diff --git a/BoardConfig.mk b/BoardConfig.mk
index acf645b..a83f46e 100755
--- a/BoardConfig.mk
+++ b/BoardConfig.mk
@@ -1,4 +1,4 @@
-# Copyright (C) 2009 The CyanogenMod Project
+# Copyright (C) 2017 The LineageOS Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -48,6 +48,9 @@ TARGET_KERNEL_SOURCE := kernel/samsung/viennalte
 TARGET_KERNEL_CONFIG := msm8974_sec_defconfig
 TARGET_KERNEL_VARIANT_CONFIG := msm8974_sec_viennalteeur_cm_defconfig
 
+# Init
+TARGET_INIT_VENDOR_LIB := libinit_msm8974
+
 # Audio
 BOARD_HAVE_NEW_QCOM_CSDCLIENT := true
 USE_CUSTOM_AUDIO_POLICY := 1
@@ -110,7 +113,7 @@ BOARD_USES_MMCUTILS := true
 TARGET_RECOVERY_FSTAB := $(LOCAL_PATH)/rootdir/etc/fstab.qcom
 
 # SELinux
-include device/qcom/sepolicy/sepolicy.mk
+-include device/qcom/sepolicy/sepolicy.mk
 BOARD_SEPOLICY_DIRS += $(LOCAL_PATH)/sepolicy
 
 # WiFi
diff --git a/README.md b/README.md
index 2cfc0d4..83e481a 100755
--- a/README.md
+++ b/README.md
@@ -1,3 +1,69 @@
-Copyright 2014 - The CyanogenMod Project
+Device configuration for the Samsung Galaxy Note Pro 12.2
 
-Device configuration for Samsung Note Pro 12.2 (LTE)
+Copyright (C) 2017 The LineageOS Project
+Copyright (C) 2017 Valera Chigir <valera1978@tut.by>
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+------------------------------------------------------------------
+
+* Description
+
+  This repository is for LineageOS on Samsung Galaxy Note Pro 12.2 (viennalte)
+
+* How To Build LineageOS for Samsung Galaxy Note Pro 12.2
+
+  - Make a workspace
+
+mkdir cm14
+cd cm14
+
+  - Do repo init & sync
+
+repo init -u git://github.com/LineageOS/android.git -b cm-14.1
+
+  - Create .repo/local_manifests/roomservice.xml with the following content:
+
+<?xml version="1.0" encoding="UTF-8"?>
+<manifest>
+  <project name="Valera1978/android_device_samsung_viennalte" path="device/samsung/viennalte" remote="github" revision="cm14.0" />
+  <project name="Valera1978/android_kernel_samsung_viennalte" path="kernel/samsung/viennalte" remote="github" revision="cm14.0" />
+  <project name="Valera1978/android_vendor_samsung_viennalte" path="vendor/samsung/viennalte" remote="github" revision="cm14.0" />
+  <project name="LineageOS/android_external_sony_boringssl-compat" path="external/sony/boringssl-compat" remote="github" />
+  <project name="LineageOS/android_device_samsung_msm8974-common" path="device/samsung/msm8974-common" remote="github" />
+  <project name="LineageOS/android_device_qcom_common" path="device/qcom/common" remote="github" />
+  <project name="LineageOS/android_device_samsung_qcom-common" path="device/samsung/qcom-common" remote="github" />
+  <project name="LineageOS/android_hardware_samsung" path="hardware/samsung" remote="github" />
+  <project name="TheMuppets/proprietary_vendor_qcom_binaries" path="vendor/qcom/binaries" remote="github" />
+  <project name="LineageOS/android_external_stlport" path="external/stlport" remote="github" />
+</manifest>
+
+repo sync
+
+  - Copy proprietary vendor files
+
+  There are two options to to that. Connect your device with adb enabled and run:
+
+./extract-files.sh
+
+  Or if you have the system image unpacked on your disk, then simply run:
+
+    STOCK_ROM_DIR=/path/to/system ./extract-files.sh
+
+  - Setup environment
+
+. build/envsetup.sh
+
+  - Build cm14
+
+brunch viennalte
+
+or another way:
+
+lunch lineage_viennalte-userdebug
+export USE_CCACHE=1
+make -j10 bacon
diff --git a/audio/audio_policy.conf b/audio/audio_policy.conf
old mode 100644
new mode 100755
diff --git a/bluetooth/bdroid_buildcfg.h b/bluetooth/bdroid_buildcfg.h
index 27f8a0a..4df3873 100755
--- a/bluetooth/bdroid_buildcfg.h
+++ b/bluetooth/bdroid_buildcfg.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2012 The Android Open Source Project
- * Copyright (C) 2012 The CyanogenMod Project <http://www.cyanogenmod.org>
+ * Copyright (C) 2017 The LineageOS Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/camera/CameraWrapper.cpp b/camera/CameraWrapper.cpp
index e806a09..6abcce0 100755
--- a/camera/CameraWrapper.cpp
+++ b/camera/CameraWrapper.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012, The CyanogenMod Project
+ * Copyright (C) 2017, The LineageOS
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -58,7 +58,7 @@ camera_module_t HAL_MODULE_INFO_SYM = {
          .hal_api_version = HARDWARE_HAL_API_VERSION,
          .id = CAMERA_HARDWARE_MODULE_ID,
          .name = "MSM8974 Camera Wrapper",
-         .author = "The CyanogenMod Project",
+         .author = "The LineageOS Project",
          .methods = &camera_module_methods,
          .dso = NULL, /* remove compilation warnings */
          .reserved = {0}, /* remove compilation warnings */
diff --git a/configs/p2p_supplicant_overlay.conf b/configs/p2p_supplicant_overlay.conf
deleted file mode 100755
index acbace2..0000000
--- a/configs/p2p_supplicant_overlay.conf
+++ /dev/null
@@ -1 +0,0 @@
-disable_scan_offload=1
diff --git a/configs/wpa_supplicant_overlay.conf b/configs/wpa_supplicant_overlay.conf
deleted file mode 100755
index 06fc042..0000000
--- a/configs/wpa_supplicant_overlay.conf
+++ /dev/null
@@ -1 +0,0 @@
-p2p_disabled=1
diff --git a/device.mk b/device.mk
index 74f721c..ddecb20 100755
--- a/device.mk
+++ b/device.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2011 The CyanogenMod Project
+# Copyright (C) 2017 The LineageOS Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -35,6 +35,7 @@ $(call inherit-product-if-exists, frameworks/native/build/phone-xxxhdpi-3072-hwu
 
