diff --git a/eclass/linux-info.eclass b/eclass/linux-info.eclass
index 4596c30..147d58f 100644
--- a/eclass/linux-info.eclass
+++ b/eclass/linux-info.eclass
@@ -1,4 +1,4 @@
-# Copyright 1999-2018 Gentoo Foundation
+# Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Chromium OS customizations notes:
@@ -173,14 +173,14 @@
 # ---------------------------------------
 
 # @FUNCTION: getfilevar
-# @USAGE: variable configfile
+# @USAGE: <variable> <configfile>
 # @RETURN: the value of the variable
 # @DESCRIPTION:
 # It detects the value of the variable defined in the file configfile. This is
 # done by including the configfile, and printing the variable with Make.
 # It WILL break if your makefile has missing dependencies!
 getfilevar() {
-	local ERROR basefname basedname myARCH="${ARCH}" M="${S}"
+	local ERROR basefname basedname myARCH="${ARCH}"
 	ERROR=0
 
 	[ -z "${1}" ] && ERROR=1
@@ -198,18 +198,15 @@
 
 		# We use nonfatal because we want the caller to take care of things #373151
 		[[ ${EAPI:-0} == [0123] ]] && nonfatal() { "$@"; }
-		case ${EBUILD_PHASE_FUNC} in
-			pkg_info|pkg_nofetch|pkg_pretend) M="${T}" ;;
-		esac
 		echo -e "e:\\n\\t@echo \$(${1})\\ninclude ${basefname}" | \
-			nonfatal emake -C "${basedname}" M="${M}" ${BUILD_FIXES} -s -f - 2>/dev/null
+			nonfatal emake -C "${basedname}" M="${T}" ${BUILD_FIXES} -s -f - 2>/dev/null
 
 		ARCH=${myARCH}
 	fi
 }
 
 # @FUNCTION: getfilevar_noexec
-# @USAGE: variable configfile
+# @USAGE: <variable> <configfile>
 # @RETURN: the value of the variable
 # @DESCRIPTION:
 # It detects the value of the variable defined in the file configfile.
@@ -324,7 +321,7 @@
 }
 
 # @FUNCTION: linux_chkconfig_present
-# @USAGE: option
+# @USAGE: <option>
 # @RETURN: true or false
 # @DESCRIPTION:
 # It checks that CONFIG_<option>=y or CONFIG_<option>=m is present in the current kernel .config
@@ -336,7 +333,7 @@
 }
 
 # @FUNCTION: linux_chkconfig_module
-# @USAGE: option
+# @USAGE: <option>
 # @RETURN: true or false
 # @DESCRIPTION:
 # It checks that CONFIG_<option>=m is present in the current kernel .config
@@ -348,7 +345,7 @@
 }
 
 # @FUNCTION: linux_chkconfig_builtin
-# @USAGE: option
+# @USAGE: <option>
 # @RETURN: true or false
 # @DESCRIPTION:
 # It checks that CONFIG_<option>=y is present in the current kernel .config
@@ -360,7 +357,7 @@
 }
 
 # @FUNCTION: linux_chkconfig_string
-# @USAGE: option
+# @USAGE: <option>
 # @RETURN: CONFIG_<option>
 # @DESCRIPTION:
 # It prints the CONFIG_<option> value of the current kernel .config (it requires a configured kernel).
@@ -375,7 +372,7 @@
 # ---------------------------------------
 
 # @FUNCTION: kernel_is
-# @USAGE: [-lt -gt -le -ge -eq] major_number [minor_number patch_number]
+# @USAGE: [-lt -gt -le -ge -eq] <major_number> [minor_number patch_number]
 # @RETURN: true or false
 # @DESCRIPTION:
 # It returns true when the current kernel version satisfies the comparison against the passed version.
@@ -830,7 +827,7 @@
 			linux_chkconfig_present ${config} || error=1
 		fi
 
