diff --git libselinux-2.6/Makefile libselinux-2.6/Makefile

index baa0db3..3355f01 100644

--- libselinux-2.6/Makefile

+++ libselinux-2.6/Makefile

@@ -1,4 +1,4 @@

-SUBDIRS = src include utils man

+SUBDIRS = src include utils man golang

 DISABLE_SETRANS ?= n

 DISABLE_RPM ?= n

@@ -27,6 +27,16 @@ else

 endif

 export PCRE_CFLAGS PCRE_LDFLAGS

+OS := $(shell uname)

+export OS

+

+ifeq ($(shell $(CC) -v 2>&1 | grep "clang"),)

+COMPILER := gcc

+else

+COMPILER := clang

+endif

+export COMPILER

+

 all install relabel clean distclean indent:

 	@for subdir in $(SUBDIRS); do \

 		(cd $$subdir && $(MAKE) $@) || exit 1; \

@@ -47,4 +57,10 @@ install-pywrap:

 install-rubywrap: 

 	$(MAKE) -C src install-rubywrap $@

+clean-pywrap:

+	$(MAKE) -C src clean-pywrap $@

+

+clean-rubywrap:

+	$(MAKE) -C src clean-rubywrap $@

+

 test:

diff --git libselinux-2.6/golang/Makefile libselinux-2.6/golang/Makefile

new file mode 100644

index 0000000..b75677b

--- /dev/null

+++ libselinux-2.6/golang/Makefile

@@ -0,0 +1,22 @@

+# Installation directories.

+PREFIX ?= $(DESTDIR)/usr

+LIBDIR ?= $(DESTDIR)/usr/lib

+GODIR ?= $(LIBDIR)/golang/src/pkg/github.com/selinux

+all:

+

+install: 

+	[ -d $(GODIR) ] || mkdir -p $(GODIR)

+	install -m 644 selinux.go $(GODIR)

+

+test:

+	@mkdir selinux

+	@cp selinux.go selinux

+	GOPATH=$(pwd) go run test.go 

+	@rm -rf selinux

+

+clean:

+	@rm -f *~

+	@rm -rf selinux

+indent:

+

+relabel:

diff --git libselinux-2.6/golang/selinux.go libselinux-2.6/golang/selinux.go

new file mode 100644

index 0000000..34bf6bb

--- /dev/null

+++ libselinux-2.6/golang/selinux.go

@@ -0,0 +1,412 @@

+package selinux

+

+/*

+ The selinux package is a go bindings to libselinux required to add selinux

+ support to docker.

+

+ Author Dan Walsh <dwalsh@redhat.com>

+

+ Used some ideas/code from the go-ini packages https://github.com/vaughan0

+ By Vaughan Newton

+*/

+

+// #cgo pkg-config: libselinux

+// #include <selinux/selinux.h>

+// #include <stdlib.h>

+import "C"

+import (

+	"bufio"

+	"crypto/rand"

+	"encoding/binary"

+	"fmt"

+	"io"

+	"os"

+	"path"

+	"path/filepath"

+	"regexp"

+	"strings"

+	"unsafe"

+)

+

+var (

+	assignRegex = regexp.MustCompile(`^([^=]+)=(.*)$`)

+	mcsList     = make(map[string]bool)

+)

+

+func Matchpathcon(path string, mode os.FileMode) (string, error) {

+	var con C.security_context_t

+	var scon string

+	rc, err := C.matchpathcon(C.CString(path), C.mode_t(mode), &con)

+	if rc == 0 {

+		scon = C.GoString(con)

+		C.free(unsafe.Pointer(con))

+	}

+	return scon, err

+}

+

+func Setfilecon(path, scon string) (int, error) {

+	rc, err := C.lsetfilecon(C.CString(path), C.CString(scon))

+	return int(rc), err

+}

+

+func Getfilecon(path string) (string, error) {

+	var scon C.security_context_t

+	var fcon string

+	rc, err := C.lgetfilecon(C.CString(path), &scon)

+	if rc >= 0 {

+		fcon = C.GoString(scon)

