diff --git a/private/bug_map b/private/bug_map
index 26d25e7dfb263ab546d91375f511c6715968309b..6bad8c2864b351b61ffba045069e6322cf7e67e8 100644
--- a/private/bug_map
+++ b/private/bug_map
@@ -3,3 +3,6 @@ update_engine update_engine capability 69197466
 vold system_data_file file 62140539
 system_server proc file 69175449
 system_server vendor_framework_file dir 68826235
+crash_dump app_data_file dir 68319037
+crash_dump bluetooth_data_file 68319037
+crash_dump vendor_overlay_file 68319037
diff --git a/public/charger.te b/public/charger.te
index 5a5b6535c80efbbcedc553fa0ca72600cff6ca50..9c48dddbd74672ff9a5daa5e5e809e06fe93ebc8 100644
--- a/public/charger.te
+++ b/public/charger.te
@@ -17,8 +17,8 @@ wakelock_use(charger)
 
 allow charger self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
 
-# Write to /sys/power/state
-allow charger sysfs_power:file write;
+# Read/write to /sys/power/state
+allow charger sysfs_power:file rw_file_perms;
 
 allow charger sysfs_batteryinfo:file r_file_perms;
 
diff --git a/public/update_engine.te b/public/update_engine.te
index 9f9b557a263fea298177ab2db76af6f1a56f7280..fef5dec78d749b68595ec8cf29c4f91714e679f0 100644
--- a/public/update_engine.te
+++ b/public/update_engine.te
@@ -12,6 +12,12 @@ allow update_engine qtaguid_device:chr_file r_file_perms;
 # Following permissions are needed for update_engine.
 allow update_engine self:process { setsched };
 allow update_engine self:capability { fowner sys_admin };
+# Note: fsetid checks are triggered when creating a file in a directory with
+# the setgid bit set to determine if the file should inherit setgid. In this
+# case, setgid on the file is undesirable so we should just suppress the
+# denial.
+dontaudit update_engine self:capability fsetid;
+
 allow update_engine kmsg_device:chr_file w_file_perms;
 allow update_engine update_engine_exec:file rx_file_perms;
 wakelock_use(update_engine);