-		if [[ ${error} > 0 ]]; then
+		if [[ ${error} -gt 0 ]]; then
 			local report_func="eerror" local_error
 			local_error="ERROR_${config}"
 			local_error="${!local_error}"
@@ -865,14 +862,14 @@
 		fi
 	done
 
-	if [[ ${hard_errors_count} > 0 ]]; then
+	if [[ ${hard_errors_count} -gt 0 ]]; then
 		eerror "Please check to make sure these options are set correctly."
 		eerror "Failure to do so may cause unexpected problems."
 		eerror "Once you have satisfied these options, please try merging"
 		eerror "this package again."
 		export LINUX_CONFIG_EXISTS_DONE="${old_LINUX_CONFIG_EXISTS_DONE}"
 		die "Incorrect kernel configuration options"
-	elif [[ ${soft_errors_count} > 0 ]]; then
+	elif [[ ${soft_errors_count} -gt 0 ]]; then
 		ewarn "Please check to make sure these options are set correctly."
 		ewarn "Failure to do so may cause unexpected problems."
 	else
diff --git a/eclass/python-utils-r1.eclass b/eclass/python-utils-r1.eclass
index f95981a..5c8152f 100644
--- a/eclass/python-utils-r1.eclass
+++ b/eclass/python-utils-r1.eclass
@@ -1,4 +1,4 @@
-# Copyright 1999-2019 Gentoo Authors
+# Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: python-utils-r1.eclass
@@ -16,8 +16,8 @@
 # This eclass does not set any metadata variables nor export any phase
 # functions. It can be inherited safely.
 #
-# For more information, please see the wiki:
-# https://wiki.gentoo.org/wiki/Project:Python/python-utils-r1
+# For more information, please see the Python Guide:
+# https://dev.gentoo.org/~mgorny/python-guide/
 
 case "${EAPI:-0}" in
 	[0-4]) die "Unsupported EAPI=${EAPI:-0} (too old) for ${ECLASS}" ;;
@@ -41,7 +41,7 @@
 _PYTHON_ALL_IMPLS=(
 	pypy3
 	python2_7
-	python3_6 python3_7 python3_8
+	python3_6 python3_7 python3_8 python3_9
 )
 readonly _PYTHON_ALL_IMPLS
 
@@ -77,7 +77,7 @@
 	# keep in sync with _PYTHON_ALL_IMPLS!
 	# (not using that list because inline patterns shall be faster)
 	case "${impl}" in
-		python2_7|python3_[678]|pypy3)
+		python2_7|python3_[6789]|pypy3)
 			return 0
 			;;
 		jython2_7|pypy|pypy1_[89]|pypy2_0|python2_[56]|python3_[12345])
@@ -198,7 +198,7 @@
 # This variable is set automatically in the following contexts:
 #
 # python-r1: Set in functions called by python_foreach_impl() or after
-# calling python_export_best().
+# calling python_setup().
 #
 # python-single-r1: Set after calling python-single-r1_pkg_setup().
 #
@@ -217,7 +217,7 @@
 # This variable is set automatically in the following contexts:
 #
 # python-r1: Set in functions called by python_foreach_impl() or after
-# calling python_export_best().
+# calling python_setup().
 #
 # python-single-r1: Set after calling python-single-r1_pkg_setup().
 #
@@ -228,116 +228,24 @@
 # python2.7
 # @CODE
 