 # Permissions
 PRODUCT_COPY_FILES += \
+    frameworks/native/data/etc/android.hardware.audio.low_latency.xml:system/etc/permissions/android.hardware.audio.low_latency.xml \
     frameworks/native/data/etc/android.hardware.consumerir.xml:system/etc/permissions/android.hardware.consumerir.xml \
     frameworks/native/data/etc/android.hardware.telephony.cdma.xml:system/etc/permissions/android.hardware.telephony.cdma.xml \
     frameworks/native/data/etc/android.hardware.telephony.gsm.xml:system/etc/permissions/android.hardware.telephony.gsm.xml \
@@ -54,6 +55,10 @@ PRODUCT_PACKAGES += \
     camera.msm8974 \
     libxml2
 
+# Doze
+PRODUCT_PACKAGES += \
+    SamsungDoze
+
 # GPS
 PRODUCT_PACKAGES += \
     gps.msm8974
@@ -114,6 +119,10 @@ PRODUCT_PACKAGES += \
 PRODUCT_PACKAGES += \
     Gello
 
+# Root
+PRODUCT_PACKAGES += \
+    su
+
 # Thermal
 PRODUCT_COPY_FILES += \
     $(LOCAL_PATH)/configs/thermal-engine-8974.conf:system/etc/thermal-engine-8974.conf \
diff --git a/include/camera/CameraParametersExtra.h b/include/camera/CameraParametersExtra.h
index 9ee51f1..bc2249d 100755
--- a/include/camera/CameraParametersExtra.h
+++ b/include/camera/CameraParametersExtra.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014 The CyanogenMod Project
+ * Copyright (C) 2017 The LineageOS Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/liblights/Android.mk b/liblights/Android.mk
index d1cb599..10de21a 100755
--- a/liblights/Android.mk
+++ b/liblights/Android.mk
@@ -1,4 +1,4 @@
-# Copyright (C) 2012 The CyanogenMod Project
+# Copyright (C) 2017 The LineageOS Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/liblights/lights.c b/liblights/lights.c
index 3aff9ab..0cdcb5b 100755
--- a/liblights/lights.c
+++ b/liblights/lights.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2008 The Android Open Source Project
- * Copyright (C) 2013 The CyanogenMod Project
+ * Copyright (C) 2017 The LineageOS Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -165,6 +165,6 @@ struct hw_module_t HAL_MODULE_INFO_SYM = {
     .version_minor = 0,
     .id = LIGHTS_HARDWARE_MODULE_ID,
     .name = "Viennalte Lights Module",
-    .author = "The CyanogenMod Project",
+    .author = "The LineageOS Project",
     .methods = &lights_module_methods,
 };
diff --git a/overlay/frameworks/base/packages/SettingsProvider/res/values/config.xml b/overlay/frameworks/base/packages/SettingsProvider/res/values/config.xml
index 13c9dfe..7f99839 100755
--- a/overlay/frameworks/base/packages/SettingsProvider/res/values/config.xml
+++ b/overlay/frameworks/base/packages/SettingsProvider/res/values/config.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
 /**
- * Copyright (c) 2012, The CyanogenMod Project
+ * Copyright (c) 2017, The LineageOS
  *
  * Licensed under the Apache License, Version 2.0 (the "License"); 
  * you may not use this file except in compliance with the License. 
diff --git a/overlay/packages/apps/Settings/res/values/config.xml b/overlay/packages/apps/Settings/res/values/config.xml
index bb9eca4..b1307c3 100755
--- a/overlay/packages/apps/Settings/res/values/config.xml
+++ b/overlay/packages/apps/Settings/res/values/config.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright (C) 2012 The CyanogenMod Project
+<!-- Copyright (C) 2017 The LineageOS Project
 
