selinux-refpolicy/refpolicy/policy/modules/system/domain.te

# Mark process types as domains
attribute domain;

neverallow domain ~domain:process { transition dyntransition };