diff --git a/src/exec.c b/src/exec.c
index fb98f1c20..3c4e749c1 100644
--- a/src/exec.c
+++ b/src/exec.c
@@ -345,7 +345,7 @@ direct_exec_allowed(struct command_details *details)
     debug_decl(direct_exec_allowed, SUDO_DEBUG_EXEC);
 
     /* Assumes sudo_needs_pty() was already checked. */
-    if (ISSET(details->flags, CD_SET_TIMEOUT|CD_SUDOEDIT) ||
+    if (ISSET(details->flags, CD_RBAC_ENABLED|CD_SET_TIMEOUT|CD_SUDOEDIT) ||
 	    policy_plugin.u.policy->close != NULL)
 	debug_return_bool(false);