diff --git a/CONTRIBUTORS.mkdn b/CONTRIBUTORS.mkdn
index c0824494..5681086e 100644
--- a/CONTRIBUTORS.mkdn
+++ b/CONTRIBUTORS.mkdn
@@ -27,6 +27,7 @@ Maintainers (LineageOS 13.0):
 * __B&N Nook Tablet (acclaim):__  chrmhoffmann
 * __BQ Aquaris E5 4G/E5 S (vegetalte):__  cmorlok, eloimuns, Kra1o5, stucki, brinlyau (bq-dev)
 * __BQ Aquaris M5 (piccolo):__  cmorlok, eloimuns, Kra1o5, stucki, brinlyau (bq-dev)
+* __BQ Aquaris X5 (paella):__  cmorlok, eloimuns, Kra1o5, stucki, brinlyau (bq-dev)
 * __BQ Aquaris X5 Plus (gohan):__  cmorlok, eloimuns, Kra1o5, stucki, brinlyau (bq-dev)
 * __Google Android One:__ varunchitre15
 * __Google Galaxy Nexus:__ Ziyan, musical_chairs
@@ -60,6 +61,7 @@ Maintainers (LineageOS 13.0):
 * __Huawei Ascend Mate 2:__ mdmower, u-ra
 * __Huawei Honor 4/4X (cherry):__ dianlujitao, surdupetru, desalesouche
 * __LeEco Le 2 (s2):__ codeworkx
+* __LeEco Le Pro3 (zl1):__ jrior001, codeworkx
 * __LG G2 (AT&T) (D800):__ arcee, Rashed97, Shelnutt2
 * __LG G2 (T-Mobile) (D801):__ arcee, Rashed97, Shelnutt2
 * __LG G2 (International) (D802):__ arcee, Rashed97, Shelnutt2
diff --git a/addonsu/51-addonsu.sh b/addonsu/51-addonsu.sh
new file mode 100644
index 00000000..4e36c4cd
--- /dev/null
+++ b/addonsu/51-addonsu.sh
@@ -0,0 +1,37 @@
+#!/sbin/sh
+
+. /tmp/backuptool.functions
+
+list_files() {
+cat <<EOF
+bin/su
+xbin/su
+EOF
+}
+
+case "$1" in
+  backup)
+    list_files | while read FILE DUMMY; do
+      backup_file $S/"$FILE"
+    done
+  ;;
+  restore)
+    list_files | while read FILE REPLACEMENT; do
+      R=""
+      [ -n "$REPLACEMENT" ] && R="$S/$REPLACEMENT"
+      [ -f "$C/$S/$FILE" -o -L "$C/$S/$FILE" ] && restore_file $S/"$FILE" "$R"
+    done
+  ;;
+  pre-backup)
+    # Stub
+  ;;
+  post-backup)
+    # Stub
+  ;;
+  pre-restore)
+    # Stub
+  ;;
+  post-restore)
+    # Stub
+  ;;
+esac
diff --git a/addonsu/mount-system.sh b/addonsu/mount-system.sh
new file mode 100644
index 00000000..2e209fb2
--- /dev/null
+++ b/addonsu/mount-system.sh
@@ -0,0 +1,13 @@
+#!/sbin/sh
+
+if mount /system; then
+    exit 0
+fi
+
+# Try to get the block from /etc/recovery.fstab
+block=`cat /etc/recovery.fstab | cut -d '#' -f 1 | grep /system | grep -o '/dev/[^ ]*' | head -1`
+if [ -n "$block" ] && mount $block /system; then
+    exit 0
+fi
+
+exit 1
diff --git a/addonsu/updater-script-install b/addonsu/updater-script-install
new file mode 100644
index 00000000..762ddc5b
--- /dev/null
+++ b/addonsu/updater-script-install
@@ -0,0 +1,21 @@
+ui_print("Installing su addon...");
+ifelse(is_mounted("/system"), unmount("/system"));
+package_extract_file("mount-system.sh", "/tmp/mount-system.sh");
+set_metadata("/tmp/mount-system.sh", "uid", 0, "gid", 0, "mode", 0755);
+run_program("/tmp/mount-system.sh") == 0 || abort("Could not mount /system");
+
+if getprop("ro.build.system_root_image") != "true" then
+  package_extract_dir("system", "/system");
+  set_metadata("/system/addon.d/51-addonsu.sh", "uid", 0, "gid", 0, "mode", 0755, "selabel", "u:object_r:system_file:s0");
+  set_metadata("/system/xbin/su", "uid", 0, "gid", 2000, "mode", 0755, "selabel", "u:object_r:su_exec:s0");
+  symlink("/system/xbin/su", "/system/bin/su");
+else
+  package_extract_dir("system", "/system/system");
