99813a
diff --git a/libselinux/Makefile b/libselinux/Makefile
99813a
index fd4f0b1..51469bc 100644
99813a
--- a/libselinux/Makefile
99813a
+++ b/libselinux/Makefile
99813a
@@ -1,4 +1,4 @@
99813a
-SUBDIRS = src include utils man
99813a
+SUBDIRS = src include utils man golang
99813a
 
99813a
 DISABLE_AVC ?= n
99813a
 DISABLE_SETRANS ?= n
99813a
diff --git a/libselinux/golang/Makefile b/libselinux/golang/Makefile
99813a
new file mode 100644
249294
index 0000000..b75677b
99813a
--- /dev/null
99813a
+++ b/libselinux/golang/Makefile
249294
@@ -0,0 +1,22 @@
99813a
+# Installation directories.
99813a
+PREFIX ?= $(DESTDIR)/usr
ee8c86
+LIBDIR ?= $(DESTDIR)/usr/lib
ee8c86
+GODIR ?= $(LIBDIR)/golang/src/pkg/github.com/selinux
99813a
+all:
99813a
+
99813a
+install: 
99813a
+	[ -d $(GODIR) ] || mkdir -p $(GODIR)
99813a
+	install -m 644 selinux.go $(GODIR)
99813a
+
99813a
+test:
249294
+	@mkdir selinux
249294
+	@cp selinux.go selinux
249294
+	GOPATH=$(pwd) go run test.go 
249294
+	@rm -rf selinux
99813a
+
99813a
+clean:
249294
+	@rm -f *~
249294
+	@rm -rf selinux
99813a
+indent:
99813a
+
99813a
+relabel:
99813a
diff --git a/libselinux/golang/selinux.go b/libselinux/golang/selinux.go
99813a
new file mode 100644
249294
index 0000000..6cee26a
99813a
--- /dev/null
99813a
+++ b/libselinux/golang/selinux.go
249294
@@ -0,0 +1,378 @@
99813a
+package selinux
99813a
+
99813a
+/*
99813a
+ The selinux package is a go bindings to libselinux required to add selinux
99813a
+ support to docker.
99813a
+
99813a
+ Author Dan Walsh <dwalsh@redhat.com>
99813a
+
99813a
+ Used some ideas/code from the go-ini packages https://github.com/vaughan0
99813a
+ By Vaughan Newton
99813a
+*/
99813a
+
99813a
+// #cgo pkg-config: libselinux
99813a
+// #include <selinux/selinux.h>
99813a
+// #include <stdlib.h>
99813a
+import "C"
99813a
+import (
99813a
+	"encoding/binary"
99813a
+	"crypto/rand"
99813a
+	"unsafe"
99813a
+	"fmt"
99813a
+	"bufio"
99813a
+	"regexp"
99813a
+	"io"
99813a
+	"os"
99813a
+	"strings"
99813a
+)
99813a
+
99813a
+var (
99813a
+	assignRegex  = regexp.MustCompile(`^([^=]+)=(.*)$`)
99813a
+	mcs_list = make(map[string]bool)
99813a
+)
99813a
+
99813a
+func Matchpathcon(path string, mode int) (string, error) {
99813a
+	var con C.security_context_t
99813a
+	var scon string
99813a
+	rc, err := C.matchpathcon(C.CString(path),C.mode_t(mode), &con)
99813a
+	if rc == 0 {
99813a
+		scon = C.GoString(con)
99813a
+		C.free(unsafe.Pointer(con))
99813a
+	}
99813a
+	return scon, err
99813a
+}
99813a
+
99813a
+func Setfilecon(path,scon string) (int, error) {
99813a
+        rc, err := C.lsetfilecon(C.CString(path),C.CString(scon))
99813a
+	return int(rc), err
99813a
+}
99813a
+
249294
+func Getfilecon(path string) (string, error) {
249294
+	var scon C.security_context_t
249294
+	var fcon string
249294
+        rc, err := C.lgetfilecon(C.CString(path),&scon)
249294
+	if (rc >= 0) {
249294
+		fcon = C.GoString(scon)	
249294
+		err = nil
249294
+	}
249294
+	return fcon, err
249294
+}
249294
+
249294
+func Setfscreatecon(scon string) (int, error) {
249294
+	var (
249294
+		rc C.int
249294
+		err error
249294
+	)
249294
+	if (scon != "") {
249294
+		rc, err = C.setfscreatecon(C.CString(scon))
249294
+	} else {
249294
+		rc, err = C.setfscreatecon(nil)
249294
+	}
249294
+	return int(rc), err
249294
+}
249294
+
249294
+func Getfscreatecon() (string, error) {
249294
+	var scon C.security_context_t
249294
+	var fcon string
249294
+        rc, err := C.getfscreatecon(&scon)
249294
+	if (rc >= 0) {
249294
+		fcon = C.GoString(scon)	
