_file *pf)
+bool load_policy(char *filename, policydb_t * policydb, struct policy_file *pf)
 {
-    int fd;
+    int fd = -1;
     struct stat sb;
-    void *map;
-    int ret;
+    void *map = MAP_FAILED;
+    bool ret = false;
 
     fd = open(filename, O_RDONLY);
     if (fd < 0) {
         fprintf(stderr, "Can't open '%s':  %s\n", filename, strerror(errno));
-        return 1;
+        goto cleanup;
     }
     if (fstat(fd, &sb) < 0) {
         fprintf(stderr, "Can't stat '%s':  %s\n", filename, strerror(errno));
-        close(fd);
-        return 1;
+        goto cleanup;
     }
     map = mmap(NULL, sb.st_size, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
     if (map == MAP_FAILED) {
         fprintf(stderr, "Can't mmap '%s':  %s\n", filename, strerror(errno));
-        close(fd);
-        return 1;
+        goto cleanup;
     }
 
     policy_file_init(pf);
@@ -52,17 +50,21 @@
     pf->len = sb.st_size;
     if (policydb_init(policydb)) {
         fprintf(stderr, "Could not initialize policydb!\n");
-        close(fd);
-        munmap(map, sb.st_size);
-        return 1;
+        goto cleanup;
     }
-    ret = policydb_read(policydb, pf, 0);
-    if (ret) {
+    if (policydb_read(policydb, pf, 0)) {
         fprintf(stderr, "error(s) encountered while parsing configuration\n");
-        close(fd);
-        munmap(map, sb.st_size);
-        return 1;
+        goto cleanup;
     }
 
-    return 0;
+    ret = true;
+
+cleanup:
+    if (map != MAP_FAILED) {
+        munmap(map, sb.st_size);
+    }
+    if (fd >= 0) {
+        close(fd);
+    }
+    return ret;
 }
diff --git a/tools/sepolicy-analyze/utils.h b/tools/sepolicy-analyze/utils.h
index 83f5a78..cef6ca3 100644
--- a/tools/sepolicy-analyze/utils.h
+++ b/tools/sepolicy-analyze/utils.h
@@ -11,6 +11,6 @@
 
 void display_allow(policydb_t *policydb, avtab_key_t *key, int idx, uint32_t perms);
 
-int load_policy(char *filename, policydb_t * policydb, struct policy_file *pf);
+bool load_policy(char *filename, policydb_t * policydb, struct policy_file *pf);
 
 #endif /* UTILS_H */
diff --git a/tools/version_policy.c b/tools/version_policy.c
index 8848190..8bb422a 100644
--- a/tools/version_policy.c
+++ b/tools/version_policy.c
@@ -65,14 +65,15 @@
 	rc = cil_add_file(*db, path, buff, file_size);
 	if (rc != SEPOL_OK) {
 		fprintf(stderr, "Failure adding %s to parse tree\n", path);
-		goto err;
+		goto parse_err;
 	}
 	free(buff);
 
 	return SEPOL_OK;
 err:
-	free(buff);
 	fclose(file);
+parse_err:
+	free(buff);
 file_err:
 	cil_db_destroy(db);
 	return rc;
diff --git a/treble_sepolicy_tests_for_release.mk b/treble_sepolicy_tests_for_release.mk
index e32b8f4..0195e5f 100644
--- a/treble_sepolicy_tests_for_release.mk
+++ b/treble_sepolicy_tests_for_release.mk
@@ -5,8 +5,8 @@
 # permissions granted do not violate the treble model.  Also ensure that treble
 # compatibility guarantees are upheld between SELinux version bumps.
 LOCAL_MODULE := treble_sepolicy_tests_$(version)
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := tests
+LOCAL_MODULE_CLASS := FAKE
+LOCAL_MODULE_TAGS := optional
 
