diff --git a/Android.mk b/Android.mk
index 8c9802cf8f82fe8268e2fd573028607c2dda70d3..e5b244b510e111f000459a461675681ec9a6f0ba 100644
--- a/Android.mk
+++ b/Android.mk
@@ -190,6 +190,7 @@ ifeq ($(PRODUCT_FULL_TREBLE),true)
 # Use split SELinux policy
 LOCAL_REQUIRED_MODULES += \
     $(platform_mapping_file) \
+    26.0.cil \
     nonplat_sepolicy.cil \
     plat_sepolicy.cil \
     plat_and_mapping_sepolicy.cil.sha256 \
@@ -378,6 +379,16 @@ current_mapping.cil :=
 #################################
 include $(CLEAR_VARS)
 
+LOCAL_MODULE := 26.0.cil
+LOCAL_SRC_FILES := private/compat/26.0/26.0.cil
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_TAGS := optional
+LOCAL_MODULE_PATH := $(TARGET_OUT)/etc/selinux/mapping
+
+include $(BUILD_PREBUILT)
+#################################
+include $(CLEAR_VARS)
+
 LOCAL_MODULE := plat_and_mapping_sepolicy.cil.sha256
 LOCAL_MODULE_CLASS := ETC
 LOCAL_MODULE_TAGS := optional
diff --git a/private/domain_deprecated.te b/private/domain_deprecated.te
index 046394e0d5ea54e81c52ca7a9e21849241f82565..65fd9c73a474c66345d2746eb53dd5e9d2fb8837 100644
--- a/private/domain_deprecated.te
+++ b/private/domain_deprecated.te
@@ -3,108 +3,12 @@
 # Read files already opened under /data.
 allow domain_deprecated system_data_file:file { getattr read };
 allow domain_deprecated system_data_file:lnk_file r_file_perms;
-userdebug_or_eng(`
-auditallow {
-  domain_deprecated
-  -appdomain
-  -sdcardd
-  -system_server
-  -tee
-} system_data_file:file { getattr read };
-auditallow {
-  domain_deprecated
-  -appdomain
-  -system_server
-  -tee
-} system_data_file:lnk_file r_file_perms;
-')
 
 # Read apk files under /data/app.
 allow domain_deprecated apk_data_file:dir { getattr search };
 allow domain_deprecated apk_data_file:file r_file_perms;
 allow domain_deprecated apk_data_file:lnk_file r_file_perms;
-userdebug_or_eng(`
-auditallow {
-  domain_deprecated
-  -appdomain
-  -dex2oat
-  -installd
-  -system_server
-} apk_data_file:dir { getattr search };
-auditallow {
-  domain_deprecated
-  -appdomain
-  -dex2oat
-  -installd
-  -system_server
-} apk_data_file:file r_file_perms;
-auditallow {
-  domain_deprecated
-  -appdomain
-  -dex2oat
-  -installd
-  -system_server
-} apk_data_file:lnk_file r_file_perms;
-')
 
 # Read access to pseudo filesystems.
 r_dir_file(domain_deprecated, proc)
 r_dir_file(domain_deprecated, sysfs)
-
-userdebug_or_eng(`
-auditallow {
-  domain_deprecated
-  -fsck
-  -fsck_untrusted
-  -sdcardd
-  -system_server
-  -update_engine
-  -vold
-} proc:file r_file_perms;
-auditallow {
-  domain_deprecated
-  -fsck
-  -fsck_untrusted
-  -system_server
-  -vold
-} proc:lnk_file { open ioctl lock }; # getattr read granted in domain
-auditallow {
-  domain_deprecated
-  -fingerprintd
-  -healthd
-  -netd
-  -recovery
-  -system_app
-  -surfaceflinger
-  -system_server
-  -tee
-  -ueventd
-  -vold
-} sysfs:dir { open getattr read ioctl lock }; # search granted in domain
-auditallow {
-  domain_deprecated
-  -fingerprintd
-  -healthd
-  -netd
-  -recovery
-  -system_app
-  -surfaceflinger
-  -system_server
-  -tee
-  -ueventd
-  -vold
-} sysfs:file r_file_perms;
-auditallow {
-  domain_deprecated
-  -fingerprintd
-  -healthd
-  -netd
-  -recovery
-  -system_app
-  -surfaceflinger
-  -system_server
-  -tee
-  -ueventd
-  -vold
-} sysfs:lnk_file { getattr open ioctl lock }; # read granted in domain
-')
diff --git a/private/ephemeral_app.te b/private/ephemeral_app.te
index de5c53c479963b0066d01382e7ad3d8420bf2067..872892b7beebd5ca0779b719f1204f4d688c6647 100644
--- a/private/ephemeral_app.te
+++ b/private/ephemeral_app.te
@@ -19,6 +19,10 @@ app_domain(ephemeral_app)
 # Allow ephemeral apps to read/write files in visible storage if provided fds
 allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr ioctl lock append};
 
+# Some apps ship with shared libraries and binaries that they write out
+# to their sandbox directory and then execute.
+allow ephemeral_app app_data_file:file {r_file_perms execute};
+
 # services
 allow ephemeral_app audioserver_service:service_manager find;
 allow ephemeral_app cameraserver_service:service_manager find;
@@ -35,8 +39,7 @@ allow ephemeral_app ephemeral_app_api_service:service_manager find;
 ### neverallow rules
 ###
 
