6146f7
diff --git libselinux-2.6/Makefile libselinux-2.6/Makefile
ea9eee
index baa0db3..3355f01 100644
6146f7
--- libselinux-2.6/Makefile
6146f7
+++ libselinux-2.6/Makefile
e58e94
@@ -1,4 +1,4 @@
e58e94
-SUBDIRS = src include utils man
e58e94
+SUBDIRS = src include utils man golang
e58e94
 
e58e94
 DISABLE_SETRANS ?= n
6146f7
 DISABLE_RPM ?= n
ea9eee
@@ -27,6 +27,16 @@ else
ea9eee
 endif
ea9eee
 export PCRE_CFLAGS PCRE_LDFLAGS
ea9eee
 
ea9eee
+OS := $(shell uname)
ea9eee
+export OS
ea9eee
+
ea9eee
+ifeq ($(shell $(CC) -v 2>&1 | grep "clang"),)
ea9eee
+COMPILER := gcc
ea9eee
+else
ea9eee
+COMPILER := clang
ea9eee
+endif
ea9eee
+export COMPILER
ea9eee
+
ea9eee
 all install relabel clean distclean indent:
ea9eee
 	@for subdir in $(SUBDIRS); do \
ea9eee
 		(cd $$subdir && $(MAKE) $@) || exit 1; \
ea9eee
@@ -47,4 +57,10 @@ install-pywrap:
ea9eee
 install-rubywrap: 
ea9eee
 	$(MAKE) -C src install-rubywrap $@
ea9eee
 