      Licensed under the Apache License, Version 2.0 (the "License");
      you may not use this file except in compliance with the License.
diff --git a/power/power_ext.c b/power/power_ext.c
index c31c10f..a508e68 100755
--- a/power/power_ext.c
+++ b/power/power_ext.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014 The CyanogenMod Project
+ * Copyright (c) 2017 The LineageOS Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/readme b/readme
deleted file mode 100755
index 83e481a..0000000
--- a/readme
+++ /dev/null
@@ -1,69 +0,0 @@
-Device configuration for the Samsung Galaxy Note Pro 12.2
-
-Copyright (C) 2017 The LineageOS Project
-Copyright (C) 2017 Valera Chigir <valera1978@tut.by>
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-------------------------------------------------------------------
-
-* Description
-
-  This repository is for LineageOS on Samsung Galaxy Note Pro 12.2 (viennalte)
-
-* How To Build LineageOS for Samsung Galaxy Note Pro 12.2
-
-  - Make a workspace
-
-mkdir cm14
-cd cm14
-
-  - Do repo init & sync
-
-repo init -u git://github.com/LineageOS/android.git -b cm-14.1
-
-  - Create .repo/local_manifests/roomservice.xml with the following content:
-
-<?xml version="1.0" encoding="UTF-8"?>
-<manifest>
-  <project name="Valera1978/android_device_samsung_viennalte" path="device/samsung/viennalte" remote="github" revision="cm14.0" />
-  <project name="Valera1978/android_kernel_samsung_viennalte" path="kernel/samsung/viennalte" remote="github" revision="cm14.0" />
-  <project name="Valera1978/android_vendor_samsung_viennalte" path="vendor/samsung/viennalte" remote="github" revision="cm14.0" />
-  <project name="LineageOS/android_external_sony_boringssl-compat" path="external/sony/boringssl-compat" remote="github" />
-  <project name="LineageOS/android_device_samsung_msm8974-common" path="device/samsung/msm8974-common" remote="github" />
-  <project name="LineageOS/android_device_qcom_common" path="device/qcom/common" remote="github" />
-  <project name="LineageOS/android_device_samsung_qcom-common" path="device/samsung/qcom-common" remote="github" />
-  <project name="LineageOS/android_hardware_samsung" path="hardware/samsung" remote="github" />
-  <project name="TheMuppets/proprietary_vendor_qcom_binaries" path="vendor/qcom/binaries" remote="github" />
-  <project name="LineageOS/android_external_stlport" path="external/stlport" remote="github" />
-</manifest>
-
-repo sync
-
-  - Copy proprietary vendor files
-
-  There are two options to to that. Connect your device with adb enabled and run:
-
-./extract-files.sh
-
-  Or if you have the system image unpacked on your disk, then simply run:
-
-    STOCK_ROM_DIR=/path/to/system ./extract-files.sh
-
-  - Setup environment
-
-. build/envsetup.sh
-
-  - Build cm14
-
-brunch viennalte
-
-or another way:
-
-lunch lineage_viennalte-userdebug
-export USE_CCACHE=1
-make -j10 bacon
diff --git a/ril/ril_shim.c b/ril/ril_shim.c
index d240fa6..3cd7605 100755
--- a/ril/ril_shim.c
