diff --git a/recipes-core/toybox/toybox_%.bbappend b/recipes-core/toybox/toybox_%.bbappend
new file mode 100644
index 0000000000000000000000000000000000000000..7eb0d04ec10ef5fb16ad360593502854072566db
--- /dev/null
+++ b/recipes-core/toybox/toybox_%.bbappend
@@ -0,0 +1,11 @@
+inherit enable-selinux
+
+PACKAGECONFIG[selinux] = "--enable-selinux,--disable-selinux,libselinux"
+
+do_configure:append() {
+    # Enable selinux by turning off TOYBOX_LSM_NONE and replacing with TOYBOX_SELINUX
+    #  This enables functionality such as ls -Z and ps -Z.
+    sed -e 's/CONFIG_TOYBOX_LSM_NONE=y/# CONFIG_TOYBOX_LSM_NONE is not set/' -i .config
+    sed -e 's/# CONFIG_TOYBOX_SELINUX is not set/CONFIG_TOYBOX_SELINUX=y/' -i .config
+}
+
diff --git a/recipes-security/sepolicy/neo/apps/pulseaudio.te b/recipes-security/sepolicy/neo/apps/pulseaudio.te
index 7051db7b312db912455a989fb8c2f132dc4d1d72..ebf03c70f0cf4bebc8149769c795a47732498fcd 100644
--- a/recipes-security/sepolicy/neo/apps/pulseaudio.te
+++ b/recipes-security/sepolicy/neo/apps/pulseaudio.te
@@ -12,6 +12,7 @@ gen_require(`
         type socket_device_t;
         type system_dmabuf_device_t;
         type vendor_dmabuf_audioml_heap_device_t;
+        type btapp_t;
 ')
 
