mcs: constrain context contain access

Signed-off-by: Kenton Groombridge <me@concord.sh>

policy/mcs

@@ -123,6 +123,9 @@ mlsconstrain key { create link read search setattr view write }
 mlsconstrain { ipc sem msgq shm } { create destroy setattr write unix_write }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
+mlsconstrain context contains
+	((( h1 dom h2 ) and ( l1 domby l2 )) or ( t1 != mcs_constrained_type ));
+
 #
 # MCS policy for SELinux-enabled databases
 #