ea9eee
+clean-pywrap:
ea9eee
+	$(MAKE) -C src clean-pywrap $@
ea9eee
+
ea9eee
+clean-rubywrap:
ea9eee
+	$(MAKE) -C src clean-rubywrap $@
ea9eee
+
ea9eee
 test:
6146f7
diff --git libselinux-2.6/golang/Makefile libselinux-2.6/golang/Makefile
e58e94
new file mode 100644
e58e94
index 0000000..b75677b
e58e94
--- /dev/null
6146f7
+++ libselinux-2.6/golang/Makefile
e58e94
@@ -0,0 +1,22 @@
e58e94
+# Installation directories.
e58e94
+PREFIX ?= $(DESTDIR)/usr
e58e94
+LIBDIR ?= $(DESTDIR)/usr/lib
e58e94
+GODIR ?= $(LIBDIR)/golang/src/pkg/github.com/selinux
e58e94
+all:
e58e94
+
e58e94
+install: 
e58e94
+	[ -d $(GODIR) ] || mkdir -p $(GODIR)
e58e94
+	install -m 644 selinux.go $(GODIR)
e58e94
+
e58e94
+test:
e58e94
+	@mkdir selinux
e58e94
+	@cp selinux.go selinux
e58e94
+	GOPATH=$(pwd) go run test.go 
e58e94
+	@rm -rf selinux
e58e94
+
e58e94
+clean:
e58e94
+	@rm -f *~
e58e94
+	@rm -rf selinux
e58e94
+indent:
e58e94
+
e58e94
+relabel:
6146f7
diff --git libselinux-2.6/golang/selinux.go libselinux-2.6/golang/selinux.go
e58e94
new file mode 100644
e58e94
index 0000000..34bf6bb
e58e94
--- /dev/null
6146f7
+++ libselinux-2.6/golang/selinux.go
e58e94
@@ -0,0 +1,412 @@
e58e94
+package selinux
e58e94
+
e58e94
+/*
e58e94
+ The selinux package is a go bindings to libselinux required to add selinux
e58e94
+ support to docker.
e58e94
+
e58e94
+ Author Dan Walsh <dwalsh@redhat.com>
e58e94
+
e58e94
+ Used some ideas/code from the go-ini packages https://github.com/vaughan0
e58e94
+ By Vaughan Newton
e58e94
+*/
e58e94
+
e58e94
+// #cgo pkg-config: libselinux
e58e94
+// #include <selinux selinux.h="">
e58e94
+// #include <stdlib.h>
e58e94
+import "C"
e58e94
+import (
e58e94
+	"bufio"
e58e94
+	"crypto/rand"
e58e94
+	"encoding/binary"
e58e94
+	"fmt"
e58e94
+	"io"
e58e94
+	"os"
e58e94
+	"path"
e58e94
+	"path/filepath"
e58e94
+	"regexp"
e58e94
+	"strings"
e58e94
+	"unsafe"
e58e94
+)
e58e94
+
e58e94
+var (
e58e94
+	assignRegex = regexp.MustCompile(`^([^=]+)=(.*)$`)
e58e94
+	mcsList     = make(map[string]bool)
e58e94
+)
e58e94
+
e58e94
+func Matchpathcon(path string, mode os.FileMode) (string, error) {
e58e94
+	var con C.security_context_t
e58e94
+	var scon string
e58e94
+	rc, err := C.matchpathcon(C.CString(path), C.mode_t(mode), &con)
e58e94
+	if rc == 0 {
e58e94
+		scon = C.GoString(con)
e58e94
+		C.free(unsafe.Pointer(con))
e58e94
+	}
e58e94
+	return scon, err
e58e94
+}
e58e94
+
e58e94
+func Setfilecon(path, scon string) (int, error) {
e58e94
+	rc, err := C.lsetfilecon(C.CString(path), C.CString(scon))
e58e94
+	return int(rc), err
e58e94
+}
e58e94
+
e58e94
+func Getfilecon(path string) (string, error) {
e58e94
+	var scon C.security_context_t
e58e94
+	var fcon string
e58e94
+	rc, err := C.lgetfilecon(C.CString(path), &scon)
e58e94
+	if rc >= 0 {
e58e94
+		fcon = C.GoString(scon)
e58e94
+		err = nil
e58e94
+	}
e58e94
+	return fcon, err
e58e94
+}
e58e94
+
e58e94
+func Setfscreatecon(scon string) (int, error) {
e58e94
+	var (
e58e94
+		rc  C.int
e58e94
+		err error
e58e94
+	)
e58e94
+	if scon != "" {
e58e94
+		rc, err = C.setfscreatecon(C.CString(scon))
e58e94
+	} else {
e58e94
+		rc, err = C.setfscreatecon(nil)
e58e94
+	}
e58e94
+	return int(rc), err
e58e94
+}
e58e94
+
e58e94
+func Getfscreatecon() (string, error) {
e58e94
+	var scon C.security_context_t
e58e94
+	var fcon string
e58e94
+	rc, err := C.getfscreatecon(&scon)
e58e94
+	if rc >= 0 {
e58e94
+		fcon = C.GoString(scon)
e58e94
+		err = nil
e58e94
+		C.freecon(scon)
e58e94
+	}
e58e94
+	return fcon, err
e58e94
+}
e58e94
+
e58e94
+func Getcon() string {
e58e94
+	var pcon C.security_context_t
e58e94
+	C.getcon(&pcon)
e58e94
+	scon := C.GoString(pcon)
e58e94
+	C.freecon(pcon)
e58e94
+	return scon
e58e94
+}
e58e94
+
e58e94
+func Getpidcon(pid int) (string, error) {
e58e94
+	var pcon C.security_context_t
e58e94
+	var scon string
e58e94
+	rc, err := C.getpidcon(C.pid_t(pid), &pcon)
e58e94
+	if rc >= 0 {
e58e94
+		scon = C.GoString(pcon)
e58e94
+		C.freecon(pcon)
e58e94
+		err = nil
e58e94
+	}
e58e94
+	return scon, err
e58e94
+}
e58e94
+
e58e94
+func Getpeercon(socket int) (string, error) {
e58e94
+	var pcon C.security_context_t
e58e94
+	var scon string
e58e94
+	rc, err := C.getpeercon(C.int(socket), &pcon)
e58e94
+	if rc >= 0 {
e58e94
+		scon = C.GoString(pcon)
e58e94
+		C.freecon(pcon)
e58e94
+		err = nil
e58e94
+	}
e58e94
+	return scon, err
e58e94
+}
e58e94
+
e58e94
+func Setexeccon(scon string) error {
e58e94
+	var val *C.char
e58e94
+	if !SelinuxEnabled() {
e58e94
+		return nil
e58e94
+	}
e58e94
+	if scon != "" {
e58e94
+		val = C.CString(scon)
e58e94
+	} else {
e58e94
+		val = nil
e58e94
+	}
e58e94
+	_, err := C.setexeccon(val)
e58e94
+	return err
e58e94
+}
e58e94
+
e58e94
+type Context struct {
e58e94
+	con []string
e58e94
+}
e58e94
+
e58e94
+func (c *Context) SetUser(user string) {
e58e94
+	c.con[0] = user
e58e94
+}
e58e94
+func (c *Context) GetUser() string {
e58e94
+	return c.con[0]
e58e94
+}
e58e94
+func (c *Context) SetRole(role string) {
e58e94
+	c.con[1] = role
e58e94
+}
e58e94
+func (c *Context) GetRole() string {
e58e94
+	return c.con[1]
e58e94
+}
e58e94
+func (c *Context) SetType(setype string) {
e58e94
+	c.con[2] = setype
e58e94
+}
e58e94
+func (c *Context) GetType() string {
e58e94
+	return c.con[2]
e58e94
+}
e58e94
+func (c *Context) SetLevel(mls string) {
e58e94
+	c.con[3] = mls
e58e94
+}
e58e94
+func (c *Context) GetLevel() string {
e58e94
+	return c.con[3]
e58e94
+}
e58e94
+func (c *Context) Get() string {
e58e94
+	return strings.Join(c.con, ":")
e58e94
+}
e58e94
+func (c *Context) Set(scon string) {
e58e94
+	c.con = strings.SplitN(scon, ":", 4)
e58e94
+}
e58e94
+func NewContext(scon string) Context {
e58e94
+	var con Context
e58e94
+	con.Set(scon)
e58e94
+	return con
e58e94
+}
e58e94
+
e58e94
+func SelinuxEnabled() bool {
e58e94
+	b := C.is_selinux_enabled()
e58e94
+	if b > 0 {
e58e94
+		return true
e58e94
+	}
e58e94
+	return false
e58e94
+}
e58e94
+
e58e94
+const (
e58e94
+	Enforcing  = 1
e58e94
+	Permissive = 0
e58e94
+	Disabled   = -1
e58e94
+)
e58e94
+
e58e94
+func SelinuxGetEnforce() int {
e58e94
+	return int(C.security_getenforce())
e58e94
+}
e58e94
+
e58e94
+func SelinuxGetEnforceMode() int {
e58e94
+	var enforce C.int
e58e94
+	C.selinux_getenforcemode(&enforce)
e58e94
+	return int(enforce)
e58e94
+}
e58e94
+
e58e94
+func mcsAdd(mcs string) {
e58e94
+	mcsList[mcs] = true
e58e94
+}
e58e94
+
e58e94
+func mcsDelete(mcs string) {
e58e94
+	mcsList[mcs] = false
e58e94
+}
e58e94
+
e58e94
+func mcsExists(mcs string) bool {
e58e94
+	return mcsList[mcs]
e58e94
+}
e58e94
+
e58e94
+func IntToMcs(id int, catRange uint32) string {
e58e94
+	if (id < 1) || (id > 523776) {
e58e94
+		return ""
e58e94
+	}
e58e94
+
e58e94
+	SETSIZE := int(catRange)
e58e94
+	TIER := SETSIZE
e58e94
+
e58e94
+	ORD := id
e58e94
+	for ORD > TIER {
e58e94
+		ORD = ORD - TIER
e58e94
+		TIER -= 1
e58e94
+	}
e58e94
+	TIER = SETSIZE - TIER
e58e94
+	ORD = ORD + TIER
e58e94
+	return fmt.Sprintf("s0:c%d,c%d", TIER, ORD)
e58e94
+}
e58e94
+
e58e94
+func uniqMcs(catRange uint32) string {
e58e94
+	var n uint32
e58e94
+	var c1, c2 uint32
e58e94
+	var mcs string
e58e94
+	for {
e58e94
+		binary.Read(rand.Reader, binary.LittleEndian, &n)
e58e94
+		c1 = n % catRange
e58e94
+		binary.Read(rand.Reader, binary.LittleEndian, &n)
e58e94
+		c2 = n % catRange
e58e94
+		if c1 == c2 {
e58e94
+			continue
e58e94
+		} else {
e58e94
+			if c1 > c2 {
e58e94
+				t := c1
e58e94
+				c1 = c2
e58e94
+				c2 = t
e58e94
+			}
e58e94
+		}
e58e94
+		mcs = fmt.Sprintf("s0:c%d,c%d", c1, c2)
e58e94
+		if mcsExists(mcs) {
e58e94
+			continue
e58e94
+		}
e58e94
+		mcsAdd(mcs)
e58e94
+		break
e58e94
+	}
e58e94
+	return mcs
e58e94
+}
e58e94
+func freeContext(processLabel string) {
e58e94
+	var scon Context
e58e94
+	scon = NewContext(processLabel)
e58e94
+	mcsDelete(scon.GetLevel())
e58e94
+}
e58e94
+
e58e94
+func GetLxcContexts() (processLabel string, fileLabel string) {
e58e94
+	var val, key string
e58e94
+	var bufin *bufio.Reader
e58e94
+	if !SelinuxEnabled() {
e58e94
+		return
e58e94
+	}
e58e94
+	lxcPath := C.GoString(C.selinux_lxc_contexts_path())
e58e94
+	fileLabel = "system_u:object_r:svirt_sandbox_file_t:s0"
e58e94
+	processLabel = "system_u:system_r:svirt_lxc_net_t:s0"
e58e94
+
e58e94
+	in, err := os.Open(lxcPath)
e58e94
+	if err != nil {
e58e94
+		goto exit
e58e94
+	}
e58e94
+
e58e94
+	defer in.Close()
e58e94
+	bufin = bufio.NewReader(in)
e58e94
+
e58e94
+	for done := false; !done; {
e58e94
+		var line string
e58e94
+		if line, err = bufin.ReadString('\n'); err != nil {
e58e94
+			if err == io.EOF {
e58e94
+				done = true
e58e94
+			} else {
e58e94
+				goto exit
e58e94
+			}
e58e94
+		}
e58e94
+		line = strings.TrimSpace(line)
e58e94
+		if len(line) == 0 {
e58e94
+			// Skip blank lines
e58e94
+			continue
e58e94
+		}
e58e94
+		if line[0] == ';' || line[0] == '#' {
e58e94
+			// Skip comments
e58e94
+			continue
e58e94
+		}
e58e94
+		if groups := assignRegex.FindStringSubmatch(line); groups != nil {
e58e94
+			key, val = strings.TrimSpace(groups[1]), strings.TrimSpace(groups[2])
e58e94
+			if key == "process" {
e58e94
+				processLabel = strings.Trim(val, "\"")
e58e94
+			}
e58e94
+			if key == "file" {
e58e94
+				fileLabel = strings.Trim(val, "\"")
e58e94
+			}
e58e94
+		}
e58e94
+	}
e58e94
+exit:
e58e94
+	var scon Context
e58e94
+	mcs := IntToMcs(os.Getpid(), 1024)
e58e94
+	scon = NewContext(processLabel)
e58e94
+	scon.SetLevel(mcs)
e58e94
+	processLabel = scon.Get()
e58e94
+	scon = NewContext(fileLabel)
e58e94
+	scon.SetLevel(mcs)
e58e94
+	fileLabel = scon.Get()
e58e94
+	return processLabel, fileLabel
e58e94
+}
e58e94
+
e58e94
+func CopyLevel(src, dest string) (string, error) {
e58e94
+	if !SelinuxEnabled() {
e58e94
+		return "", nil
e58e94
+	}
e58e94
+	if src == "" {
e58e94
+		return "", nil
e58e94
+	}
e58e94
+	rc, err := C.security_check_context(C.CString(src))
e58e94
+	if rc != 0 {
e58e94
+		return "", err
e58e94
+	}
e58e94
+	rc, err = C.security_check_context(C.CString(dest))
e58e94
+	if rc != 0 {
e58e94
+		return "", err
e58e94
+	}
e58e94
+	scon := NewContext(src)
e58e94
+	tcon := NewContext(dest)
e58e94
+	tcon.SetLevel(scon.GetLevel())
e58e94
+	return tcon.Get(), nil
e58e94
+}
e58e94
+
e58e94
+func RestoreCon(fpath string, recurse bool) error {
e58e94
+	var flabel string
e58e94
+	var err error
e58e94
+	var fs os.FileInfo
e58e94
+
e58e94
+	if !SelinuxEnabled() {
e58e94
+		return nil
e58e94
+	}
e58e94
+
e58e94
+	if recurse {
e58e94
+		var paths []string
e58e94
+		var err error
e58e94
+
e58e94
+		if paths, err = filepath.Glob(path.Join(fpath, "**", "*")); err != nil {
e58e94
+			return fmt.Errorf("Unable to find directory %v: %v", fpath, err)
e58e94
+		}
e58e94
+
e58e94
+		for _, fpath := range paths {
e58e94
+			if err = RestoreCon(fpath, false); err != nil {
e58e94
+				return fmt.Errorf("Unable to restore selinux context for %v: %v", fpath, err)
e58e94
+			}
e58e94
+		}
e58e94
+		return nil
e58e94
+	}
e58e94
+	if fs, err = os.Stat(fpath); err != nil {
e58e94
+		return fmt.Errorf("Unable stat %v: %v", fpath, err)
e58e94
+	}
e58e94
+
e58e94
+	if flabel, err = Matchpathcon(fpath, fs.Mode()); flabel == "" {
e58e94
+		return fmt.Errorf("Unable to get context for %v: %v", fpath, err)
e58e94
+	}
e58e94
+
e58e94
+	if rc, err := Setfilecon(fpath, flabel); rc != 0 {
e58e94
+		return fmt.Errorf("Unable to set selinux context for %v: %v", fpath, err)
e58e94
+	}
e58e94
+
e58e94
+	return nil
e58e94
+}
e58e94
+
e58e94
+func Test() {
e58e94
+	var plabel, flabel string
e58e94
+	if !SelinuxEnabled() {
e58e94
+		return
e58e94
+	}
e58e94
+
e58e94
+	plabel, flabel = GetLxcContexts()
e58e94
+	fmt.Println(plabel)
e58e94
+	fmt.Println(flabel)
e58e94
+	freeContext(plabel)
e58e94
+	plabel, flabel = GetLxcContexts()
e58e94
+	fmt.Println(plabel)
e58e94
+	fmt.Println(flabel)
e58e94
+	freeContext(plabel)
e58e94
+	if SelinuxEnabled() {
e58e94
+		fmt.Println("Enabled")
e58e94
+	} else {
e58e94
+		fmt.Println("Disabled")
e58e94
+	}
e58e94
+	fmt.Println("getenforce ", SelinuxGetEnforce())
e58e94
+	fmt.Println("getenforcemode ", SelinuxGetEnforceMode())
e58e94
+	flabel, _ = Matchpathcon("/home/dwalsh/.emacs", 0)
e58e94
+	fmt.Println(flabel)
e58e94
+	pid := os.Getpid()
e58e94
+	fmt.Printf("PID:%d MCS:%s\n", pid, IntToMcs(pid, 1023))
e58e94
+	fmt.Println(Getcon())
e58e94
+	fmt.Println(Getfilecon("/etc/passwd"))
e58e94
+	fmt.Println(Getpidcon(1))
e58e94
+	Setfscreatecon("unconfined_u:unconfined_r:unconfined_t:s0")
e58e94
+	fmt.Println(Getfscreatecon())
e58e94
+	Setfscreatecon("")
e58e94
+	fmt.Println(Getfscreatecon())
e58e94
+	fmt.Println(Getpidcon(1))
e58e94
+}
6146f7
diff --git libselinux-2.6/golang/test.go libselinux-2.6/golang/test.go
e58e94
new file mode 100644
e58e94
index 0000000..fed6de8
e58e94
--- /dev/null
6146f7
+++ libselinux-2.6/golang/test.go
e58e94
@@ -0,0 +1,9 @@
e58e94
+package main
e58e94
+
e58e94
+import (
e58e94
+	"./selinux"
e58e94
+)
e58e94
+
e58e94
+func main() {
e58e94
+	selinux.Test()
e58e94
+}
5239c1
diff --git libselinux-2.6/include/selinux/restorecon.h libselinux-2.6/include/selinux/restorecon.h
5239c1
index 7cfdee1..de694cd 100644
5239c1
--- libselinux-2.6/include/selinux/restorecon.h
5239c1
+++ libselinux-2.6/include/selinux/restorecon.h
5239c1
@@ -50,9 +50,9 @@ extern int selinux_restorecon(const char *pathname,
5239c1
  */
5239c1
 #define SELINUX_RESTORECON_VERBOSE			0x0010
5239c1
 /*
5239c1
- * Show progress by printing * to stdout every 1000 files, unless
5239c1
- * relabeling the entire OS, that will then show the approximate
5239c1
- * percentage complete.
5239c1
+ * If SELINUX_RESTORECON_PROGRESS is true and
5239c1
+ * SELINUX_RESTORECON_MASS_RELABEL is true, then output approx % complete,
5239c1
+ * else output the number of files in 1k blocks processed to stdout.
5239c1
  */
5239c1
 #define SELINUX_RESTORECON_PROGRESS			0x0020
5239c1
 /*
5239c1
@@ -91,6 +91,11 @@ extern int selinux_restorecon(const char *pathname,
5239c1
  * mounts to be excluded from relabeling checks.
5239c1
  */
5239c1
 #define SELINUX_RESTORECON_IGNORE_MOUNTS		0x2000
5239c1
+/*
5239c1
+ * Set if there is a mass relabel required.
5239c1
+ * See SELINUX_RESTORECON_PROGRESS flag for details.
5239c1
+ */
5239c1
+#define SELINUX_RESTORECON_MASS_RELABEL			0x4000
5239c1
 