-# @ECLASS-VARIABLE: PYTHON_SITEDIR
-# @DEFAULT_UNSET
-# @DESCRIPTION:
-# The path to Python site-packages directory.
-#
-# Set and exported on request using python_export().
-# Requires a proper build-time dependency on the Python implementation.
-#
-# Example value:
-# @CODE
-# /usr/lib64/python2.7/site-packages
-# @CODE
-
-# @ECLASS-VARIABLE: PYTHON_INCLUDEDIR
-# @DEFAULT_UNSET
-# @DESCRIPTION:
-# The path to Python include directory.
-#
-# Set and exported on request using python_export().
-# Requires a proper build-time dependency on the Python implementation.
-#
-# Example value:
-# @CODE
-# /usr/include/python2.7
-# @CODE
-
-# @ECLASS-VARIABLE: PYTHON_LIBPATH
-# @DEFAULT_UNSET
-# @DESCRIPTION:
-# The path to Python library.
-#
-# Set and exported on request using python_export().
-# Valid only for CPython. Requires a proper build-time dependency
-# on the Python implementation.
-#
-# Example value:
-# @CODE
-# /usr/lib64/libpython2.7.so
-# @CODE
-
-# @ECLASS-VARIABLE: PYTHON_CFLAGS
-# @DEFAULT_UNSET
-# @DESCRIPTION:
-# Proper C compiler flags for building against Python. Obtained from
-# pkg-config or python-config.
-#
-# Set and exported on request using python_export().
-# Valid only for CPython. Requires a proper build-time dependency
-# on the Python implementation and on pkg-config.
-#
-# Example value:
-# @CODE
-# -I/usr/include/python2.7
-# @CODE
-
-# @ECLASS-VARIABLE: PYTHON_LIBS
-# @DEFAULT_UNSET
-# @DESCRIPTION:
-# Proper C compiler flags for linking against Python. Obtained from
-# pkg-config or python-config.
-#
-# Set and exported on request using python_export().
-# Valid only for CPython. Requires a proper build-time dependency
-# on the Python implementation and on pkg-config.
-#
-# Example value:
-# @CODE
-# -lpython2.7
-# @CODE
-
-# @ECLASS-VARIABLE: PYTHON_CONFIG
-# @DEFAULT_UNSET
-# @DESCRIPTION:
-# Path to the python-config executable.
-#
-# Set and exported on request using python_export().
-# Valid only for CPython. Requires a proper build-time dependency
-# on the Python implementation and on pkg-config.
-#
-# Example value:
-# @CODE
-# /usr/bin/python2.7-config
-# @CODE
-
-# @ECLASS-VARIABLE: PYTHON_PKG_DEP
-# @DEFAULT_UNSET
-# @DESCRIPTION:
-# The complete dependency on a particular Python package as a string.
-#
-# Set and exported on request using python_export().
-#
-# Example value:
-# @CODE
-# dev-lang/python:2.7[xml]
-# @CODE
-
-# @ECLASS-VARIABLE: PYTHON_SCRIPTDIR
-# @DEFAULT_UNSET
-# @DESCRIPTION:
-# The location where Python scripts must be installed for current impl.
-#
-# Set and exported on request using python_export().
-#
-# Example value:
-# @CODE
-# /usr/lib/python-exec/python2.7
-# @CODE
-
 # @FUNCTION: python_export
 # @USAGE: [<impl>] <variables>...
+# @INTERNAL
+# @DESCRIPTION:
+# Backwards compatibility function.  The relevant API is now considered
+# private, please use python_get* instead.
+python_export() {
+	debug-print-function ${FUNCNAME} "${@}"
+
+	eqawarn "python_export() is part of private eclass API."
+	eqawarn "Please call python_get*() instead."
+
+	_python_export "${@}"
+}
+
+# @FUNCTION: _python_export
+# @USAGE: [<impl>] <variables>...
+# @INTERNAL
 # @DESCRIPTION:
 # Set and export the Python implementation-relevant variables passed
 # as parameters.
@@ -350,7 +258,7 @@
 # The variables which can be exported are: PYTHON, EPYTHON,
 # PYTHON_SITEDIR. They are described more completely in the eclass
 # variable documentation.
-python_export() {
+_python_export() {
 	debug-print-function ${FUNCNAME} "${@}"
 
 	local impl var
@@ -367,7 +275,7 @@
 		*)
 			impl=${EPYTHON}
 			if [[ -z ${impl} ]]; then
-				die "python_export called without a python implementation and EPYTHON is unset"
+				die "_python_export called without a python implementation and EPYTHON is unset"
 			fi
 			;;
 	esac
@@ -433,10 +341,14 @@
 				local val
 
