Merge "Only installd and init may relabel app_data_file."

public/domain.te

@@ -1187,6 +1187,12 @@ neverallow {
   -installd # creation of sandbox
 } app_data_file:dir_file_class_set { create unlink };
 
+neverallow {
+  domain
+  -init
+  -installd
+} app_data_file:dir_file_class_set { relabelfrom relabelto };
+
 #
 # Only these domains should transition to shell domain. This domain is
 # permissible for the "shell user". If you need a process to exec a shell