+		err = nil

+	}

+	return fcon, err

+}

+

+func Setfscreatecon(scon string) (int, error) {

+	var (

+		rc  C.int

+		err error

+	)

+	if scon != "" {

+		rc, err = C.setfscreatecon(C.CString(scon))

+	} else {

+		rc, err = C.setfscreatecon(nil)

+	}

+	return int(rc), err

+}

+

+func Getfscreatecon() (string, error) {

+	var scon C.security_context_t

+	var fcon string

+	rc, err := C.getfscreatecon(&scon)

+	if rc >= 0 {

+		fcon = C.GoString(scon)

+		err = nil

+		C.freecon(scon)

+	}

+	return fcon, err

+}

+

+func Getcon() string {

+	var pcon C.security_context_t

+	C.getcon(&pcon)

+	scon := C.GoString(pcon)

+	C.freecon(pcon)

+	return scon

+}

+

+func Getpidcon(pid int) (string, error) {

+	var pcon C.security_context_t

+	var scon string

+	rc, err := C.getpidcon(C.pid_t(pid), &pcon)

+	if rc >= 0 {

+		scon = C.GoString(pcon)

+		C.freecon(pcon)

+		err = nil

+	}

+	return scon, err

+}

+

+func Getpeercon(socket int) (string, error) {

+	var pcon C.security_context_t

+	var scon string

+	rc, err := C.getpeercon(C.int(socket), &pcon)

+	if rc >= 0 {

+		scon = C.GoString(pcon)

+		C.freecon(pcon)

+		err = nil

+	}

+	return scon, err

+}

+

+func Setexeccon(scon string) error {

+	var val *C.char

+	if !SelinuxEnabled() {

+		return nil

+	}

+	if scon != "" {

+		val = C.CString(scon)

+	} else {

+		val = nil

+	}

+	_, err := C.setexeccon(val)

+	return err

+}

+

+type Context struct {

+	con []string

+}

+

+func (c *Context) SetUser(user string) {

+	c.con[0] = user

+}

+func (c *Context) GetUser() string {

+	return c.con[0]

+}

+func (c *Context) SetRole(role string) {

+	c.con[1] = role

+}

+func (c *Context) GetRole() string {

+	return c.con[1]

+}

+func (c *Context) SetType(setype string) {

+	c.con[2] = setype

+}

+func (c *Context) GetType() string {

+	return c.con[2]

+}

+func (c *Context) SetLevel(mls string) {

+	c.con[3] = mls

+}

+func (c *Context) GetLevel() string {

+	return c.con[3]

+}

+func (c *Context) Get() string {

+	return strings.Join(c.con, ":")

+}

+func (c *Context) Set(scon string) {

+	c.con = strings.SplitN(scon, ":", 4)

+}

+func NewContext(scon string) Context {

+	var con Context

+	con.Set(scon)

+	return con

+}

+

+func SelinuxEnabled() bool {

+	b := C.is_selinux_enabled()

+	if b > 0 {

+		return true

+	}

+	return false

+}

+

+const (

+	Enforcing  = 1

+	Permissive = 0

+	Disabled   = -1

+)

+

+func SelinuxGetEnforce() int {

+	return int(C.security_getenforce())

+}

+

+func SelinuxGetEnforceMode() int {

+	var enforce C.int

+	C.selinux_getenforcemode(&enforce)

+	return int(enforce)

+}

+

+func mcsAdd(mcs string) {

+	mcsList[mcs] = true

+}

+

+func mcsDelete(mcs string) {

+	mcsList[mcs] = false

+}

+

+func mcsExists(mcs string) bool {

+	return mcsList[mcs]

+}

+

+func IntToMcs(id int, catRange uint32) string {

+	if (id < 1) || (id > 523776) {

+		return ""

+	}

+

+	SETSIZE := int(catRange)

+	TIER := SETSIZE

+

+	ORD := id

+	for ORD > TIER {

+		ORD = ORD - TIER

+		TIER -= 1

+	}

+	TIER = SETSIZE - TIER

+	ORD = ORD + TIER

+	return fmt.Sprintf("s0:c%d,c%d", TIER, ORD)

