diff --git a/Android.mk b/Android.mk
index f36e1b3..90e430c 100644
--- a/Android.mk
+++ b/Android.mk
@@ -1,6 +1,9 @@
 ifeq ($(HAVE_SELINUX),true)
 
 LOCAL_PATH:= $(call my-dir)
+
+include $(call all-makefiles-under,$(LOCAL_PATH))
+
 include $(CLEAR_VARS)
 
 # SELinux policy version.
@@ -20,6 +23,7 @@
 LOCAL_POLICY_PORT_CONTEXTS := $(wildcard $(addsuffix sepolicy.port_contexts, $(LOCAL_POLICY_DIRS)))
 LOCAL_POLICY_GENFS_CONTEXTS := $(wildcard $(addsuffix sepolicy.genfs_contexts, $(LOCAL_POLICY_DIRS)))
 LOCAL_POLICY_INITIAL_SID_CONTEXTS := $(wildcard $(addsuffix sepolicy.initial_sid_contexts, $(LOCAL_POLICY_DIRS)))
+LOCAL_POLICY_SC := $(wildcard $(addsuffix seapp_contexts, $(LOCAL_POLICY_DIRS)))
 
 ##################################
 include $(CLEAR_VARS)
@@ -73,17 +77,26 @@
 	$(hide) m4 -s $^ > $@
 
 file_contexts :=
+
 ##################################
 include $(CLEAR_VARS)
-
 LOCAL_MODULE := seapp_contexts
-LOCAL_SRC_FILES := $(LOCAL_MODULE)
 LOCAL_MODULE_CLASS := ETC
 LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
 
-include $(BUILD_PREBUILT)
+include $(BUILD_SYSTEM)/base_rules.mk
 
+seapp_contexts.tmp := $(intermediates)/seapp_contexts.tmp
+$(seapp_contexts.tmp): $(LOCAL_PATH)/seapp_contexts $(LOCAL_POLICY_SC)
+	@mkdir -p $(dir $@)
+	$(hide) m4 -s $^ > $@
+
+$(LOCAL_BUILT_MODULE) : $(seapp_contexts.tmp) $(TARGET_ROOT_OUT)/sepolicy.$(POLICYVERS) $(HOST_OUT_EXECUTABLES)/checkseapp
+	@mkdir -p $(dir $@)
+	$(HOST_OUT_EXECUTABLES)/checkseapp -p $(TARGET_ROOT_OUT)/sepolicy.24 -o $@ $<
+
+seapp_contexts.tmp :=
 ##################################
 include $(CLEAR_VARS)
 
diff --git a/check_seapp/Android.mk b/check_seapp/Android.mk
new file mode 100644
index 0000000..e4a4acc
--- /dev/null
+++ b/check_seapp/Android.mk
@@ -0,0 +1,15 @@
+##
+# checkseapp
+#
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := checkseapp
+LOCAL_MODULE_TAGS := optional
+LOCAL_C_INCLUDES := $(LOCAL_PATH)/../libsepol/include/ 
+LOCAL_CFLAGS := -DLINK_SEPOL_STATIC 
+LOCAL_SRC_FILES := check_seapp/check_seapp.c
+LOCAL_STATIC_LIBRARIES := libsepol
+LOCAL_MODULE_CLASS := EXECUTABLES
+
+include $(BUILD_HOST_EXECUTABLE)
diff --git a/check_seapp/check_seapp.c b/check_seapp/check_seapp.c
new file mode 100644
index 0000000..5865bd0
--- /dev/null
+++ b/check_seapp/check_seapp.c
@@ -0,0 +1,968 @@
+#include <stdio.h>
+#include <stdarg.h>
+#include <ctype.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+#include <stdint.h>
+#include <search.h>
+#include <sepol/sepol.h>
+#include <sepol/policydb/policydb.h>
+
+#define TABLE_SIZE 1024
+#define KVP_NUM_OF_RULES (sizeof(rules) / sizeof(key_map))
+#define log_set_verbose() do { logging_verbose = 1; log_info("Enabling verbose\n"); } while(0)
+#define log_error(fmt, ...) log_msg(stderr, "Error: ", fmt, ##__VA_ARGS__)
+#define log_warn(fmt, ...) log_msg(stderr, "Warning: ", fmt, ##__VA_ARGS__)
+#define log_info(fmt, ...) if (logging_verbose ) { log_msg(stdout, "Info: ", fmt, ##__VA_ARGS__); }
+
+typedef struct line_order_list line_order_list;
+typedef struct hash_entry hash_entry;
+typedef enum key_dir key_dir;
+typedef enum data_type data_type;
+typedef enum rule_map_switch rule_map_switch;
+typedef enum map_match map_match;
+typedef struct key_map key_map;
+typedef struct kvp kvp;
+typedef struct rule_map rule_map;
+typedef struct policy_info policy_info;
+
+enum map_match {
+	map_no_matches,
+	map_input_matched,
+	map_matched
+};
+
+/**
+ * Whether or not the "key" from a key vaue pair is considered an
+ * input or an output.