 				case "${impl}" in
-					python*)
-						# python-2.7, python-3.2, etc.
+					python2*|python3.6|python3.7*)
+						# python* up to 3.7
 						val=$($(tc-getPKG_CONFIG) --libs ${impl/n/n-}) || die
 						;;
+					python*)
+						# python3.8+
+						val=$($(tc-getPKG_CONFIG) --libs ${impl/n/n-}-embed) || die
+						;;
 					*)
 						die "${impl}: obtaining ${var} not supported"
 						;;
@@ -467,16 +379,12 @@
 				case ${impl} in
 					python2.7)
 						PYTHON_PKG_DEP='>=dev-lang/python-2.7.5-r2:2.7';;
-					python3.3)
-						PYTHON_PKG_DEP='>=dev-lang/python-3.3.2-r2:3.3';;
 					python*)
 						PYTHON_PKG_DEP="dev-lang/python:${impl#python}";;
 					pypy)
-						PYTHON_PKG_DEP='>=dev-python/pypy-5:0=';;
+						PYTHON_PKG_DEP='>=dev-python/pypy-7.3.0:0=';;
 					pypy3)
-						PYTHON_PKG_DEP='>=dev-python/pypy3-5:0=';;
-					jython2.7)
-						PYTHON_PKG_DEP='dev-java/jython:2.7';;
+						PYTHON_PKG_DEP='>=dev-python/pypy3-7.3.0:0=';;
 					*)
 						die "Invalid implementation: ${impl}"
 				esac
@@ -495,7 +403,7 @@
 				debug-print "${FUNCNAME}: PYTHON_SCRIPTDIR = ${PYTHON_SCRIPTDIR}"
 				;;
 			*)
-				die "python_export: unknown variable ${var}"
+				die "_python_export: unknown variable ${var}"
 		esac
 	done
 }
@@ -506,13 +414,10 @@
 # Obtain and print the 'site-packages' path for the given
 # implementation. If no implementation is provided, ${EPYTHON} will
 # be used.
-#
-# If you just need to have PYTHON_SITEDIR set (and exported), then it is
-# better to use python_export() directly instead.
 python_get_sitedir() {
 	debug-print-function ${FUNCNAME} "${@}"
 
-	python_export "${@}" PYTHON_SITEDIR
+	_python_export "${@}" PYTHON_SITEDIR
 	echo "${PYTHON_SITEDIR}"
 }
 
@@ -521,13 +426,10 @@
 # @DESCRIPTION:
 # Obtain and print the include path for the given implementation. If no
 # implementation is provided, ${EPYTHON} will be used.
-#
-# If you just need to have PYTHON_INCLUDEDIR set (and exported), then it
-# is better to use python_export() directly instead.
 python_get_includedir() {
 	debug-print-function ${FUNCNAME} "${@}"
 
-	python_export "${@}" PYTHON_INCLUDEDIR
+	_python_export "${@}" PYTHON_INCLUDEDIR
 	echo "${PYTHON_INCLUDEDIR}"
 }
 
@@ -542,7 +444,7 @@
 python_get_library_path() {
 	debug-print-function ${FUNCNAME} "${@}"
 
-	python_export "${@}" PYTHON_LIBPATH
+	_python_export "${@}" PYTHON_LIBPATH
 	echo "${PYTHON_LIBPATH}"
 }
 
@@ -559,7 +461,7 @@
 python_get_CFLAGS() {
 	debug-print-function ${FUNCNAME} "${@}"
 
-	python_export "${@}" PYTHON_CFLAGS
+	_python_export "${@}" PYTHON_CFLAGS
 	echo "${PYTHON_CFLAGS}"
 }
 
@@ -576,7 +478,7 @@
 python_get_LIBS() {
 	debug-print-function ${FUNCNAME} "${@}"
 
-	python_export "${@}" PYTHON_LIBS
+	_python_export "${@}" PYTHON_LIBS
 	echo "${PYTHON_LIBS}"
 }
 
@@ -593,7 +495,7 @@
 python_get_PYTHON_CONFIG() {
 	debug-print-function ${FUNCNAME} "${@}"
 