+}

+

+func uniqMcs(catRange uint32) string {

+	var n uint32

+	var c1, c2 uint32

+	var mcs string

+	for {

+		binary.Read(rand.Reader, binary.LittleEndian, &n)

+		c1 = n % catRange

+		binary.Read(rand.Reader, binary.LittleEndian, &n)

+		c2 = n % catRange

+		if c1 == c2 {

+			continue

+		} else {

+			if c1 > c2 {

+				t := c1

+				c1 = c2

+				c2 = t

+			}

+		}

+		mcs = fmt.Sprintf("s0:c%d,c%d", c1, c2)

+		if mcsExists(mcs) {

+			continue

+		}

+		mcsAdd(mcs)

+		break

+	}

+	return mcs

+}

+func freeContext(processLabel string) {

+	var scon Context

+	scon = NewContext(processLabel)

+	mcsDelete(scon.GetLevel())

+}

+

+func GetLxcContexts() (processLabel string, fileLabel string) {

+	var val, key string

+	var bufin *bufio.Reader

+	if !SelinuxEnabled() {

+		return

+	}

+	lxcPath := C.GoString(C.selinux_lxc_contexts_path())

+	fileLabel = "system_u:object_r:svirt_sandbox_file_t:s0"

+	processLabel = "system_u:system_r:svirt_lxc_net_t:s0"

+

+	in, err := os.Open(lxcPath)

+	if err != nil {

+		goto exit

+	}

+

+	defer in.Close()

+	bufin = bufio.NewReader(in)

+

+	for done := false; !done; {

+		var line string

+		if line, err = bufin.ReadString('\n'); err != nil {

+			if err == io.EOF {

+				done = true

+			} else {

+				goto exit

+			}

+		}

+		line = strings.TrimSpace(line)

+		if len(line) == 0 {

+			// Skip blank lines

+			continue

+		}

+		if line[0] == ';' || line[0] == '#' {

+			// Skip comments

+			continue

+		}

+		if groups := assignRegex.FindStringSubmatch(line); groups != nil {

+			key, val = strings.TrimSpace(groups[1]), strings.TrimSpace(groups[2])

+			if key == "process" {

+				processLabel = strings.Trim(val, "\"")

+			}

+			if key == "file" {

+				fileLabel = strings.Trim(val, "\"")

+			}

+		}

+	}

+exit:

+	var scon Context

+	mcs := IntToMcs(os.Getpid(), 1024)

+	scon = NewContext(processLabel)

+	scon.SetLevel(mcs)

+	processLabel = scon.Get()

+	scon = NewContext(fileLabel)

+	scon.SetLevel(mcs)

+	fileLabel = scon.Get()

+	return processLabel, fileLabel

+}

+

+func CopyLevel(src, dest string) (string, error) {

+	if !SelinuxEnabled() {

+		return "", nil

+	}

+	if src == "" {

+		return "", nil

+	}

+	rc, err := C.security_check_context(C.CString(src))

+	if rc != 0 {

+		return "", err

+	}

+	rc, err = C.security_check_context(C.CString(dest))

+	if rc != 0 {

+		return "", err

+	}

+	scon := NewContext(src)

+	tcon := NewContext(dest)

+	tcon.SetLevel(scon.GetLevel())

+	return tcon.Get(), nil

+}

+

+func RestoreCon(fpath string, recurse bool) error {

+	var flabel string

+	var err error

+	var fs os.FileInfo

+

+	if !SelinuxEnabled() {

+		return nil

+	}

+

+	if recurse {

+		var paths []string

+		var err error

+

+		if paths, err = filepath.Glob(path.Join(fpath, "**", "*")); err != nil {

+			return fmt.Errorf("Unable to find directory %v: %v", fpath, err)

+		}

+

+		for _, fpath := range paths {

+			if err = RestoreCon(fpath, false); err != nil {

+				return fmt.Errorf("Unable to restore selinux context for %v: %v", fpath, err)

+			}

+		}

+		return nil

+	}

+	if fs, err = os.Stat(fpath); err != nil {

+		return fmt.Errorf("Unable stat %v: %v", fpath, err)