+ */
+enum key_dir {
+	dir_in, dir_out
+};
+
+/**
+ * Used as options to rule_map_free()
+ *
+ * This is needed to get around the fact that GNU C's hash_map doesn't copy the key, so
+ * we cannot free a key when overrding rule_map's in the table.
+ */
+enum rule_map_switch {
+	rule_map_preserve_key, /** Used to preserve the key in the rule_map, ie don't free it*/
+	rule_map_destroy_key   /** Used when you need a full free of the rule_map structure*/
+};
+
+/**
+ * The expected "type" of data the value in the key
+ * value pair should be.
+ */
+enum data_type {
+	dt_bool, dt_string
+};
+
+/**
+ * This list is used to store a double pointer to each
+ * hash table / line rule combination. This way a replacement
+ * in the hash table automatically updates the list. The list
+ * is also used to keep "first encountered" ordering amongst
+ * the encountered key value pairs in the rules file.
+ */
+struct line_order_list {
+	hash_entry *e;
+	line_order_list *next;
+};
+
+/**
+ * The workhorse of the logic. This struct maps key value pairs to
+ * an associated set of meta data maintained in rule_map_new()
+ */
+struct key_map {
+	char *name;
+	key_dir dir;
+	data_type type;
+	char *data;
+};
+
+/**
+ * Key value pair struct, this represents the raw kvp values coming
+ * from the rules files.
+ */
+struct kvp {
+	char *key;
+	char *value;
+};
+
+/**
+ * Rules are made up of meta data and an associated set of kvp stored in a
+ * key_map array.
+ */
+struct rule_map {
+	char *key; /** key value before hashing */
+	int length; /** length of the key map */
+	int lineno; /** Line number rule was encounter on */
+	rule_map *next; /** next pointer used in hash table for chaining on collision */
+	key_map m[]; /** key value mapping */
+};
+
+struct hash_entry {
+	rule_map *r; /** The rule map to store at that location */
+};
+
+/**
+ * Data associated for a policy file
+ */
+struct policy_info {
+
+	char *policy_file_name; /** policy file path name */
+	FILE *policy_file;      /** file handle to the policy file */
+	sepol_policydb_t *db;
+	sepol_policy_file_t *pf;
+	sepol_handle_t *handle;
+	sepol_context_t *con;
+};
+
+/** Set to !0 to enable verbose logging */
+static int logging_verbose = 0;
+
+/** file handle to the output file */
+static FILE *output_file = NULL;
+
+/** file handle to the input file */
+static FILE *input_file = NULL;
+
+/** output file path name */
+static char *out_file_name = NULL;
+
+/** input file path name */
+static char *in_file_name = NULL;
+
+static policy_info pol = {
+	.policy_file_name = NULL,
+	.policy_file = NULL,
+	.db = NULL,
+	.pf = NULL,
+	.handle = NULL,
+	.con = NULL
+};
+
+/**
+ * The heart of the mapping process, this must be updated if a new key value pair is added
+ * to a rule.
+ */
+key_map rules[] = {
+                /*Inputs*/
+                { .name = "isSystemServer", .type = dt_bool,   .dir = dir_in,  .data = NULL },
+                { .name = "user",           .type = dt_string, .dir = dir_in,  .data = NULL },
+                { .name = "seinfo",         .type = dt_string, .dir = dir_in,  .data = NULL },
+                { .name = "name",           .type = dt_string, .dir = dir_in,  .data = NULL },
+                { .name = "sebool",         .type = dt_string, .dir = dir_in,  .data = NULL },
+                /*Outputs*/
+                { .name = "domain",         .type = dt_string, .dir = dir_out, .data = NULL },
+                { .name = "type",           .type = dt_string, .dir = dir_out, .data = NULL },
+                { .name = "levelFromUid",   .type = dt_bool,   .dir = dir_out, .data = NULL },
+                { .name = "level",          .type = dt_string, .dir = dir_out, .data = NULL },
+			};
+
+/**
+ * Head pointer to a linked list of
+ * rule map table entries, used for
+ * preserving the order of entries
+ * based on "first encounter"
+ */
+static line_order_list *list_head = NULL;
+
+/**
+ * Pointer to the tail of the list for
+ * quick appends to the end of the list
+ */
+static line_order_list *list_tail = NULL;
+
+/**
+ * Send a logging message to a file
+ * @param out
+ * 	Output file to send message too
+ * @param prefix
+ * 	A special prefix to write to the file, such as "Error:"
+ * @param fmt
+ * 	The printf style formatter to use, such as "%d"
+ */
+static void log_msg(FILE *out, const char *prefix, const char *fmt, ...) {
+	fprintf(out, "%s", prefix);
+	va_list args;
+	va_start(args, fmt);
+	vfprintf(out, fmt, args);
+	va_end(args);
+}
+
+/**
+ * Checks for a type in the policy.
+ * @param db
+ * 	The policy db to search
+ * @param type
+ * 	The type to search for
+ * @return
+ * 	1 if the type is found, 0 otherwise.