+++ b/ril/ril_shim.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015 The CyanogenMod Project
+ * Copyright (C) 2017 The LineageOS Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/sepolicy/bluetooth.te b/sepolicy/bluetooth.te
index 154f4bc..2ea6924 100755
--- a/sepolicy/bluetooth.te
+++ b/sepolicy/bluetooth.te
@@ -1,2 +1,3 @@
-allow bluetooth bluetooth_device:chr_file { open write };
+allow bluetooth bluetooth_device:chr_file rw_file_perms;
 allow bluetooth proc_bluetooth_writable:dir search;
+allow bluetooth wifi_data_file:file r_file_perms;
diff --git a/sepolicy/cameraserver.te b/sepolicy/cameraserver.te
index b7d7a34..2a2100a 100755
--- a/sepolicy/cameraserver.te
+++ b/sepolicy/cameraserver.te
@@ -1,7 +1,7 @@
 allow cameraserver camera_socket:sock_file write;
 allow cameraserver init:unix_stream_socket connectto;
 allow cameraserver property_socket:sock_file write;
-allow cameraserver system_data_file:sock_file write;
+allow cameraserver sysfs_camera:dir search;
+allow cameraserver sysfs_camera:file { open read };
 allow cameraserver system_file:file execmod;
-allow cameraserver system_prop:property_service set;
-allow cameraserver tmpfs:dir search;
+
diff --git a/sepolicy/file.te b/sepolicy/file.te
index 275a0f2..5ba86a2 100755
--- a/sepolicy/file.te
+++ b/sepolicy/file.te
@@ -1,7 +1,8 @@
+type sensors_efs_file, file_type;
 type sysfs_camera, fs_type, sysfs_type;
 type sysfs_display, fs_type, sysfs_type;
-type sysfs_vibeamp, fs_type, sysfs_type;
-type sysfs_rmnet, fs_type, sysfs_type;
 type sysfs_sec, fs_type, sysfs_type;
+type sysfs_vibeamp, fs_type, sysfs_type;
+type sysfs_wifi_nv_path, fs_type, sysfs_type;
+type vcs_data_file, file_type, data_file_type;
 type wifi_efs_file, file_type;
-type sensors_efs_file, file_type;
diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index 8753968..57edebf 100755
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -1,5 +1,9 @@
+# Audience
+/dev/ttyHS3                                             u:object_r:audio_device:s0
+
 # Bluetooth
 /dev/btlock                                             u:object_r:bluetooth_device:s0
+/dev/rfkill                                             u:object_r:bluetooth_device:s0
 /efs/bluetooth(/.*)?                                    u:object_r:bluetooth_efs_file:s0
 
 # Camera
@@ -8,34 +12,44 @@
 
 # CMHW
 /sys/devices/virtual/timed_output/vibrator(/.*)?        u:object_r:sysfs_vibeamp:s0
-/sys/class/sec/sec_touchkey/keypad_enable               u:object_r:sysfs_display:s0
-
-# Domain
-/system/bin/macloader                                   u:object_r:macloader_exec:s0
 
 # Display
 /sys/devices/virtual/lcd/panel/power_reduce             u:object_r:sysfs_display:s0
 
-# RIL
-/efs/FactoryApp(/.*)?                                   u:object_r:efs_file:s0
-/efs/imei                                               u:object_r:efs_file:s0
-/efs/mps_code.dat                                       u:object_r:efs_file:s0
+# EFS
+/dev/block/platform/msm_sdcc.1/by-name/efs              u:object_r:modem_efs_partition_device:s0
 