 include $(BUILD_SYSTEM)/base_rules.mk
 
@@ -16,6 +16,7 @@
 # been maintained by our mapping files.
 $(version)_PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/public
 $(version)_PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/prebuilts/api/$(version)/private
+policy_files := $(call build_policy, $(sepolicy_build_files), $($(version)_PLAT_PUBLIC_POLICY) $($(version)_PLAT_PRIVATE_POLICY))
 $(version)_plat_policy.conf := $(intermediates)/$(version)_plat_policy.conf
 $($(version)_plat_policy.conf): PRIVATE_MLS_SENS := $(MLS_SENS)
 $($(version)_plat_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
@@ -25,11 +26,12 @@
 $($(version)_plat_policy.conf): PRIVATE_TGT_WITH_NATIVE_COVERAGE := $(with_native_coverage)
 $($(version)_plat_policy.conf): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
 $($(version)_plat_policy.conf): PRIVATE_SEPOLICY_SPLIT := true
-$($(version)_plat_policy.conf): $(call build_policy, $(sepolicy_build_files), \
-$($(version)_PLAT_PUBLIC_POLICY) $($(version)_PLAT_PRIVATE_POLICY))
+$($(version)_plat_policy.conf): PRIVATE_POLICY_FILES := $(policy_files)
+$($(version)_plat_policy.conf): $(policy_files) $(M4)
 	$(transform-policy-to-conf)
 	$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
 
+policy_files :=
 
 built_$(version)_plat_sepolicy := $(intermediates)/built_$(version)_plat_sepolicy
 $(built_$(version)_plat_sepolicy): PRIVATE_ADDITIONAL_CIL_FILES := \
@@ -52,7 +54,7 @@
 # targeting the $(version) SELinux release.  This ensures that our policy will build
 # when used on a device that has non-platform policy targetting the $(version) release.
 $(version)_compat := $(intermediates)/$(version)_compat
-$(version)_mapping.cil := $(call intermediates-dir-for,ETC,$(version).cil)/$(version).cil
+$(version)_mapping.cil := $(call intermediates-dir-for,ETC,plat_$(version).cil)/plat_$(version).cil
 $(version)_mapping.ignore.cil := \
     $(call intermediates-dir-for,ETC,$(version).ignore.cil)/$(version).ignore.cil
 $(version)_prebuilts_dir := $(LOCAL_PATH)/prebuilts/api/$(version)
@@ -81,29 +83,18 @@
 	mkdir -p $(dir $@)
 	cat $^ > $@
 