 user_data_files_type(audio_data_file_t);
@@ -27,3 +28,7 @@ userdebug_or_eng(`
     ')
     allow pulseaudio_t unconfined_t:unix_stream_socket connectto;
 ')
+
+#Usecase to inetract with bt-app service for audio stream
+
+allow pulseaudio_t btapp_t:unix_stream_socket { connectto };
diff --git a/recipes-security/sepolicy/neo/device/qbt.fc b/recipes-security/sepolicy/neo/device/qbt.fc
new file mode 100644
index 0000000000000000000000000000000000000000..09995735fc1aa7980c046726a0ccfa5d47b8ccf6
--- /dev/null
+++ b/recipes-security/sepolicy/neo/device/qbt.fc
@@ -0,0 +1,35 @@
+# Copyright (c) 2018,2020 The Linux Foundation. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#     * Redistributions of source code must retain the above copyright
+#       notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+#       copyright notice, this list of conditions and the following
+#       disclaimer in the documentation and/or other materials provided
+#       with the distribution.
+#     * Neither the name of The Linux Foundation nor the names of its
+#       contributors may be used to endorse or promote products derived
+#       from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#Changes from Qualcomm Innovation Center, Inc. are provided under the following license:
+#Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+#SPDX-License-Identifier: BSD-3-Clause-Clear
+
+/dev/btpower                         -c      gen_context(system_u:object_r:bt_device_t,s0)
+/dev/ttyHS0                          -c      gen_context(system_u:object_r:ttyHS0_device_t,s0)
+/dev/socket/ble_gap_socket           -s      gen_context(system_u:object_r:bt_app_sock_t,s0)
+/dev/socket/ble_wbds_socket          -s      gen_context(system_u:object_r:bt_app_sock_t,s0)
diff --git a/recipes-security/sepolicy/neo/device/qbt.if b/recipes-security/sepolicy/neo/device/qbt.if
new file mode 100644
index 0000000000000000000000000000000000000000..f9f056be0266a0f183a12363c512a35c69c272d4
--- /dev/null
+++ b/recipes-security/sepolicy/neo/device/qbt.if
@@ -0,0 +1,32 @@
+# Copyright (c) 2018 The Linux Foundation. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#     * Redistributions of source code must retain the above copyright
+#       notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+#       copyright notice, this list of conditions and the following
+#       disclaimer in the documentation and/or other materials provided
+#       with the distribution.
+#     * Neither the name of The Linux Foundation nor the names of its
+#       contributors may be used to endorse or promote products derived
+#       from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#Changes from Qualcomm Innovation Center, Inc. are provided under the following license:
+#Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+#SPDX-License-Identifier: BSD-3-Clause-Clear
+
+## <summary>Bluetooth daemonization changes interface</summary>
diff --git a/recipes-security/sepolicy/neo/device/qbt.te b/recipes-security/sepolicy/neo/device/qbt.te
new file mode 100644
index 0000000000000000000000000000000000000000..dd0e1a6d396fa6662276ef57c284f8c5c68d3c58
--- /dev/null
+++ b/recipes-security/sepolicy/neo/device/qbt.te
@@ -0,0 +1,94 @@
+# Copyright (c) 2018,2020 The Linux Foundation. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#     * Redistributions of source code must retain the above copyright
+#       notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+#       copyright notice, this list of conditions and the following
+#       disclaimer in the documentation and/or other materials provided
+#       with the distribution.
+#     * Neither the name of The Linux Foundation nor the names of its
+#       contributors may be used to endorse or promote products derived
+#       from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
+# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
+# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#Changes from Qualcomm Innovation Center, Inc. are provided under the following license:
+#Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+#SPDX-License-Identifier: BSD-3-Clause-Clear
+
+files_read_config_files(btapp_t);
+
+gen_require(`
+  type system_dbusd_var_run_t;
+  type system_dbusd_t;
+  type pmsg_device_t;
+  type socket_device_t;
+  type leprop_sock_t;
+  type leprop_t;
+  type syslogd_var_run_t;
+  type data_t;
+  type bluetooth_conf_t;
+  type pulseaudio_t;
+  type device_t;
+  type unreserved_port_t;
+  type firmware_t;
+  type node_t;
+  type mount_t;
+  type pulseaudio_var_run_t;
+')
+
+type bt_device_t;
+dev_node(bt_device_t);
+rw_chr_files_pattern(btapp_t, device_t, bt_device_t);
+
+type ttyHS0_device_t;
+dev_node(ttyHS0_device_t);
+allow btapp_t ttyHS0_device_t:chr_file manage_chr_file_perms; #/dev/ttyHS0
+
+type bt_app_sock_t;
+dev_node(bt_app_sock_t);
+manage_sock_files_pattern(btapp_t, bt_app_sock_t, bt_app_sock_t);
+
+read_files_pattern(btapp_t, firmware_t, firmware_t);
+manage_sock_files_pattern(btapp_t, socket_device_t, socket_device_t);
+manage_sock_files_pattern(btapp_t, data_t, data_t);
+rw_sock_files_pattern(btapp_t, pulseaudio_var_run_t, pulseaudio_var_run_t);
+kernel_read_system_state(btapp_t);
+leprop_rw_props(btapp_t);
+corenet_tcp_bind_all_unreserved_ports(btapp_t);
+corenet_tcp_bind_generic_node(btapp_t);
+
+allow btapp_t self:tcp_socket create_stream_socket_perms;
+allow btapp_t self:unix_stream_socket { accept listen };
+
+allow btapp_t system_dbusd_var_run_t:dir search; #/run/dbus
+allow btapp_t system_dbusd_var_run_t:sock_file write;
+allow btapp_t system_dbusd_t:unix_stream_socket connectto;
+
+allow btapp_t bluetooth_conf_t:file rw_file_perms;
+allow btapp_t pulseaudio_t:unix_stream_socket { connectto sendto };
+
+## for DBus
+ifdef(`init_systemd', `
+    dbus_connect_system_bus(btapp_t)
+    dbus_send_system_bus(btapp_t)
+')
+
+allow btapp_t bt_data_t:sock_file {create unlink write };
+data_filetrans(btapp_t, bt_data_t, { file dir })
+manage_user_data_files(btapp_t, bt_data_t)
+allow mount_t bt_data_t:sock_file manage_sock_file_perms;
+allow btapp_t bluetooth_conf_t:sock_file {create unlink write };
diff --git a/recipes-security/sepolicy/neo/device/weston.te b/recipes-security/sepolicy/neo/device/weston.te
index 17bc033cc25a351b643ba7e5b1d1c8e7f2ea2dc8..7782b4241b165ee5f76ddd1fd697d1c20722a27c 100644
--- a/recipes-security/sepolicy/neo/device/weston.te
+++ b/recipes-security/sepolicy/neo/device/weston.te
@@ -27,7 +27,7 @@
 