5239c1
 /**
5239c1
  * selinux_restorecon_set_sehandle - Set the global fc handle.
5239c1
diff --git libselinux-2.6/man/man3/selinux_restorecon.3 libselinux-2.6/man/man3/selinux_restorecon.3
5239c1
index 2d8274b..3350f9c 100644
5239c1
--- libselinux-2.6/man/man3/selinux_restorecon.3
5239c1
+++ libselinux-2.6/man/man3/selinux_restorecon.3
5239c1
@@ -88,8 +88,16 @@ will take precedence.
5239c1
 .RE
5239c1
 .sp
5239c1
 .B SELINUX_RESTORECON_PROGRESS
5239c1
-show progress by printing * to stdout every 1000 files unless relabeling the
5239c1
-entire OS, that will then show the approximate percentage complete.
5239c1
+show progress by outputting the number of files in 1k blocks processed
5239c1
+to stdout. If the
5239c1
+.B SELINUX_RESTORECON_MASS_RELABEL
5239c1
+flag is also set then the approximate percentage complete will be shown.
5239c1
+.sp
5239c1
+.B SELINUX_RESTORECON_MASS_RELABEL
5239c1
+generally set when relabeling the entire OS, that will then show the
5239c1
+approximate percentage complete. The
5239c1
+.B SELINUX_RESTORECON_PROGRESS
5239c1
+flag must also be set.
5239c1
 .sp
5239c1
 .B SELINUX_RESTORECON_REALPATH
5239c1
 convert passed-in
6146f7
diff --git libselinux-2.6/man/man8/selinux.8 libselinux-2.6/man/man8/selinux.8
e58e94
index 6f1034b..c9f188c 100644
6146f7
--- libselinux-2.6/man/man8/selinux.8
6146f7
+++ libselinux-2.6/man/man8/selinux.8
e58e94
@@ -91,11 +91,13 @@ This manual page was written by Dan Walsh <dwalsh@redhat.com>.
e58e94
 .BR sepolicy (8),
e58e94
 .BR system-config-selinux (8),
e58e94
 .BR togglesebool (8),
e58e94
-.BR restorecon (8),
e58e94
 .BR fixfiles (8),
e58e94
+.BR restorecon (8),
e58e94
 .BR setfiles (8),
e58e94
 .BR semanage (8),
e58e94
-.BR sepolicy(8)
e58e94
+.BR sepolicy(8),
e58e94
+.BR seinfo(8),
e58e94
+.BR sesearch(8)
e58e94
 
