diff --git a/su.te b/su.te
index 5ba5776..c17fd0b 100644
--- a/su.te
+++ b/su.te
@@ -23,4 +23,7 @@
 
   # su is also permissive to permit setenforce.
   permissive su;
+
+  # Make su a net domain.
+  net_domain(su)
 ')