Move mcs_constrained() impementation.

policy/modules/kernel/mcs.if

@@ -3,6 +3,34 @@
 ##	Contains attributes used in MCS policy.
 ## </required>
 
+########################################
+## <summary>
+##	Constrain by category access control (MCS).
+## </summary>
+## <desc>
+##	<p>
+##	Constrain the specified type by category based
+##	access control (MCS) This prevents this domain from
+##	interacting with subjects and operating on objects
+##	that it otherwise would be able to interact
+##	with or operate on respectively.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Type to be constrained by MCS.
+##	</summary>
+## </param>
+## <infoflow type="none"/>
+#
+interface(`mcs_constrained',`
+	gen_require(`
+		attribute mcs_constrained_type;
+	')
+
+	typeattribute $1 mcs_constrained_type;
+')
+
 ########################################
 ## <summary>
 ##	This domain is allowed to read files and directories
@@ -102,31 +130,3 @@ interface(`mcs_process_set_categories',`
 
 	typeattribute $1 mcssetcats;
 ')
-
-########################################
-## <summary>
-##	Constrain by category access control (MCS).
-## </summary>
-## <desc>
-##	<p>
-##	Constrain the specified type by category based
-##	access control (MCS) This prevents this domain from
-##	interacting with subjects and operating on objects
-##	that it otherwise would be able to interact
-##	with or operate on respectively.
-##	</p>
-## </desc>
-## <param name="domain">
-##	<summary>
-##	Type to be constrained by MCS.
-##	</summary>
-## </param>
-## <infoflow type="none"/>
-#
-interface(`mcs_constrained',`
-	gen_require(`
-		attribute mcs_constrained_type;
-	')
-
-	typeattribute $1 mcs_constrained_type;
-')