e58e94
 Every confined service on the system has a man page in the following format:
e58e94
 .br
2f3335
diff --git libselinux-2.6/src/Makefile libselinux-2.6/src/Makefile
ea9eee
index 13501cd..e1334e9 100644
2f3335
--- libselinux-2.6/src/Makefile
2f3335
+++ libselinux-2.6/src/Makefile
2f3335
@@ -2,7 +2,7 @@
2f3335
 # runtimes (e.g. Python 2 vs Python 3) by optionally prefixing the build
2f3335
 # targets with "PYPREFIX":
2f3335
 PYTHON ?= python
2f3335
-PYPREFIX ?= $(notdir $(PYTHON))
ea9eee
+PYPREFIX ?= $(shell $(PYTHON) -c 'import sys;print("python-%d.%d" % sys.version_info[:2])')
2f3335
 RUBY ?= ruby
2f3335
 RUBYPREFIX ?= $(notdir $(RUBY))
2f3335
 PKG_CONFIG ?= pkg-config
ea9eee
@@ -13,15 +13,26 @@ LIBDIR ?= $(PREFIX)/lib
ea9eee
 SHLIBDIR ?= $(DESTDIR)/lib
ea9eee
 INCLUDEDIR ?= $(PREFIX)/include
ea9eee
 PYINC ?= $(shell $(PKG_CONFIG) --cflags $(PYPREFIX))
ea9eee
+PYLIBS ?= $(shell $(PKG_CONFIG) --libs $(PYPREFIX))
ea9eee
 PYSITEDIR ?= $(DESTDIR)$(shell $(PYTHON) -c 'import site; print(site.getsitepackages()[0])')
ea9eee
-RUBYLIBVER ?= $(shell $(RUBY) -e 'print RUBY_VERSION.split(".")[0..1].join(".")')
ea9eee
-RUBYINC ?= $(shell $(PKG_CONFIG) --exists ruby-$(RUBYLIBVER) && $(PKG_CONFIG) --cflags ruby-$(RUBYLIBVER) || $(PKG_CONFIG) --cflags ruby)
ea9eee
+PYCEXT ?= $(shell $(PYTHON) -c 'import imp;print([s for s,m,t in imp.get_suffixes() if t == imp.C_EXTENSION][0])')
ea9eee
+RUBYINC ?= $(shell $(RUBY) -e 'puts "-I" + RbConfig::CONFIG["rubyarchhdrdir"] + " -I" + RbConfig::CONFIG["rubyhdrdir"]')
ea9eee
+RUBYLIBS ?= $(shell $(RUBY) -e 'puts "-L" + RbConfig::CONFIG["libdir"] + " -lruby"')
ea9eee
 RUBYINSTALL ?= $(DESTDIR)$(shell $(RUBY) -e 'puts RbConfig::CONFIG["vendorarchdir"]')
ea9eee
 LIBBASE ?= $(shell basename $(LIBDIR))
ea9eee
+LIBSEPOLA ?= $(LIBDIR)/libsepol.a
ea9eee
 
ea9eee
 VERSION = $(shell cat ../VERSION)
ea9eee
 LIBVERSION = 1
ea9eee
 
ea9eee
+OS ?= $(shell uname)
ea9eee
+
ea9eee
+ifeq ($(shell $(CC) -v 2>&1 | grep "clang"),)
ea9eee
+COMPILER ?= gcc
ea9eee
+else
ea9eee
+COMPILER ?= clang
ea9eee
+endif
ea9eee
+
ea9eee
 LIBA=libselinux.a 
ea9eee
 TARGET=libselinux.so
ea9eee
 LIBPC=libselinux.pc
ea9eee
@@ -48,23 +59,38 @@ OBJS= $(patsubst %.c,%.o,$(SRCS))
ea9eee
 LOBJS= $(patsubst %.c,%.lo,$(SRCS))
ea9eee
 CFLAGS ?= -O -Wall -W -Wundef -Wformat-y2k -Wformat-security -Winit-self -Wmissing-include-dirs \
ea9eee
           -Wunused -Wunknown-pragmas -Wstrict-aliasing -Wshadow -Wpointer-arith \
ea9eee
-          -Wbad-function-cast -Wcast-align -Wwrite-strings -Wlogical-op -Waggregate-return \
ea9eee
+          -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return \
ea9eee
           -Wstrict-prototypes -Wold-style-definition -Wmissing-prototypes \
ea9eee
           -Wmissing-declarations -Wmissing-noreturn -Wmissing-format-attribute \
ea9eee
           -Wredundant-decls -Wnested-externs -Winline -Winvalid-pch -Wvolatile-register-var \
ea9eee
-          -Wdisabled-optimization -Wbuiltin-macro-redefined -Wpacked-bitfield-compat \
ea9eee
-          -Wsync-nand -Wattributes -Wcoverage-mismatch -Wmultichar -Wcpp \
ea9eee
+          -Wdisabled-optimization -Wbuiltin-macro-redefined \
ea9eee
+          -Wattributes -Wmultichar \
ea9eee
           -Wdeprecated-declarations -Wdiv-by-zero -Wdouble-promotion -Wendif-labels -Wextra \
ea9eee
-          -Wformat-contains-nul -Wformat-extra-args -Wformat-zero-length -Wformat=2 -Wmultichar \
ea9eee
-          -Wnormalized=nfc -Woverflow -Wpointer-to-int-cast -Wpragmas -Wsuggest-attribute=const \
ea9eee
-          -Wsuggest-attribute=noreturn -Wsuggest-attribute=pure -Wtrampolines \
ea9eee
-          -Wno-missing-field-initializers -Wno-sign-compare -Wjump-misses-init \
ea9eee
-          -Wno-format-nonliteral -Wframe-larger-than=$(MAX_STACK_SIZE) -Wp,-D_FORTIFY_SOURCE=2 \
ea9eee
+          -Wformat-extra-args -Wformat-zero-length -Wformat=2 -Wmultichar \
ea9eee
+          -Woverflow -Wpointer-to-int-cast -Wpragmas \
ea9eee
+          -Wno-missing-field-initializers -Wno-sign-compare \
ea9eee
+          -Wno-format-nonliteral -Wframe-larger-than=$(MAX_STACK_SIZE) \
ea9eee
           -fstack-protector-all --param=ssp-buffer-size=4 -fexceptions \
ea9eee
           -fasynchronous-unwind-tables -fdiagnostics-show-option -funit-at-a-time \
ea9eee
-          -fipa-pure-const -Wno-suggest-attribute=pure -Wno-suggest-attribute=const \
ea9eee
           -Werror -Wno-aggregate-return -Wno-redundant-decls
ea9eee
 
ea9eee
+LD_SONAME_FLAGS=-soname,$(LIBSO),-z,defs,-z,relro
ea9eee
+
ea9eee
+ifeq ($(COMPILER), gcc)
ea9eee
+CFLAGS += -fipa-pure-const -Wlogical-op -Wpacked-bitfield-compat -Wsync-nand \
ea9eee
+	-Wcoverage-mismatch -Wcpp -Wformat-contains-nul -Wnormalized=nfc -Wsuggest-attribute=const \
ea9eee
+	-Wsuggest-attribute=noreturn -Wsuggest-attribute=pure -Wtrampolines -Wjump-misses-init \
ea9eee
+	-Wno-suggest-attribute=pure -Wno-suggest-attribute=const -Wp,-D_FORTIFY_SOURCE=2
ea9eee
+else
ea9eee
+CFLAGS += -Wunused-command-line-argument
ea9eee
+endif
ea9eee
+
ea9eee
+ifeq ($(OS), Darwin)
ea9eee
+override CFLAGS += -I/opt/local/include
ea9eee
+override LDFLAGS += -L/opt/local/lib -undefined dynamic_lookup
ea9eee
+LD_SONAME_FLAGS=-install_name,$(LIBSO)
ea9eee
+endif
ea9eee
+
ea9eee
 PCRE_LDFLAGS ?= -lpcre
ea9eee
 
