Merge "allow modprobe to load signed kernel modules" into oc-dev
diff --git a/public/domain.te b/public/domain.te
index 8f63624..34cbadc 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -489,6 +489,7 @@
 neverallow {
   domain
   userdebug_or_eng(`-domain') # exclude debuggable builds
+  -hal_bootctl
   -init
   -uncrypt
   -update_engine