Strengthen setenforce and setbool assertions
Change-Id: I58f15889c248b49f9e29028a3c0a86b4c950ff07
diff --git a/assert.te b/assert.te
index 1f12c5e..85cb48b 100644
--- a/assert.te
+++ b/assert.te
@@ -16,7 +16,7 @@
# Setting SELinux enforcing status or booleans.
# Conditionally allowed to system_app for SEAndroidManager.
-neverallow { appdomain -system_app } kernel:security { setenforce setbool };
+neverallow { domain -unconfineddomain -system -system_app } kernel:security { setenforce setbool };
# Load security policy.
neverallow appdomain kernel:security load_policy;