-treble_sepolicy_tests_$(version) := $(intermediates)/treble_sepolicy_tests_$(version)
-$(treble_sepolicy_tests_$(version)): ALL_FC_ARGS := $(all_fc_args)
-$(treble_sepolicy_tests_$(version)): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(treble_sepolicy_tests_$(version)): PRIVATE_SEPOLICY_OLD := $(built_$(version)_plat_sepolicy)
-$(treble_sepolicy_tests_$(version)): PRIVATE_COMBINED_MAPPING := $($(version)_mapping.combined.cil)
-$(treble_sepolicy_tests_$(version)): PRIVATE_PLAT_SEPOLICY := $(built_plat_sepolicy)
-$(treble_sepolicy_tests_$(version)): PRIVATE_PLAT_PUB_SEPOLICY := $(base_plat_pub_policy.cil)
-$(treble_sepolicy_tests_$(version)): PRIVATE_FAKE_TREBLE :=
+$(LOCAL_BUILT_MODULE): ALL_FC_ARGS := $(all_fc_args)
+$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
+$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_OLD := $(built_$(version)_plat_sepolicy)
+$(LOCAL_BUILT_MODULE): PRIVATE_COMBINED_MAPPING := $($(version)_mapping.combined.cil)
+$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_SEPOLICY := $(built_plat_sepolicy)
+$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_PUB_SEPOLICY := $(base_plat_pub_policy.cil)
+$(LOCAL_BUILT_MODULE): PRIVATE_FAKE_TREBLE :=
 ifeq ($(PRODUCT_FULL_TREBLE_OVERRIDE),true)
-# TODO(b/113124961): account for PRODUCT_SHIPPING_API_LEVEL when determining
-# fake treble status once emulator is no longer fake treble.
-#ifdef PRODUCT_SHIPPING_API_LEVEL
-# These requirements were originally added in Android Oreo. Devices
-# launching after this should not distinguish between
-# PRODUCT_FULL_TREBLE and PRODUCT_FULL_TREBLE_OVERRIDE since this could
-# lead to release problems where they think they pass this test but
-# fail it when it actually gets runned for compliance.
-#ifeq ($(call math_gt_or_eq,$(PRODUCT_SHIPPING_API_LEVEL),26),)
-$(treble_sepolicy_tests_$(version)): PRIVATE_FAKE_TREBLE := --fake-treble
-#endif # if PRODUCT_SHIPPING_API_LEVEL < 26 (Android Oreo)
-#endif # PRODUCT_SHIPPING_API_LEVEL defined
+# TODO(b/113124961): remove fake-treble
+$(LOCAL_BUILT_MODULE): PRIVATE_FAKE_TREBLE := --fake-treble
 endif # PRODUCT_FULL_TREBLE_OVERRIDE = true
-$(treble_sepolicy_tests_$(version)): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \
+$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \
   $(all_fc_files) $(built_sepolicy) $(built_plat_sepolicy) \
   $(base_plat_pub_policy.cil) \
   $(built_$(version)_plat_sepolicy) $($(version)_compat) $($(version)_mapping.combined.cil)
diff --git a/vendor/file_contexts b/vendor/file_contexts
index 9da79f4..4e988a9 100644
--- a/vendor/file_contexts
+++ b/vendor/file_contexts
@@ -2,14 +2,16 @@
 # Default HALs
 #
 /(vendor|system/vendor)/bin/hw/android\.hardware\.atrace@1\.0-service         u:object_r:hal_atrace_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.audio@2\.0-service          u:object_r:hal_audio_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.audio(@2\.0-|\.)service     u:object_r:hal_audio_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.audiocontrol@1\.0-service  u:object_r:hal_audiocontrol_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.evs@1\.0-service  u:object_r:hal_evs_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.vehicle@2\.0-service  u:object_r:hal_vehicle_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.0-service      u:object_r:hal_bluetooth_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.0-service\.btlinux    u:object_r:hal_bluetooth_btlinux_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.can@1\.0-service  u:object_r:hal_can_socketcan_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.evs@1\.[0-9]-service  u:object_r:hal_evs_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.vehicle@2\.0-(service|protocan-service)  u:object_r:hal_vehicle_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.[0-9]+-service      u:object_r:hal_bluetooth_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.[0-9]+-service\.btlinux    u:object_r:hal_bluetooth_btlinux_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service u:object_r:hal_fingerprint_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.boot@1\.0-service           u:object_r:hal_bootctl_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.face@1\.1-service\.example u:object_r:hal_face_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.boot@1\.[0-9]+-service      u:object_r:hal_bootctl_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.broadcastradio@\d+\.\d+-service u:object_r:hal_broadcastradio_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-service_64       u:object_r:hal_camera_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-service          u:object_r:hal_camera_default_exec:s0
@@ -18,24 +20,28 @@
 /(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-external-service          u:object_r:hal_camera_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.configstore@1\.[0-9]+-service    u:object_r:hal_configstore_default_exec:s0
 /(vendor|sustem/vendor)/bin/hw/android\.hardware\.confirmationui@1\.0-service u:object_r:hal_confirmationui_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.contexthub@1\.0-service     u:object_r:hal_contexthub_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.contexthub@1\.[0-9]+-service     u:object_r:hal_contexthub_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.drm@1\.0-service            u:object_r:hal_drm_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.drm@1\.0-service-lazy       u:object_r:hal_drm_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.cas@1\.[01]-service            u:object_r:hal_cas_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.cas@1\.[01]-service-lazy       u:object_r:hal_cas_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.dumpstate@1\.0-service      u:object_r:hal_dumpstate_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.cas@1\.