diff --git a/apex/Android.bp b/apex/Android.bp
index 994bfd2..bbe2193 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -99,6 +99,13 @@
 }
 
 filegroup {
+  name: "com.android.federatedcompute-file_contexts",
+  srcs: [
+    "com.android.federatedcompute-file_contexts",
+  ],
+}
+
+filegroup {
   name: "com.android.geotz-file_contexts",
   srcs: [
     "com.android.geotz-file_contexts",
diff --git a/apex/com.android.federatedcompute-file_contexts b/apex/com.android.federatedcompute-file_contexts
new file mode 100644
index 0000000..9398505
--- /dev/null
+++ b/apex/com.android.federatedcompute-file_contexts
@@ -0,0 +1 @@
+(/.*)?           u:object_r:system_file:s0
diff --git a/build/soong/service_fuzzer_bindings.go b/build/soong/service_fuzzer_bindings.go
index ee32646..822cabc 100644
--- a/build/soong/service_fuzzer_bindings.go
+++ b/build/soong/service_fuzzer_bindings.go
@@ -23,12 +23,15 @@
 		"android.hardware.automotive.evs.IEvsEnumerator/hw/0":                     []string{},
 		"android.hardware.boot.IBootControl/default":                              []string{},
 		"android.hardware.automotive.evs.IEvsEnumerator/hw/1":                     []string{},
+		"android.hardware.automotive.remoteaccess.IRemoteAccess/default":          []string{},
 		"android.hardware.automotive.vehicle.IVehicle/default":                    []string{},
 		"android.hardware.automotive.audiocontrol.IAudioControl/default":          []string{},
 		"android.hardware.biometrics.face.IFace/default":                          []string{},
 		"android.hardware.biometrics.fingerprint.IFingerprint/default":            []string{},
 		"android.hardware.biometrics.fingerprint.IFingerprint/virtual":            []string{},
 		"android.hardware.bluetooth.audio.IBluetoothAudioProviderFactory/default": []string{},
+		"android.hardware.broadcastradio.IBroadcastRadio/amfm":                    []string{},
+		"android.hardware.broadcastradio.IBroadcastRadio/dab":                     []string{},
 		"android.hardware.camera.provider.ICameraProvider/internal/0":             []string{},
 		"android.hardware.contexthub.IContextHub/default":                         []string{},
 		"android.hardware.drm.IDrmFactory/clearkey":                               []string{},
diff --git a/private/app_zygote.te b/private/app_zygote.te
index 8a62341..8aa288e 100644
--- a/private/app_zygote.te
+++ b/private/app_zygote.te
@@ -159,6 +159,7 @@
 neverallow app_zygote {
   domain
   -app_zygote
+  -prng_seeder
   userdebug_or_eng(`-su')
   userdebug_or_eng(`-heapprofd')
   userdebug_or_eng(`-traced_perf')
diff --git a/private/compat/33.0/33.0.ignore.cil b/private/compat/33.0/33.0.ignore.cil
index 4589cdc..ad10722 100644
--- a/private/compat/33.0/33.0.ignore.cil
+++ b/private/compat/33.0/33.0.ignore.cil
@@ -11,10 +11,12 @@
     device_config_memory_safety_native_prop
     device_config_vendor_system_native_prop
     hal_bootctl_service
+    hal_remoteaccess_service
     hal_tv_input_service
     healthconnect_service
     keystore_config_prop
     permissive_mte_prop
+    prng_seeder
     servicemanager_prop
     system_net_netd_service
     tuner_config_prop
@@ -22,4 +24,5 @@
     virtual_face_hal_prop
     virtual_fingerprint_hal_prop
     hal_gatekeeper_service
+    hal_broadcastradio_service
   ))
diff --git a/private/domain.te b/private/domain.te
index 3d59a27..8f43181 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -121,6 +121,9 @@
 # should be used.
 get_prop(domain, log_file_logger_prop)
 
+# Allow all processes to connect to PRNG seeder daemon.