-# RMNET
-/sys/class/android_usb/f_rmnet_smd_sdio/transport  --  u:object_r:sysfs_rmnet:s0
-/sys/devices/virtual/android_usb/android0/f_rmnet_smd_sdio/transport  --  u:object_r:sysfs_rmnet:s0
+# Fingerprint
+/data/validity(/.*)?                                    u:object_r:vcs_data_file:s0
+/dev/validity(/.*)?                                     u:object_r:vcs_device:s0
+/dev/vfsspi                                             u:object_r:vcs_device:s0
+
+# Macloader
+/system/bin/macloader                                   u:object_r:macloader_exec:s0
+
+# NFC
+/dev/bcm2079x                                           u:object_r:nfc_device:s0
+/dev/pn547                                              u:object_r:nfc_device:s0
+
+# RIL
+/data/data/com.android.providers.telephony/databases(/.*)?     u:object_r:radio_data_file:s0
+/data/data/com.android.providers.telephony/shared_prefs(/.*)?  u:object_r:radio_data_file:s0
 
 # SEC
 /sys/devices/virtual/sec/sec_key/hall_irq_ctrl          u:object_r:sysfs_sec:s0
+/sys/devices/virtual/sec/tsp(/.*)?                      u:object_r:sysfs_sec:s0
 
 # Sensors
 /dev/batch_io                                           u:object_r:sensors_device:s0
-/dev/shtc1_sensor                                       u:object_r:sensors_device:s0
 /efs/FactoryApp/baro_delta                              u:object_r:sensors_efs_file:s0
+/efs/gyro_cal_data                                      u:object_r:sensors_efs_file:s0
 /efs/prox_cal                                           u:object_r:sensors_efs_file:s0
 
-# Thermal
-/system/bin/thermal-engine                              u:object_r:thermal-engine_exec:s0
+# Uncrypt
+/dev/block/platform/msm_sdcc.1/by-name/fota             u:object_r:misc_block_device:s0
 
 # WiFi
-/efs/wifi/.mac.info                                     u:object_r:wifi_efs_file:s0
+/data/.cid.info                                         u:object_r:wifi_data_file:s0
+/data/.wifiver.info                                     u:object_r:wifi_data_file:s0
+/efs/wifi(/.*)?                                         u:object_r:wifi_efs_file:s0
+/sys/module/dhd/parameters/nvram_path                   u:object_r:sysfs_wifi_nv_path:s0
diff --git a/sepolicy/fingerprintd.te b/sepolicy/fingerprintd.te
new file mode 100755
index 0000000..4a25a4c
--- /dev/null
+++ b/sepolicy/fingerprintd.te
@@ -0,0 +1,14 @@
+allow fingerprintd vcs_data_file:dir create_dir_perms;
+allow fingerprintd vcs_data_file:file create_file_perms;
+
+allow fingerprintd vcs_device:dir create_dir_perms;
+allow fingerprintd vcs_device:file create_file_perms;
+allow fingerprintd vcs_device:fifo_file create_file_perms;
+allow fingerprintd vcs_device:chr_file create_file_perms;
+
+allow fingerprintd tee_device:chr_file rw_file_perms;
+
+allow fingerprintd firmware_file:dir r_dir_perms;
+allow fingerprintd firmware_file:file r_file_perms;
+
+allow fingerprintd vfat:file { getattr open read };
diff --git a/sepolicy/fsck.te b/sepolicy/fsck.te
new file mode 100755
index 0000000..a66c9df
--- /dev/null
+++ b/sepolicy/fsck.te
@@ -0,0 +1 @@
+allow fsck modem_efs_partition_device:blk_file rw_file_perms;
diff --git a/sepolicy/genfs_contexts b/sepolicy/genfs_contexts
index 51f0c78..49a35af 100755
--- a/sepolicy/genfs_contexts
+++ b/sepolicy/genfs_contexts
@@ -1,2 +1 @@
-genfscon proc /bluetooth/sleep/lpm     u:object_r:proc_bluetooth_writable:s0
-genfscon proc /bluetooth/sleep/btwrite u:object_r:proc_bluetooth_writable:s0
+genfscon proc /bluetooth/sleep u:object_r:proc_bluetooth_writable:s0
diff --git a/sepolicy/healthd.te b/sepolicy/healthd.te
new file mode 100755
index 0000000..cdf9e70
--- /dev/null
+++ b/sepolicy/healthd.te
@@ -0,0 +1,2 @@
+allow healthd device:dir r_dir_perms;
+allow healthd rtc_device:chr_file rw_file_perms;
diff --git a/sepolicy/hostapd.te b/sepolicy/hostapd.te
new file mode 100755
index 0000000..f9388f6
--- /dev/null
+++ b/sepolicy/hostapd.te
@@ -0,0 +1 @@
+allow hostapd bluetooth_device:chr_file { open read };
diff --git a/sepolicy/init.te b/sepolicy/init.te
new file mode 100755
index 0000000..4ba3a86
--- /dev/null
+++ b/sepolicy/init.te
@@ -0,0 +1,2 @@
+allow init sysfs_sec:lnk_file r_file_perms;
+allow init debugfs:file write;
diff --git a/sepolicy/kernel.te b/sepolicy/kernel.te
new file mode 100755
index 0000000..2193b45
--- /dev/null
+++ b/sepolicy/kernel.te
@@ -0,0 +1,2 @@
+allow kernel audio_device:chr_file rw_file_perms;
+allow kernel efs_file:dir search;
diff --git a/sepolicy/macloader.te b/sepolicy/macloader.te
index afc2fc4..df90419 100755
--- a/sepolicy/macloader.te
+++ b/sepolicy/macloader.te
@@ -5,7 +5,9 @@ init_daemon_domain(macloader)
 type_transition macloader system_data_file:file wifi_data_file;
 