[0-2]-service            u:object_r:hal_cas_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.cas@1\.[0-2]-service-lazy       u:object_r:hal_cas_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.dumpstate@1\.0-service\.example      u:object_r:hal_dumpstate_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.gatekeeper@1\.0-service     u:object_r:hal_gatekeeper_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.gnss@[0-9]\.[0-9]-service   u:object_r:hal_gnss_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.allocator@2\.0-service   u:object_r:hal_graphics_allocator_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.allocator@3\.0-service   u:object_r:hal_graphics_allocator_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.allocator@4\.0-service   u:object_r:hal_graphics_allocator_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.graphics\.composer@[0-9]\.[0-9]-service    u:object_r:hal_graphics_composer_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.health@1\.0-service         u:object_r:hal_health_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.health@2\.0-service         u:object_r:hal_health_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.health@2\.1-service         u:object_r:hal_health_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.health\.storage@1\.0-service       u:object_r:hal_health_storage_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.identity-service.example u:object_r:hal_identity_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.input\.classifier@1\.0-service     u:object_r:hal_input_classifier_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.ir@1\.0-service             u:object_r:hal_ir_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@3\.0-service      u:object_r:hal_keymaster_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@4\.0-service      u:object_r:hal_keymaster_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@4\.1-service      u:object_r:hal_keymaster_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.light@2\.0-service          u:object_r:hal_light_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.light@2\.0-service-lazy     u:object_r:hal_light_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.lowpan@1\.0-service         u:object_r:hal_lowpan_default_exec:s0
@@ -45,20 +51,24 @@
 /(vendor|system/vendor)/bin/hw/android\.hardware\.nfc@1\.2-service            u:object_r:hal_nfc_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.media\.omx@1\.0-service            u:object_r:mediacodec_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.power@1\.0-service          u:object_r:hal_power_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.power-service.example       u:object_r:hal_power_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.power\.stats@1\.0-service   u:object_r:hal_power_stats_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.radio\.config@1\.0-service  u:object_r:hal_radio_config_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.radio@1\.2-radio-service    u:object_r:hal_radio_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.radio@1\.2-sap-service    u:object_r:hal_radio_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.sensors@[0-9]\.[0-9]-service  u:object_r:hal_sensors_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.rebootescrow-service\.default    u:object_r:hal_rebootescrow_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.sensors@[0-9]\.[0-9]-service(\.multihal)?  u:object_r:hal_sensors_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.secure_element@1\.0-service u:object_r:hal_secure_element_default_exec:s0
 /(vendor|system/vendor)/bin/hw/rild                                           u:object_r:rild_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.thermal@1\.[01]-service        u:object_r:hal_thermal_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.cec@1\.0-service        u:object_r:hal_tv_cec_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.input@1\.0-service      u:object_r:hal_tv_input_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.tuner@1\.0-service        u:object_r:hal_tv_tuner_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.usb@1\.0-service            u:object_r:hal_usb_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.usb\.gadget@1\.1-service    u:object_r:hal_usb_gadget_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.vibrator@1\.0-service       u:object_r:hal_vibrator_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.vibrator-service.example    u:object_r:hal_vibrator_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.vr@1\.0-service             u:object_r:hal_vr_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.wifi\.offload@1\.0-service  u:object_r:hal_wifi_offload_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.wifi@1\.0-service           u:object_r:hal_wifi_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.wifi@1\.0-service-lazy      u:object_r:hal_wifi_default_exec:s0
 /(vendor|system/vendor)/bin/hw/hostapd                                        u:object_r:hal_wifi_hostapd_default_exec:s0
@@ -69,11 +79,19 @@
 # Same process HALs installed by platform into /vendor
 #
 /(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@2\.0-impl\.so u:object_r:same_process_hal_file:s0
+/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@2\.0-impl-2\.1\.so u:object_r:same_process_hal_file:s0
 /(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@3\.0-impl\.so u:object_r:same_process_hal_file:s0
+/(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.graphics\.mapper@4\.0-impl\.so u:object_r:same_process_hal_file:s0
 /(vendor|system/vendor)/lib(64)?/hw/android\.hardware\.renderscript@1\.0-impl\.so     u:object_r:same_process_hal_file:s0
 /(vendor|system/vendor)/lib(64)?/hw/gralloc\.default\.so                              u:object_r:same_process_hal_file:s0
 
