Merge "Enforce restrictions on kernel module origin"

domain.te

@@ -545,3 +545,8 @@ neverallow {
   -ueventd
   -vold
 } fuse_device:chr_file *;
+
+# Enforce restrictions on kernel module origin.
+# Do not allow kernel module loading except from system,
+# vendor, and boot partitions.
+neverallow * ~{ system_file rootfs }:system module_load;