+  set_metadata("/system/system/addon.d/51-addonsu.sh", "uid", 0, "gid", 0, "mode", 0755, "selabel", "u:object_r:system_file:s0");
+  set_metadata("/system/system/xbin/su", "uid", 0, "gid", 2000, "mode", 0755, "selabel", "u:object_r:su_exec:s0");
+  symlink("/system/xbin/su", "/system/system/bin/su");
+endif;
+
+unmount("/system");
+ui_print("Done");
+set_progress(1.000000);
diff --git a/addonsu/updater-script-remove b/addonsu/updater-script-remove
new file mode 100644
index 00000000..dab1df9f
--- /dev/null
+++ b/addonsu/updater-script-remove
@@ -0,0 +1,19 @@
+ui_print("Removing su addon...");
+ifelse(is_mounted("/system"), unmount("/system"));
+package_extract_file("mount-system.sh", "/tmp/mount-system.sh");
+set_metadata("/tmp/mount-system.sh", "uid", 0, "gid", 0, "mode", 0755);
+run_program("/tmp/mount-system.sh") == 0 || abort("Could not mount /system");
+
+if getprop("ro.build.system_root_image") != "true" then
+  delete("/system/addon.d/51-addonsu.sh");
+  delete("/system/bin/su");
+  delete("/system/xbin/su");
+else
+  delete("/system/system/addon.d/51-addonsu.sh");
+  delete("/system/system/bin/su");
+  delete("/system/system/xbin/su");
+endif;
+
+unmount("/system");
+ui_print("Done");
+set_progress(1.000000);
diff --git a/build/tasks/addonsu.mk b/build/tasks/addonsu.mk
new file mode 100644
index 00000000..1c360f38
--- /dev/null
+++ b/build/tasks/addonsu.mk
@@ -0,0 +1,37 @@
+ADDONSU_PREBUILTS_PATH := vendor/cm/addonsu/
+
+ADDONSU_INSTALL_OUT := $(PRODUCT_OUT)/addonsu-install/
+ADDONSU_INSTALL_TARGET := $(PRODUCT_OUT)/addonsu-$(PRODUCT_VERSION_MAJOR).$(PRODUCT_VERSION_MINOR)-$(TARGET_ARCH).zip
+
+$(ADDONSU_INSTALL_TARGET): $(ALL_MODULES.updater.BUILT) \
+		$(ALL_MODULES.su.BUILT)
+	$(hide) rm -rf $@ $(ADDONSU_INSTALL_OUT)
+	$(hide) mkdir -p $(ADDONSU_INSTALL_OUT)/META-INF/com/google/android/
+	$(hide) mkdir -p $(ADDONSU_INSTALL_OUT)/system/xbin
+	$(hide) mkdir -p $(ADDONSU_INSTALL_OUT)/system/addon.d
+	$(hide) cp $(ALL_MODULES.su.BUILT) $(ADDONSU_INSTALL_OUT)/system/xbin/
+	$(hide) cp $(ALL_MODULES.updater.BUILT) $(ADDONSU_INSTALL_OUT)/META-INF/com/google/android/update-binary
+	$(hide) cp $(ADDONSU_PREBUILTS_PATH)/51-addonsu.sh $(ADDONSU_INSTALL_OUT)/system/addon.d/
+	$(hide) cp $(ADDONSU_PREBUILTS_PATH)/mount-system.sh $(ADDONSU_INSTALL_OUT)/
+	$(hide) cp $(ADDONSU_PREBUILTS_PATH)/updater-script-install $(ADDONSU_INSTALL_OUT)/META-INF/com/google/android/updater-script
+	$(hide) (cd $(ADDONSU_INSTALL_OUT) && zip -qr $@ *)
+
+.PHONY: addonsu
+addonsu: $(ADDONSU_INSTALL_TARGET)
+	@echo "Done: $(ADDONSU_INSTALL_TARGET)"
+
+
+ADDONSU_REMOVE_OUT := $(PRODUCT_OUT)/addonsu-remove/
+ADDONSU_REMOVE_TARGET := $(PRODUCT_OUT)/addonsu-remove-$(PRODUCT_VERSION_MAJOR).$(PRODUCT_VERSION_MINOR)-$(TARGET_ARCH).zip
+
+$(ADDONSU_REMOVE_TARGET): $(ALL_MODULES.updater.BUILT)
+	$(hide) rm -rf $@ $(ADDONSU_REMOVE_OUT)
+	$(hide) mkdir -p $(ADDONSU_REMOVE_OUT)/META-INF/com/google/android/
+	$(hide) cp $(ALL_MODULES.updater.BUILT) $(ADDONSU_REMOVE_OUT)/META-INF/com/google/android/update-binary
+	$(hide) cp $(ADDONSU_PREBUILTS_PATH)/mount-system.sh $(ADDONSU_REMOVE_OUT)/
+	$(hide) cp $(ADDONSU_PREBUILTS_PATH)/updater-script-remove $(ADDONSU_REMOVE_OUT)/META-INF/com/google/android/updater-script
+	$(hide) (cd $(ADDONSU_REMOVE_OUT) && zip -qr $@ *)
+
+.PHONY: addonsu-remove
+addonsu-remove: $(ADDONSU_REMOVE_TARGET)