 #############################
+# Libraries removed from vndk-sp (must still be accessible by passthrough HALs using them)
+#
+/(vendor|system/vendor)/lib(64)?/libhwbinder.so u:object_r:same_process_hal_file:s0
+/(vendor|system/vendor)/lib(64)?/libhidltransport.so u:object_r:same_process_hal_file:s0
+
+#############################
 # Data files
 #
 /data/vendor/wifi/hostapd(/.*)?                                               u:object_r:hostapd_data_file:s0
diff --git a/vendor/hal_bootctl_default.te b/vendor/hal_bootctl_default.te
index ca30e58..ac30370 100644
--- a/vendor/hal_bootctl_default.te
+++ b/vendor/hal_bootctl_default.te
@@ -4,3 +4,16 @@
 
 type hal_bootctl_default_exec, exec_type, vendor_file_type, file_type;
 init_daemon_domain(hal_bootctl_default)
+
+# Needed for ReadDefaultFstab.
+allow hal_bootctl_default proc_cmdline:file r_file_perms;
+allow hal_bootctl_default sysfs_dt_firmware_android:dir search;
+allow hal_bootctl_default sysfs_dt_firmware_android:file r_file_perms;
+
+# ReadDefaultFstab looks for /metadata/gsi/booted. We don't care about getting
+# a GSI-corrected fstab.
+dontaudit hal_bootctl_default metadata_file:dir search;
+
+# Needed for reading/writing misc partition.
+allow hal_bootctl_default block_device:dir search;
+allow hal_bootctl_default misc_block_device:blk_file rw_file_perms;
diff --git a/vendor/hal_can_socketcan.te b/vendor/hal_can_socketcan.te
new file mode 100644
index 0000000..afa1311
--- /dev/null
+++ b/vendor/hal_can_socketcan.te
@@ -0,0 +1,36 @@
+type hal_can_socketcan, domain;
+hal_server_domain(hal_can_socketcan, hal_can_controller)
+hal_server_domain(hal_can_socketcan, hal_can_bus)
+
+type hal_can_socketcan_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_can_socketcan)
+
+# Managing SocketCAN interfaces
+allow hal_can_socketcan self:capability net_admin;
+allow hal_can_socketcan self:netlink_route_socket { create bind write nlmsg_write read };
+
+# Calling if_nametoindex(3) to open CAN sockets
+allow hal_can_socketcan self:udp_socket { create ioctl };
+allowxperm hal_can_socketcan self:udp_socket ioctl {
+    SIOCGIFINDEX
+};
+
+# Communicating with SocketCAN interfaces and bringing them up/down
+allow hal_can_socketcan self:can_socket { bind create read write ioctl setopt };
+allowxperm hal_can_socketcan self:can_socket ioctl {
+    SIOCGIFFLAGS
+    SIOCSIFFLAGS
+};
+
+# Un-publishing ICanBus interfaces
+allow hal_can_socketcan hidl_manager_hwservice:hwservice_manager find;
+
+allow hal_can_socketcan usb_serial_device:chr_file { ioctl read write open };
+allowxperm hal_can_socketcan usb_serial_device:chr_file ioctl {
+    TCGETS
+    TCSETSW
+    TIOCGSERIAL
+    TIOCSSERIAL
+    TIOCSETD
+    SIOCGIFNAME
+};
diff --git a/vendor/hal_drm_default.te b/vendor/hal_drm_default.te
index f81f398..cf8d894 100644
--- a/vendor/hal_drm_default.te
+++ b/vendor/hal_drm_default.te
@@ -6,6 +6,5 @@
 
 allow hal_drm_default hal_codec2_server:fd use;
 allow hal_drm_default hal_omx_server:fd use;
-allow hal_drm_default { appdomain -isolated_app }:fd use;
 
 allow hal_drm_default hal_allocator_server:fd use;
diff --git a/vendor/hal_evs_default.te b/vendor/hal_evs_default.te
index b927f1e..57a0299 100644
--- a/vendor/hal_evs_default.te
+++ b/vendor/hal_evs_default.te
@@ -6,5 +6,10 @@
 type hal_evs_default_exec, exec_type, vendor_file_type, file_type;
 init_daemon_domain(hal_evs_default)
 
