diff --git a/su.te b/su.te
index 5ba57760ff3f945634789302811b11e5ffdd8c2c..c17fd0bf437c074b7c0c456c01c7c115b2cd0ac8 100644
--- a/su.te
+++ b/su.te
@@ -23,4 +23,7 @@ userdebug_or_eng(`
 
   # su is also permissive to permit setenforce.
   permissive su;
+
+  # Make su a net domain.
+  net_domain(su)
 ')