Merge "Disallow relabeling vsock" into main
diff --git a/private/domain.te b/private/domain.te
index 61e2ea6..c92830f 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -2235,3 +2235,6 @@
# Only init/vendor are allowed to write sysfs_pgsize_migration;
# ueventd needs write access to all sysfs files.
neverallow { domain -init -vendor_init -ueventd } sysfs_pgsize_migration:file no_w_file_perms;
+
+# We need to be able to rely on vsock labels, so disallow changing them.
+neverallow domain *:vsock_socket { relabelfrom relabelto };