Looks like it should be in a base OS policy?