 # Changes from Qualcomm Innovation Center are provided under the following license:
 #
-# Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+# Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted (subject to the limitations in the
@@ -108,6 +108,12 @@ gen_require(`
  type home_root_t;
  type user_home_dir_t;
  type user_tmpfs_t;
+ type device_t;
+ type vendor_dmabuf_system_heap_device_t;
+ type sysfs_cpu_capacity;
+ type sysfs_cpu_present;
+ type gpumodel_t;
+ type pmsg_device_t;
 ')
 
 dontaudit weston_t self:capability { setuid sys_admin } ;
@@ -147,6 +153,7 @@ files_type(weston_usr_t);
 allow weston_t weston_usr_t:dir search_dir_perms;
 allow weston_t weston_usr_t:file read_file_perms;
 
+mls_file_read_all_levels(weston_t);
 allow weston_t self:capability kill;
 allow weston_t brightness_t:file rw_file_perms;
 allow weston_t etc_t:file read_file_perms;
@@ -179,18 +186,26 @@ allow weston_t socket_device_t:dir manage_dir_perms;
 allow weston_t socket_device_t:file manage_file_perms;
 allow weston_t socket_device_t:sock_file manage_sock_file_perms;
 allow weston_t user_tmpfs_t:file { map rw_file_perms };
+allow weston_t device_t:dir search;
+allow weston_t vendor_dmabuf_system_heap_device_t:chr_file read_chr_file_perms;
+allow weston_t sysfs_cpu_capacity:file read_file_perms;
+allow weston_t sysfs_cpu_present:file read_file_perms;
+allow weston_t gpumodel_t:file read_file_perms;
+allow weston_t pmsg_device_t:chr_file write_chr_file_perms;
 
 userdebug_or_eng(`
      gen_require(`
         type trace_marker_t;
         type tracefs_t;
         type debugfs_t;
+        type adbd_t;
     ')
 
     allow weston_t debugfs_t:dir search;
     allow weston_t trace_marker_t:file { write open };
     allow weston_t tracefs_t:dir search;
     allow weston_t tty_device_t:chr_file manage_chr_file_perms; #/dev/tty
+    allow weston_t adbd_t:unix_stream_socket { connectto create_stream_socket_perms };
 ')
 
 manage_qmmf_data_files(weston_t)
diff --git a/recipes-security/sepolicy/neo/system/mount.te b/recipes-security/sepolicy/neo/system/mount.te
index df0205fc24e6194d26053cc8994e30de57e63674..c1d3db1f81e1b73b01993d054422bd2355b8fd05 100644
--- a/recipes-security/sepolicy/neo/system/mount.te
+++ b/recipes-security/sepolicy/neo/system/mount.te
@@ -69,6 +69,7 @@ gen_require(`
     type hwfde_conf_file_t;
     type lib_t;
     type overlay_t;
+    type systemd_unit_t;
 ')
 
 permissive mount_t;
@@ -85,3 +86,4 @@ allow mount_t lib_t:filesystem relabelfrom;
 allow mount_t overlay_t:chr_file { create link rename unlink };
 allow mount_t var_t:chr_file unlink;
 allow mount_t data_t:sock_file { create unlink };
+allow mount_t systemd_unit_t:lnk_file { getattr read };
diff --git a/recipes-security/sepolicy/neo/system/systemd.te b/recipes-security/sepolicy/neo/system/systemd.te
index 6c77514452bf037138d7432e29395f5c77b89853..b2ed6d95a3bafb20aae6b39fec54120caa00aabb 100644
--- a/recipes-security/sepolicy/neo/system/systemd.te
+++ b/recipes-security/sepolicy/neo/system/systemd.te
@@ -48,6 +48,7 @@ gen_require(`
  type proc_t;
  type lib_t;
  type tracefs_t;
+ type udev_t;
 ')
 