-allow hal_evs_default hal_graphics_allocator_default:fd use;
+allow hal_evs_default hal_graphics_allocator_server:fd use;
 
+# allow to use surface flinger
+allow hal_evs_default automotive_display_service_server:fd use;
+
+# allow to use automotive display service
+allow hal_evs_default fwk_automotive_display_hwservice:hwservice_manager find;
diff --git a/vendor/hal_identity_default.te b/vendor/hal_identity_default.te
new file mode 100644
index 0000000..7f84687
--- /dev/null
+++ b/vendor/hal_identity_default.te
@@ -0,0 +1,5 @@
+type hal_identity_default, domain;
+hal_server_domain(hal_identity_default, hal_identity)
+
+type hal_identity_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_identity_default)
diff --git a/vendor/hal_rebootescrow_default.te b/vendor/hal_rebootescrow_default.te
new file mode 100644
index 0000000..2625693
--- /dev/null
+++ b/vendor/hal_rebootescrow_default.te
@@ -0,0 +1,10 @@
+type hal_rebootescrow_default, domain;
+hal_server_domain(hal_rebootescrow_default, hal_rebootescrow)
+get_prop(hal_rebootescrow_default, rebootescrow_hal_prop);
+
+type hal_rebootescrow_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_rebootescrow_default)
+
+type rebootescrow_device, dev_type;
+allow hal_rebootescrow_default rebootescrow_device:{ chr_file blk_file } rw_file_perms;
+allow hal_rebootescrow_default block_device:dir search;
diff --git a/vendor/hal_sensors_default.te b/vendor/hal_sensors_default.te
index 172e686..f00b25a 100644
--- a/vendor/hal_sensors_default.te
+++ b/vendor/hal_sensors_default.te
@@ -17,3 +17,6 @@
 # allow sensor hal to use lock for keeping system awake for wake up
 # events delivery.
 wakelock_use(hal_sensors_default);
+
+# allow sensor hal to use ashmem fd from system_server.
+allow hal_sensors_default system_server:fd use;
diff --git a/vendor/hal_tv_tuner_default.te b/vendor/hal_tv_tuner_default.te
new file mode 100644
index 0000000..d5b8f57
--- /dev/null
+++ b/vendor/hal_tv_tuner_default.te
@@ -0,0 +1,5 @@
+type hal_tv_tuner_default, domain;
+hal_server_domain(hal_tv_tuner_default, hal_tv_tuner)
+
+type hal_tv_tuner_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_tv_tuner_default)
diff --git a/vendor/hal_usb_gadget_default.te b/vendor/hal_usb_gadget_default.te
new file mode 100644
index 0000000..f1486b9
--- /dev/null
+++ b/vendor/hal_usb_gadget_default.te
@@ -0,0 +1,5 @@
+type hal_usb_gadget_default, domain;
+hal_server_domain(hal_usb_gadget_default, hal_usb_gadget)
+
+type hal_usb_gadget_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_usb_gadget_default)
diff --git a/vendor/hal_vehicle_default.te b/vendor/hal_vehicle_default.te
index e605ecb..dcb03a8 100644
--- a/vendor/hal_vehicle_default.te
+++ b/vendor/hal_vehicle_default.te
@@ -5,3 +5,8 @@
 # may be started by init
 type hal_vehicle_default_exec, exec_type, vendor_file_type, file_type;
 init_daemon_domain(hal_vehicle_default)
+
+# communication with CAN bus HAL
+allow hal_vehicle_default hal_can_bus_hwservice:hwservice_manager find;
+allow hal_vehicle_default hal_can_socketcan:binder { call transfer };
+allow hal_can_socketcan hal_vehicle_default:binder { call transfer };
diff --git a/vendor/hal_wifi_offload_default.te b/vendor/hal_wifi_offload_default.te
deleted file mode 100644
index 44bd306..0000000
--- a/vendor/hal_wifi_offload_default.te
+++ /dev/null
@@ -1,5 +0,0 @@
-type hal_wifi_offload_default, domain;
-hal_server_domain(hal_wifi_offload_default, hal_wifi_offload)
-
-type hal_wifi_offload_default_exec, exec_type, vendor_file_type, file_type;
-init_daemon_domain(hal_wifi_offload_default)
diff --git a/vendor/mediacodec.te b/vendor/mediacodec.te
index 40a5489..d6d0de1 100644
--- a/vendor/mediacodec.te
+++ b/vendor/mediacodec.te
@@ -3,15 +3,6 @@
 