ea9eee
 override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE $(DISABLE_FLAGS) $(PCRE_CFLAGS)
ea9eee
@@ -84,7 +110,7 @@ DISABLE_FLAGS+= -DNO_MEDIA_BACKEND -DNO_DB_BACKEND -DNO_X_BACKEND \
ea9eee
 	-DBUILD_HOST
ea9eee
 SRCS= callbacks.c freecon.c label.c label_file.c \
ea9eee
 	label_backends_android.c regex.c label_support.c \
ea9eee
-	matchpathcon.c setrans_client.c sha1.c
ea9eee
+	matchpathcon.c setrans_client.c sha1.c booleans.c
ea9eee
 else
ea9eee
 DISABLE_FLAGS+= -DNO_ANDROID_BACKEND
ea9eee
 SRCS:= $(filter-out label_backends_android.c, $(SRCS))
ea9eee
@@ -107,30 +133,30 @@ $(SWIGRUBYLOBJ): $(SWIGRUBYCOUT)
ea9eee
 	$(CC) $(CFLAGS) $(SWIG_CFLAGS) $(RUBYINC) -fPIC -DSHARED -c -o $@ $<
ea9eee
 
ea9eee
 $(SWIGSO): $(SWIGLOBJ)
ea9eee
-	$(CC) $(CFLAGS) -shared -o $@ $< -L. -lselinux $(LDFLAGS) -L$(LIBDIR)
ea9eee
+	$(CC) $(CFLAGS) -shared -o $@ $< -L. -lselinux $(LDFLAGS) $(PYLIBS) -L$(LIBDIR)
ea9eee
 
ea9eee
 $(SWIGRUBYSO): $(SWIGRUBYLOBJ)
ea9eee
-	$(CC) $(CFLAGS) -shared -o $@ $^ -L. -lselinux $(LDFLAGS) -L$(LIBDIR)
ea9eee
+	$(CC) $(CFLAGS) -shared -o $@ $^ -L. -lselinux $(LDFLAGS) $(RUBYLIBS) -L$(LIBDIR)
ea9eee
 
ea9eee
 $(LIBA): $(OBJS)
ea9eee
 	$(AR) rcs $@ $^
ea9eee
 	$(RANLIB) $@
ea9eee
 
ea9eee
 $(LIBSO): $(LOBJS)
ea9eee
-	$(CC) $(CFLAGS) -shared -o $@ $^ $(PCRE_LDFLAGS) -ldl $(LDFLAGS) -L$(LIBDIR) -Wl,-soname,$(LIBSO),-z,defs,-z,relro
ea9eee
+	$(CC) $(CFLAGS) -shared -o $@ $^ $(PCRE_LDFLAGS) -ldl $(LDFLAGS) -L$(LIBDIR) -Wl,$(LD_SONAME_FLAGS)
ea9eee
 	ln -sf $@ $(TARGET) 
ea9eee
 
ea9eee
 $(LIBPC): $(LIBPC).in ../VERSION
ea9eee
 	sed -e 's/@VERSION@/$(VERSION)/; s:@prefix@:$(PREFIX):; s:@libdir@:$(LIBBASE):; s:@includedir@:$(INCLUDEDIR):' < $< > $@
ea9eee
 
ea9eee
 selinuxswig_python_exception.i: ../include/selinux/selinux.h
ea9eee
-	bash exception.sh > $@ 
ea9eee
+	bash -e exception.sh > $@ || (rm -f $@ ; false)
ea9eee
 
ea9eee
 $(AUDIT2WHYLOBJ): audit2why.c
ea9eee
 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
ea9eee
 
ea9eee
 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)
ea9eee
-	$(CC) $(CFLAGS) -shared -o $@ $^ -L. $(LDFLAGS) -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR)
ea9eee
+	$(CC) $(CFLAGS) -shared -o $@ $^ -L. $(LDFLAGS) -lselinux $(LIBSEPOLA) $(PYLIBS) -L$(LIBDIR)
ea9eee
 
ea9eee
 %.o:  %.c policy.h
ea9eee
 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<
ea9eee
@@ -160,8 +186,8 @@ install: all
ea9eee
 
ea9eee
 install-pywrap: pywrap
ea9eee
 	test -d $(PYSITEDIR)/selinux || install -m 755 -d $(PYSITEDIR)/selinux
ea9eee
-	install -m 755 $(SWIGSO) $(PYSITEDIR)/_selinux.so
ea9eee
-	install -m 755 $(AUDIT2WHYSO) $(PYSITEDIR)/selinux/audit2why.so
ea9eee
+	install -m 755 $(SWIGSO) $(PYSITEDIR)/_selinux$(PYCEXT)
ea9eee
+	install -m 755 $(AUDIT2WHYSO) $(PYSITEDIR)/selinux/audit2why$(PYCEXT)
ea9eee
 	install -m 644 $(SWIGPYOUT) $(PYSITEDIR)/selinux/__init__.py
ea9eee
 
ea9eee
 install-rubywrap: rubywrap
ea9eee
@@ -171,8 +197,14 @@ install-rubywrap: rubywrap
ea9eee
 relabel:
ea9eee
 	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)
ea9eee
 
ea9eee
-clean: 
ea9eee
-	-rm -f $(LIBPC) $(OBJS) $(LOBJS) $(LIBA) $(LIBSO) $(SWIGLOBJ) $(SWIGRUBYLOBJ) $(SWIGSO) $(TARGET) $(AUDIT2WHYSO) *.o *.lo *~
ea9eee
+clean-pywrap:
ea9eee
+	-rm -f $(SWIGLOBJ) $(SWIGSO) $(AUDIT2WHYLOBJ) $(AUDIT2WHYSO)
ea9eee
+
ea9eee
+clean-rubywrap:
ea9eee
+	-rm -f $(SWIGRUBYLOBJ) $(SWIGRUBYSO)
ea9eee
+
ea9eee
+clean: clean-pywrap clean-rubywrap
ea9eee
+	-rm -f $(LIBPC) $(OBJS) $(LOBJS) $(LIBA) $(LIBSO) $(TARGET) *.o *.lo *~
ea9eee
 
ea9eee
 distclean: clean
ea9eee
 	rm -f $(GENERATED) $(SWIGFILES)
ea9eee
@@ -180,4 +212,4 @@ distclean: clean
ea9eee
 indent:
ea9eee
 	../../scripts/Lindent $(filter-out $(GENERATED),$(wildcard *.[ch]))
ea9eee
 
ea9eee
-.PHONY: all clean pywrap rubywrap swigify install install-pywrap install-rubywrap distclean
ea9eee
+.PHONY: all clean clean-pywrap clean-rubywrap pywrap rubywrap swigify install install-pywrap install-rubywrap distclean
6146f7
diff --git libselinux-2.6/src/avc_sidtab.c libselinux-2.6/src/avc_sidtab.c
e58e94
index 9669264..c775430 100644
6146f7
--- libselinux-2.6/src/avc_sidtab.c
6146f7
+++ libselinux-2.6/src/avc_sidtab.c
e58e94
@@ -81,6 +81,11 @@ sidtab_context_to_sid(struct sidtab *s,
e58e94
 	int hvalue, rc = 0;
e58e94
 	struct sidtab_node *cur;
e58e94
 
e58e94
+	if (! ctx) {
e58e94
+		errno=EINVAL;
e58e94
+		return -1;
e58e94
+	}
e58e94
+
e58e94
 	*sid = NULL;
e58e94
 	hvalue = sidtab_hash(ctx);
e58e94
 
7f0ad3
diff --git libselinux-2.6/src/booleans.c libselinux-2.6/src/booleans.c
7f0ad3
index cbb0610..9cffffe 100644
7f0ad3
--- libselinux-2.6/src/booleans.c
7f0ad3
+++ libselinux-2.6/src/booleans.c
7f0ad3
@@ -55,6 +55,7 @@ int security_get_boolean_names(char ***names, int *len)
7f0ad3
 	snprintf(path, sizeof path, "%s%s", selinux_mnt, SELINUX_BOOL_DIR);
7f0ad3
 	*len = scandir(path, &namelist, &filename_select, alphasort);
7f0ad3
 	if (*len <= 0) {
7f0ad3
+		errno = ENOENT;
7f0ad3
 		return -1;
7f0ad3
 	}
7f0ad3
 