 allow systemd_modules_load_t kernel_t:unix_dgram_socket sendto;
@@ -85,7 +86,7 @@ allow systemd_modules_load_t syslogd_t:unix_dgram_socket sendto;
 allow systemd_modules_load_t etc_t:file read_file_perms;
 
 modutils_read_module_deps(systemd_modules_load_t);
-allow systemd_modules_load_t self:capability sys_module;
+allow systemd_modules_load_t self:capability { sys_module sys_admin };
 allow systemd_modules_load_t var_run_t:dir { read_file_perms getattr search };
 allow systemd_modules_load_t debugfs_t:dir search;
 allow systemd_modules_load_t modules_object_t:system module_load;
@@ -116,3 +117,6 @@ allow systemd_update_done_t kernel_t:unix_dgram_socket sendto;
 #/lib/modules mount point denials for system_module_load_t
 allow systemd_modules_load_t initrc_var_run_t:lnk_file read_lnk_file_perms;
 allow systemd_modules_load_t lib_t:system module_load;
+
+allow udev_t configfs_t:file { read open };
+allow udev_t lib_t:system module_load;
diff --git a/recipes-security/sepolicy/vm/libcontainer/platform_container.if b/recipes-security/sepolicy/vm/libcontainer/platform_container.if
index efd3519a63ad621b5eee346a3dcfdf8ca51c969f..fd09c2a139fc3e35e56b5ae2276f6ef5fb4a8197 100644
--- a/recipes-security/sepolicy/vm/libcontainer/platform_container.if
+++ b/recipes-security/sepolicy/vm/libcontainer/platform_container.if
@@ -30,7 +30,7 @@ interface(`platform_container_domain_type',`
 
     can_exec($1, $2)
 
-    # TODO: Any way to fine-tune this?
+    # needed until all containers using user namespaced /dev/kmsg
     mls_file_read_all_levels($1)
     mls_file_write_all_levels($1)
     # for bind-mounting when using the libminijail default option
@@ -41,9 +41,8 @@ interface(`platform_container_domain_type',`
     domtrans_pattern(platform_launcher_domain, $2, $1)
 ')
 
-########################################
 ## <summary>
-##      Allow bind mounting of a node
+##     Allow specified type to be bind-mounted by the platform
 ## </summary>
 ## <param name="domain">
 ##      <summary>
@@ -51,16 +50,28 @@ interface(`platform_container_domain_type',`
 ##      </summary>
 ## </param>
 ## <param name="target">
-##      <summary>
-##      File type to allow
-##      </summary>
+##     <summary>
+##     Type allowed to be bind-mounted
+##     </summary>
 ## </param>
-## <param name="class">
-##      <summary>
-##      File class to allow
-##      </summary>
+## <param name="filetype">
+##     <summary>
+##     The object being bind-mounted
+##     </summary>
 ## </param>
 #
 interface(`platform_container_bind_mount',`
+    gen_require(`
+        attribute platform_launcher_domain;
+        type supervisor_t;
+    ')
+
+    # for non user-namespaces
     allow $1 $2:$3 { getattr relabelto };
+
+    # for user namespaces
+    allow platform_launcher_domain $2:$3 getattr;
+    allow supervisor_t $2:$3 { getattr relabelto };
+    # allow creation of the target mountpoint regardless of filetype
+    allow supervisor_t $2:file { create_file_perms read mounton };
 ')
diff --git a/recipes-security/sepolicy/vm/libcontainer/platform_container.te b/recipes-security/sepolicy/vm/libcontainer/platform_container.te
index 8092f079a06a717178465f8ee666daedc559d221..006b5e43b9063b898f7601e19a66f0e4a9854426 100644
--- a/recipes-security/sepolicy/vm/libcontainer/platform_container.te
+++ b/recipes-security/sepolicy/vm/libcontainer/platform_container.te
@@ -35,6 +35,9 @@ allow platform_container_domain tvmmink_sock_t:sock_file write;
 # Redirect all TVMRoot logs to adb logcat
 #  no user variant support for bind mounts, so always allow the mount. But
 #  writes should be behind the macro
+gen_require(`
+    type kmsg_device_t;
+')
 platform_container_bind_mount(platform_container_domain, kmsg_device_t, chr_file)
 userdebug_or_eng(`
     dev_write_kmsg(platform_container_domain)
diff --git a/recipes-security/sepolicy/vm/libcontainer/supervisor.te b/recipes-security/sepolicy/vm/libcontainer/supervisor.te
index b4d2f854993e091abcfabd4d3e9aa7d812c584d8..01fab992fdd9dfe8d1670ed0aea175963f88ae7f 100644
--- a/recipes-security/sepolicy/vm/libcontainer/supervisor.te
+++ b/recipes-security/sepolicy/vm/libcontainer/supervisor.te
@@ -6,7 +6,7 @@ policy_module(supervisor, 1.0)
 type supervisor_t;
 type supervisor_exec_t;
 