+unix_socket_connect(domain, prng_seeder, prng_seeder)
+
 # No domains other than a select few can access the misc_block_device. This
 # block device is reserved for OTA use.
 # Do not assert this rule on userdebug/eng builds, due to some devices using
@@ -498,6 +501,7 @@
     -logd # Logging by writing to logd Unix domain socket is public API
     -netd # netdomain needs this
     -mdnsd # netdomain needs this
+    -prng_seeder # Any process using libcrypto needs this
     userdebug_or_eng(`-su') # communications with su are permitted only on userdebug or eng builds
     -init
     -tombstoned # linker to tombstoned
diff --git a/private/file.te b/private/file.te
index 3f5531f..60e2274 100644
--- a/private/file.te
+++ b/private/file.te
@@ -120,3 +120,8 @@
 # This executable does not have its own domain because it is executed in the caller's domain. For
 # example, it is executed in the `artd` domain when artd calls it.
 type art_exec_exec, system_file_type, exec_type, file_type;
+
+# Filesystem entry for for PRNG seeder socket.  Processes require
+# write permission on this to connect, and needs to be mlstrustedobject
+# in to satisfy MLS constraints for trusted domains.
+type prng_seeder_socket, file_type, coredomain_socket, mlstrustedobject;
diff --git a/private/file_contexts b/private/file_contexts
index f5d40c8..951c9b5 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -149,6 +149,7 @@
 /dev/socket/pdx/system/vr/display/manager	u:object_r:pdx_display_manager_endpoint_socket:s0
 /dev/socket/pdx/system/vr/display/screenshot	u:object_r:pdx_display_screenshot_endpoint_socket:s0
 /dev/socket/pdx/system/vr/display/vsync	u:object_r:pdx_display_vsync_endpoint_socket:s0
+/dev/socket/prng_seeder	u:object_r:prng_seeder_socket:s0
 /dev/socket/property_service	u:object_r:property_socket:s0
 /dev/socket/racoon	u:object_r:racoon_socket:s0
 /dev/socket/recovery    u:object_r:recovery_socket:s0
@@ -220,6 +221,7 @@
 /system/bin/bcc                 u:object_r:rs_exec:s0
 /system/bin/blank_screen	u:object_r:blank_screen_exec:s0
 /system/bin/boringssl_self_test(32|64) u:object_r:boringssl_self_test_exec:s0
+/system/bin/prng_seeder		u:object_r:prng_seeder_exec:s0
 /system/bin/charger		u:object_r:charger_exec:s0
 /system/bin/canhalconfigurator  u:object_r:canhalconfigurator_exec:s0
 /system/bin/e2fsdroid		u:object_r:e2fs_exec:s0
diff --git a/private/init.te b/private/init.te
index 9e50bd4..f03a138 100644
--- a/private/init.te
+++ b/private/init.te
@@ -109,6 +109,9 @@
 # Allow accessing /sys/kernel/tracing/instances/bootreceiver to set up tracing.
 allow init debugfs_bootreceiver_tracing:file w_file_perms;
 
+# PRNG seeder daemon socket is created and listened on by init before forking.
+allow init prng_seeder:unix_stream_socket { create bind listen };
+
 # Devices with kernels where CONFIG_HIST_TRIGGERS isn't enabled will
 # attempt to write a non exisiting 'synthetic_events' file, when setting
 # up synthetic events. This is a no-op in tracefs.
diff --git a/private/prng_seeder.te b/private/prng_seeder.te
new file mode 100644
index 0000000..299e37b
--- /dev/null
+++ b/private/prng_seeder.te
@@ -0,0 +1,17 @@
+# PRNG seeder daemon
+# Started from early init, maintains a FIPS approved DRBG which it periodically reseeds from
+# /dev/hw_random.  When BoringSSL (libcrypto) in other processes needs seeding data for its
+# internal DRBGs it will connect to /dev/socket/prng_seeder and the daemon will write a
+# fixed size block of entropy then disconnect.  No other IO is performed.
+typeattribute prng_seeder coredomain;
+
+# mlstrustedsubject required in order to allow connections from trusted app domains.
+typeattribute prng_seeder mlstrustedsubject;
+
+type prng_seeder_exec, system_file_type, exec_type, file_type;
+init_daemon_domain(prng_seeder)
+
+# Socket open and listen are performed by init.