249294
+		err = nil
249294
+		C.freecon(scon)
249294
+	}
249294
+	return fcon, err
249294
+}
249294
+
249294
+func Getcon() (string) {
249294
+	var pcon C.security_context_t
249294
+	C.getcon(&pcon)
249294
+	scon := C.GoString(pcon)
249294
+	C.freecon(pcon)
249294
+	return scon
249294
+}
249294
+
249294
+func Getpidcon(pid int) (string, error) {
249294
+	var pcon C.security_context_t
249294
+	var scon string
249294
+	rc, err := C.getpidcon(C.pid_t(pid), &pcon)
249294
+	if (rc >= 0) {
249294
+		scon = C.GoString(pcon)
249294
+		C.freecon(pcon)
249294
+		err = nil
249294
+	}
249294
+	return scon, err
249294
+}
249294
+
249294
+func Getpeercon(socket int) (string, error) {
249294
+	var pcon C.security_context_t
249294
+	var scon string
249294
+	rc, err := C.getpeercon(C.int(socket), &pcon)
249294
+	if (rc >= 0) {
249294
+		scon = C.GoString(pcon)
249294
+		C.freecon(pcon)
249294
+		err = nil
249294
+	}
249294
+	return scon, err
249294
+}
249294
+
99813a
+func Setexeccon(scon string) (int, error) {
99813a
+	var val *C.char
99813a
+	if ! Selinux_enabled() {
99813a
+		return 0, nil
99813a
+	}
99813a
+	if scon != "" {
99813a
+		val = C.CString(scon)
99813a
+	} else {
99813a
+		val = nil
99813a
+	}
99813a
+        rc, err := C.setexeccon(val)
99813a
+	return int(rc), err
99813a
+}
99813a
+
99813a
+type Context struct {
99813a
+	con []string
99813a
+}
99813a
+func (c *Context) Set_user(user string) {
99813a
+	c.con[0]=user
99813a
+}
99813a
+func (c *Context) Get_user() string {
99813a
+	return c.con[0]
99813a
+}
99813a
+func (c *Context) Set_role(role string) {
99813a
+	c.con[1]=role
99813a
+}
99813a
+func (c *Context) Get_role() string {
99813a
+	return c.con[1]
99813a
+}
99813a
+func (c *Context) Set_type(setype string) {
99813a
+	c.con[2]=setype
99813a
+}
99813a
+func (c *Context) Get_type() string {
99813a
+	return c.con[2]
99813a
+}
99813a
+func (c *Context) Set_level(mls string) {
99813a
+	c.con[3]=mls
99813a
+}
99813a
+func (c *Context) Get_level() string {
99813a
+	return c.con[3]
99813a
+}
99813a
+func (c *Context) Get() string{
99813a
+	return strings.Join(c.con,":")
99813a
+}
99813a
+func (c *Context) Set(scon string) {
99813a
+	c.con = strings.SplitN(scon,":",4)
99813a
+}
99813a
+func New_context(scon string) Context {
99813a
+	var con Context
99813a
+	con.Set(scon)
99813a
+	return con
99813a
+}
99813a
+
99813a
+func Is_selinux_enabled() bool {
99813a
+	b := C.is_selinux_enabled()
99813a
+	if b > 0 {
99813a
+		return true;
99813a
+	}
99813a
+	return false
99813a
+}
99813a
+
99813a
+func Selinux_enabled() bool {
99813a
+	b := C.is_selinux_enabled()
99813a
+	if b > 0 {
99813a
+		return true;
99813a
+	}
99813a
+	return false
99813a
+}
99813a
+
99813a
+const (
99813a
+	Enforcing = 1
99813a
+	Permissive = 0
99813a
+	Disabled = -1
99813a
+)
99813a
+
99813a
+func Selinux_getenforce() int {
99813a
+	return int(C.security_getenforce())
99813a
+}
99813a
+
99813a
+func Selinux_getenforcemode() (int) {
99813a
+	var enforce C.int
99813a
+	C.selinux_getenforcemode(&enforce)
99813a
+	return int(enforce)
99813a
+}
99813a
+
99813a
+func mcs_add(mcs string) {
99813a
+	mcs_list[mcs] = true
99813a
+}
99813a
+
99813a
+func mcs_delete(mcs string) {
99813a
+	mcs_list[mcs] = false
99813a
+}
99813a
+
99813a
+func mcs_exists(mcs string) bool {
99813a
+	return mcs_list[mcs] 
99813a
+}
99813a
+
ee8c86
+func Int_to_mcs(id int, catRange uint32) string {
ee8c86
+        if ((id < 1) || (id >523776)) {
ee8c86
+          return "";
ee8c86
+        }
ee8c86
+
ee8c86
+	SETSIZE := int(catRange);
