Add neverallow for mounting on proc

Change-Id: Ie19ac00f2e96836667e8a5c18fafeaf6b6eadb25

domain.te

@@ -397,3 +397,5 @@ neverallow domain {
 # TODO: prohibit non-zygote spawned processes from using shared libraries
 # with text relocations. b/20013628 .
 # neverallow { domain -appdomain } file_type:file execmod;
+
+neverallow { domain -init } proc:{ file dir } mounton;