+	}

+

+	if flabel, err = Matchpathcon(fpath, fs.Mode()); flabel == "" {

+		return fmt.Errorf("Unable to get context for %v: %v", fpath, err)

+	}

+

+	if rc, err := Setfilecon(fpath, flabel); rc != 0 {

+		return fmt.Errorf("Unable to set selinux context for %v: %v", fpath, err)

+	}

+

+	return nil

+}

+

+func Test() {

+	var plabel, flabel string

+	if !SelinuxEnabled() {

+		return

+	}

+

+	plabel, flabel = GetLxcContexts()

+	fmt.Println(plabel)

+	fmt.Println(flabel)

+	freeContext(plabel)

+	plabel, flabel = GetLxcContexts()

+	fmt.Println(plabel)

+	fmt.Println(flabel)

+	freeContext(plabel)

+	if SelinuxEnabled() {

+		fmt.Println("Enabled")

+	} else {

+		fmt.Println("Disabled")

+	}

+	fmt.Println("getenforce ", SelinuxGetEnforce())

+	fmt.Println("getenforcemode ", SelinuxGetEnforceMode())

+	flabel, _ = Matchpathcon("/home/dwalsh/.emacs", 0)

+	fmt.Println(flabel)

+	pid := os.Getpid()

+	fmt.Printf("PID:%d MCS:%s\n", pid, IntToMcs(pid, 1023))

+	fmt.Println(Getcon())

+	fmt.Println(Getfilecon("/etc/passwd"))

+	fmt.Println(Getpidcon(1))

+	Setfscreatecon("unconfined_u:unconfined_r:unconfined_t:s0")

+	fmt.Println(Getfscreatecon())

+	Setfscreatecon("")

+	fmt.Println(Getfscreatecon())

+	fmt.Println(Getpidcon(1))

+}

diff --git libselinux-2.6/golang/test.go libselinux-2.6/golang/test.go

new file mode 100644

index 0000000..fed6de8

--- /dev/null

+++ libselinux-2.6/golang/test.go

@@ -0,0 +1,9 @@

+package main

+

+import (

+	"./selinux"

+)

+

+func main() {

+	selinux.Test()

+}

diff --git libselinux-2.6/include/selinux/restorecon.h libselinux-2.6/include/selinux/restorecon.h

index 7cfdee1..de694cd 100644

--- libselinux-2.6/include/selinux/restorecon.h

+++ libselinux-2.6/include/selinux/restorecon.h

@@ -50,9 +50,9 @@ extern int selinux_restorecon(const char *pathname,

  */

 #define SELINUX_RESTORECON_VERBOSE			0x0010

 /*

- * Show progress by printing * to stdout every 1000 files, unless

- * relabeling the entire OS, that will then show the approximate

- * percentage complete.

+ * If SELINUX_RESTORECON_PROGRESS is true and

+ * SELINUX_RESTORECON_MASS_RELABEL is true, then output approx % complete,

+ * else output the number of files in 1k blocks processed to stdout.

  */

 #define SELINUX_RESTORECON_PROGRESS			0x0020

 /*

@@ -91,6 +91,11 @@ extern int selinux_restorecon(const char *pathname,

  * mounts to be excluded from relabeling checks.

  */

 #define SELINUX_RESTORECON_IGNORE_MOUNTS		0x2000

+/*

+ * Set if there is a mass relabel required.

+ * See SELINUX_RESTORECON_PROGRESS flag for details.

+ */

+#define SELINUX_RESTORECON_MASS_RELABEL			0x4000

 /**

  * selinux_restorecon_set_sehandle - Set the global fc handle.

diff --git libselinux-2.6/man/man3/selinux_restorecon.3 libselinux-2.6/man/man3/selinux_restorecon.3

index 2d8274b..3350f9c 100644

--- libselinux-2.6/man/man3/selinux_restorecon.3

+++ libselinux-2.6/man/man3/selinux_restorecon.3

@@ -88,8 +88,16 @@ will take precedence.

 .RE

 .sp

 .B SELINUX_RESTORECON_PROGRESS

-show progress by printing * to stdout every 1000 files unless relabeling the

-entire OS, that will then show the approximate percentage complete.