+	@echo "Done: $(ADDONSU_REMOVE_TARGET)"
diff --git a/prebuilt/common/bin/backuptool.functions b/prebuilt/common/bin/backuptool.functions
index 9598f23c..8a372a3e 100644
--- a/prebuilt/common/bin/backuptool.functions
+++ b/prebuilt/common/bin/backuptool.functions
@@ -7,8 +7,18 @@ export C=/tmp/backupdir
 export S=/system
 export V=13.0
 
+copy_file() {
+  cp -dp "$1" "$2"
+  # symlinks don't have a context
+  if [ ! -L "$1" ]; then
+    # it is assumed that every label starts with 'u:object_r' and has no white-spaces
+    local context=`ls -Z "$1" | grep -o 'u:object_r:[^ ]*' | head -1`
+    chcon "$context" "$2"
+  fi
+}
+
 backup_file() {
-  if [ -e "$1" ]; then
+  if [ -e "$1" -o -L "$1" ]; then
     local F=`basename "$1"`
     local D=`dirname "$1"`
     # dont backup any apps that have odex files, they are useless
@@ -16,7 +26,7 @@ backup_file() {
       echo "Skipping odexed apk $1";
     else
       mkdir -p "$C/$D"
-      cp -p $1 "$C/$D/$F"
+      copy_file "$1" "$C/$D/$F"
     fi
   fi
 }
@@ -24,11 +34,11 @@ backup_file() {
 restore_file() {
   local FILE=`basename "$1"`
   local DIR=`dirname "$1"`
-  if [ -e "$C/$DIR/$FILE" ]; then
+  if [ -e "$C/$DIR/$FILE" -o -L "$C/$DIR/$FILE" ]; then
     if [ ! -d "$DIR" ]; then
       mkdir -p "$DIR";
     fi
-    cp -p "$C/$DIR/$FILE" "$1";
+    copy_file "$C/$DIR/$FILE" "$1";
     if [ -n "$2" ]; then
       echo "Deleting obsolete file $2"
       rm "$2";
diff --git a/prebuilt/common/etc/apns-conf.xml b/prebuilt/common/etc/apns-conf.xml
index ec1c3223..f0e330e8 100644
--- a/prebuilt/common/etc/apns-conf.xml
+++ b/prebuilt/common/etc/apns-conf.xml
@@ -3688,27 +3688,27 @@
   <apn carrier="Movistar AG MMS" mcc="722" mnc="007" apn="mms.gprs.unifon.com.ar" user="mms" password="mms" mmsc="http://mms.tmovil.cl/" mmsproxy="200.068.032.239" mmsport="9201" type="mms" />
   <apn carrier="QUAM" mcc="722" mnc="01" apn="internet.movil" user="internet" password="internet" authtype="1" type="default,supl,dun" />
   <apn carrier="QUAM MMS" mcc="722" mnc="01" apn="mms.movil" user="mms" password="mms" mmsc="http://mms.quam.com.ar" mmsproxy="200.68.32.239" mmsport="9090" type="mms" />
-  <apn carrier="Movistar WAP" mcc="722" mnc="07" apn="wap.gprs.unifon.com.ar" proxy="200.5.68.10" port="8080" mmsc="" user="wap" password="wap" authtype="1" type="default,supl" />
+  <apn carrier="Movistar WAP" mcc="722" mnc="07" apn="wap.gprs.unifon.com.ar" mmsc="" user="wap" password="wap" authtype="1" type="default,supl" />
   <apn carrier="Movistar MMS" mcc="722" mnc="07" apn="mms.gprs.unifon.com.ar" proxy="" port="" mmsproxy="200.68.32.239" mmsport="8080" mmsc="http://mms.movistar.com.ar" user="mms" password="mms" authtype="1" type="mms" />
-  <apn carrier="Movistar WAP" mcc="722" mnc="070" apn="wap.gprs.unifon.com.ar" proxy="200.5.68.10" port="8080" mmsc="" user="wap" password="wap" type="default,supl" />
+  <apn carrier="Movistar WAP" mcc="722" mnc="070" apn="wap.gprs.unifon.com.ar" mmsc="" user="wap" password="wap" type="default,supl" />
   <apn carrier="Movistar MMS" mcc="722" mnc="070" apn="mms.gprs.unifon.com.ar" proxy="" port="" mmsproxy="200.68.32.239" mmsport="8080" mmsc="http://mms.movistar.com.ar" user="mms" password="mms" type="mms" />
