diff --git a/policy/mcs b/policy/mcs
index c8c573e98..023bd149b 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -123,6 +123,9 @@ mlsconstrain key { create link read search setattr view write }
 mlsconstrain { ipc sem msgq shm } { create destroy setattr write unix_write }
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
+mlsconstrain context contains
+	((( h1 dom h2 ) and ( l1 domby l2 )) or ( t1 != mcs_constrained_type ));
+
 #
 # MCS policy for SELinux-enabled databases
 #