 allow macloader efs_file:dir search;
-allow macloader wifi_efs_file:dir search;
-
-allow macloader wifi_efs_file:file { read open getattr };
+allow macloader self:capability { chown dac_override fowner fsetid };
+allow macloader sysfs_wifi_nv_path:file { open write };
 allow macloader system_data_file:dir { add_name search write };
+allow macloader wifi_data_file:file { create_file_perms getattr setattr };
+allow macloader wifi_efs_file:dir search;
+allow macloader wifi_efs_file:file r_file_perms;
diff --git a/sepolicy/mediaserver.te b/sepolicy/mediaserver.te
index ba25c10..7ebc14c 100755
--- a/sepolicy/mediaserver.te
+++ b/sepolicy/mediaserver.te
@@ -1,6 +1,6 @@
-allow mediaserver persist_drm_file:dir search;
-allow mediaserver persist_drm_file:file rw_file_perms;
+allow mediaserver cameraproxy_service:service_manager find;
+allow mediaserver sensorservice_service:service_manager find;
 allow mediaserver sysfs_camera:dir search;
 allow mediaserver sysfs_camera:file { getattr open read };
-allow mediaserver system_data_file:sock_file { write };
 allow mediaserver system_file:file execmod; # for libmmjpeg
+allow mediaserver system_prop:property_service set;
diff --git a/sepolicy/mm-qcamerad.te b/sepolicy/mm-qcamerad.te
index ac48102..f30345c 100755
--- a/sepolicy/mm-qcamerad.te
+++ b/sepolicy/mm-qcamerad.te
@@ -1,6 +1,6 @@
+allow mm-qcamerad media_rw_data_file:dir search;
 allow mm-qcamerad sysfs_camera:dir search;
-allow mm-qcamerad sysfs_camera:file { getattr open read write };
-allow mm-qcamerad system_data_file:dir { add_name remove_name write };
-allow mm-qcamerad system_data_file:sock_file { create unlink };
-allow mm-qcamerad system_data_file:sock_file unlink;
-allow mm-qcamerad system_file:file execmod;
+allow mm-qcamerad sysfs_camera:file rw_file_perms;
+allow mm-qcamerad system_data_file:dir w_dir_perms;
+allow mm-qcamerad system_file:file execmod; # for libmmcamera_faceproc
+type_transition mm-qcamerad system_data_file:sock_file camera_socket "cam_socket3";
diff --git a/sepolicy/mpdecision.te b/sepolicy/mpdecision.te
new file mode 100755
index 0000000..25e559f
--- /dev/null
+++ b/sepolicy/mpdecision.te
@@ -0,0 +1,2 @@
+allow mpdecision system_data_file:dir { add_name remove_name write };
+allow mpdecision system_data_file:sock_file write;
diff --git a/sepolicy/platform_app.te b/sepolicy/platform_app.te
index df0989d..3b7e201 100755
--- a/sepolicy/platform_app.te
+++ b/sepolicy/platform_app.te
@@ -1,7 +1,3 @@
-allow platform_app fuseblk:dir read;
-allow platform_app fuseblk:dir { open write };
-allow platform_app fuseblk:dir { search };
-allow platform_app fuseblk:file { read write };
-allow platform_app fuseblk:file { open };
-allow platform_app fuseblk:file { getattr };
+allow platform_app fuseblk:dir { open read remove_name search write };
+allow platform_app fuseblk:file { getattr unlink write };
 