-  <apn carrier="Movistar WAP" mcc="722" mnc="071" apn="wap.gprs.unifon.com.ar" proxy="200.5.68.10" port="8080" mmsc="" user="wap" password="wap" type="default,supl" />
+  <apn carrier="Movistar WAP" mcc="722" mnc="071" apn="wap.gprs.unifon.com.ar" mmsc="" user="wap" password="wap" type="default,supl" />
   <apn carrier="Movistar MMS" mcc="722" mnc="071" apn="mms.gprs.unifon.com.ar" proxy="" port="" mmsproxy="200.68.32.239" mmsport="8080" mmsc="http://mms.movistar.com.ar" user="mms" password="mms" type="mms" />
-  <apn carrier="Movistar WAP" mcc="722" mnc="072" apn="wap.gprs.unifon.com.ar" proxy="200.5.68.10" port="8080" mmsc="" user="wap" password="wap" type="default,supl" />
+  <apn carrier="Movistar WAP" mcc="722" mnc="072" apn="wap.gprs.unifon.com.ar" mmsc="" user="wap" password="wap" type="default,supl" />
   <apn carrier="Movistar MMS" mcc="722" mnc="072" apn="mms.gprs.unifon.com.ar" proxy="" port="" mmsproxy="200.68.32.239" mmsport="8080" mmsc="http://mms.movistar.com.ar" user="mms" password="mms" type="mms" />
-  <apn carrier="Movistar WAP" mcc="722" mnc="073" apn="wap.gprs.unifon.com.ar" proxy="200.5.68.10" port="8080" mmsc="" user="wap" password="wap" type="default,supl" />
+  <apn carrier="Movistar WAP" mcc="722" mnc="073" apn="wap.gprs.unifon.com.ar" mmsc="" user="wap" password="wap" type="default,supl" />
   <apn carrier="Movistar MMS" mcc="722" mnc="073" apn="mms.gprs.unifon.com.ar" proxy="" port="" mmsproxy="200.68.32.239" mmsport="8080" mmsc="http://mms.movistar.com.ar" user="mms" password="mms" type="mms" />
-  <apn carrier="Movistar WAP" mcc="722" mnc="074" apn="wap.gprs.unifon.com.ar" proxy="200.5.68.10" port="8080" mmsc="" user="wap" password="wap" type="default,supl" />
+  <apn carrier="Movistar WAP" mcc="722" mnc="074" apn="wap.gprs.unifon.com.ar" mmsc="" user="wap" password="wap" type="default,supl" />
   <apn carrier="Movistar MMS" mcc="722" mnc="074" apn="mms.gprs.unifon.com.ar" proxy="" port="" mmsproxy="200.68.32.239" mmsport="8080" mmsc="http://mms.movistar.com.ar" user="mms" password="mms" type="mms" />
-  <apn carrier="Movistar WAP" mcc="722" mnc="075" apn="wap.gprs.unifon.com.ar" proxy="200.5.68.10" port="8080" mmsc="" user="wap" password="wap" type="default,supl" />
+  <apn carrier="Movistar WAP" mcc="722" mnc="075" apn="wap.gprs.unifon.com.ar" mmsc="" user="wap" password="wap" type="default,supl" />
   <apn carrier="Movistar MMS" mcc="722" mnc="075" apn="mms.gprs.unifon.com.ar" proxy="" port="" mmsproxy="200.68.32.239" mmsport="8080" mmsc="http://mms.movistar.com.ar" user="mms" password="mms" type="mms" />
-  <apn carrier="Movistar WAP" mcc="722" mnc="076" apn="wap.gprs.unifon.com.ar" proxy="200.5.68.10" port="8080" mmsc="" user="wap" password="wap" type="default,supl" />
+  <apn carrier="Movistar WAP" mcc="722" mnc="076" apn="wap.gprs.unifon.com.ar" mmsc="" user="wap" password="wap" type="default,supl" />
   <apn carrier="Movistar MMS" mcc="722" mnc="076" apn="mms.gprs.unifon.com.ar" proxy="" port="" mmsproxy="200.68.32.239" mmsport="8080" mmsc="http://mms.movistar.com.ar" user="mms" password="mms" type="mms" />
-  <apn carrier="Movistar WAP" mcc="722" mnc="077" apn="wap.gprs.unifon.com.ar" proxy="200.5.68.10" port="8080" mmsc="" user="wap" password="wap" type="default,supl" />
