I'm in a situation where I have to put a _lot_ of entries into role_transitions on my default role.
As far as I can tell there isn't a way to tell grsecurity that it's OK for someone to transfer to any role - you have to specifically put them all.
Would it be an easy fix to add support for the "any" keyword here, or possibly a wildcard of some sort?