ee8c86
+	TIER := SETSIZE;
ee8c86
+
ee8c86
+	ORD := id;
ee8c86
+	for ;ORD > TIER; {
ee8c86
+		ORD = ORD - TIER;
ee8c86
+		TIER -= 1;
ee8c86
+	}
ee8c86
+	TIER = SETSIZE - TIER;
ee8c86
+	ORD = ORD + TIER;
ee8c86
+	return fmt.Sprintf("s0:c%d,c%d", TIER, ORD);
ee8c86
+}
ee8c86
+
99813a
+func uniq_mcs(catRange uint32) string {
99813a
+	var n uint32
99813a
+	var c1,c2 uint32
99813a
+	var mcs string
99813a
+	for ;; {
99813a
+		binary.Read(rand.Reader, binary.LittleEndian, &n)
99813a
+		c1 = n % catRange
99813a
+		binary.Read(rand.Reader, binary.LittleEndian, &n)
99813a
+		c2 = n % catRange
99813a
+		if c1 == c2 {
99813a
+			continue
99813a
+		} else {
99813a
+			if c1 > c2 {
99813a
+				t := c1
99813a
+				c1 = c2
99813a
+				c2 = t
99813a
+			}
99813a
+		}
99813a
+		mcs = fmt.Sprintf("s0:c%d,c%d", c1, c2)
99813a
+		if mcs_exists(mcs) {
99813a
+			continue
99813a
+		}
99813a
+		mcs_add(mcs)
99813a
+		break
99813a
+	}
99813a
+	return mcs
99813a
+}
99813a
+func free_context(process_label string) {
99813a
+	var scon Context
99813a
+	scon = New_context(process_label)
99813a
+	mcs_delete(scon.Get_level())
99813a
+}
99813a
+
99813a
+func Get_lxc_contexts() (process_label string, file_label string) {
99813a
+	var val, key string
99813a
+	var bufin *bufio.Reader
99813a
+	if ! Selinux_enabled() {
99813a
+		return
99813a
+	}
99813a
+	lxc_path := C.GoString(C.selinux_lxc_contexts_path())
99813a
+	file_label = "system_u:object_r:svirt_sandbox_file_t:s0"
99813a
+	process_label = "system_u:system_r:svirt_lxc_net_t:s0"
99813a
+
99813a
+	in, err := os.Open(lxc_path)
99813a
+	if err != nil {
99813a
+		goto exit
99813a
+	}
99813a
+
99813a
+	defer in.Close()
99813a
+	bufin = bufio.NewReader(in)
99813a
+
99813a
+	for done := false; !done; {
99813a
+		var line string
99813a
+		if line, err = bufin.ReadString('\n'); err != nil {
99813a
+			if err == io.EOF {
99813a
+				done = true
99813a
+			} else {
99813a
+				goto exit
99813a
+			}
99813a
+		}
99813a
+		line = strings.TrimSpace(line)
99813a
+		if len(line) == 0 {
99813a
+			// Skip blank lines
99813a
+			continue
99813a
+		}
99813a
+		if line[0] == ';' || line[0] == '#' {
99813a
+			// Skip comments
99813a
+			continue
99813a
+		}
99813a
+		if groups := assignRegex.FindStringSubmatch(line); groups != nil {
99813a
+			key, val = strings.TrimSpace(groups[1]), strings.TrimSpace(groups[2])
99813a
+			if key == "process" {
99813a
+				process_label = strings.Trim(val,"\"")
99813a
+			}
99813a
+			if key == "file" {
99813a
+				file_label = strings.Trim(val,"\"")
99813a
+			}
99813a
+		}
99813a
+	}
99813a
+exit:
99813a
+	var scon Context
ee8c86
+	mcs := Int_to_mcs(os.Getpid(), 1024)
99813a
+	scon = New_context(process_label)
99813a
+	scon.Set_level(mcs)
99813a
+	process_label = scon.Get()
99813a
+	scon = New_context(file_label)
99813a
+	scon.Set_level(mcs)
99813a
+	file_label = scon.Get()
99813a
+	return process_label, file_label
99813a
+}
99813a
+
99813a
+func CopyLevel (src, dest string) (string, error) {
99813a
+	if ! Selinux_enabled() {
99813a
+		return "", nil
99813a
+	}
99813a
+	if src == "" {
99813a
+		return "", nil
99813a
+	}
99813a
+	rc, err := C.security_check_context(C.CString(src))
99813a
+	if rc != 0 {
99813a
+		return "", err
99813a
+	}
99813a
+	rc, err = C.security_check_context(C.CString(dest))
99813a
+	if rc != 0 {
99813a
+		return "", err
99813a
+	}
99813a
+	scon := New_context(src)
99813a
+	tcon := New_context(dest)
99813a
+	tcon.Set_level(scon.Get_level())
99813a
+	return tcon.Get(), nil
99813a
+}
99813a
+
99813a