diff --git a/sepolicy/priv_app.te b/sepolicy/priv_app.te
new file mode 100755
index 0000000..b70230c
--- /dev/null
+++ b/sepolicy/priv_app.te
@@ -0,0 +1,3 @@
+allow priv_app device:dir { open read };
+allow priv_app fuseblk:dir { add_name open read search read write };
+allow priv_app fuseblk:file { create getattr open read write };
diff --git a/sepolicy/property_contexts b/sepolicy/property_contexts
new file mode 100755
index 0000000..1f84c35
--- /dev/null
+++ b/sepolicy/property_contexts
@@ -0,0 +1,10 @@
+##########################
+# property service keys
+#
+#
+persist.ril.radiocapa.tdscdma            u:object_r:radio_prop:s0
+persist.ril.modem.board                  u:object_r:radio_prop:s0
+persist.ril.ims.eutranParam              u:object_r:radio_prop:s0
+persist.ril.ims.utranParam               u:object_r:radio_prop:s0
+persist.ril.xcap.pdnFailCause            u:object_r:radio_prop:s0
+persist.ril.ims.pdnFailCause             u:object_r:radio_prop:s0
diff --git a/sepolicy/rild.te b/sepolicy/rild.te
index f0e72b5..9be05bc 100755
--- a/sepolicy/rild.te
+++ b/sepolicy/rild.te
@@ -1,3 +1,5 @@
-allow rild proc_net:file { getattr open read write };
-allow rild sysfs_sec:file { getattr open read write };
-allow rild self:capability { dac_override dac_read_search };
+allow rild proc_net:file rw_file_perms;
+allow rild self:capability dac_override;
+allow rild sysfs_sec:file rw_file_perms;
+allow rild radio_data_file:lnk_file read;
+allow rild radio_prop:property_service set;
diff --git a/sepolicy/rmt_storage.te b/sepolicy/rmt_storage.te
index a46ca64..ebf0d84 100755
--- a/sepolicy/rmt_storage.te
+++ b/sepolicy/rmt_storage.te
@@ -1 +1 @@
-allow rmt_storage ssd_device:blk_file { open read write };
+allow rmt_storage self:capability dac_override;
diff --git a/sepolicy/system_app.te b/sepolicy/system_app.te
deleted file mode 100755
index bc716f2..0000000
--- a/sepolicy/system_app.te
+++ /dev/null
@@ -1 +0,0 @@
-allow system_app sysfs_display:file { getattr open read write };
diff --git a/sepolicy/system_server.te b/sepolicy/system_server.te
index 4bc10ab..75c1bd4 100755
--- a/sepolicy/system_server.te
+++ b/sepolicy/system_server.te
@@ -1,9 +1,10 @@
-allow system_server sysfs_vibeamp:dir search;
-allow system_server sysfs_vibeamp:file { getattr open read write };
-allow system_server time_daemon:unix_stream_socket connectto;
-allow system_server sysfs_thermal:dir search;
-allow system_server sysfs_thermal:file { open read write };
 allow system_server efs_file:dir search;
-allow system_server sensors_efs_file:file { open read };
-allow system_server efs_file:file { read };
-allow system_server wifi_efs_file:file { read write };
+allow system_server sensors_efs_file:file r_file_perms;
+allow system_server sysfs_display:file rw_file_perms;
+allow system_server sysfs_sec:dir search;
+allow system_server sysfs_sec:file rw_file_perms;
+allow system_server sysfs_vibeamp:dir search;
+allow system_server sysfs_vibeamp:file rw_file_perms;
+allow system_server wifi_efs_file:dir search;
+allow system_server wifi_efs_file:file r_file_perms;
+allow system_server app_data_file:file rename;
diff --git a/sepolicy/tee.te b/sepolicy/tee.te
new file mode 100755
index 0000000..02eeef6
--- /dev/null
+++ b/sepolicy/tee.te
@@ -0,0 +1,2 @@
+allow tee vcs_data_file:dir create_dir_perms;
+allow tee vcs_data_file:file create_file_perms;