-init_vendor_domain(supervisor_t, supervisor_exec_t)
+init_daemon_domain(supervisor_t, supervisor_exec_t)
 
 type supervisor_sock_t;
 dev_node(supervisor_sock_t)
@@ -33,12 +33,11 @@ type supervisor_tmp_t;
 files_type(supervisor_tmp_t)
 files_tmp_filetrans(supervisor_t, supervisor_tmp_t, dir)
 manage_dirs_pattern(supervisor_t, tmp_t, supervisor_tmp_t)
-allow supervisor_t supervisor_tmp_t:dir { mounton search getattr };
 allow supervisor_t tmpfs_t:filesystem { mount unmount };
-# tmpfs_t rules needed until util-linux 2.39 rootcontext=@target support
-manage_files_pattern(supervisor_t, tmp_t, tmpfs_t)
-manage_dirs_pattern(supervisor_t, tmp_t, tmpfs_t)
-allow supervisor_t tmpfs_t:dir mounton;
+allow supervisor_t supervisor_tmp_t:dir { mounton relabelfrom };
+fs_tmpfs_filetrans(supervisor_t, supervisor_tmp_t, dir)
+manage_chr_files_pattern(supervisor_t, supervisor_tmp_t, supervisor_tmp_t)
+allow supervisor_t supervisor_tmp_t:chr_file relabelfrom;
 
 corecmd_exec_shell(supervisor_t)
 # Supervisor doesn't care about the shell environment
@@ -47,21 +46,20 @@ gen_require(`
 ')
 dontaudit supervisor_t home_root_t:dir { search getattr };
 
-allow supervisor_t self:capability { sys_admin sys_ptrace sys_chroot chown };
+# dac_override is required because the supervisor needs to fix dac permissions
+#  whether root is allowed to access the file or not.
+allow supervisor_t self:capability { sys_admin sys_ptrace sys_chroot chown mknod fowner dac_override };
 allow supervisor_t self:cap_userns { sys_admin sys_ptrace };
+# covered by dac_override
+dontaudit supervisor_t self:capability dac_read_search;
 
-# TODO: Replace with a more sophisticated way
 gen_require(`
     type device_t;
-    type smcinvoke_device_t;
-    type kmsg_device_t;
 ')
-allow supervisor_t {
-    device_t
-}:dir { mounton getattr };
-allow supervisor_t {
-    smcinvoke_device_t
-    kmsg_device_t
-}:chr_file getattr;
+allow supervisor_t device_t:dir { mounton getattr relabelto rmdir write add_name relabelfrom create setattr };
+allow supervisor_t device_t:chr_file { create relabelfrom setattr };
+
 # for /dev/kmsg
 mls_file_read_all_levels(supervisor_t)
+mls_file_upgrade(supervisor_t)
+mls_file_downgrade(supervisor_t)
diff --git a/recipes-security/sepolicy/vm/test/containertest.te b/recipes-security/sepolicy/vm/test/containertest.te
index 8ecf698b79b4190cb8c0f5b144007d9091b3ea80..9cfdcfe6426f95e0f235b88d13e72ca3c7ad7e81 100644
--- a/recipes-security/sepolicy/vm/test/containertest.te
+++ b/recipes-security/sepolicy/vm/test/containertest.te
@@ -16,6 +16,7 @@ type containertest_t;
 type containertest_exec_t;
 platform_container_domain_type(containertest_t, containertest_exec_t)
 domtrans_pattern(launchertest_t, containertest_exec_t, containertest_t)
+role system_r types containertest_t;
 