+ * @warning
+ * 	This function always returns 1 if libsepol is not linked
+ * 	statically to this executable and LINK_SEPOL_STATIC is not
+ * 	defined.
+ */
+int check_type(sepol_policydb_t *db, char *type) {
+
+	int rc = 1;
+#if defined(LINK_SEPOL_STATIC)
+	policydb_t *d = (policydb_t *)db;
+	hashtab_datum_t dat;
+	dat = hashtab_search(d->p_types.table, type);
+	rc = (dat == NULL) ? 0 : 1;
+#endif
+	return rc;
+}
+
+/**
+ * Validates a key_map against a set of enforcement rules, this
+ * function exits the application on a type that cannot be properly
+ * checked
+ *
+ * @param m
+ * 	The key map to check
+ * @param lineno
+ * 	The line number in the source file for the corresponding key map
+ */
+static int key_map_validate(key_map *m, int lineno) {
+
+	int rc = 1;
+	int ret = 1;
+	int resp;
+	char *key = m->name;
+	char *value = m->data;
+	data_type type = m->type;
+	sepol_bool_key_t *se_key;
+
+	log_info("Validating %s=%s\n", key, value);
+
+	 /* Booleans can always be checked for sanity */
+	if (type == dt_bool && (!strcmp("true", value) || !strcmp("false", value))) {
+		goto out;
+	}
+	else if (type == dt_bool) {
+		log_error("Expected boolean value got: %s=%s on line: %d in file: %s\n",
+				key, value, lineno, out_file_name);
+		rc = 0;
+		goto out;
+	}
+
+	/*
+	 * If their is no policy file present,
+	 * then it is not in strict mode so just return.
+	 * User and name cannot really be checked.
+	 */
+	if (!pol.policy_file) {
+		goto out;
+	}
+	else if (!strcasecmp(key, "sebool")) {
+
+		ret = sepol_bool_key_create(pol.handle, value, &se_key);
+		if (ret < 0) {
+			log_error("Could not create selinux boolean key, error: %s\n",
+					strerror(errno));
+			rc = 0;
+			goto out;
+		}
+
+		ret = sepol_bool_exists(pol.handle, pol.db, se_key, &resp);
+		if (ret < 0) {
+			log_error("Could not check selinux boolean, error: %s\n",
+					strerror(errno));
+			rc = 0;
+			goto bool_err;
+		}
+
+		if(!resp) {
+			log_error("Could not find selinux boolean \"%s\" on line: %d in file: %s\n",
+					value, lineno, out_file_name);
+			rc = 0;
+			goto bool_err;
+		}
+	}
+	else if (!strcasecmp(key, "type") || !strcasecmp(key, "domain")) {
+
+		if(!check_type(pol.db, value)) {
+			log_error("Could not find selinux type \"%s\" on line: %d in file: %s\n", value,
+					lineno, out_file_name);
+			rc = 0;
+		}
+		goto out;
+	}
+
+	else if (!strcasecmp(key, "level")) {
+
+		ret = sepol_mls_check(pol.handle, pol.db, value);
+		if (ret < 0) {
+			log_error("Could not find selinux level \"%s\", on line: %d in file: %s\n", value,
+					lineno, out_file_name);
+			rc = 0;
+			goto out;
+		}
+	}
+
+bool_err:
+	sepol_bool_key_free(se_key);
+
+out:
+	log_info("Key map validate returning: %d\n", rc);
+	return rc;
+}
+
+/**
+ * Prints a rule map back to a file
+ * @param fp
+ * 	The file handle to print too
+ * @param r
+ * 	The rule map to print
+ */
+static void rule_map_print(FILE *fp, rule_map *r) {
+
+	int i;
+	key_map *m;
+
+	for (i = 0; i < r->length; i++) {
+		m = &(r->m[i]);
+		if (i < r->length - 1)
+			fprintf(fp, "%s=%s ", m->name, m->data);
+		else
+			fprintf(fp, "%s=%s", m->name, m->data);
+	}
+}
+
+/**
+ * Compare two rule maps for equality
+ * @param rmA
+ * 	a rule map to check
+ * @param rmB
+ * 	a rule map to check
+ * @return
+ *  a map_match enum indicating the result
+ */
+static map_match rule_map_cmp(rule_map *rmA, rule_map *rmB) {
+
+	int i;
+	int j;
+	int inputs_found = 0;
+	int num_of_matched_inputs = 0;
+	int input_mode = 0;
+	int matches = 0;
+	key_map *mA;
+	key_map *mB;
+
+	if (rmA->length != rmB->length)
+		return map_no_matches;
+
+	for (i = 0; i < rmA->length; i++) {
+		mA = &(rmA->m[i]);
+
+		for (j = 0; j < rmB->length; j++) {
+			mB = &(rmB->m[j]);
+			input_mode = 0;
+
+			if (mA->type != mB->type)
+				continue;
+
+			if (strcmp(mA->name, mB->name))
+				continue;
+
+			if (strcmp(mA->data, mB->data))
+				continue;
+
+			if (mB->dir != mA->dir)
+				continue;
+			else if (mB->dir == dir_in) {
+				input_mode = 1;
+				inputs_found++;
+			}
+
+			if (input_mode) {
+				log_info("Matched input lines: type=%s name=%s data=%s dir=%d\n", mA->type, mA->name, mA->data, mA->dir);
+				num_of_matched_inputs++;
+			}
+
+			/* Match found, move on */
+			log_info("Matched lines: type=%s name=%s data=%s dir=%d\n", mA->type, mA->name, mA->data, mA->dir);
+			matches++;
+			break;
+		}
+	}
+
+	/* If they all matched*/
+	if (matches == rmA->length) {
+		log_info("Rule map cmp MATCH\n");
+		return map_matched;
+	}
+
+	/* They didn't all match but the input's did */
+	else if (num_of_matched_inputs == inputs_found) {
+		log_info("Rule map cmp INPUT MATCH\n");
+		return map_input_matched;
+	}
+
+	/* They didn't all match, and the inputs didn't match, ie it didn't
+	 * match */
+	else {
+		log_info("Rule map cmp NO MATCH\n");
+		return map_no_matches;
+	}
+}
+
+/**
+ * Frees a rule map
+ * @param rm
+ * 	rule map to be freed.