-	python_export "${@}" PYTHON_CONFIG
+	_python_export "${@}" PYTHON_CONFIG
 	echo "${PYTHON_CONFIG}"
 }
 
@@ -606,7 +508,7 @@
 python_get_scriptdir() {
 	debug-print-function ${FUNCNAME} "${@}"
 
-	python_export "${@}" PYTHON_SCRIPTDIR
+	_python_export "${@}" PYTHON_SCRIPTDIR
 	echo "${PYTHON_SCRIPTDIR}"
 }
 
@@ -671,7 +573,7 @@
 	[[ ${EPYTHON} ]] || die 'No Python implementation set (EPYTHON is null).'
 
 	local PYTHON=${PYTHON}
-	[[ ${PYTHON} ]] || python_export PYTHON
+	[[ ${PYTHON} ]] || _python_export PYTHON
 
 	# default to sys.path
 	if [[ ${#} -eq 0 ]]; then
@@ -774,9 +676,8 @@
 	local f=${1}
 	local newfn=${2}
 
-	local PYTHON_SCRIPTDIR d
-	python_export PYTHON_SCRIPTDIR
-	d=${PYTHON_SCRIPTDIR#${EPREFIX}}
+	local scriptdir=$(python_get_scriptdir)
+	local d=${scriptdir#${EPREFIX}}
 
 	(
 		dodir "${wrapd}"
@@ -902,10 +803,8 @@
 		d=${python_moduleroot}
 	else
 		# relative to site-packages
-		local PYTHON_SITEDIR=${PYTHON_SITEDIR}
-		[[ ${PYTHON_SITEDIR} ]] || python_export PYTHON_SITEDIR
-
-		d=${PYTHON_SITEDIR#${SYSROOT}}/${python_moduleroot//.//}
+		local sitedir=$(python_get_sitedir)
+		d=${sitedir#${SYSROOT}}/${python_moduleroot//.//}
 	fi
 
 	(
@@ -935,10 +834,8 @@
 
 	[[ ${EPYTHON} ]] || die 'No Python implementation set (EPYTHON is null).'
 
-	local d PYTHON_INCLUDEDIR=${PYTHON_INCLUDEDIR}
-	[[ ${PYTHON_INCLUDEDIR} ]] || python_export PYTHON_INCLUDEDIR
-
-	d=${PYTHON_INCLUDEDIR#${SYSROOT}}
+	local includedir=$(python_get_includedir)
+	local d=${includedir#${SYSROOT}}
 
 	(
 		insopts -m 0644
@@ -950,6 +847,21 @@
 # @FUNCTION: python_wrapper_setup
 # @USAGE: [<path> [<impl>]]
 # @DESCRIPTION:
+# Backwards compatibility function.  The relevant API is now considered
+# private, please use python_setup instead.
+python_wrapper_setup() {
+	debug-print-function ${FUNCNAME} "${@}"
+
+	eqawarn "python_wrapper_setup() is part of private eclass API."
+	eqawarn "Please call python_setup() instead."
+
+	_python_wrapper_setup "${@}"
+}
+
+# @FUNCTION: _python_wrapper_setup
+# @USAGE: [<path> [<impl>]]
+# @INTERNAL
+# @DESCRIPTION:
 # Create proper 'python' executable and pkg-config wrappers
 # (if available) in the directory named by <path>. Set up PATH
 # and PKG_CONFIG_PATH appropriately. <path> defaults to ${T}/${EPYTHON}.
@@ -961,7 +873,7 @@
 # be assumed to contain proper wrappers already and only environment
 # setup will be done. If wrapper update is requested, the directory
 # shall be removed first.
-python_wrapper_setup() {
+_python_wrapper_setup() {
 	debug-print-function ${FUNCNAME} "${@}"
 