 userdebug_or_eng(`
     # launchertest_t
@@ -48,6 +49,8 @@ userdebug_or_eng(`
     allow launchertest_t launchertest_tmpfs_t:chr_file manage_chr_file_perms;
     allow launchertest_t launchertest_tmpfs_t:dir manage_dir_perms;
     allow launchertest_t launchertest_tmpfs_t:lnk_file create;
+
+    # required for /dev/kmsg
     mls_file_read_all_levels(launchertest_t)
 
     # Memfd testing - copy elf contents to tmpfs and transition
@@ -66,26 +69,19 @@ userdebug_or_eng(`
     # TODO: Is this common? only saw this for one test
     can_exec(containertest_t, launchertest_tmpfs_t)
 
-    # /dev/dri
-    dev_rw_dri(containertest_t)
-    mls_file_read_all_levels(containertest_t)
-    mls_file_write_all_levels(containertest_t)
-    
-    # /dev/socket/letzd
-    optional_policy(`
-        gen_require(`
-            type socket_device_t;
-            type letzd_sock_t;
-        ')
-        allow containertest_t socket_device_t:dir { getattr search };
-        allow containertest_t letzd_sock_t:sock_file getattr;
-    ')
-
     # Inspect process list. Not all containers will care about this
     kernel_list_proc(containertest_t)
     corecmd_exec_shell(containertest_t)
     # /mnt/test.txt (mount namespace test)
+    gen_require(`
+        type mount_t;
+    ')
     allow containertest_t tmpfs_t:file { read write create open };
+    mount_domtrans(containertest_t)
+    allow containertest_t mount_t:process2 nnp_transition;
+    allow mount_t self:cap_userns sys_admin;
+    kernel_read_system_state(containertest_t)
+
 
     # Memfd testing
     can_exec(containertest_t, tmpfs_t)
@@ -107,6 +103,13 @@ userdebug_or_eng(`
     vendor_kernel_load_exempt(containertest_t)
     kernel_load_module(containertest_t)
 
-    # Redirect to /dev/kmsg
-    mls_file_write_all_levels(launchertest_t)
+    # bind mounts
+    gen_require(`
+        type socket_device_t;
+        type tvmmink_sock_t;
+        type vendor_virtio_mem_device_t;
+    ')
+    platform_container_bind_mount(containertest_t, socket_device_t, dir);
+    platform_container_bind_mount(containertest_t, tvmmink_sock_t, sock_file);
+    platform_container_bind_mount(containertest_t, vendor_virtio_mem_device_t, chr_file);
 ')  # userdebug_or_eng
diff --git a/recipes-security/sepolicy/vm/tvmmink/tvmprelauncher.te b/recipes-security/sepolicy/vm/tvmmink/tvmprelauncher.te
index fa56c88d4f6969516c568fcdbd20ae9018bbf9d6..259211e9991ea335a3cb08d6ab98c567bfb44832 100644
--- a/recipes-security/sepolicy/vm/tvmmink/tvmprelauncher.te
+++ b/recipes-security/sepolicy/vm/tvmmink/tvmprelauncher.te
@@ -46,3 +46,9 @@ gen_require(`
     type tvmmink_t;
 ')
 neverallow { domain -tvmprelauncher_t -tvmmink_t } tvmprelauncher_sock_t:sock_file rw_sock_file_perms;
+
+gen_require(`
+    type socket_device_t;
+')
+platform_container_bind_mount(tvmprelauncher_t, smcinvoke_device_t, chr_file)
+platform_container_bind_mount(tvmprelauncher_t, socket_device_t, dir)