diff --git a/build/soong/service_fuzzer_bindings.go b/build/soong/service_fuzzer_bindings.go
index 9891388..726bbbc 100644
--- a/build/soong/service_fuzzer_bindings.go
+++ b/build/soong/service_fuzzer_bindings.go
@@ -392,7 +392,7 @@
 		"procstats":                              EXCEPTION_NO_FUZZER,
 		"profcollectd":                           EXCEPTION_NO_FUZZER,
 		"profiling_service":                      EXCEPTION_NO_FUZZER,
-		"protolog":                               EXCEPTION_NO_FUZZER,
+		"protolog_configuration":                 EXCEPTION_NO_FUZZER,
 		"radio.phonesubinfo":                     EXCEPTION_NO_FUZZER,
 		"radio.phone":                            EXCEPTION_NO_FUZZER,
 		"radio.sms":                              EXCEPTION_NO_FUZZER,
diff --git a/private/adbd.te b/private/adbd.te
index c852038..154a04c 100644
--- a/private/adbd.te
+++ b/private/adbd.te
@@ -216,8 +216,7 @@
 allow adbd shell:fd use;
 
 # Allow pull /vendor/apex files for CTS tests
-allow adbd vendor_apex_file:dir search;
-allow adbd vendor_apex_file:file r_file_perms;
+r_dir_file(adbd, vendor_apex_file)
 
 # Allow adb pull of updated apex files in /data/apex/active.
 allow adbd apex_data_file:dir search;
diff --git a/private/gmscore_app.te b/private/gmscore_app.te
index f938ad5..90194f9 100644
--- a/private/gmscore_app.te
+++ b/private/gmscore_app.te
@@ -112,11 +112,6 @@
 allow gmscore_app recovery_service:service_manager find;
 allow gmscore_app stats_service:service_manager find;
 
-# Used by Finsky / Android "Verify Apps" functionality when
-# running "adb install foo.apk".
-allow gmscore_app shell_data_file:file r_file_perms;
-allow gmscore_app shell_data_file:dir r_dir_perms;
-
 # Write to /cache.
 allow gmscore_app { cache_file cache_recovery_file }:dir create_dir_perms;
 allow gmscore_app { cache_file cache_recovery_file }:file create_file_perms;
diff --git a/private/hal_fingerprint.te b/private/hal_fingerprint.te
index 29abe4f..a1d68be 100644
--- a/private/hal_fingerprint.te
+++ b/private/hal_fingerprint.te
@@ -10,8 +10,8 @@
 # For memory allocation
 allow hal_fingerprint ion_device:chr_file r_file_perms;
 
-allow hal_fingerprint fingerprint_vendor_data_file:file { create_file_perms };
-allow hal_fingerprint fingerprint_vendor_data_file:dir rw_dir_perms;
+allow { hal_fingerprint -coredomain } fingerprint_vendor_data_file:file { create_file_perms };
+allow { hal_fingerprint -coredomain } fingerprint_vendor_data_file:dir rw_dir_perms;
 
 r_dir_file(hal_fingerprint, cgroup)
 r_dir_file(hal_fingerprint, cgroup_v2)
diff --git a/private/platform_app.te b/private/platform_app.te
index eb1a7c7..320624c 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -51,6 +51,7 @@
 userdebug_or_eng(`
   set_prop(platform_app, persist_sysui_ranking_update_prop)
 ')
+set_prop(platform_app, debug_tracing_desktop_mode_visible_tasks_prop)
 
 # com.android.captiveportallogin reads /proc/vmstat
 allow platform_app {
diff --git a/private/property.te b/private/property.te
index acb8d79..1f94608 100644
--- a/private/property.te
+++ b/private/property.te
@@ -3,6 +3,7 @@
 system_internal_prop(apexd_payload_metadata_prop)
 system_internal_prop(ctl_snapuserd_prop)
 system_internal_prop(crashrecovery_prop)
+system_internal_prop(debug_tracing_desktop_mode_visible_tasks_prop)
 system_internal_prop(device_config_core_experiments_team_internal_prop)
 system_internal_prop(device_config_lmkd_native_prop)
 system_internal_prop(device_config_mglru_native_prop)
diff --git a/private/property_contexts b/private/property_contexts
index f0a4281..f631f8f 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -33,6 +33,7 @@
 