+ */
+static void rule_map_free(rule_map *rm, rule_map_switch s) {
+
+	int i;
+	int len = rm->length;
+	for (i = 0; i < len; i++) {
+		key_map *m = &(rm->m[i]);
+		free(m->data);
+	}
+
+	if(s == rule_map_destroy_key && rm->key)
+		free(rm->key);
+
+	free(rm);
+}
+
+static void free_kvp(kvp *k) {
+	free(k->key);
+	free(k->value);
+}
+
+/**
+ * Given a set of key value pairs, this will construct a new rule map.
+ * On error this function calls exit.
+ * @param keys
+ * 	Keys from a rule line to map
+ * @param num_of_keys
+ * 	The length of the keys array
+ * @param lineno
+ * 	The line number the keys were extracted from
+ * @return
+ * 	A rule map pointer.
+ */
+static rule_map *rule_map_new(kvp keys[], unsigned int num_of_keys, int lineno) {
+
+	unsigned int i = 0, j = 0;
+	rule_map *new_map = NULL;
+	kvp *k = NULL;
+	key_map *r = NULL, *x = NULL;
+
+	new_map = calloc(1, (num_of_keys * sizeof(key_map)) + sizeof(rule_map));
+	if (!new_map)
+		goto oom;
+
+	new_map->length = num_of_keys;
+	new_map->lineno = lineno;
+
+	/* For all the keys in a rule line*/
+	for (i = 0; i < num_of_keys; i++) {
+		k = &(keys[i]);
+		r = &(new_map->m[i]);
+
+		for (j = 0; j < KVP_NUM_OF_RULES; j++) {
+			x = &(rules[j]);
+
+			/* Only assign key name to map name */
+			if (strcasecmp(k->key, x->name)) {
+				if (i == KVP_NUM_OF_RULES) {
+					log_error("No match for key: %s\n", k->key);
+					goto err;
+				}
+				continue;
+			}
+
+			memcpy(r, x, sizeof(key_map));
+
+			/* Assign rule map value to one from file */
+			r->data = strdup(k->value);
+			if (!r->data)
+				goto oom;
+
+			/* Enforce type check*/
+			log_info("Validating keys!\n");
+			if (!key_map_validate(r, lineno)) {
+				log_error("Could not validate\n");
+				goto err;
+			}
+
+			/* Only build key off of inputs*/
+			if (r->dir == dir_in) {
+				char *tmp;
+				int l = strlen(k->key);
+				l += strlen(k->value);
+				l += (new_map->key) ? strlen(new_map->key) : 0;
+				l += 1;
+
+				tmp = realloc(new_map->key, l);
+				if (!tmp)
+					goto oom;
+
+				new_map->key = tmp;
+
+				strcat(new_map->key, k->key);
+				strcat(new_map->key, k->value);
+			}
+			break;
+		}
+		free_kvp(k);
+	}
+
+	if (new_map->key == NULL) {
+		log_error("Strange, no keys found, input file corrupt perhaps?\n");
+		goto err;
+	}
+
+	return new_map;
+
+oom:
+	log_error("Out of memory!\n");
+err:
+	if(new_map) {
+		rule_map_free(new_map, rule_map_destroy_key);
+		for (; i < num_of_keys; i++) {
+			k = &(keys[i]);
+			free_kvp(k);
+		}
+	}
+	exit(EXIT_FAILURE);
+}
+
+/**
+ * Print the usage of the program
+ */
+static void usage() {
+	printf(
+	        "checkseapp [options] <input file>\n"
+		        "Processes an seapp_contexts file specified by argument <input file> (default stdin) "
+		        "and allows later declarations to override previous ones on a match.\n"
+		        "Options:\n"
+		        "-h - print this help message\n"
+		        "-v - enable verbose debugging informations\n"
+		        "-p policy file - specify policy file for strict checking of output selectors\n"
+		        "-o output file - specify output file, default is stdout\n");
+}
+
+static void init() {
+
+	/* If not set on stdin already */
+	if(!input_file) {
+		log_info("Opening input file: %s\n", in_file_name);
+		input_file = fopen(in_file_name, "r");
+		if (!input_file) {
+			log_error("Could not open file: %s error: %s\n", in_file_name, strerror(errno));
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	/* If not set on std out already */
+	if(!output_file) {
+		output_file = fopen(out_file_name, "w+");
+		if (!output_file) {
+			log_error("Could not open file: %s error: %s\n", out_file_name, strerror(errno));