+show progress by outputting the number of files in 1k blocks processed

+to stdout. If the

+.B SELINUX_RESTORECON_MASS_RELABEL

+flag is also set then the approximate percentage complete will be shown.

+.sp

+.B SELINUX_RESTORECON_MASS_RELABEL

+generally set when relabeling the entire OS, that will then show the

+approximate percentage complete. The

+.B SELINUX_RESTORECON_PROGRESS

+flag must also be set.

 .sp

 .B SELINUX_RESTORECON_REALPATH

 convert passed-in

diff --git libselinux-2.6/man/man8/selinux.8 libselinux-2.6/man/man8/selinux.8

index 6f1034b..c9f188c 100644

--- libselinux-2.6/man/man8/selinux.8

+++ libselinux-2.6/man/man8/selinux.8

@@ -91,11 +91,13 @@ This manual page was written by Dan Walsh <dwalsh@redhat.com>.

 .BR sepolicy (8),

 .BR system-config-selinux (8),

 .BR togglesebool (8),

-.BR restorecon (8),

 .BR fixfiles (8),

+.BR restorecon (8),

 .BR setfiles (8),

 .BR semanage (8),

-.BR sepolicy(8)

+.BR sepolicy(8),

+.BR seinfo(8),

+.BR sesearch(8)

 Every confined service on the system has a man page in the following format:

 .br

diff --git libselinux-2.6/src/Makefile libselinux-2.6/src/Makefile

index 13501cd..e1334e9 100644

--- libselinux-2.6/src/Makefile

+++ libselinux-2.6/src/Makefile

@@ -2,7 +2,7 @@

 # runtimes (e.g. Python 2 vs Python 3) by optionally prefixing the build

 # targets with "PYPREFIX":

 PYTHON ?= python

-PYPREFIX ?= $(notdir $(PYTHON))

+PYPREFIX ?= $(shell $(PYTHON) -c 'import sys;print("python-%d.%d" % sys.version_info[:2])')

 RUBY ?= ruby

 RUBYPREFIX ?= $(notdir $(RUBY))

 PKG_CONFIG ?= pkg-config

@@ -13,15 +13,26 @@ LIBDIR ?= $(PREFIX)/lib

 SHLIBDIR ?= $(DESTDIR)/lib

 INCLUDEDIR ?= $(PREFIX)/include

 PYINC ?= $(shell $(PKG_CONFIG) --cflags $(PYPREFIX))

+PYLIBS ?= $(shell $(PKG_CONFIG) --libs $(PYPREFIX))

 PYSITEDIR ?= $(DESTDIR)$(shell $(PYTHON) -c 'import site; print(site.getsitepackages()[0])')

-RUBYLIBVER ?= $(shell $(RUBY) -e 'print RUBY_VERSION.split(".")[0..1].join(".")')

-RUBYINC ?= $(shell $(PKG_CONFIG) --exists ruby-$(RUBYLIBVER) && $(PKG_CONFIG) --cflags ruby-$(RUBYLIBVER) || $(PKG_CONFIG) --cflags ruby)

+PYCEXT ?= $(shell $(PYTHON) -c 'import imp;print([s for s,m,t in imp.get_suffixes() if t == imp.C_EXTENSION][0])')

+RUBYINC ?= $(shell $(RUBY) -e 'puts "-I" + RbConfig::CONFIG["rubyarchhdrdir"] + " -I" + RbConfig::CONFIG["rubyhdrdir"]')

+RUBYLIBS ?= $(shell $(RUBY) -e 'puts "-L" + RbConfig::CONFIG["libdir"] + " -lruby"')

 RUBYINSTALL ?= $(DESTDIR)$(shell $(RUBY) -e 'puts RbConfig::CONFIG["vendorarchdir"]')

 LIBBASE ?= $(shell basename $(LIBDIR))

+LIBSEPOLA ?= $(LIBDIR)/libsepol.a

 VERSION = $(shell cat ../VERSION)

 LIBVERSION = 1

+OS ?= $(shell uname)

+

+ifeq ($(shell $(CC) -v 2>&1 | grep "clang"),)

