sepolicy/policy/mask_only/kernel.te

type kernel, domain, mlstrustedobject;
neverallow * kernel:process { transition dyntransition };