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	if (pol.policy_file_name) {
+
+		log_info("Opening policy file: %s\n", pol.policy_file_name);
+		pol.policy_file = fopen(pol.policy_file_name, "rb");
+		if (!pol.policy_file) {
+			log_error("Could not open file: %s error: %s\n",
+					pol.policy_file_name, strerror(errno));
+			exit(EXIT_FAILURE);
+		}
+
+		pol.handle = sepol_handle_create();
+		if (!pol.handle) {
+			log_error("Could not create sepolicy handle: %s\n",
+					strerror(errno));
+			exit(EXIT_FAILURE);
+		}
+
+		if (sepol_policy_file_create(&pol.pf) < 0) {
+			log_error("Could not create sepolicy file: %s!\n",
+					strerror(errno));
+			exit(EXIT_FAILURE);
+		}
+
+		sepol_policy_file_set_fp(pol.pf, pol.policy_file);
+		sepol_policy_file_set_handle(pol.pf, pol.handle);
+
+		if (sepol_policydb_create(&pol.db) < 0) {
+			log_error("Could not create sepolicy db: %s!\n",
+					strerror(errno));
+			exit(EXIT_FAILURE);
+		}
+
+		if (sepol_policydb_read(pol.db, pol.pf) < 0) {
+			log_error("Could not lod policy file to db: %s!\n",
+					strerror(errno));
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	log_info("Policy file set to: %s\n", (pol.policy_file_name == NULL) ? "None" : pol.policy_file_name);
+	log_info("Input file set to: %s\n", (in_file_name == NULL) ? "stdin" : in_file_name);
+	log_info("Output file set to: %s\n", (out_file_name == NULL) ? "stdout" : out_file_name);
+
+#if !defined(LINK_SEPOL_STATIC)
+	log_warning("LINK_SEPOL_STATIC is not defined\n""Not checking types!");
+#endif
+
+}
+
+/**
+ * Handle parsing and setting the global flags for the command line
+ * options. This function calls exit on failure.
+ * @param argc
+ * 	argument count
+ * @param argv
+ * 	argument list
+ */
+static void handle_options(int argc, char *argv[]) {
+
+	int c;
+	int num_of_args;
+
+	while ((c = getopt(argc, argv, "ho:p:v")) != -1) {
+		switch (c) {
+		case 'h':
+			usage();
+			exit(EXIT_SUCCESS);
+		case 'o':
+			out_file_name = optarg;
+			break;
+		case 'p':
+			pol.policy_file_name = optarg;
+			break;
+		case 'v':
+			log_set_verbose();
+			break;
+		case '?':
+			if (optopt == 'o' || optopt == 'p')
+				log_error("Option -%c requires an argument.\n", optopt);
+			else if (isprint (optopt))
+				log_error("Unknown option `-%c'.\n", optopt);
+			else {
+				log_error(
+						"Unknown option character `\\x%x'.\n",
+						optopt);
+				exit(EXIT_FAILURE);
+			}
+			break;
+		default:
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	num_of_args = argc - optind;
+
+	if (num_of_args > 1) {
+		log_error("Too many arguments, expected 0 or 1, argument, got %d\n", num_of_args);
+		usage();
+		exit(EXIT_FAILURE);
+	} else if (num_of_args == 1) {
+		in_file_name = argv[argc - 1];
+	} else {
+		input_file = stdin;
+		in_file_name = "stdin";
+	}
+
+	if (!out_file_name) {
+		output_file = stdout;
+		out_file_name = "stdout";
+	}
+}
+
+/**
+ * Adds a rule_map double pointer, ie the hash table pointer to the list.
+ * By using a double pointer, the hash table can have a line be overridden
+ * and the value is updated in the list. This function calls exit on failure.
+ * @param rm
+ * 	the rule_map to add.
+ */
+static void list_add(hash_entry *e) {
+
+	line_order_list *node = malloc(sizeof(line_order_list));
+	if (node == NULL)
+		goto oom;
+
+	node->next = NULL;
+	node->e = e;
+
+	if (list_head == NULL)
+		list_head = list_tail = node;
+	else {
+		list_tail->next = node;
+		list_tail = list_tail->next;
+	}
+	return;
+
+oom:
+	log_error("Out of memory!\n");
+	exit(EXIT_FAILURE);
+}
+
+/**
+ * Free's the rule map list, which ultimatley contains
+ * all the malloc'd rule_maps.