6146f7
diff --git libselinux-2.6/src/canonicalize_context.c libselinux-2.6/src/canonicalize_context.c
e58e94
index 7cf3139..364a746 100644
6146f7
--- libselinux-2.6/src/canonicalize_context.c
6146f7
+++ libselinux-2.6/src/canonicalize_context.c
e58e94
@@ -17,6 +17,11 @@ int security_canonicalize_context_raw(const char * con,
e58e94
 	size_t size;
e58e94
 	int fd, ret;
e58e94
 
e58e94
+	if (! con) {
e58e94
+		errno=EINVAL;
e58e94
+		return -1;
e58e94
+	}
e58e94
+
e58e94
 	if (!selinux_mnt) {
e58e94
 		errno = ENOENT;
e58e94
 		return -1;
6146f7
diff --git libselinux-2.6/src/check_context.c libselinux-2.6/src/check_context.c
e58e94
index 52063fa..234749c 100644
6146f7
--- libselinux-2.6/src/check_context.c
6146f7
+++ libselinux-2.6/src/check_context.c
e58e94
@@ -14,6 +14,11 @@ int security_check_context_raw(const char * con)
e58e94
 	char path[PATH_MAX];
e58e94
 	int fd, ret;
e58e94
 
e58e94
+	if (! con) {
e58e94
+		errno=EINVAL;
e58e94
+		return -1;
e58e94
+	}
e58e94
+
e58e94
 	if (!selinux_mnt) {
e58e94
 		errno = ENOENT;
e58e94
 		return -1;
6146f7
diff --git libselinux-2.6/src/compute_av.c libselinux-2.6/src/compute_av.c
e58e94
index 937e5c3..35ace7f 100644
6146f7
--- libselinux-2.6/src/compute_av.c
6146f7
+++ libselinux-2.6/src/compute_av.c
e58e94
@@ -26,6 +26,11 @@ int security_compute_av_flags_raw(const char * scon,
e58e94
 		return -1;
e58e94
 	}
e58e94
 
e58e94
+	if ((! scon) || (! tcon)) {
e58e94
+		errno=EINVAL;
e58e94
+		return -1;
e58e94
+	}
e58e94
+
e58e94
 	snprintf(path, sizeof path, "%s/access", selinux_mnt);
e58e94
 	fd = open(path, O_RDWR);
e58e94
 	if (fd < 0)
6146f7
diff --git libselinux-2.6/src/compute_create.c libselinux-2.6/src/compute_create.c
e58e94
index 9559d42..14a65d1 100644
6146f7
--- libselinux-2.6/src/compute_create.c
6146f7
+++ libselinux-2.6/src/compute_create.c
e58e94
@@ -64,6 +64,11 @@ int security_compute_create_name_raw(const char * scon,
e58e94
 		return -1;
e58e94
 	}
e58e94
 
e58e94
+	if ((! scon) || (! tcon)) {
e58e94
+		errno=EINVAL;
e58e94
+		return -1;
e58e94
+	}
e58e94
+
e58e94
 	snprintf(path, sizeof path, "%s/create", selinux_mnt);
e58e94
 	fd = open(path, O_RDWR);
e58e94
 	if (fd < 0)
6146f7
diff --git libselinux-2.6/src/compute_member.c libselinux-2.6/src/compute_member.c
e58e94
index 1fc7e41..065d996 100644
6146f7
--- libselinux-2.6/src/compute_member.c
6146f7
+++ libselinux-2.6/src/compute_member.c
e58e94
@@ -25,6 +25,11 @@ int security_compute_member_raw(const char * scon,
e58e94
 		return -1;
e58e94
 	}
e58e94
 
e58e94
+	if ((! scon) || (! tcon)) {
e58e94
+		errno=EINVAL;
e58e94
+		return -1;
e58e94
+	}
e58e94
+
e58e94
 	snprintf(path, sizeof path, "%s/member", selinux_mnt);
e58e94
 	fd = open(path, O_RDWR);
e58e94
 	if (fd < 0)
6146f7
diff --git libselinux-2.6/src/compute_relabel.c libselinux-2.6/src/compute_relabel.c
e58e94
index 4615aee..cc77f36 100644
6146f7
--- libselinux-2.6/src/compute_relabel.c
6146f7
+++ libselinux-2.6/src/compute_relabel.c
e58e94
@@ -25,6 +25,11 @@ int security_compute_relabel_raw(const char * scon,
e58e94
 		return -1;
e58e94
 	}
e58e94
 
e58e94
+	if ((! scon) || (! tcon)) {
e58e94
+		errno=EINVAL;
e58e94
+		return -1;
e58e94
+	}
e58e94
+
e58e94
 	snprintf(path, sizeof path, "%s/relabel", selinux_mnt);
e58e94
 	fd = open(path, O_RDWR);
e58e94
 	if (fd < 0)
6146f7
diff --git libselinux-2.6/src/compute_user.c libselinux-2.6/src/compute_user.c
e58e94
index b37c5d3..7703c26 100644
6146f7
--- libselinux-2.6/src/compute_user.c
6146f7
+++ libselinux-2.6/src/compute_user.c
e58e94
@@ -24,6 +24,11 @@ int security_compute_user_raw(const char * scon,
e58e94
 		return -1;
e58e94
 	}
e58e94
 
e58e94
+	if (! scon) {
e58e94
+		errno=EINVAL;
e58e94
+		return -1;
e58e94
+	}
e58e94
+
e58e94
 	snprintf(path, sizeof path, "%s/user", selinux_mnt);
e58e94
 	fd = open(path, O_RDWR);
e58e94
 	if (fd < 0)
6146f7
diff --git libselinux-2.6/src/fsetfilecon.c libselinux-2.6/src/fsetfilecon.c
e58e94
index 52707d0..0cbe12d 100644
6146f7
--- libselinux-2.6/src/fsetfilecon.c
6146f7
+++ libselinux-2.6/src/fsetfilecon.c
e58e94
@@ -9,8 +9,12 @@
e58e94
 
e58e94
 int fsetfilecon_raw(int fd, const char * context)
e58e94
 {
e58e94
-	int rc = fsetxattr(fd, XATTR_NAME_SELINUX, context, strlen(context) + 1,
e58e94
-			 0);
e58e94
+	int rc;
e58e94
+	if (! context) {
e58e94
+		errno=EINVAL;
e58e94
+		return -1;
e58e94
+	}
e58e94
+	rc = fsetxattr(fd, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);
e58e94
 	if (rc < 0 && errno == ENOTSUP) {
e58e94
 		char * ccontext = NULL;
e58e94
 		int err = errno;
81b36a
diff --git libselinux-2.6/src/load_policy.c libselinux-2.6/src/load_policy.c
81b36a
index b7e1a6f..6d74a9a 100644
81b36a
--- libselinux-2.6/src/load_policy.c
81b36a
+++ libselinux-2.6/src/load_policy.c
81b36a
@@ -450,8 +450,11 @@ int selinux_init_load_policy(int *enforce)
81b36a
 		}
81b36a
 	}
81b36a
 
81b36a
-	if (seconfig == -1)
81b36a
+	if (seconfig == -1) {
81b36a
+		umount(selinux_mnt);
81b36a
+		fini_selinuxmnt();
81b36a
 		goto noload;
81b36a
+	}
81b36a
 
81b36a
 	/* Load the policy. */
81b36a
 	return selinux_mkload_policy(0);
6146f7
diff --git libselinux-2.6/src/lsetfilecon.c libselinux-2.6/src/lsetfilecon.c
e58e94
index 1d3b28a..ea6d70b 100644
6146f7
--- libselinux-2.6/src/lsetfilecon.c
6146f7
+++ libselinux-2.6/src/lsetfilecon.c
e58e94
@@ -9,8 +9,13 @@
e58e94
 
e58e94
 int lsetfilecon_raw(const char *path, const char * context)
e58e94
 {
e58e94
-	int rc = lsetxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1,
e58e94
-			 0);
e58e94
+	int rc;
e58e94
+	if (! context) {
e58e94
+		errno=EINVAL;
e58e94
+		return -1;
e58e94
+	}
e58e94
+
e58e94
+	rc = lsetxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);
e58e94
 	if (rc < 0 && errno == ENOTSUP) {
e58e94
 		char * ccontext = NULL;
e58e94
 		int err = errno;
6146f7
diff --git libselinux-2.6/src/matchpathcon.c libselinux-2.6/src/matchpathcon.c
6146f7
index 724eb65..58b4144 100644
6146f7
--- libselinux-2.6/src/matchpathcon.c
6146f7
+++ libselinux-2.6/src/matchpathcon.c
6146f7
@@ -389,12 +389,6 @@ int realpath_not_final(const char *name, char *resolved_path)
75cfa0
 		goto out;
75cfa0
 	}
75cfa0
 