+func Test() {
99813a
+	var plabel,flabel string
99813a
+	if ! Selinux_enabled() {
99813a
+		return
99813a
+	}
99813a
+
99813a
+	plabel, flabel = Get_lxc_contexts()
99813a
+	fmt.Println(plabel)
99813a
+	fmt.Println(flabel)
99813a
+	free_context(plabel)
99813a
+	plabel, flabel = Get_lxc_contexts()
99813a
+	fmt.Println(plabel)
99813a
+	fmt.Println(flabel)
99813a
+	free_context(plabel)
99813a
+	if Selinux_enabled() {
99813a
+		fmt.Println("Enabled")
99813a
+	} else {
99813a
+		fmt.Println("Disabled")
99813a
+	}
ee8c86
+	fmt.Println("getenforce ", Selinux_getenforce())
ee8c86
+	fmt.Println("getenforcemode ", Selinux_getenforcemode())
99813a
+	flabel,_ = Matchpathcon("/home/dwalsh/.emacs", 0)
99813a
+	fmt.Println(flabel)
ee8c86
+	pid := os.Getpid()
ee8c86
+	fmt.Printf("PID:%d MCS:%s\n", pid, Int_to_mcs(pid, 1023))
249294
+	fmt.Println(Getcon())
249294
+	fmt.Println(Getfilecon("/etc/passwd"))
249294
+	fmt.Println(Getpidcon(1))
249294
+	Setfscreatecon("unconfined_u:unconfined_r:unconfined_t:s0")
249294
+	fmt.Println(Getfscreatecon())
249294
+	Setfscreatecon("")
249294
+	fmt.Println(Getfscreatecon())
249294
+	fmt.Println(Getpidcon(1))
249294
+}
249294
diff --git a/libselinux/golang/test.go b/libselinux/golang/test.go
249294
new file mode 100644
249294
index 0000000..fed6de8
249294
--- /dev/null
249294
+++ b/libselinux/golang/test.go
249294
@@ -0,0 +1,9 @@
249294
+package main
249294
+
249294
+import (
249294
+	"./selinux"
249294
+)
249294
+
249294
+func main() {
249294
+	selinux.Test()
99813a
+}
249294
diff --git a/libselinux/man/man3/getfscreatecon.3 b/libselinux/man/man3/getfscreatecon.3
249294
index c7675be..677ece4 100644
249294
--- a/libselinux/man/man3/getfscreatecon.3
249294
+++ b/libselinux/man/man3/getfscreatecon.3
249294
@@ -49,6 +49,11 @@ Signal handlers that perform a
249294
 must take care to
249294
 save, reset, and restore the fscreate context to avoid unexpected behavior.
249294
 .
249294
+
249294
+.br
249294
+.B Note:
249294
+Contexts are thread specific.
249294
+
249294
 .SH "RETURN VALUE"
249294
 On error \-1 is returned.
249294
 On success 0 is returned.
249294
diff --git a/libselinux/man/man3/getkeycreatecon.3 b/libselinux/man/man3/getkeycreatecon.3
249294
index d6a118c..b503535 100644
249294
--- a/libselinux/man/man3/getkeycreatecon.3
249294
+++ b/libselinux/man/man3/getkeycreatecon.3
249294
@@ -48,6 +48,10 @@ Signal handlers that perform a
249294
 .BR setkeycreatecon ()
249294
 must take care to
249294
 save, reset, and restore the keycreate context to avoid unexpected behavior.
249294
+
249294
+.br
249294
+.B Note:
249294
+Contexts are thread specific.
249294
 .
249294
 .SH "RETURN VALUE"
249294
 On error \-1 is returned.
249294
diff --git a/libselinux/man/man3/getsockcreatecon.3 b/libselinux/man/man3/getsockcreatecon.3
249294
index 99e9436..673738c 100644
249294
--- a/libselinux/man/man3/getsockcreatecon.3
249294
+++ b/libselinux/man/man3/getsockcreatecon.3
249294
@@ -49,6 +49,11 @@ Signal handlers that perform a
249294
 must take care to
249294
 save, reset, and restore the sockcreate context to avoid unexpected behavior.
249294
 .
249294
+
249294
+.br
249294
+.B Note:
249294
+Contexts are thread specific.
249294
+
249294
 .SH "RETURN VALUE"
249294
 On error \-1 is returned.
249294
 On success 0 is returned.
5f9e31
diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
5f9e31
index 02dd829..6dfdb46 100644
5f9e31
--- a/libselinux/src/Makefile
5f9e31
+++ b/libselinux/src/Makefile
5f9e31
@@ -114,7 +114,7 @@ $(LIBA): $(OBJS)
5f9e31
 	$(RANLIB) $@
5f9e31
 