+ */
+static void list_free() {
+	line_order_list *cursor, *tmp;
+	hash_entry *e;
+
+	cursor = list_head;
+	while (cursor) {
+		e = cursor->e;
+		rule_map_free(e->r, rule_map_destroy_key);
+		tmp = cursor;
+		cursor = cursor->next;
+		free(e);
+		free(tmp);
+	}
+}
+
+/**
+ * Adds a rule to the hash table and to the ordered list if needed.
+ * @param rm
+ * 	The rule map to add.
+ */
+static void rule_add(rule_map *rm) {
+
+	map_match cmp;
+	ENTRY e;
+	ENTRY *f;
+	hash_entry *entry;
+	hash_entry *tmp;
+	char *preserved_key;
+
+	e.key = rm->key;
+
+	log_info("Searching for key: %s\n", e.key);
+	/* Check to see if it has already been added*/
+	f = hsearch(e, FIND);
+
+	/*
+	 * Since your only hashing on a partial key, the inputs we need to handle
+	 * when you want to override the outputs for a given input set, as well as
+	 * checking for duplicate entries.
+	 */
+	if(f) {
+		log_info("Existing entry found!\n");
+		tmp = (hash_entry *)f->data;
+		cmp = rule_map_cmp(rm, tmp->r);
+		log_info("Comparing on rule map ret: %d\n", cmp);
+		/* Override be freeing the old rule map and updating
+		   the pointer */
+		if(cmp != map_matched) {
+
+			/*
+			 * DO NOT free key pointers given to the hash map, instead
+			 * free the new key. The ordering here is critical!
+			 */
+			preserved_key = tmp->r->key;
+			rule_map_free(tmp->r, rule_map_preserve_key);
+			free(rm->key);
+			rm->key = preserved_key;
+			tmp->r = rm;
+		}
+		/* Duplicate */
+		else {
+			log_error("Duplicate line detected in file: %s\n"
+					"Lines %d and %d match!\n",
+					out_file_name, tmp->r->lineno, rm->lineno);
+			rule_map_free(rm, rule_map_destroy_key);
+			goto err;
+		}
+	}
+	/* It wasn't found, just add the rule map to the table */
+	else {
+
+		entry = malloc(sizeof(hash_entry));
+		if (!entry)
+			goto oom;
+
+		entry->r = rm;
+		e.data = entry;
+
+		f = hsearch(e, ENTER);
+		if(f == NULL) {
+			goto oom;
+		}
+
+		/* new entries must be added to the ordered list */
+		entry->r = rm;
+		list_add(entry);
+	}
+
+	return;
+oom:
+	if (e.key)
+		free(e.key);
+	if (entry)
+		free(entry);
+	if (rm)
+		free(rm);
+	log_error("Out of memory in function: %s\n", __FUNCTION__);
+err:
+	exit(EXIT_FAILURE);
+}
+
+/**
+ * Parses the seapp_contexts file and adds them to the
+ * hash table and ordered list entries when it encounters them.
+ * Calls exit on failure.
+ */
+static void parse() {
+
+	char line_buf[BUFSIZ];
+	char *token;
+	unsigned lineno = 0;
+	char *p, *name = NULL, *value = NULL, *saveptr;
+	size_t len;
+	kvp keys[KVP_NUM_OF_RULES];
+	int token_cnt = 0;
+
+	while (fgets(line_buf, sizeof line_buf - 1, input_file)) {
+
+		lineno++;
+		log_info("Got line %d\n", lineno);
+		len = strlen(line_buf);
+		if (line_buf[len - 1] == '\n')
+			line_buf[len - 1] = 0;
+		p = line_buf;
+		while (isspace(*p))
+			p++;
+		if (*p == '#' || *p == 0)
+			continue;
+
+		token = strtok_r(p, " \t", &saveptr);
+		if (!token)
+			goto err;
+
+		token_cnt = 0;
+		memset(keys, 0, sizeof(kvp) * KVP_NUM_OF_RULES);
+		while (1) {
+
+			name = token;
+			value = strchr(name, '=');
+			if (!value)
+				goto err;
+			*value++ = 0;
+
+			keys[token_cnt].key = strdup(name);
+			if (!keys[token_cnt].key)
+				goto oom;
+
+			keys[token_cnt].value = strdup(value);
+			if (!keys[token_cnt].value)
+				goto oom;
+
+			token_cnt++;
+
+			token = strtok_r(NULL, " \t", &saveptr);
+			if (!token)
+				break;
+
+		} /*End token parsing */
+
+		rule_map *r = rule_map_new(keys, token_cnt, lineno);
+		rule_add(r);
+
+	} /* End file parsing */
+	return;
+
+err:
+	log_error("reading %s, line %u, name %s, value %s\n",
+			in_file_name, lineno, name, value);
+	exit(EXIT_FAILURE);
+oom:
+	log_error("In function %s:  Out of memory\n", __FUNCTION__);
+	exit(EXIT_FAILURE);
+}
+
+/**
+ * Should be called after parsing to cause the printing of the rule_maps
+ * stored in the ordered list, head first, which preserves the "first encountered"
+ * ordering.
