domain.te

neverallow {
  domain
  -recovery
} self:capability setfcap;

# Enforce AT_SECURE for executing crash_dump.
neverallow domain crash_dump:process noatsecure;