-# Executable content should never be loaded from an ephemeral app home directory.
-neverallow ephemeral_app app_data_file:file { execute execute_no_trans };
+neverallow ephemeral_app app_data_file:file execute_no_trans;
 
 # Receive or send uevent messages.
 neverallow ephemeral_app domain:netlink_kobject_uevent_socket *;
diff --git a/private/seapp_contexts b/private/seapp_contexts
index dc7e3893bf4b57438a74f6b3b7cb35e8c22ac207..a97fc70552313b4c51a14a48a444978d87b9e05b 100644
--- a/private/seapp_contexts
+++ b/private/seapp_contexts
@@ -105,7 +105,6 @@ user=_isolated domain=isolated_app levelFrom=user
 user=_app seinfo=media domain=mediaprovider name=android.process.media type=app_data_file levelFrom=user
 user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
 user=_app isV2App=true isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=user
-user=_app isV2App=true domain=untrusted_v2_app type=app_data_file levelFrom=user
 user=_app isPrivApp=true domain=priv_app type=app_data_file levelFrom=user
 user=_app minTargetSdkVersion=26 domain=untrusted_app type=app_data_file levelFrom=user
 user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user
diff --git a/private/system_server.te b/private/system_server.te
index a46272ad6be7a9fc8fa6fb82507a50b6a7e99451..40c5382d5fdced60591ae3adc126d8cfae1aeb3f 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -493,6 +493,7 @@ set_prop(system_server, firstboot_prop)
 allow system_server system_ndebug_socket:sock_file create_file_perms;
 
 # Manage cache files.
+allow system_server cache_file:lnk_file r_file_perms;
 allow system_server { cache_file cache_recovery_file }:dir { relabelfrom create_dir_perms };
 allow system_server { cache_file cache_recovery_file }:file { relabelfrom create_file_perms };
 allow system_server { cache_file cache_recovery_file }:fifo_file create_file_perms;
diff --git a/public/attributes b/public/attributes
index d384efd8d8b33c9eaf7e5b0491bd101dc2125e27..fa8a6a693b124821d86be4593e22fd2b60ac4c69 100644
--- a/public/attributes
+++ b/public/attributes
@@ -243,13 +243,13 @@ expandattribute hal_drm false;
 attribute hal_drm_client;
 expandattribute hal_drm_client true;
 attribute hal_drm_server;
-expandattribute hal_drm_server true;
+expandattribute hal_drm_server false;
 attribute hal_cas;
-expandattribute hal_cas true;
+expandattribute hal_cas false;
 attribute hal_cas_client;
 expandattribute hal_cas_client true;
 attribute hal_cas_server;
-expandattribute hal_cas_server true;
+expandattribute hal_cas_server false;
 attribute hal_dumpstate;
 expandattribute hal_dumpstate true;
 attribute hal_dumpstate_client;
diff --git a/public/te_macros b/public/te_macros
index e8c667d41944f71608763161108a8f799bf9a434..cac977b1ccea130a5cdac4a6d9c552b3928ccf29 100644
--- a/public/te_macros
+++ b/public/te_macros
@@ -459,6 +459,12 @@ define(`not_full_treble', ifelse(target_full_treble, `true', , $1))
 #
 define(`userdebug_or_eng', ifelse(target_build_variant, `eng', $1, ifelse(target_build_variant, `userdebug', $1)))
 
+#####################################
+# User builds
+# SELinux rules which apply only to user builds
+#
+define(`userbuild', ifelse(target_build_variant, `user', $1, ))
+
 #####################################
 # asan builds
 # SELinux rules which apply only to asan builds
diff --git a/tools/sepolicy-analyze/Android.mk b/tools/sepolicy-analyze/Android.mk
index 1754fc7e6b712d2fb1e4ec72a547b01a4bc1899f..25408a3176a14dabfaa4a8b7c3213ac6bad40275 100644
--- a/tools/sepolicy-analyze/Android.mk
+++ b/tools/sepolicy-analyze/Android.mk
@@ -10,6 +10,6 @@ LOCAL_SRC_FILES := sepolicy-analyze.c dups.c neverallow.c perm.c typecmp.c boole
 LOCAL_STATIC_LIBRARIES := libsepol
 LOCAL_CXX_STL := none
 
-LOCAL_COMPATIBILITY_SUITE := cts gts
+LOCAL_COMPATIBILITY_SUITE := cts gts vts
 
 include $(BUILD_HOST_EXECUTABLE)
diff --git a/vendor/hal_sensors_default.te b/vendor/hal_sensors_default.te
index 7fd8f85617637a6b5f3e186fb78b74bae2dbc525..1bde858cd0d7bdb6e68925dbef65a76164fad266 100644
--- a/vendor/hal_sensors_default.te
+++ b/vendor/hal_sensors_default.te
@@ -6,5 +6,11 @@ init_daemon_domain(hal_sensors_default)
 
 allow hal_sensors_default fwk_scheduler_hwservice:hwservice_manager find;
 
+# Allow sensor hals to access and use gralloc memory allocated by
+# android.hardware.graphics.allocator
 allow hal_sensors_default hal_graphics_allocator_default:fd use;
 allow hal_sensors_default ion_device:chr_file r_file_perms;
+
+# allow sensor hal to use lock for keeping system awake for wake up
+# events delivery.
+wakelock_use(hal_sensors_default);