+ */
+static void output() {
+
+	rule_map *r;
+	line_order_list *cursor;
+	cursor = list_head;
+
+	while (cursor) {
+		r = cursor->e->r;
+		rule_map_print(output_file, r);
+		cursor = cursor->next;
+		fprintf(output_file, "\n");
+	}
+}
+
+/**
+ * This function is registered to the at exit handler and should clean up
+ * the programs dynamic resources, such as memory and fd's.
+ */
+static void cleanup() {
+
+	/* Only close this when it was opened by me and not the crt */
+	if (out_file_name && output_file) {
+		log_info("Closing file: %s\n", out_file_name);
+		fclose(output_file);
+	}
+
+	/* Only close this when it was opened by me  and not the crt */
+	if (in_file_name && input_file) {
+		log_info("Closing file: %s\n", in_file_name);
+		fclose(input_file);
+	}
+
+	if (pol.policy_file) {
+
+		log_info("Closing file: %s\n", pol.policy_file_name);
+		fclose(pol.policy_file);
+
+		if (pol.db)
+			sepol_policydb_free(pol.db);
+
+		if (pol.pf)
+			sepol_policy_file_free(pol.pf);
+
+		if (pol.handle)
+			sepol_handle_destroy(pol.handle);
+	}
+
+	log_info("Freeing list\n");
+	list_free();
+	hdestroy();
+}
+
+int main(int argc, char *argv[]) {
+	if (!hcreate(TABLE_SIZE)) {
+		log_error("Could not create hash table: %s\n", strerror(errno));
+		exit(EXIT_FAILURE);
+	}
+	atexit(cleanup);
+	handle_options(argc, argv);
+	init();
+	log_info("Starting to parse\n");
+	parse();
+	log_info("Parsing completed, generating output\n");
+	output();
+	log_info("Success, generated output\n");
+	exit(EXIT_SUCCESS);
+}
diff --git a/dhcp.te b/dhcp.te
new file mode 100644
index 0000000..b596479
--- /dev/null
+++ b/dhcp.te
@@ -0,0 +1,22 @@
+type dhcp, domain;
+type dhcp_exec, exec_type, file_type;
+type dhcp_data_file, file_type, data_file_type;
+type dhcp_system_file, file_type, data_file_type;
+
+init_daemon_domain(dhcp)
+
+allow dhcp cgroup:dir { create add_name };
+allow dhcp self:capability { setgid setuid net_admin net_raw };
+allow dhcp self:packet_socket { create setopt bind write read };
+allow dhcp self:netlink_route_socket { write nlmsg_write read create bind };
+allow dhcp self:udp_socket { create ioctl };
+allow dhcp shell_exec:file { read open execute };
+allow dhcp proc:file write;
+allow dhcp property_socket:sock_file write ;
+allow dhcp system_prop:property_service set ;
+allow dhcp dhcp_system_file:file rx_file_perms;
+allow dhcp dhcp_system_file:dir r_dir_perms;
+unix_socket_connect(dhcp, property, init)
+
+type_transition dhcp system_data_file:{ dir file } dhcp_data_file;
+allow dhcp dhcp_data_file:dir { write add_name search };
diff --git a/drmserver.te b/drmserver.te
index f30033a..63286d5 100644
--- a/drmserver.te
+++ b/drmserver.te
@@ -18,3 +18,4 @@
 allow drmserver drm_data_file:dir create_dir_perms;
 allow drmserver drm_data_file:file create_file_perms;
 allow drmserver self:{ tcp_socket udp_socket } *;
+allow drmserver tee_device:chr_file rw_file_perms;