5f9e31
 $(LIBSO): $(LOBJS)
5f9e31
-	$(CC) $(CFLAGS) -shared -o $@ $^ -lpcre -ldl $(LDFLAGS) -L$(LIBDIR) -Wl,-soname,$(LIBSO),-z,defs,-z,relro
5f9e31
+	$(CC) $(CFLAGS) -shared -o $@ $^ -lpcre -llzma -ldl $(LDFLAGS) -L$(LIBDIR) -Wl,-soname,$(LIBSO),-z,defs,-z,relro
5f9e31
 	ln -sf $@ $(TARGET) 
5f9e31
 
5f9e31
 $(LIBPC): $(LIBPC).in ../VERSION
ee8c86
diff --git a/libselinux/src/avc_sidtab.c b/libselinux/src/avc_sidtab.c
ee8c86
index 0b696bb..506e236 100644
ee8c86
--- a/libselinux/src/avc_sidtab.c
ee8c86
+++ b/libselinux/src/avc_sidtab.c
ee8c86
@@ -81,6 +81,11 @@ sidtab_context_to_sid(struct sidtab *s,
ee8c86
 	int hvalue, rc = 0;
ee8c86
 	struct sidtab_node *cur;
ee8c86
 
ee8c86
+	if (! ctx) {
ee8c86
+		errno=EINVAL;
ee8c86
+		return -1;
ee8c86
+	}
ee8c86
+
ee8c86
 	*sid = NULL;
ee8c86
 	hvalue = sidtab_hash(ctx);
ee8c86
 
ee8c86
diff --git a/libselinux/src/canonicalize_context.c b/libselinux/src/canonicalize_context.c
ee8c86
index 176c45a..6075025 100644
ee8c86
--- a/libselinux/src/canonicalize_context.c
ee8c86
+++ b/libselinux/src/canonicalize_context.c
ee8c86
@@ -17,6 +17,11 @@ int security_canonicalize_context_raw(const security_context_t con,
ee8c86
 	size_t size;
ee8c86
 	int fd, ret;
ee8c86
 
ee8c86
+	if (! con) {
ee8c86
+		errno=EINVAL;
ee8c86
+		return -1;
ee8c86
+	}
ee8c86
+
ee8c86
 	if (!selinux_mnt) {
ee8c86
 		errno = ENOENT;
ee8c86
 		return -1;
ee8c86
diff --git a/libselinux/src/check_context.c b/libselinux/src/check_context.c
ee8c86
index 33ab5e3..1277bdd 100644
ee8c86
--- a/libselinux/src/check_context.c
ee8c86
+++ b/libselinux/src/check_context.c
ee8c86
@@ -14,6 +14,11 @@ int security_check_context_raw(const security_context_t con)
ee8c86
 	char path[PATH_MAX];
ee8c86
 	int fd, ret;
ee8c86
 
ee8c86
+	if (! con) {
ee8c86
+		errno=EINVAL;
ee8c86
+		return -1;
ee8c86
+	}
ee8c86
+
ee8c86
 	if (!selinux_mnt) {
ee8c86
 		errno = ENOENT;
ee8c86
 		return -1;
ee8c86
diff --git a/libselinux/src/compute_av.c b/libselinux/src/compute_av.c
ee8c86
index 5962c0b..61ea454 100644
ee8c86
--- a/libselinux/src/compute_av.c
ee8c86
+++ b/libselinux/src/compute_av.c
ee8c86
@@ -26,6 +26,11 @@ int security_compute_av_flags_raw(const security_context_t scon,
ee8c86
 		return -1;
ee8c86
 	}
ee8c86
 
ee8c86
+	if ((! scon) || (! tcon)) {
ee8c86
+		errno=EINVAL;
ee8c86
+		return -1;
ee8c86
+	}
ee8c86
+
ee8c86
 	snprintf(path, sizeof path, "%s/access", selinux_mnt);
ee8c86
 	fd = open(path, O_RDWR);
ee8c86
 	if (fd < 0)
ee8c86
diff --git a/libselinux/src/compute_create.c b/libselinux/src/compute_create.c
ee8c86
index 3c05be3..34a1ccd 100644
ee8c86
--- a/libselinux/src/compute_create.c
ee8c86
+++ b/libselinux/src/compute_create.c
ee8c86
@@ -64,6 +64,11 @@ int security_compute_create_name_raw(const security_context_t scon,
ee8c86
 		return -1;
ee8c86
 	}
ee8c86
 
ee8c86
+	if ((! scon) || (! tcon)) {
ee8c86
+		errno=EINVAL;
ee8c86
+		return -1;
ee8c86
+	}
ee8c86
+
ee8c86
 	snprintf(path, sizeof path, "%s/create", selinux_mnt);
ee8c86
 	fd = open(path, O_RDWR);
ee8c86
 	if (fd < 0)
ee8c86
diff --git a/libselinux/src/compute_member.c b/libselinux/src/compute_member.c
ee8c86
index dad0a77..7850986 100644
ee8c86
--- a/libselinux/src/compute_member.c
ee8c86
+++ b/libselinux/src/compute_member.c
ee8c86
@@ -25,6 +25,11 @@ int security_compute_member_raw(const security_context_t scon,
ee8c86
 		return -1;
ee8c86
 	}
ee8c86
 