75cfa0
-	/* strip leading // */
75cfa0
-	while (tmp_path[len] && tmp_path[len] == '/' &&
75cfa0
-	       tmp_path[len+1] && tmp_path[len+1] == '/') {
75cfa0
-		tmp_path++;
75cfa0
-		len++;
75cfa0
-	}
75cfa0
 	last_component = strrchr(tmp_path, '/');
75cfa0
 
75cfa0
 	if (last_component == tmp_path) {
ea9eee
diff --git libselinux-2.6/src/selinux_config.c libselinux-2.6/src/selinux_config.c
ea9eee
index 88bcc85..bfca134 100644
ea9eee
--- libselinux-2.6/src/selinux_config.c
ea9eee
+++ libselinux-2.6/src/selinux_config.c
ea9eee
@@ -282,7 +282,6 @@ int selinux_set_policy_root(const char *path)
ea9eee
 	}
ea9eee
 	policy_type++;
ea9eee
 
ea9eee
-	fini_selinuxmnt();
ea9eee
 	fini_selinux_policyroot();
ea9eee
 
ea9eee
 	selinux_policyroot = strdup(path);
7f0ad3
diff --git libselinux-2.6/src/selinux_restorecon.c libselinux-2.6/src/selinux_restorecon.c
5239c1
index e38d1d0..690dcd8 100644
7f0ad3
--- libselinux-2.6/src/selinux_restorecon.c
7f0ad3
+++ libselinux-2.6/src/selinux_restorecon.c
5239c1
@@ -41,7 +41,7 @@
5239c1
 #define SYS_PATH "/sys"
5239c1
 #define SYS_PREFIX SYS_PATH "/"
5239c1
 
5239c1
-#define STAR_COUNT 1000
5239c1
+#define STAR_COUNT 1024
5239c1
 
5239c1
 static struct selabel_handle *fc_sehandle = NULL;
5239c1
 static unsigned char *fc_digest = NULL;
5239c1
@@ -68,18 +68,12 @@ static uint64_t efile_count;	/* Estimated total number of files */
5239c1
 struct dir_xattr *dir_xattr_list;
5239c1
 static struct dir_xattr *dir_xattr_last;
5239c1
 
5239c1
-/*
5239c1
- * If SELINUX_RESTORECON_PROGRESS is set and mass_relabel = true, then
5239c1
- * output approx % complete, else output * for every STAR_COUNT files
5239c1
- * processed to stdout.
5239c1
- */
5239c1
-static bool mass_relabel;
5239c1
-
5239c1
 /* restorecon_flags for passing to restorecon_sb() */
5239c1
 struct rest_flags {
5239c1
 	bool nochange;
5239c1
 	bool verbose;
5239c1
 	bool progress;
5239c1
+	bool mass_relabel;
5239c1
 	bool set_specctx;
5239c1
 	bool add_assoc;
5239c1
 	bool ignore_digest;
5239c1
@@ -624,14 +618,14 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
5239c1
 	if (flags->progress) {
5239c1
 		fc_count++;
5239c1
 		if (fc_count % STAR_COUNT == 0) {
5239c1
-			if (mass_relabel && efile_count > 0) {
5239c1
+			if (flags->mass_relabel && efile_count > 0) {
5239c1
 				pc = (fc_count < efile_count) ? (100.0 *
5239c1
 					     fc_count / efile_count) : 100;
5239c1
 				fprintf(stdout, "\r%-.1f%%", (double)pc);
5239c1
 			} else {
5239c1
-				fprintf(stdout, "*");
5239c1
+				fprintf(stdout, "\r%luk", fc_count / STAR_COUNT);
5239c1
 			}
5239c1
-		fflush(stdout);
5239c1
+			fflush(stdout);
5239c1
 		}
5239c1
 	}
5239c1
 
5239c1
@@ -663,7 +657,7 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
7f0ad3
 		curcon = NULL;
7f0ad3
 	}
7f0ad3
 
7f0ad3
-	if (strcmp(curcon, newcon) != 0) {
7f0ad3
+	if (curcon == NULL || strcmp(curcon, newcon) != 0) {
7f0ad3
 		if (!flags->set_specctx && curcon &&
7f0ad3
 				    (is_context_customizable(curcon) > 0)) {
7f0ad3
 			if (flags->verbose) {
5239c1
@@ -743,6 +737,8 @@ int selinux_restorecon(const char *pathname_orig,
5239c1
 		    SELINUX_RESTORECON_VERBOSE) ? true : false;
5239c1
 	flags.progress = (restorecon_flags &
5239c1
 		    SELINUX_RESTORECON_PROGRESS) ? true : false;
5239c1
+	flags.mass_relabel = (restorecon_flags &
5239c1
+		    SELINUX_RESTORECON_MASS_RELABEL) ? true : false;
5239c1
 	flags.recurse = (restorecon_flags &
5239c1
 		    SELINUX_RESTORECON_RECURSE) ? true : false;
5239c1
 	flags.set_specctx = (restorecon_flags &
5239c1
@@ -896,17 +892,6 @@ int selinux_restorecon(const char *pathname_orig,
5239c1
 		}
5239c1
 	}
5239c1
 
5239c1
-	mass_relabel = false;
5239c1
-	if (!strcmp(pathname, "/")) {
5239c1
-		mass_relabel = true;
5239c1
-		if (flags.set_xdev && flags.progress)
5239c1
-			/*
5239c1
-			 * Need to recalculate to get accurate % complete
5239c1
-			 * as only root device id will be processed.
5239c1
-			 */
5239c1
-			efile_count = file_system_count(pathname);
5239c1
-	}
5239c1
-
5239c1
 	if (flags.set_xdev)
5239c1
 		fts_flags = FTS_PHYSICAL | FTS_NOCHDIR | FTS_XDEV;
5239c1
 	else
5239c1
@@ -1000,12 +985,8 @@ int selinux_restorecon(const char *pathname_orig,
5239c1
 	}
5239c1
 
5239c1
 out:
5239c1
-	if (flags.progress) {
5239c1
-		if (mass_relabel)
5239c1
-			fprintf(stdout, "\r100.0%%\n");
5239c1
-		else
5239c1
-			fprintf(stdout, "\n");
5239c1
-	}
5239c1
+	if (flags.progress && flags.mass_relabel)
5239c1
+		fprintf(stdout, "\r%s 100.0%%\n", pathname);
5239c1
 
5239c1
 	sverrno = errno;
5239c1
 	(void) fts_close(fts);
26ed72
diff --git libselinux-2.6/src/selinuxswig_python.i libselinux-2.6/src/selinuxswig_python.i
26ed72
index 8cea18d..43df291 100644
26ed72
--- libselinux-2.6/src/selinuxswig_python.i
26ed72
+++ libselinux-2.6/src/selinuxswig_python.i
26ed72
@@ -64,7 +64,7 @@ def install(src, dest):
26ed72
 	PyObject* list = PyList_New(*$2);
26ed72
 	int i;
26ed72
 	for (i = 0; i < *$2; i++) {
26ed72
-		PyList_SetItem(list, i, PyBytes_FromString((*$1)[i]));
26ed72
+		PyList_SetItem(list, i, PyString_FromString((*$1)[i]));
26ed72
 	}
26ed72
 	$result = SWIG_Python_AppendOutput($result, list);
26ed72
 }
26ed72
@@ -97,9 +97,7 @@ def install(src, dest):
26ed72
 			len++;
26ed72
 		plist = PyList_New(len);
26ed72
 		for (i = 0; i < len; i++) {
26ed72
-			PyList_SetItem(plist, i,
26ed72
-                                       PyBytes_FromString((*$1)[i])
26ed72
-                                       );
26ed72
+			PyList_SetItem(plist, i, PyString_FromString((*$1)[i]));
26ed72
 		}
26ed72
 	} else {
26ed72
 		plist = PyList_New(0);
26ed72
@@ -116,9 +114,7 @@ def install(src, dest):
26ed72
 	if (*$1) {
26ed72
 		plist = PyList_New(result);
26ed72
 		for (i = 0; i < result; i++) {
26ed72
-			PyList_SetItem(plist, i,
26ed72
-                                       PyBytes_FromString((*$1)[i])
26ed72
-                                       );
26ed72
+			PyList_SetItem(plist, i, PyString_FromString((*$1)[i]));
26ed72
 		}
26ed72
 	} else {
26ed72
 		plist = PyList_New(0);
26ed72
@@ -171,20 +167,16 @@ def install(src, dest):
26ed72
 	$1 = (char**) malloc(size + 1);
26ed72
 