diff --git a/file_contexts b/file_contexts
index ecf6e22..8876bfe 100644
--- a/file_contexts
+++ b/file_contexts
@@ -38,6 +38,7 @@
 /dev/mtd/mtd5ro		u:object_r:radio_device:s0
 /dev/mtp_usb		u:object_r:mtp_device:s0
 /dev/pn544		u:object_r:nfc_device:s0
+/dev/ppp		u:object_r:ppp_device:s0
 /dev/ptmx		u:object_r:ptmx_device:s0
 /dev/pvrsrvkm		u:object_r:powervr_device:s0
 /dev/qemu_.*		u:object_r:qemu_device:s0
@@ -71,6 +72,7 @@
 /dev/socket/zygote	u:object_r:zygote_socket:s0
 /dev/spdif_out.*	u:object_r:audio_device:s0
 /dev/tegra.*		u:object_r:video_device:s0
+/dev/tf_driver		u:object_r:tee_device:s0
 /dev/tty[0-9]*		u:object_r:tty_device:s0
 /dev/ttyS[0-9]*		u:object_r:serial_device:s0
 /dev/uinput		u:object_r:input_device:s0
@@ -102,6 +104,12 @@
 /system/bin/wpa_supplicant	u:object_r:wpa_exec:s0
 /system/bin/qemud	u:object_r:qemud_exec:s0
 /system/bin/sdcard      u:object_r:sdcardd_exec:s0
+/system/bin/dhcpcd      u:object_r:dhcp_exec:s0
+/system/bin/mtpd	u:object_r:mtp_exec:s0
+/system/bin/pppd	u:object_r:ppp_exec:s0
+/system/bin/tf_daemon	u:object_r:tee_exec:s0
+/system/etc/ppp(/.*)?	u:object_r:ppp_system_file:s0
+/system/etc/dhcpcd(/.*)? u:object_r:dhcp_system_file:s0
 /system/xbin/su		u:object_r:su_exec:s0
 /system/vendor/bin/gpsd u:object_r:gpsd_exec:s0
 #############################
@@ -124,6 +132,7 @@
 /data/misc/systemkeys(/.*)?	u:object_r:systemkeys_data_file:s0
 /data/misc/wifi(/.*)?		u:object_r:wifi_data_file:s0
 /data/misc/camera(/.*)?	u:object_r:camera_calibration_file:s0
+/data/misc/dhcp(/.*)?           u:object_r:dhcp_data_file:s0
 # App sandboxes
 /data/data/.*		u:object_r:app_data_file:s0
 # Wallpaper file.
diff --git a/gpsd.te b/gpsd.te
index bc2893d..8010efa 100644
--- a/gpsd.te
+++ b/gpsd.te
@@ -12,3 +12,5 @@
 allow gpsd gps_socket:sock_file create_file_perms;
 # XXX Label sysfs files with a specific type?
 allow gpsd sysfs:file rw_file_perms;
+
+allow gpsd gps_device:chr_file rw_file_perms;
diff --git a/keystore.te b/keystore.te
index 6c4d610..20e7222 100644
--- a/keystore.te
+++ b/keystore.te
@@ -6,3 +6,4 @@
 allow keystore keystore_data_file:dir create_dir_perms;
 allow keystore keystore_data_file:notdevfile_class_set create_file_perms;
 allow keystore keystore_exec:file { getattr };
+allow keystore tee_device:chr_file rw_file_perms;
diff --git a/mediaserver.te b/mediaserver.te
index c8adf3a..e124db0 100644
--- a/mediaserver.te
+++ b/mediaserver.te
@@ -42,3 +42,5 @@
 allow mediaserver qtaguid_device:chr_file r_file_perms;
 # Allow abstract socket connection
 allow mediaserver rild:unix_stream_socket connectto;
+
+allow mediaserver tee_device:chr_file rw_file_perms;
diff --git a/mtp.te b/mtp.te
new file mode 100644
index 0000000..4fc04b6
--- /dev/null
+++ b/mtp.te
@@ -0,0 +1,13 @@
+# vpn tunneling protocol manager
+type mtp, domain;
+type mtp_exec, exec_type, file_type;
+
+init_daemon_domain(mtp)
+
+# pptp policy
+allow mtp self:tcp_socket { create setopt connect write read };
+allow mtp self:socket { create connect };
+allow mtp self:rawip_socket create;
+allow mtp self:capability net_raw;
+allow mtp ppp:process signal;
+allow mtp port:tcp_socket name_connect;
diff --git a/ppp.te b/ppp.te
new file mode 100644
index 0000000..115fb98
--- /dev/null
+++ b/ppp.te
@@ -0,0 +1,17 @@
+# Point to Point Protocol daemon
+type ppp, domain;
+type ppp_device, dev_type;
+type ppp_exec, exec_type, file_type;
+type ppp_system_file, file_type;
+
+domain_auto_trans(mtp, ppp_exec, ppp)
+
+allow ppp mtp:socket { read write ioctl };
+allow ppp ppp_device:chr_file rw_file_perms;
+allow ppp self:capability net_admin;
+allow ppp self:udp_socket { create ioctl };
+allow ppp ppp_system_file:dir search;
+allow ppp ppp_system_file:file rx_file_perms;
+allow ppp vpn_data_file:dir w_dir_perms;
+allow ppp vpn_data_file:file create_file_perms;
+allow ppp mtp:fd use;
diff --git a/system.te b/system.te
index 0740285..557a385 100644
--- a/system.te
+++ b/system.te
@@ -206,3 +206,6 @@
 allow system appdomain:udp_socket { read write };
 # Allow abstract socket connection
 allow system rild:unix_stream_socket connectto;
+
+# connect to vpn tunnel
+allow system mtp:unix_stream_socket { connectto };
diff --git a/tee.te b/tee.te
new file mode 100644
index 0000000..ce4e2b6
--- /dev/null
+++ b/tee.te
@@ -0,0 +1,13 @@
+##
+# trusted execution environment (tee) daemon
+#
+type tee, domain;
+type tee_exec, exec_type, file_type;
+type tee_device, dev_type;
+type tee_data_file, file_type, data_file_type;
+
+init_daemon_domain(tee)
+allow tee self:capability { dac_override };
+allow tee tee_device:chr_file rw_file_perms;
+allow tee tee_data_file:dir { getattr write add_name };
+allow tee tee_data_file:file create_file_perms;