+COMPILER ?= gcc

+else

+COMPILER ?= clang

+endif

+

 LIBA=libselinux.a 

 TARGET=libselinux.so

 LIBPC=libselinux.pc

@@ -48,23 +59,38 @@ OBJS= $(patsubst %.c,%.o,$(SRCS))

 LOBJS= $(patsubst %.c,%.lo,$(SRCS))

 CFLAGS ?= -O -Wall -W -Wundef -Wformat-y2k -Wformat-security -Winit-self -Wmissing-include-dirs \

           -Wunused -Wunknown-pragmas -Wstrict-aliasing -Wshadow -Wpointer-arith \

-          -Wbad-function-cast -Wcast-align -Wwrite-strings -Wlogical-op -Waggregate-return \

+          -Wbad-function-cast -Wcast-align -Wwrite-strings -Waggregate-return \

           -Wstrict-prototypes -Wold-style-definition -Wmissing-prototypes \

           -Wmissing-declarations -Wmissing-noreturn -Wmissing-format-attribute \

           -Wredundant-decls -Wnested-externs -Winline -Winvalid-pch -Wvolatile-register-var \

-          -Wdisabled-optimization -Wbuiltin-macro-redefined -Wpacked-bitfield-compat \

-          -Wsync-nand -Wattributes -Wcoverage-mismatch -Wmultichar -Wcpp \

+          -Wdisabled-optimization -Wbuiltin-macro-redefined \

+          -Wattributes -Wmultichar \

           -Wdeprecated-declarations -Wdiv-by-zero -Wdouble-promotion -Wendif-labels -Wextra \

-          -Wformat-contains-nul -Wformat-extra-args -Wformat-zero-length -Wformat=2 -Wmultichar \

-          -Wnormalized=nfc -Woverflow -Wpointer-to-int-cast -Wpragmas -Wsuggest-attribute=const \

-          -Wsuggest-attribute=noreturn -Wsuggest-attribute=pure -Wtrampolines \

-          -Wno-missing-field-initializers -Wno-sign-compare -Wjump-misses-init \

-          -Wno-format-nonliteral -Wframe-larger-than=$(MAX_STACK_SIZE) -Wp,-D_FORTIFY_SOURCE=2 \

+          -Wformat-extra-args -Wformat-zero-length -Wformat=2 -Wmultichar \

+          -Woverflow -Wpointer-to-int-cast -Wpragmas \

+          -Wno-missing-field-initializers -Wno-sign-compare \

+          -Wno-format-nonliteral -Wframe-larger-than=$(MAX_STACK_SIZE) \

           -fstack-protector-all --param=ssp-buffer-size=4 -fexceptions \

           -fasynchronous-unwind-tables -fdiagnostics-show-option -funit-at-a-time \

-          -fipa-pure-const -Wno-suggest-attribute=pure -Wno-suggest-attribute=const \

           -Werror -Wno-aggregate-return -Wno-redundant-decls

+LD_SONAME_FLAGS=-soname,$(LIBSO),-z,defs,-z,relro

+

+ifeq ($(COMPILER), gcc)

+CFLAGS += -fipa-pure-const -Wlogical-op -Wpacked-bitfield-compat -Wsync-nand \

+	-Wcoverage-mismatch -Wcpp -Wformat-contains-nul -Wnormalized=nfc -Wsuggest-attribute=const \

+	-Wsuggest-attribute=noreturn -Wsuggest-attribute=pure -Wtrampolines -Wjump-misses-init \

+	-Wno-suggest-attribute=pure -Wno-suggest-attribute=const -Wp,-D_FORTIFY_SOURCE=2

+else

+CFLAGS += -Wunused-command-line-argument

+endif

+

+ifeq ($(OS), Darwin)

+override CFLAGS += -I/opt/local/include

+override LDFLAGS += -L/opt/local/lib -undefined dynamic_lookup

+LD_SONAME_FLAGS=-install_name,$(LIBSO)

+endif

+

 PCRE_LDFLAGS ?= -lpcre

 override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE $(DISABLE_FLAGS) $(PCRE_CFLAGS)