ee8c86
+	if ((! scon) || (! tcon)) {
ee8c86
+		errno=EINVAL;
ee8c86
+		return -1;
ee8c86
+	}
ee8c86
+
ee8c86
 	snprintf(path, sizeof path, "%s/member", selinux_mnt);
ee8c86
 	fd = open(path, O_RDWR);
ee8c86
 	if (fd < 0)
ee8c86
diff --git a/libselinux/src/compute_relabel.c b/libselinux/src/compute_relabel.c
ee8c86
index 656f00a..2560e78 100644
ee8c86
--- a/libselinux/src/compute_relabel.c
ee8c86
+++ b/libselinux/src/compute_relabel.c
ee8c86
@@ -25,6 +25,11 @@ int security_compute_relabel_raw(const security_context_t scon,
ee8c86
 		return -1;
ee8c86
 	}
ee8c86
 
ee8c86
+	if ((! scon) || (! tcon)) {
ee8c86
+		errno=EINVAL;
ee8c86
+		return -1;
ee8c86
+	}
ee8c86
+
ee8c86
 	snprintf(path, sizeof path, "%s/relabel", selinux_mnt);
ee8c86
 	fd = open(path, O_RDWR);
ee8c86
 	if (fd < 0)
ee8c86
diff --git a/libselinux/src/compute_user.c b/libselinux/src/compute_user.c
ee8c86
index 3b39ddd..af20735 100644
ee8c86
--- a/libselinux/src/compute_user.c
ee8c86
+++ b/libselinux/src/compute_user.c
ee8c86
@@ -24,6 +24,11 @@ int security_compute_user_raw(const security_context_t scon,
ee8c86
 		return -1;
ee8c86
 	}
ee8c86
 
ee8c86
+	if (! scon) {
ee8c86
+		errno=EINVAL;
ee8c86
+		return -1;
ee8c86
+	}
ee8c86
+
ee8c86
 	snprintf(path, sizeof path, "%s/user", selinux_mnt);
ee8c86
 	fd = open(path, O_RDWR);
ee8c86
 	if (fd < 0)
7e1165
diff --git a/libselinux/src/fsetfilecon.c b/libselinux/src/fsetfilecon.c
7e1165
index 9963f7a..37f9d74 100644
7e1165
--- a/libselinux/src/fsetfilecon.c
7e1165
+++ b/libselinux/src/fsetfilecon.c
7e1165
@@ -9,8 +9,12 @@
7e1165
 