 init_daemon_domain(mediacodec)
 
-not_full_treble(`
-    # on legacy devices, continue to allow /dev/binder traffic
-    binder_use(mediacodec)
-    binder_service(mediacodec)
-    add_service(mediacodec, mediacodec_service)
-    allow mediacodec mediametrics_service:service_manager find;
-    allow mediacodec surfaceflinger_service:service_manager find;
-')
-
 # can route /dev/binder traffic to /dev/vndbinder
 vndbinder_use(mediacodec)
 
diff --git a/vendor/vendor_install_recovery.te b/vendor/vendor_install_recovery.te
new file mode 100644
index 0000000..ff63f75
--- /dev/null
+++ b/vendor/vendor_install_recovery.te
@@ -0,0 +1,24 @@
+init_daemon_domain(vendor_install_recovery)
+
+# service vendor_flash_recovery in
+# bootable/recovery/applypatch/vendor_flash_recovery.rc
+type vendor_install_recovery, domain;
+type vendor_install_recovery_exec, vendor_file_type, exec_type, file_type;
+
+# /vendor/bin/install-recovery.sh is a shell script.
+# Needs to execute /vendor/bin/sh
+allow vendor_install_recovery vendor_shell_exec:file rx_file_perms;
+
+# Execute /vendor/bin/applypatch
+allow vendor_install_recovery vendor_file:file rx_file_perms;
+not_full_treble(`allow vendor_install_recovery vendor_file:file rx_file_perms;')
+
+allow vendor_install_recovery vendor_toolbox_exec:file rx_file_perms;
+
+# Update the recovery block device based off a diff of the boot block device
+allow vendor_install_recovery block_device:dir search;
+allow vendor_install_recovery boot_block_device:blk_file r_file_perms;
+allow vendor_install_recovery recovery_block_device:blk_file rw_file_perms;
+
+# Write to /proc/sys/vm/drop_caches
+allow vendor_install_recovery proc_drop_caches:file w_file_perms;
diff --git a/vendor/vndservice_contexts b/vendor/vndservice_contexts
index 4cca2fb..068056f 100644
--- a/vendor/vndservice_contexts
+++ b/vendor/vndservice_contexts
@@ -1 +1,2 @@
+manager                 u:object_r:service_manager_vndservice:s0
 *                       u:object_r:default_android_vndservice:s0
diff --git a/vendor/vndservicemanager.te b/vendor/vndservicemanager.te
index dbc88fa..497e027 100644
--- a/vendor/vndservicemanager.te
+++ b/vendor/vndservicemanager.te
@@ -13,5 +13,10 @@
 # Read vndservice_contexts
 allow vndservicemanager vndservice_contexts_file:file r_file_perms;
 
+add_service(vndservicemanager, service_manager_vndservice)
+
+# Start lazy services
+set_prop(vndservicemanager, ctl_interface_start_prop)
+
 # Check SELinux permissions.
 selinux_check_access(vndservicemanager)