 	local workdir=${1:-${T}/${EPYTHON}}
@@ -978,10 +890,10 @@
 		# Clean up, in case we were supposed to do a cheap update.
 		rm -f "${workdir}"/bin/python{,2,3}{,-config} || die
 		rm -f "${workdir}"/bin/2to3 || die
-		rm -f "${workdir}"/pkgconfig/python{,2,3}.pc || die
+		rm -f "${workdir}"/pkgconfig/python{2,3}{,-embed}.pc || die
 
 		local EPYTHON PYTHON
-		python_export "${impl}" EPYTHON PYTHON
+		_python_export "${impl}" EPYTHON PYTHON
 
 		local pyver pyother
 		if python_is_python3; then
@@ -1021,8 +933,13 @@
 
 			# Python 2.7+.
 			ln -s "${EPREFIX}"/usr/$(get_libdir)/pkgconfig/${EPYTHON/n/n-}.pc \
-				"${workdir}"/pkgconfig/python.pc || die
-			ln -s python.pc "${workdir}"/pkgconfig/python${pyver}.pc || die
+				"${workdir}"/pkgconfig/python${pyver}.pc || die
+
+			# Python 3.8+.
+			if [[ ${EPYTHON} != python[23].[67] ]]; then
+				ln -s "${EPREFIX}"/usr/$(get_libdir)/pkgconfig/${EPYTHON/n/n-}-embed.pc \
+					"${workdir}"/pkgconfig/python${pyver}-embed.pc || die
+			fi
 		else
 			nonsupp+=( 2to3 python-config "python${pyver}-config" )
 		fi
@@ -1085,23 +1002,9 @@
 			;;
 	esac
 
-	case "${impl}" in
-		pypy|pypy3)
-			local append=
-			if [[ ${PYTHON_REQ_USE} ]]; then
-				append=[${PYTHON_REQ_USE}]
-			fi
-
-			# be happy with just the interpeter, no need for the virtual
-			has_version "${hasv_args[@]}" "dev-python/${impl}${append}" \
-				|| has_version "${hasv_args[@]}" "dev-python/${impl}-bin${append}"
-			;;
-		*)
-			local PYTHON_PKG_DEP
-			python_export "${impl}" PYTHON_PKG_DEP
-			has_version "${hasv_args[@]}" "${PYTHON_PKG_DEP}"
-			;;
-	esac
+	local PYTHON_PKG_DEP
+	_python_export "${impl}" PYTHON_PKG_DEP
+	has_version "${hasv_args[@]}" "${PYTHON_PKG_DEP}"
 }
 