7e1165
 int fsetfilecon_raw(int fd, const security_context_t context)
7e1165
 {
7e1165
-	int rc = fsetxattr(fd, XATTR_NAME_SELINUX, context, strlen(context) + 1,
7e1165
-			 0);
7e1165
+	int rc;
7e1165
+	if (! context) {
7e1165
+		errno=EINVAL;
7e1165
+		return -1;
7e1165
+	}
7e1165
+	rc = fsetxattr(fd, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);
7e1165
 	if (rc < 0 && errno == ENOTSUP) {
7e1165
 		security_context_t ccontext = NULL;
7e1165
 		int err = errno;
5f9e31
diff --git a/libselinux/src/load_policy.c b/libselinux/src/load_policy.c
ee8c86
index e419f1a..275672d 100644
5f9e31
--- a/libselinux/src/load_policy.c
5f9e31
+++ b/libselinux/src/load_policy.c
5f9e31
@@ -16,6 +16,82 @@
5f9e31
 #include <dlfcn.h>
5f9e31
 #include "policy.h"
5f9e31
 #include <limits.h>
5f9e31
+#include <lzma.h>
5f9e31
+
5f9e31
+static char *lzmaread(int fd, size_t *rsize) {
5f9e31
+	int capacity = 64*1024;
5f9e31
+	char *buf = NULL;
5f9e31
+	int tmpsize = 8 * 1024;
5f9e31
+	unsigned char tmp[tmpsize];
5f9e31
+	unsigned char tmp_out[tmpsize];
5f9e31
+	size_t size = 0;
5f9e31
+	lzma_stream strm = LZMA_STREAM_INIT;
5f9e31
+	lzma_action action = LZMA_RUN;
5f9e31
+	lzma_ret ret;
5f9e31
+	
5f9e31
+	FILE *stream = fdopen (fd, "r");
5f9e31
+	if (!stream) {
5f9e31
+		return NULL;
5f9e31
+	}
5f9e31
+	ret = lzma_stream_decoder(&strm, UINT64_MAX,
5f9e31
+				  LZMA_CONCATENATED);
5f9e31
+	
5f9e31
+	strm.avail_in = 0;
5f9e31
+	strm.next_out = tmp_out;
5f9e31
+	strm.avail_out = tmpsize;
5f9e31
+	
5f9e31
+	buf = (char *) malloc (capacity);
5f9e31
+	if (!buf)
5f9e31
+		goto err;
5f9e31
+	
5f9e31
+	while (1) {
5f9e31
+		if (strm.avail_in == 0) {
5f9e31
+			strm.next_in = tmp;
5f9e31
+			strm.avail_in = fread(tmp, 1, tmpsize, stream);
5f9e31
+			
5f9e31
+			if (ferror(stream)) {
5f9e31
+				// POSIX says that fread() sets errno if
5f9e31
+				// an error occurred. ferror() doesn't
5f9e31
+				// touch errno.
5f9e31
+				goto err;
5f9e31
+			}
5f9e31
+			if (feof(stream)) action = LZMA_FINISH;
5f9e31
+		}
5f9e31
+		
5f9e31
+		ret = lzma_code(&strm, action);
5f9e31
+		
5f9e31
+		// Write and check write error before checking decoder error.
5f9e31
+		// This way as much data as possible gets written to output
5f9e31
+		// even if decoder detected an error.
5f9e31
+		if (strm.avail_out == 0 || ret != LZMA_OK) {
5f9e31
+			const size_t num =  tmpsize - strm.avail_out;
5f9e31
+			if (num > capacity) {
5f9e31
+				buf = (char*) realloc (buf, size*2);
5f9e31
+				capacity = size;
5f9e31
+			}
5f9e31
+			memcpy (buf+size, tmp_out, num);
5f9e31
+			capacity -= num;
5f9e31
+			size += num;
5f9e31
+			strm.next_out = tmp_out;
5f9e31
+			strm.avail_out = tmpsize;
5f9e31
+		}
5f9e31
+		if (ret != LZMA_OK) {
5f9e31
+			if (ret == LZMA_STREAM_END) {
5f9e31
+				break;
5f9e31
+			} else {
5f9e31
+				goto err;
5f9e31
+			}
5f9e31
+		}
5f9e31
+	}
5f9e31
+	*rsize = size;
5f9e31
+	
5f9e31
+	goto exit;
5f9e31
+err:
5f9e31
+	free(buf); buf = NULL;
5f9e31
+exit:
5f9e31
+	lzma_end(&strm;;
5f9e31
+	return buf;
5f9e31
+}
5f9e31
 
5f9e31
 int security_load_policy(void *data, size_t len)
5f9e31
 {
5f9e31
@@ -55,7 +131,7 @@ int selinux_mkload_policy(int preservebools)
5f9e31
 	struct stat sb;
5f9e31
 	struct utsname uts;
5f9e31
 	size_t size;
5f9e31
-	void *map, *data;
5f9e31
+	void *map = NULL, *data=NULL;
5f9e31
 	int fd, rc = -1, prot;
5f9e31
 	sepol_policydb_t *policydb;
5f9e31
 	sepol_policy_file_t *pf;
5f9e31
@@ -181,24 +257,28 @@ checkbool:
5f9e31
 		goto dlclose;
5f9e31
 	}
5f9e31
 
5f9e31
-	if (fstat(fd, &sb) < 0) {
5f9e31
-		fprintf(stderr,
5f9e31
-			"SELinux:  Could not stat policy file %s:  %s\n",
5f9e31
-			path, strerror(errno));
5f9e31
-		goto close;
5f9e31
-	}
5f9e31
-
5f9e31
-	prot = PROT_READ;
5f9e31
-	if (setlocaldefs || preservebools)
5f9e31
-		prot |= PROT_WRITE;
5f9e31
+	data = lzmaread(fd,&size);
5f9e31
 
5f9e31
-	size = sb.st_size;
5f9e31
-	data = map = mmap(NULL, size, prot, MAP_PRIVATE, fd, 0);
5f9e31
-	if (map == MAP_FAILED) {
5f9e31
-		fprintf(stderr,
5f9e31
-			"SELinux:  Could not map policy file %s:  %s\n",
5f9e31
+	if (!data) {
5f9e31
+		if (fstat(fd, &sb) < 0) {
5f9e31
+			fprintf(stderr,
5f9e31
+				"SELinux:  Could not stat policy file %s:  %s\n",
5f9e31
 			path, strerror(errno));
5f9e31
-		goto close;
5f9e31
+			goto close;
5f9e31
+		}
5f9e31
+		
5f9e31
+		prot = PROT_READ;
5f9e31
+		if (setlocaldefs || preservebools)
5f9e31
+			prot |= PROT_WRITE;
5f9e31
+		
5f9e31
+		size = sb.st_size;
5f9e31
+		data = map = mmap(NULL, size, prot, MAP_PRIVATE, fd, 0);
5f9e31
+		if (map == MAP_FAILED) {
5f9e31
+			fprintf(stderr,
5f9e31
+				"SELinux:  Could not map policy file %s:  %s\n",
5f9e31
+				path, strerror(errno));
5f9e31
+			goto close;
5f9e31
+		}
5f9e31
 	}
5f9e31
 
