diff --git a/Android.mk b/Android.mk
index 2a6751eec..47b17a94f 100644
--- a/Android.mk
+++ b/Android.mk
@@ -77,10 +77,12 @@ $(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
 $(sepolicy_policy.conf) : $(call build_policy, security_classes initial_sids access_vectors global_macros mls_macros mls policy_capabilities te_macros attributes *.te roles users initial_sid_contexts fs_use genfs_contexts port_contexts)
 	@mkdir -p $(dir $@)
 	$(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) -s $^ > $@
+	$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
 
 $(LOCAL_BUILT_MODULE) : $(sepolicy_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
 	@mkdir -p $(dir $@)
 	$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $<
+	$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $(dir $<)/$(notdir $@).dontaudit $<.dontaudit
 
 built_sepolicy := $(LOCAL_BUILT_MODULE)
 sepolicy_policy.conf :=
diff --git a/bluetooth.te b/bluetooth.te
index cd1796741..31ea06479 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -26,3 +26,9 @@ allow bluetoothdomain bluetooth:unix_stream_socket { read write shutdown };
 # tethering
 allow bluetooth self:{ tun_socket udp_socket } { ioctl create };
 allow bluetooth efs_file:dir search;
+
+# Talk to init over the property socket.
+unix_socket_connect(bluetooth, property, init)
+
+# proc access.
+allow bluetooth proc_bluetooth_writable:file rw_file_perms;
diff --git a/device.te b/device.te
index 628d803cc..2aeeb16d0 100644
--- a/device.te
+++ b/device.te
@@ -30,8 +30,10 @@ type qemu_device, dev_type;
 type kmsg_device, dev_type;
 type null_device, dev_type, mlstrustedobject;
 type random_device, dev_type;
+type sensors_device, dev_type;
 type serial_device, dev_type;
 type socket_device, dev_type;
+type timerirq_device, dev_type;
 type tty_device, dev_type;
 type urandom_device, dev_type;
 type video_device, dev_type;
@@ -46,6 +48,7 @@ type watchdog_device, dev_type;
 type uhid_device, dev_type;
 type tun_device, dev_type, mlstrustedobject;
 type usbaccessory_device, dev_type;
+type usb_device, dev_type;
 
 # All devices have a uart for the hci
 # attach service. The uart dev node
@@ -53,6 +56,6 @@ type usbaccessory_device, dev_type;
 # is used in per device policy
 type hci_attach_dev, dev_type;
 
-# All devices have a rpmsg device for 
+# All devices have a rpmsg device for
 # achieving remoteproc and rpmsg modules
 type rpmsg_device, dev_type;
diff --git a/file.te b/file.te
index cc196a3e4..a82945a5f 100644
--- a/file.te
+++ b/file.te
@@ -5,6 +5,7 @@ type sockfs, fs_type;
 type rootfs, fs_type;
 type proc, fs_type;
 type qtaguid_proc, fs_type, mlstrustedobject;
+type proc_bluetooth_writable, fs_type;
 type selinuxfs, fs_type;
 type cgroup, fs_type, mlstrustedobject;
 type sysfs, fs_type, mlstrustedobject;
diff --git a/file_contexts b/file_contexts
index 6501dfd83..6e05edb13 100644
--- a/file_contexts
+++ b/file_contexts
@@ -41,6 +41,7 @@
 /dev/block/loop[0-9]*	u:object_r:loop_device:s0
 /dev/block/ram[0-9]*	u:object_r:ram_device:s0
 /dev/block/mtdblock5	u:object_r:radio_device:s0
+/dev/bus/usb(.*)?       u:object_r:usb_device:s0
 /dev/cam		u:object_r:camera_device:s0
 /dev/console		u:object_r:console_device:s0
 /dev/cpuctl(/.*)?	u:object_r:cpuctl_device:s0
diff --git a/mediaserver.te b/mediaserver.te
index 0696331cd..85be2d5de 100644
--- a/mediaserver.te
+++ b/mediaserver.te
@@ -49,4 +49,4 @@ allow mediaserver qtaguid_proc:file rw_file_perms;
 allow mediaserver qtaguid_device:chr_file r_file_perms;
 
 # Allow abstract socket connection
-allow mediaserver rild:unix_stream_socket connectto;
+allow mediaserver rild:unix_stream_socket { connectto read write setopt };
diff --git a/rild.te b/rild.te
index c331bb327..e8069bff6 100644
--- a/rild.te
+++ b/rild.te
@@ -37,3 +37,5 @@ allow rild radio_prop:property_service set;
 
 # Read/Write to uart driver (for GPS)
 allow rild gps_device:chr_file rw_file_perms;
+
+allow rild tty_device:chr_file rw_file_perms;
diff --git a/system.te b/system.te
index eacd5fb55..cf92bca9f 100644
--- a/system.te
+++ b/system.te
@@ -221,3 +221,10 @@ allow system backup_data_file:dir { relabelto relabelfrom };
 allow system cache_backup_file:file { relabelto relabelfrom };
 # LocalTransport creates and relabels /cache/backup
 allow system cache_backup_file:dir { relabelto relabelfrom create_dir_perms };
+
+# Allow system to talk to usb device
+allow system usb_device:chr_file rw_file_perms;
+allow system usb_device:dir r_dir_perms;
+
+# Allow system to talk to sensors and timer irq
+allow system { sensors_device timerirq_device }:chr_file rw_file_perms;
diff --git a/zygote.te b/zygote.te
index 9707082c3..33e8fe80a 100644
--- a/zygote.te
+++ b/zygote.te
@@ -37,3 +37,6 @@ allow zygote sdcard_type:dir { write search setattr create add_name mounton };
 dontaudit zygote self:capability fsetid;
 allow zygote tmpfs:dir { write create add_name setattr mounton search };
 allow zygote tmpfs:filesystem mount;
+
+# Handle --invoke-with command when launching Zygote with a wrapper command.
+allow zygote zygote_exec:file { execute_no_trans open };