+  <apn carrier="Movistar WAP" mcc="722" mnc="077" apn="wap.gprs.unifon.com.ar" mmsc="" user="wap" password="wap" type="default,supl" />
   <apn carrier="Movistar MMS" mcc="722" mnc="077" apn="mms.gprs.unifon.com.ar" proxy="" port="" mmsproxy="200.68.32.239" mmsport="8080" mmsc="http://mms.movistar.com.ar" user="mms" password="mms" type="mms" />
-  <apn carrier="Movistar WAP" mcc="722" mnc="078" apn="wap.gprs.unifon.com.ar" proxy="200.5.68.10" port="8080" mmsc="" user="wap" password="wap" type="default,supl" />
+  <apn carrier="Movistar WAP" mcc="722" mnc="078" apn="wap.gprs.unifon.com.ar" mmsc="" user="wap" password="wap" type="default,supl" />
   <apn carrier="Movistar MMS" mcc="722" mnc="078" apn="mms.gprs.unifon.com.ar" proxy="" port="" mmsproxy="200.68.32.239" mmsport="8080" mmsc="http://mms.movistar.com.ar" user="mms" password="mms" type="mms" />
-  <apn carrier="Movistar WAP" mcc="722" mnc="079" apn="wap.gprs.unifon.com.ar" proxy="200.5.68.10" port="8080" mmsc="" user="wap" password="wap" type="default,supl" />
+  <apn carrier="Movistar WAP" mcc="722" mnc="079" apn="wap.gprs.unifon.com.ar" mmsc="" user="wap" password="wap" type="default,supl" />
   <apn carrier="Movistar MMS" mcc="722" mnc="079" apn="mms.gprs.unifon.com.ar" proxy="" port="" mmsproxy="200.68.32.239" mmsport="8080" mmsc="http://mms.movistar.com.ar" user="mms" password="mms" type="mms" />
   <apn carrier="Personal WAP" mcc="722" mnc="34" apn="gprs.personal.com" user="" password="" type="default,supl" />
   <apn carrier="Personal MMS" mcc="722" mnc="34" apn="mms" proxy="" port="" mmsproxy="172.25.7.31" mmsport="8080" mmsc="http://mms.personal.com" user="mms" password="mms" type="mms" />
diff --git a/prebuilt/common/etc/init.local.rc b/prebuilt/common/etc/init.local.rc
index 2a5316d4..53f972c9 100644
--- a/prebuilt/common/etc/init.local.rc
+++ b/prebuilt/common/etc/init.local.rc
@@ -1,6 +1,4 @@
 # CyanogenMod Extras
-import /init.superuser.rc
-
 on init
     export ANDROID_CACHE /cache
     export TERMINFO /system/etc/terminfo
@@ -211,3 +209,19 @@ on property:sys.io.scheduler=bfq
     write /sys/block/sde/queue/iosched/slice_idle 0
     write /sys/block/dm-0/queue/iosched/slice_idle 0
 
+# su daemon
+service su_daemon /system/xbin/su --daemon
+    disabled
+    seclabel u:r:sudaemon:s0
+
+on property:persist.sys.root_access=0
+    stop su_daemon
+
+on property:persist.sys.root_access=1
+    start su_daemon
+
+on property:persist.sys.root_access=2
+    stop su_daemon
+
+on property:persist.sys.root_access=3
+    start su_daemon
diff --git a/sepolicy/seapp_contexts b/sepolicy/seapp_contexts
index 11c8f00f..6b9c88fb 100644
--- a/sepolicy/seapp_contexts
+++ b/sepolicy/seapp_contexts
@@ -1,4 +1,4 @@
 user=_app seinfo=platform name=com.cyanogenmod.filemanager domain=untrusted_app type=app_data_file
 user=theme_man domain=system_app type=system_data_file
-user=_app seinfo=cmupdater name=com.cyanogenmod.updater domain=system_app type=system_app_data_file
-user=_app seinfo=themeservice name=org.cyanogenmod.themeservice domain=themeservice_app type=themeservice_app_data_file
\ No newline at end of file
+user=_app seinfo=cmupdater name=org.lineageos.updater domain=system_app type=system_app_data_file
+user=_app seinfo=themeservice name=org.cyanogenmod.themeservice domain=themeservice_app type=themeservice_app_data_file