5f9e31
 	if (vers > kernvers && usesepol) {
5f9e31
@@ -210,6 +290,8 @@ checkbool:
5f9e31
 			goto unmap;
5f9e31
 		}
5f9e31
 		policy_file_set_mem(pf, data, size);
5f9e31
+		if (!map)
5f9e31
+			free(data);
5f9e31
 		if (policydb_read(policydb, pf)) {
5f9e31
 			policy_file_free(pf);
5f9e31
 			policydb_free(policydb);
5f9e31
@@ -223,7 +305,8 @@ checkbool:
5f9e31
 				path);
5f9e31
 			policy_file_free(pf);
5f9e31
 			policydb_free(policydb);
5f9e31
-			munmap(map, sb.st_size);
5f9e31
+			if (map)
5f9e31
+				munmap(map, sb.st_size);
5f9e31
 			close(fd);
5f9e31
 			vers--;
5f9e31
 			goto search;
5f9e31
@@ -275,7 +358,7 @@ checkbool:
5f9e31
 #endif
5f9e31
 	}
5f9e31
 
5f9e31
-
5f9e31
+	
5f9e31
 	rc = security_load_policy(data, size);
5f9e31
 	
5f9e31
 	if (rc)
5f9e31
@@ -286,7 +369,8 @@ checkbool:
5f9e31
       unmap:
5f9e31
 	if (data != map)
5f9e31
 		free(data);
5f9e31
-	munmap(map, sb.st_size);
5f9e31
+	if (map)
5f9e31
+		munmap(map, sb.st_size);
5f9e31
       close:
5f9e31
 	close(fd);
5f9e31
       dlclose:
e61de3
diff --git a/libselinux/src/lsetfilecon.c b/libselinux/src/lsetfilecon.c
7e1165
index fd9bb26..af2d88c 100644
e61de3
--- a/libselinux/src/lsetfilecon.c
e61de3
+++ b/libselinux/src/lsetfilecon.c
7e1165
@@ -9,8 +9,13 @@
e61de3
 
e61de3
 int lsetfilecon_raw(const char *path, const security_context_t context)
e61de3
 {
e61de3
-	int rc = lsetxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1,
7e1165
-			 0);
e61de3
+	int rc;
e61de3
+	if (! context) {
e61de3
+		errno=EINVAL;
e61de3
+		return -1;
e61de3
+	}
e61de3
+
7e1165
+	rc = lsetxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);
e61de3
 	if (rc < 0 && errno == ENOTSUP) {
e61de3
 		security_context_t ccontext = NULL;
7e1165
 		int err = errno;
ca9cea
diff --git a/libselinux/src/matchpathcon.c b/libselinux/src/matchpathcon.c
01a1f7
index 2d7369e..2a00807 100644
ca9cea
--- a/libselinux/src/matchpathcon.c
ca9cea
+++ b/libselinux/src/matchpathcon.c
495b75
@@ -2,6 +2,7 @@
974a6e
 #include <string.h>
974a6e
 #include <errno.h>
974a6e
 #include <stdio.h>
974a6e
+#include <syslog.h>
974a6e
 #include "selinux_internal.h"
974a6e
 #include "label_internal.h"
974a6e
 #include "callbacks.h"
495b75
@@ -62,7 +63,7 @@ static void
974a6e
 {
974a6e
 	va_list ap;
974a6e
 	va_start(ap, fmt);
974a6e
-	vfprintf(stderr, fmt, ap);
974a6e
+	vsyslog(LOG_ERR, fmt, ap);
974a6e
 	va_end(ap);
974a6e
 }
b5b41b
 
7e1165
diff --git a/libselinux/src/setfilecon.c b/libselinux/src/setfilecon.c
7e1165
index 50cb228..e617039 100644
7e1165
--- a/libselinux/src/setfilecon.c
7e1165
+++ b/libselinux/src/setfilecon.c
7e1165
@@ -9,8 +9,12 @@
7e1165
 
7e1165
 int setfilecon_raw(const char *path, const security_context_t context)
7e1165
 {
7e1165
-	int rc = setxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1,
7e1165
-			0);
7e1165
+	int rc;
7e1165
+	if (! context) {
7e1165
+		errno=EINVAL;
7e1165
+		return -1;
7e1165
+	}
7e1165
+	rc = setxattr(path, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);
7e1165
 	if (rc < 0 && errno == ENOTSUP) {
7e1165
 		security_context_t ccontext = NULL;
7e1165
 		int err = errno;