gentoo-selinux-policies/cron_additional.te

policy_module(cron_additional, 0.0.1)

require {
  type crond_t;
  type cron_spool_t;
  type system_cron_spool_t;
}

allow crond_t cron_spool_t:dir watch;
allow crond_t system_cron_spool_t:dir watch;
allow crond_t system_cron_spool_t:file watch;