sepolicy/policy/mask_only/kernel.te

type kernel, domain, mlstrustedsubject;
neverallow * kernel:process { transition dyntransition };