+allow prng_seeder prng_seeder:unix_stream_socket { read write getattr accept };
+allow prng_seeder hw_random_device:chr_file { read open };
+allow prng_seeder kmsg_debug_device:chr_file { w_file_perms getattr ioctl };
diff --git a/private/service_contexts b/private/service_contexts
index d86bf47..92f79c7 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -5,12 +5,15 @@
 android.hardware.automotive.evs.IEvsEnumerator/hw/0                  u:object_r:hal_evs_service:s0
 android.hardware.boot.IBootControl/default                           u:object_r:hal_bootctl_service:s0
 android.hardware.automotive.evs.IEvsEnumerator/hw/1                  u:object_r:hal_evs_service:s0
-android.hardware.automotive.vehicle.IVehicle/default                 u:object_r:hal_vehicle_service:s0
 android.hardware.automotive.audiocontrol.IAudioControl/default       u:object_r:hal_audiocontrol_service:s0
+android.hardware.automotive.remoteaccess.IRemoteAccess/default       u:object_r:hal_remoteaccess_service:s0
+android.hardware.automotive.vehicle.IVehicle/default                 u:object_r:hal_vehicle_service:s0
 android.hardware.biometrics.face.IFace/default                       u:object_r:hal_face_service:s0
 android.hardware.biometrics.fingerprint.IFingerprint/default         u:object_r:hal_fingerprint_service:s0
 android.hardware.biometrics.fingerprint.IFingerprint/virtual         u:object_r:hal_fingerprint_service:s0
 android.hardware.bluetooth.audio.IBluetoothAudioProviderFactory/default u:object_r:hal_audio_service:s0
+android.hardware.broadcastradio.IBroadcastRadio/amfm                 u:object_r:hal_broadcastradio_service:s0
+android.hardware.broadcastradio.IBroadcastRadio/dab                  u:object_r:hal_broadcastradio_service:s0
 # The instance here is internal/0 following naming convention for ICameraProvider.
 # It advertises internal camera devices.
 android.hardware.camera.provider.ICameraProvider/internal/0          u:object_r:hal_camera_service:s0
diff --git a/public/attributes b/public/attributes
index aeed208..f431725 100644
--- a/public/attributes
+++ b/public/attributes
@@ -362,6 +362,7 @@
 hal_attribute(power);
 hal_attribute(power_stats);
 hal_attribute(rebootescrow);
+hal_attribute(remoteaccess);
 hal_attribute(secure_element);
 hal_attribute(sensors);
 hal_attribute(telephony);
diff --git a/public/domain.te b/public/domain.te
index 11a14c5..9fbef64 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -436,6 +436,7 @@
 # Only the kernel hwrng thread should be able to read from the HW RNG.
 neverallow {
   domain
+  -prng_seeder # PRNG seeder daemon periodically reseeds itself from HW RNG
   -shell # For CTS, restricted to just getattr in shell.te
   -ueventd # To create the /dev/hw_random file
 } hw_random_device:chr_file *;
diff --git a/public/dumpstate.te b/public/dumpstate.te
index a2d2417..c73c2e7 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -78,6 +78,7 @@
   hal_audio_server
   hal_audiocontrol_server
   hal_bluetooth_server
+  hal_broadcastradio_server
   hal_camera_server
   hal_codec2_server
   hal_drm_server
diff --git a/public/hal_broadcastradio.te b/public/hal_broadcastradio.te
index 84a2597..bb882c9 100644
--- a/public/hal_broadcastradio.te
+++ b/public/hal_broadcastradio.te
@@ -2,3 +2,6 @@
 binder_call(hal_broadcastradio_server, hal_broadcastradio_client)
 
 hal_attribute_hwservice(hal_broadcastradio, hal_broadcastradio_hwservice)
+hal_attribute_service(hal_broadcastradio, hal_broadcastradio_service)
+
+binder_call(hal_broadcastradio_server, servicemanager)
diff --git a/public/hal_configstore.te b/public/hal_configstore.te
index 29bab48..886286e 100644
--- a/public/hal_configstore.te
+++ b/public/hal_configstore.te
@@ -31,6 +31,7 @@
   domain
   -hal_configstore_server
   -logd
+  -prng_seeder
   userdebug_or_eng(`-su')
   -tombstoned
   userdebug_or_eng(`-heapprofd')
diff --git a/public/hal_remoteaccess.te b/public/hal_remoteaccess.te
new file mode 100644
index 0000000..8a55529
--- /dev/null
+++ b/public/hal_remoteaccess.te
@@ -0,0 +1,6 @@
+# HwBinder IPC from client to server, and callbacks
+binder_call(hal_remoteaccess_client, hal_remoteaccess_server)
+binder_call(hal_remoteaccess_server, hal_remoteaccess_client)
+
+hal_attribute_service(hal_remoteaccess, hal_remoteaccess_service)
+
diff --git a/public/prng_seeder.te b/public/prng_seeder.te
