domain: relax execmod restrictions

Some devices still have pre-built binaries with text relocations
on them. As a result, it's premature to assert a neverallow rule
for files in /system

Bug: 20013628
Change-Id: I3a1e43db5c610164749dee6882f645a0559c789b

domain.te

@@ -390,10 +390,13 @@ neverallow { domain userdebug_or_eng(`-dumpstate -shell -su') } su_exec:file no_
 # which, long term, need to go away.
 neverallow domain {
   file_type
+  -system_file      # needs to die. b/20013628
   -system_data_file
   -apk_data_file
   -app_data_file
   -asec_public_file
 }:file execmod;
 
-neverallow { domain -appdomain } file_type:file execmod;
+# TODO: prohibit non-zygote spawned processes from using shared libraries
+# with text relocations. b/20013628 .
+# neverallow { domain -appdomain } file_type:file execmod;