26ed72
 	for(i = 0; i < size; i++) {
26ed72
-		if (!PyBytes_Check(PySequence_GetItem($input, i))) {
26ed72
-			PyErr_SetString(PyExc_ValueError, "Sequence must contain only bytes");
26ed72
-
26ed72
+		if (!PyString_Check(PySequence_GetItem($input, i))) {
26ed72
+			PyErr_SetString(PyExc_ValueError, "Sequence must contain only strings");
26ed72
 			return NULL;
26ed72
 		}
26ed72
-
26ed72
 	}
26ed72
 		
26ed72
 	for(i = 0; i < size; i++) {
26ed72
 		s = PySequence_GetItem($input, i);
26ed72
-
26ed72
-		$1[i] = (char*) malloc(PyBytes_Size(s) + 1);
26ed72
-		strcpy($1[i], PyBytes_AsString(s));
26ed72
-
26ed72
+		$1[i] = (char*) malloc(PyString_Size(s) + 1);
26ed72
+		strcpy($1[i], PyString_AsString(s));
26ed72
 	}
26ed72
 	$1[size] = NULL;
26ed72
 }
6146f7
diff --git libselinux-2.6/src/setfilecon.c libselinux-2.6/src/setfilecon.c
e58e94
index d05969c..3f0200e 100644
6146f7
--- libselinux-2.6/src/setfilecon.c
6146f7
+++ libselinux-2.6/src/setfilecon.c
e58e94
@@ -9,8 +9,12 @@
e58e94
 
e58e94
 int setfilecon_raw(const char *path, const char * context)
e58e94
 {
e58e94
-	int rc = setxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1,
e58e94
-			0);
e58e94
+	int rc;
e58e94
+	if (! context) {
e58e94
+		errno=EINVAL;
e58e94
+		return -1;
e58e94
+	}
e58e94
+	rc = setxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);
e58e94
 	if (rc < 0 && errno == ENOTSUP) {
e58e94
 		char * ccontext = NULL;
e58e94
 		int err = errno;
ea9eee
diff --git libselinux-2.6/utils/Makefile libselinux-2.6/utils/Makefile
ea9eee
index e56a953..7744184 100644
ea9eee
--- libselinux-2.6/utils/Makefile
ea9eee
+++ libselinux-2.6/utils/Makefile
ea9eee
@@ -5,25 +5,46 @@ USRBINDIR ?= $(PREFIX)/sbin
ea9eee
 SBINDIR ?= $(DESTDIR)/sbin
ea9eee
 INCLUDEDIR ?= $(PREFIX)/include
ea9eee
 
ea9eee
+OS ?= $(shell uname)
ea9eee
+
ea9eee
+ifeq ($(shell $(CC) -v 2>&1 | grep "clang"),)
ea9eee
+COMPILER ?= gcc
ea9eee
+else
ea9eee
+COMPILER ?= clang
ea9eee
+endif
ea9eee
+
ea9eee
 MAX_STACK_SIZE=8192
ea9eee
 CFLAGS ?= -O -Wall -W -Wundef -Wformat-y2k -Wformat-security -Winit-self -Wmissing-include-dirs \
ea9eee
           -Wunused -Wunknown-pragmas -Wstrict-aliasing -Wshadow -Wpointer-arith \
ea9eee
-          -Wbad-function-cast -Wcast-align -Wwrite-strings -Wlogical-op -Waggregate-return \
ea9eee
+          -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return \
ea9eee
           -Wstrict-prototypes -Wold-style-definition -Wmissing-prototypes \
ea9eee
           -Wmissing-declarations -Wmissing-noreturn -Wmissing-format-attribute \
ea9eee
           -Wredundant-decls -Wnested-externs -Winline -Winvalid-pch -Wvolatile-register-var \
ea9eee
-          -Wdisabled-optimization -Wbuiltin-macro-redefined -Wpacked-bitfield-compat \
ea9eee
-          -Wsync-nand -Wattributes -Wcoverage-mismatch -Wmultichar -Wcpp \
ea9eee
+          -Wdisabled-optimization -Wbuiltin-macro-redefined \
ea9eee
+          -Wattributes -Wmultichar \
ea9eee
           -Wdeprecated-declarations -Wdiv-by-zero -Wdouble-promotion -Wendif-labels -Wextra \
ea9eee
-          -Wformat-contains-nul -Wformat-extra-args -Wformat-zero-length -Wformat=2 -Wmultichar \
ea9eee
-          -Wnormalized=nfc -Woverflow -Wpointer-to-int-cast -Wpragmas -Wsuggest-attribute=const \
ea9eee
-          -Wsuggest-attribute=noreturn -Wsuggest-attribute=pure -Wtrampolines \
ea9eee
-          -Wno-missing-field-initializers -Wno-sign-compare -Wjump-misses-init \
ea9eee
+          -Wformat-extra-args -Wformat-zero-length -Wformat=2 -Wmultichar \
ea9eee
+          -Woverflow -Wpointer-to-int-cast -Wpragmas \
ea9eee
+          -Wno-missing-field-initializers -Wno-sign-compare \
ea9eee
           -Wno-format-nonliteral -Wframe-larger-than=$(MAX_STACK_SIZE) -Wp,-D_FORTIFY_SOURCE=2 \
ea9eee
           -fstack-protector-all --param=ssp-buffer-size=4 -fexceptions \
ea9eee
           -fasynchronous-unwind-tables -fdiagnostics-show-option -funit-at-a-time \
ea9eee
-          -fipa-pure-const -Wno-suggest-attribute=pure -Wno-suggest-attribute=const \
ea9eee
           -Werror -Wno-aggregate-return -Wno-redundant-decls
ea9eee
+
ea9eee
+LD_SONAME_FLAGS=-soname,$(LIBSO),-z,defs,-z,relro
ea9eee
+
ea9eee
+ifeq ($(COMPILER), gcc)
ea9eee
+CFLAGS += -fipa-pure-const -Wpacked-bitfield-compat -Wsync-nand -Wcoverage-mismatch \
ea9eee
+	-Wcpp -Wformat-contains-nul -Wnormalized=nfc -Wsuggest-attribute=const \
ea9eee
+	-Wsuggest-attribute=noreturn -Wsuggest-attribute=pure -Wtrampolines -Wjump-misses-init \
ea9eee
+	-Wno-suggest-attribute=pure -Wno-suggest-attribute=const
ea9eee
+endif
ea9eee
+
ea9eee
+ifeq ($(OS), Darwin)
ea9eee
+override CFLAGS += -I/opt/local/include -I../../libsepol/include
ea9eee
+override LDFLAGS += -L../../libsepol/src -undefined dynamic_lookup
ea9eee
+endif
ea9eee
+
ea9eee
 override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE $(DISABLE_FLAGS) $(PCRE_CFLAGS)
ea9eee
 LDLIBS += -L../src -lselinux -L$(LIBDIR)
ea9eee
 PCRE_LDFLAGS ?= -lpcre
7f0ad3
diff --git libselinux-2.6/utils/matchpathcon.c libselinux-2.6/utils/matchpathcon.c
7f0ad3
index d1f1348..0288feb 100644
7f0ad3
--- libselinux-2.6/utils/matchpathcon.c
7f0ad3
+++ libselinux-2.6/utils/matchpathcon.c
7f0ad3
@@ -15,7 +15,7 @@
7f0ad3
 static void usage(const char *progname)
7f0ad3
 {
7f0ad3
 	fprintf(stderr,
7f0ad3
-		"usage:  %s [-N] [-n] [-f file_contexts] [ -P policy_root_path ] [-p prefix] [-Vq] path...\n",
7f0ad3
+		"usage:  %s [-V] [-N] [-n] [-m type] [-f file_contexts_file] [-p prefix] [-P policy_root_path] filepath...\n",
7f0ad3
 		progname);
7f0ad3
 	exit(1);
7f0ad3
 }