neverallow hell

FAILED: /home/speed/rom-out/carbon-orb/target/product/shieldtablet/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows
/bin/bash -c "(rm -f /home/speed/rom-out/carbon-orb/target/product/shieldtablet/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows ) && (ASAN_OPTIONS=detect_leaks=0 /home/speed/rom-out/carbon-orb/host/linux-x86/bin/checkpolicy -M -c 		30 -o /home/speed/rom-out/carbon-orb/target/product/shieldtablet/obj/ETC/sepolicy_neverallows_intermediates/sepolicy_neverallows /home/speed/rom-out/carbon-orb/target/product/shieldtablet/obj/ETC/sepolicy_neverallows_intermediates/policy.conf )"
libsepol.report_failure: neverallow on line 1394 of system/sepolicy/public/domain.te (or line 11004 of policy.conf) violated by allow zygote cgroup:file { create };
libsepol.report_failure: neverallow on line 1380 of system/sepolicy/public/domain.te (or line 10990 of policy.conf) violated by allow update_engine update_engine:capability { dac_read_search };
libsepol.report_failure: neverallow on line 1379 of system/sepolicy/public/domain.te (or line 10989 of policy.conf) violated by allow update_engine update_engine:capability { dac_override };
libsepol.report_failure: neverallow on line 1175 of system/sepolicy/public/domain.te (or line 10795 of policy.conf) violated by allow update_engine system_data_file:file { write create setattr append unlink rename };
libsepol.report_failure: neverallow on line 500 of system/sepolicy/public/domain.te (or line 10444 of policy.conf) violated by allow update_engine rootfs:file { write create setattr relabelto append unlink rename };
libsepol.report_failure: neverallow on line 493 of system/sepolicy/public/domain.te (or line 10437 of policy.conf) violated by allow update_engine system_file:file { relabelto };
libsepol.report_failure: neverallow on line 491 of system/sepolicy/public/domain.te (or line 10435 of policy.conf) violated by allow update_engine system_file:dir { write create setattr rename };
libsepol.report_failure: neverallow on line 491 of system/sepolicy/public/domain.te (or line 10435 of policy.conf) violated by allow update_engine system_file:file { write create setattr relabelfrom append unlink rename };
libsepol.report_failure: neverallow on line 491 of system/sepolicy/public/domain.te (or line 10435 of policy.conf) violated by allow update_engine system_file:lnk_file { write create setattr append unlink rename };
libsepol.report_failure: neverallow on line 326 of system/sepolicy/public/domain.te (or line 10270 of policy.conf) violated by allow update_engine update_engine:capability { sys_rawio };
libsepol.check_assertions: 10 neverallow failures occurred
Error while expanding policy
/home/speed/rom-out/carbon-orb/host/linux-x86/bin/checkpolicy:  loading policy configuration from /home/speed/rom-out/carbon-orb/target/product/shieldtablet/obj/ETC/sepolicy_neverallows_intermediates/policy.conf