diff --git a/sepolicy/thermal-engine.te b/sepolicy/thermal-engine.te
new file mode 100755
index 0000000..97ae015
--- /dev/null
+++ b/sepolicy/thermal-engine.te
@@ -0,0 +1 @@
+allow thermal-engine self:capability chown;
diff --git a/sepolicy/time_daemon.te b/sepolicy/time_daemon.te
deleted file mode 100755
index d41beff..0000000
--- a/sepolicy/time_daemon.te
+++ /dev/null
@@ -1,2 +0,0 @@
-allow time_daemon time_data_file:file { getattr append unlink };
-allow time_daemon time_data_file:dir { remove_name };
\ No newline at end of file
diff --git a/sepolicy/ueventd.te b/sepolicy/ueventd.te
index 2000897..d03550c 100755
--- a/sepolicy/ueventd.te
+++ b/sepolicy/ueventd.te
@@ -1,2 +1,6 @@
-allow ueventd sysfs_vibeamp:file rw_file_perms;
 allow ueventd sysfs_camera:file rw_file_perms;
+allow ueventd sysfs_sec:file rw_file_perms;
+allow ueventd sysfs_vibeamp:file rw_file_perms;
+allow ueventd vcs_device:chr_file create_file_perms;
+allow ueventd vfat:dir search;
+allow ueventd vfat:file { getattr open read };
diff --git a/sepolicy/untrusted_app.te b/sepolicy/untrusted_app.te
index 362f06f..12f3fdb 100755
--- a/sepolicy/untrusted_app.te
+++ b/sepolicy/untrusted_app.te
@@ -1,12 +1,3 @@
-allow untrusted_app fuseblk:dir read;
-allow untrusted_app fuseblk:dir { open write };
-allow untrusted_app fuseblk:dir { search };
-allow untrusted_app fuseblk:file { read write };
-allow untrusted_app fuseblk:file { open };
-allow untrusted_app fuseblk:file { getattr };
-
-allow untrusted_app rootfs:dir { read };
-allow untrusted_app sysfs:file { read };
-allow untrusted_app sysfs:file { open };
-
-
+# These are safe for an untrusted_app -- they are the external SD card
+allow untrusted_app fuseblk:dir search;
+allow untrusted_app fuseblk:file { getattr read };
diff --git a/sepolicy/vold.te b/sepolicy/vold.te
new file mode 100755
index 0000000..61ec258
--- /dev/null
+++ b/sepolicy/vold.te
@@ -0,0 +1 @@
+allow vold efs_file:dir r_file_perms;
diff --git a/sepolicy/wpa.te b/sepolicy/wpa.te
new file mode 100755
index 0000000..1cdf25b
--- /dev/null
+++ b/sepolicy/wpa.te
@@ -0,0 +1,4 @@
+allow wpa bluetooth_device:chr_file rw_file_perms;
+allow wpa efs_file:dir search;
+allow wpa wifi_efs_file:dir search;
+allow wpa wifi_efs_file:file r_file_perms;
diff --git a/setup-makefiles.sh b/setup-makefiles.sh
index 588f7a7..efa0bd2 100755
--- a/setup-makefiles.sh
+++ b/setup-makefiles.sh
@@ -13,7 +13,7 @@ echo "Setup makefiles in $OUT_ROOT for $DEVICE"
 echo "Proprietary files in $OUT_PROP"
 
 (cat << EOF) > $MAKEFILE
-# Copyright (C) 2014 The CyanogenMod Project
+# Copyright (C) 2017 The LineageOS Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -54,7 +54,7 @@ for FILE in `egrep -v '(^#|^$)' $1`; do
 done
 
 (cat << EOF) > $OUT_ROOT/$DEVICE-vendor.mk
-# Copyright (C) 2014 The CyanogenMod Project
+# Copyright (C) 2017 The LineageOS Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -84,7 +84,7 @@ PRODUCT_PACKAGES += \\
 EOF
 
   (cat << EOF) > $OUT_ROOT//Android.mk
-# Copyright (C) 2014 The CyanogenMod Project
+# Copyright (C) 2017 The LineageOS Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/system.prop b/system.prop
index d95831b..f582006 100755
--- a/system.prop
+++ b/system.prop
@@ -44,3 +44,7 @@ ro.vendor.extension_library=/vendor/lib/libqti-perfd-client.so
 
 # Bluetooth
 qcom.bluetooth.soc=rome
+
+# Tethering
+PRODUCT_PROPERTY_OVERRIDES += \
+    net.tethering.noprovisioning=true