 # @FUNCTION: python_fix_shebang
@@ -1262,6 +1165,7 @@
 # @FUNCTION: _python_check_locale_sanity
 # @USAGE: <locale>
 # @RETURN: 0 if sane, 1 otherwise
+# @INTERNAL
 # @DESCRIPTION:
 # Check whether the specified locale sanely maps between lowercase
 # and uppercase ASCII characters.
diff --git a/metadata/md5-cache/acct-group/kvm-0.0.1 b/metadata/md5-cache/acct-group/kvm-0.0.1
new file mode 100644
index 0000000..ecbf62b
--- /dev/null
+++ b/metadata/md5-cache/acct-group/kvm-0.0.1
@@ -0,0 +1,8 @@
+DEFINED_PHASES=setup
+DEPEND=sys-apps/baselayout
+EAPI=7
+KEYWORDS=*
+RDEPEND=sys-apps/baselayout
+SLOT=0
+_eclasses_=user	7c566af8c48023219fd63246e88d6621
+_md5_=f52112fdb0f2ab3584c95f147a1e2b24
diff --git a/metadata/md5-cache/acct-group/sshd-0.0.1 b/metadata/md5-cache/acct-group/sshd-0.0.1
new file mode 100644
index 0000000..9d81ae6
--- /dev/null
+++ b/metadata/md5-cache/acct-group/sshd-0.0.1
@@ -0,0 +1,8 @@
+DEFINED_PHASES=setup
+DEPEND=sys-apps/baselayout
+EAPI=7
+KEYWORDS=*
+RDEPEND=sys-apps/baselayout
+SLOT=0
+_eclasses_=user	7c566af8c48023219fd63246e88d6621
+_md5_=3e2179fc58433049b2d6cd269ab8a799
diff --git a/profiles/base/accounts/group/arc-data-snapshotd b/profiles/base/accounts/group/arc-data-snapshotd
new file mode 100644
index 0000000..90f4aaf
--- /dev/null
+++ b/profiles/base/accounts/group/arc-data-snapshotd
@@ -0,0 +1,3 @@
+group:arc-data-snapshotd
+gid:20153
+users:arc-data-snapshotd
diff --git a/profiles/base/accounts/group/arc-host-clock b/profiles/base/accounts/group/arc-host-clock
new file mode 100644
index 0000000..21e6549
--- /dev/null
+++ b/profiles/base/accounts/group/arc-host-clock
@@ -0,0 +1,2 @@
+group:arc-host-clock
+gid:20152
diff --git a/profiles/base/accounts/group/avfs b/profiles/base/accounts/group/avfs
index a029984..99cc813 100644
--- a/profiles/base/accounts/group/avfs
+++ b/profiles/base/accounts/group/avfs
@@ -1,3 +1,4 @@
 group:avfs
 gid:301
 users:cros-disks
+defunct:true
diff --git a/profiles/base/accounts/group/chronos-access b/profiles/base/accounts/group/chronos-access
index 871d711..6994e35 100644
--- a/profiles/base/accounts/group/chronos-access
+++ b/profiles/base/accounts/group/chronos-access
@@ -4,4 +4,4 @@
 # mostly system daemons running as a non-chronos user, group permissions
 # to access files/directories owned by chronos.
 # This includes all users accessing opencryptoki database files.
-users:root,ipsec,chronos,chaps,cros-disks,imageloaderd,crash
+users:root,ipsec,chronos,cros-disks,imageloaderd,crash
diff --git a/profiles/base/accounts/group/federated-service b/profiles/base/accounts/group/federated-service
new file mode 100644
index 0000000..cdbbca9
--- /dev/null
+++ b/profiles/base/accounts/group/federated-service
@@ -0,0 +1,3 @@
+group:federated-service
+gid:20151
+users:federated-service
diff --git a/profiles/base/accounts/group/iioservice b/profiles/base/accounts/group/iioservice
new file mode 100644
index 0000000..7a48e09
--- /dev/null
+++ b/profiles/base/accounts/group/iioservice
@@ -0,0 +1,3 @@
+group:iioservice
+gid:20158
+users:iioservice
diff --git a/profiles/base/accounts/group/ocr_service b/profiles/base/accounts/group/ocr_service
new file mode 100644
index 0000000..12baf20
--- /dev/null
+++ b/profiles/base/accounts/group/ocr_service
@@ -0,0 +1,3 @@
+group:ocr_service
+gid:20149
+users:ocr_service
diff --git a/profiles/base/accounts/group/policy-readers b/profiles/base/accounts/group/policy-readers
index 41f2e86..0e76e2a 100644
--- a/profiles/base/accounts/group/policy-readers
+++ b/profiles/base/accounts/group/policy-readers
@@ -1,4 +1,4 @@
 # Members have read access to the device policy in /var/lib/whitelist.
 group:policy-readers
