diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te
index 867aefc4a..fe1132779 100644
--- a/policy/modules/system/ipsec.te
+++ b/policy/modules/system/ipsec.te
@@ -151,12 +151,16 @@ corenet_udp_bind_isakmp_port(ipsec_t)
 corenet_udp_bind_ipsecnat_port(ipsec_t)
 corenet_sendrecv_generic_server_packets(ipsec_t)
 corenet_sendrecv_isakmp_server_packets(ipsec_t)
+# allow pluto to build Security Association Database
+corenet_setcontext_all_spds(ipsec_t)
 
 dev_read_sysfs(ipsec_t)
 dev_read_rand(ipsec_t)
 dev_read_urand(ipsec_t)
 
 domain_use_interactive_fds(ipsec_t)
+# allow pluto to set contexts on ipsec policy and SAs
+domain_ipsec_setcontext_all_domains(ipsec_t)
 
 files_list_tmp(ipsec_t)
 files_read_etc_files(ipsec_t)