@@ -84,7 +110,7 @@ DISABLE_FLAGS+= -DNO_MEDIA_BACKEND -DNO_DB_BACKEND -DNO_X_BACKEND \

 	-DBUILD_HOST

 SRCS= callbacks.c freecon.c label.c label_file.c \

 	label_backends_android.c regex.c label_support.c \

-	matchpathcon.c setrans_client.c sha1.c

+	matchpathcon.c setrans_client.c sha1.c booleans.c

 else

 DISABLE_FLAGS+= -DNO_ANDROID_BACKEND

 SRCS:= $(filter-out label_backends_android.c, $(SRCS))

@@ -107,30 +133,30 @@ $(SWIGRUBYLOBJ): $(SWIGRUBYCOUT)

 	$(CC) $(CFLAGS) $(SWIG_CFLAGS) $(RUBYINC) -fPIC -DSHARED -c -o $@ $<

 $(SWIGSO): $(SWIGLOBJ)

-	$(CC) $(CFLAGS) -shared -o $@ $< -L. -lselinux $(LDFLAGS) -L$(LIBDIR)

+	$(CC) $(CFLAGS) -shared -o $@ $< -L. -lselinux $(LDFLAGS) $(PYLIBS) -L$(LIBDIR)

 $(SWIGRUBYSO): $(SWIGRUBYLOBJ)

-	$(CC) $(CFLAGS) -shared -o $@ $^ -L. -lselinux $(LDFLAGS) -L$(LIBDIR)

+	$(CC) $(CFLAGS) -shared -o $@ $^ -L. -lselinux $(LDFLAGS) $(RUBYLIBS) -L$(LIBDIR)

 $(LIBA): $(OBJS)

 	$(AR) rcs $@ $^

 	$(RANLIB) $@

 $(LIBSO): $(LOBJS)

-	$(CC) $(CFLAGS) -shared -o $@ $^ $(PCRE_LDFLAGS) -ldl $(LDFLAGS) -L$(LIBDIR) -Wl,-soname,$(LIBSO),-z,defs,-z,relro

+	$(CC) $(CFLAGS) -shared -o $@ $^ $(PCRE_LDFLAGS) -ldl $(LDFLAGS) -L$(LIBDIR) -Wl,$(LD_SONAME_FLAGS)

 	ln -sf $@ $(TARGET) 

 $(LIBPC): $(LIBPC).in ../VERSION

 	sed -e 's/@VERSION@/$(VERSION)/; s:@prefix@:$(PREFIX):; s:@libdir@:$(LIBBASE):; s:@includedir@:$(INCLUDEDIR):' < $< > $@

 selinuxswig_python_exception.i: ../include/selinux/selinux.h

-	bash exception.sh > $@ 

+	bash -e exception.sh > $@ || (rm -f $@ ; false)

 $(AUDIT2WHYLOBJ): audit2why.c

 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<

 $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ)

-	$(CC) $(CFLAGS) -shared -o $@ $^ -L. $(LDFLAGS) -lselinux $(LIBDIR)/libsepol.a -L$(LIBDIR)

+	$(CC) $(CFLAGS) -shared -o $@ $^ -L. $(LDFLAGS) -lselinux $(LIBSEPOLA) $(PYLIBS) -L$(LIBDIR)

 %.o:  %.c policy.h

 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<

@@ -160,8 +186,8 @@ install: all

 install-pywrap: pywrap

 	test -d $(PYSITEDIR)/selinux || install -m 755 -d $(PYSITEDIR)/selinux

-	install -m 755 $(SWIGSO) $(PYSITEDIR)/_selinux.so

-	install -m 755 $(AUDIT2WHYSO) $(PYSITEDIR)/selinux/audit2why.so

+	install -m 755 $(SWIGSO) $(PYSITEDIR)/_selinux$(PYCEXT)

+	install -m 755 $(AUDIT2WHYSO) $(PYSITEDIR)/selinux/audit2why$(PYCEXT)

 	install -m 644 $(SWIGPYOUT) $(PYSITEDIR)/selinux/__init__.py

 install-rubywrap: rubywrap