 gid:303
-users:authpolicyd,chronos,u2f,shill
+users:attestation,authpolicyd,chronos,u2f,shill
diff --git a/profiles/base/accounts/group/smdisplay b/profiles/base/accounts/group/smdisplay
new file mode 100644
index 0000000..3eb8071
--- /dev/null
+++ b/profiles/base/accounts/group/smdisplay
@@ -0,0 +1,3 @@
+group:smdisplay
+gid:20148
+users:
diff --git a/profiles/base/accounts/group/typecd b/profiles/base/accounts/group/typecd
index 17d1164..fa6b191 100644
--- a/profiles/base/accounts/group/typecd
+++ b/profiles/base/accounts/group/typecd
@@ -1,4 +1,3 @@
 group:typecd
 gid:20146
-# The browser runs as chronos.
-users:chronos
+users:typecd
diff --git a/profiles/base/accounts/group/video b/profiles/base/accounts/group/video
index 00836a2..6347d0b 100644
--- a/profiles/base/accounts/group/video
+++ b/profiles/base/accounts/group/video
@@ -1,3 +1,3 @@
 group:video
 gid:27
-users:root,chronos,arc-camera,dlm,rtanalytics,crosvm,cfm-monitor
+users:root,chronos,arc-camera,dlm,rtanalytics,crosvm,cfm-monitor,smdisplay,cdm-oemcrypto
diff --git a/profiles/base/accounts/user/arc-data-snapshotd b/profiles/base/accounts/user/arc-data-snapshotd
new file mode 100644
index 0000000..45c17ef
--- /dev/null
+++ b/profiles/base/accounts/user/arc-data-snapshotd
@@ -0,0 +1,6 @@
+user:arc-data-snapshotd
+uid:20153
+gid:20153
+gecos:User for arc-data-snapshotd service.
+home:/dev/null
+shell:/bin/false
diff --git a/profiles/base/accounts/user/arc-host-clock b/profiles/base/accounts/user/arc-host-clock
new file mode 100644
index 0000000..845619b
--- /dev/null
+++ b/profiles/base/accounts/user/arc-host-clock
@@ -0,0 +1,6 @@
+user:arc-host-clock
+uid:20152
+gid:20152
+gecos:ARC host clock service
+home:/dev/null
+shell:/bin/false
diff --git a/profiles/base/accounts/user/avfs b/profiles/base/accounts/user/avfs
index 7d25b65..dca42ac 100644
--- a/profiles/base/accounts/user/avfs
+++ b/profiles/base/accounts/user/avfs
@@ -4,3 +4,4 @@
 gecos:FUSE-based virtual FS daemon for archive files
 home:/dev/null
 shell:/bin/false
+defunct:true
diff --git a/profiles/base/accounts/user/federated-service b/profiles/base/accounts/user/federated-service
new file mode 100644
index 0000000..25aa9e9
--- /dev/null
+++ b/profiles/base/accounts/user/federated-service
@@ -0,0 +1,6 @@
+user:federated-service
+uid:20151
+gid:20151
+gecos:CrOS Federated Computation service
+home:/dev/null
+shell:/bin/false
diff --git a/profiles/base/accounts/user/iioservice b/profiles/base/accounts/user/iioservice
new file mode 100644
index 0000000..ed6e708
--- /dev/null
+++ b/profiles/base/accounts/user/iioservice
@@ -0,0 +1,6 @@
+user:iioservice
+uid:20158
+gid:20158
+gecos:CrOS IIO service daemon
+home:/dev/null
+shell:/bin/false
diff --git a/profiles/base/accounts/user/ocr_service b/profiles/base/accounts/user/ocr_service
new file mode 100644
index 0000000..a7909b4
--- /dev/null
+++ b/profiles/base/accounts/user/ocr_service
@@ -0,0 +1,6 @@
+user:ocr_service
+uid:20149
+gid:20149
+gecos:User of Optical Character Recognition service.
+home:/dev/null
+shell:/bin/false
diff --git a/profiles/base/accounts/user/smdisplay b/profiles/base/accounts/user/smdisplay
new file mode 100644
index 0000000..d5feb32
--- /dev/null
+++ b/profiles/base/accounts/user/smdisplay
@@ -0,0 +1,6 @@
+user:smdisplay
+uid:20148
+gid:20148
+gecos:SMIUSBDisplay daemon user
+home:/dev/null
+shell:/bin/false
diff --git a/profiles/base/accounts/user/typecd b/profiles/base/accounts/user/typecd
index 6634d5c..0a684e2 100644
--- a/profiles/base/accounts/user/typecd
+++ b/profiles/base/accounts/user/typecd
@@ -1,5 +1,5 @@
 user:typecd
-uid:20103
+uid:20146
 gid:20146
 gecos:CrOS USB Type C Daemon
 home:/dev/null