new file mode 100644
index 0000000..7438452
--- /dev/null
+++ b/public/prng_seeder.te
@@ -0,0 +1,2 @@
+# PRNG seeder daemon
+type prng_seeder, domain;
diff --git a/public/service.te b/public/service.te
index c2060c1..2b43fc2 100644
--- a/public/service.te
+++ b/public/service.te
@@ -270,6 +270,7 @@
 type hal_audiocontrol_service, hal_service_type, service_manager_type;
 type hal_authsecret_service, protected_service, hal_service_type, service_manager_type;
 type hal_bootctl_service, protected_service, hal_service_type, service_manager_type;
+type hal_broadcastradio_service, protected_service, hal_service_type, service_manager_type;
 type hal_camera_service, protected_service, hal_service_type, service_manager_type;
 type hal_contexthub_service, protected_service, hal_service_type, service_manager_type;
 type hal_dice_service, protected_service, hal_service_type, service_manager_type;
@@ -296,6 +297,7 @@
 type hal_power_stats_service, protected_service, hal_service_type, service_manager_type;
 type hal_radio_service, protected_service, hal_service_type, service_manager_type;
 type hal_rebootescrow_service, protected_service, hal_service_type, service_manager_type;
+type hal_remoteaccess_service, protected_service, hal_service_type, service_manager_type;
 type hal_remotelyprovisionedcomponent_service, protected_service, hal_service_type, service_manager_type;
 type hal_sensors_service, protected_service, hal_service_type, service_manager_type;
 type hal_secureclock_service, protected_service, hal_service_type, service_manager_type;
diff --git a/public/vendor_init.te b/public/vendor_init.te
index c8ddfb9..61fa686 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -282,7 +282,8 @@
 ###
 
 # Vendor init shouldn't communicate with any vendor process, nor most system processes.
-neverallow_establish_socket_comms(vendor_init, { domain -init -logd -su -vendor_init });
+neverallow_establish_socket_comms(vendor_init, {
+    domain -init -logd -prng_seeder -su -vendor_init });
 
 # The vendor_init domain is only entered via an exec based transition from the
 # init domain, never via setcon().
diff --git a/vendor/file_contexts b/vendor/file_contexts
index 24f0d51..ceb1492 100644
--- a/vendor/file_contexts
+++ b/vendor/file_contexts
@@ -13,6 +13,7 @@
 /(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.evs(.*)?          u:object_r:hal_evs_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.vehicle@2\.0-((default|emulator)-)*(service|protocan-service)  u:object_r:hal_vehicle_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.vehicle@V1-(default|emulator)-service u:object_r:hal_vehicle_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.remoteaccess@V1-default-service u:object_r:hal_remoteaccess_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.[0-9]+-service      u:object_r:hal_bluetooth_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.[0-9]+-service\.btlinux    u:object_r:hal_bluetooth_btlinux_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.face@1\.[0-9]+-service\.example u:object_r:hal_face_default_exec:s0
@@ -23,6 +24,7 @@
 /(vendor|system/vendor)/bin/hw/android\.hardware\.boot@1\.[0-9]+-service      u:object_r:hal_bootctl_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.boot-service.default      u:object_r:hal_bootctl_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.broadcastradio@\d+\.\d+-service u:object_r:hal_broadcastradio_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.broadcastradio-service.default u:object_r:hal_broadcastradio_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider(@2\.[0-9]+|-V1)-service_64       u:object_r:hal_camera_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider(@2\.[0-9]+|-V1)-service          u:object_r:hal_camera_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider(@2\.[0-9]+|-V1)-service-lazy_64  u:object_r:hal_camera_default_exec:s0
diff --git a/vendor/hal_remoteaccess_default.te b/vendor/hal_remoteaccess_default.te
new file mode 100644
index 0000000..571b827
--- /dev/null
+++ b/vendor/hal_remoteaccess_default.te
@@ -0,0 +1,6 @@
+type hal_remoteaccess_default, domain;
+hal_server_domain(hal_remoteaccess_default, hal_remoteaccess)
+
+# may be started by init
+type hal_remoteaccess_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_remoteaccess_default)