 debug.                  u:object_r:debug_prop:s0
 debug.db.               u:object_r:debuggerd_prop:s0
+debug.tracing.desktop_mode_visible_tasks u:object_r:debug_tracing_desktop_mode_visible_tasks_prop:s0 exact uint
 dumpstate.              u:object_r:dumpstate_prop:s0
 dumpstate.options       u:object_r:dumpstate_options_prop:s0
 init.svc_debug_pid.     u:object_r:init_svc_debug_prop:s0
diff --git a/private/service.te b/private/service.te
index a3754e4..63259c6 100644
--- a/private/service.te
+++ b/private/service.te
@@ -1,27 +1,27 @@
-type adaptive_auth_service,         system_server_service, service_manager_type;
-type ambient_context_service,       app_api_service, system_server_service, service_manager_type;
-type attention_service,             system_server_service, service_manager_type;
-type bg_install_control_service,    system_api_service, system_server_service, service_manager_type;
-type compos_service,                service_manager_type;
-type communal_service,              app_api_service, system_server_service, service_manager_type;
-type dynamic_system_service,        system_api_service, system_server_service, service_manager_type;
-type feature_flags_service,         app_api_service, system_server_service, service_manager_type;
-type gsi_service,                   service_manager_type;
-type incidentcompanion_service,     app_api_service, system_api_service, system_server_service, service_manager_type;
-type logcat_service,                system_server_service, service_manager_type;
-type logd_service,                  service_manager_type;
-type mediatuner_service,            app_api_service, service_manager_type;
+type adaptive_auth_service,          system_server_service, service_manager_type;
+type ambient_context_service,        app_api_service, system_server_service, service_manager_type;
+type attention_service,              system_server_service, service_manager_type;
+type bg_install_control_service,     system_api_service, system_server_service, service_manager_type;
+type compos_service,                 service_manager_type;
+type communal_service,               app_api_service, system_server_service, service_manager_type;
+type dynamic_system_service,         system_api_service, system_server_service, service_manager_type;
+type feature_flags_service,          app_api_service, system_server_service, service_manager_type;
+type gsi_service,                    service_manager_type;
+type incidentcompanion_service,      app_api_service, system_api_service, system_server_service, service_manager_type;
+type logcat_service,                 system_server_service, service_manager_type;
+type logd_service,                   service_manager_type;
+type mediatuner_service,             app_api_service, service_manager_type;
 type on_device_intelligence_service, app_api_service, system_server_service, service_manager_type, isolated_compute_allowed_service;
-type profcollectd_service,          service_manager_type;
-type protolog_service,              system_api_service, system_server_service, service_manager_type;
-type resolver_service,              system_server_service, service_manager_type;
-type rkpd_registrar_service,        service_manager_type;
-type rkpd_refresh_service,          service_manager_type;
-type safety_center_service,         app_api_service, system_api_service, system_server_service, service_manager_type;
-type stats_service,                 service_manager_type;
-type statsbootstrap_service,        system_server_service, service_manager_type;
-type statscompanion_service,        system_server_service, service_manager_type;
-type statsmanager_service,          system_api_service, system_server_service, service_manager_type;
+type profcollectd_service,           service_manager_type;
+type protolog_configuration_service, app_api_service, system_api_service, system_server_service, service_manager_type;
+type resolver_service,               system_server_service, service_manager_type;
+type rkpd_registrar_service,         service_manager_type;
+type rkpd_refresh_service,           service_manager_type;
+type safety_center_service,          app_api_service, system_api_service, system_server_service, service_manager_type;
+type stats_service,                  service_manager_type;
+type statsbootstrap_service,         system_server_service, service_manager_type;
+type statscompanion_service,         system_server_service, service_manager_type;
+type statsmanager_service,           system_api_service, system_server_service, service_manager_type;
 
 is_flag_enabled(RELEASE_SUPERVISION_SERVICE, `
     type supervision_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
diff --git a/private/service_contexts b/private/service_contexts
index 78d2c5a..71abb42 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -373,7 +373,7 @@
 powerstats                                u:object_r:powerstats_service:s0
 power                                     u:object_r:power_service:s0
 profiling_service                         u:object_r:profiling_service:s0
-protolog                                  u:object_r:protolog_service:s0
+protolog_configuration                    u:object_r:protolog_configuration_service:s0
 print                                     u:object_r:print_service:s0
 processinfo                               u:object_r:processinfo_service:s0
 procstats                                 u:object_r:procstats_service:s0
diff --git a/private/traced_probes.te b/private/traced_probes.te
index 003e992..6540420 100644
--- a/private/traced_probes.te
+++ b/private/traced_probes.te
@@ -111,6 +111,10 @@
 binder_call(traced_probes, statsd)
 allow traced_probes stats_service:service_manager find;
 
+# Allow reading the system property representing number of desktop windows to
+# set the initial value for the counter in traces.
+get_prop(traced_probes, debug_tracing_desktop_mode_visible_tasks_prop)
+
 ###
 ### Neverallow rules
 ###