selinux-refpolicy/refpolicy/policy/modules/system/domain.te

policy_module(domain,1.0)

########################################
#
# Declarations
#

# Mark process types as domains
attribute domain;

# entrypoint executables
attribute entry_type;

# widely-inheritable file descriptors
attribute privfd;

# Domains that can set their current context
# (perform dynamic transitions)
attribute set_curr_context;

# constraint related attributes
attribute can_change_process_identity;
attribute can_change_process_role;
attribute can_change_object_identity;

# Transitions only allowed from domains to other domains
neverallow domain ~domain:process { transition dyntransition };

# enabling setcurrent breaks process tranquility.  If you do not
# know what this means or do not understand the implications of a
# dynamic transition, you should not be using it!!!
neverallow { domain -set_curr_context } self:process setcurrent;

# TODO:
# cjp: also need to except correctly for SEFramework
#neverallow { domain unlabeled_t } file_type:process *;
#neverallow ~{ domain unlabeled_t } *:process *;