diff --git a/.cvsignore b/.cvsignore
index 418767c..13efe64 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -66,3 +66,4 @@ libselinux-1.27.22.tgz
 libselinux-1.27.23.tgz
 libselinux-1.27.25.tgz
 libselinux-1.27.26.tgz
+libselinux-1.27.28.tgz
diff --git a/libselinux.spec b/libselinux.spec
index 7643708..e70f079 100644
--- a/libselinux.spec
+++ b/libselinux.spec
@@ -1,7 +1,7 @@
 %define libsepolver 1.9.41-1
 Summary: SELinux library and simple utilities
 Name: libselinux
-Version: 1.27.26
+Version: 1.27.28
 Release: 1
 License: Public domain (uncopyrighted)
 Group: System Environment/Libraries
@@ -104,6 +104,19 @@ exit 0
 %{_libdir}/python2.4/site-packages/selinux.py*
 
 %changelog
+* Thu Dec 1 2005 Dan Walsh <dwalsh@redhat.com> 1.27.28-1
+- Update to latest from NSA
+	* Added MATCHPATHCON_VALIDATE flag for set_matchpathcon_flags() and
+	  modified matchpathcon implementation to make context validation/
+	  canonicalization optional at matchpathcon_init time, deferring it
+	  to a successful matchpathcon by default unless the new flag is set
+	  by the caller.
+	* Added matchpathcon_init_prefix() interface, and
+	  reworked matchpathcon implementation to support selective
+	  loading of file contexts entries based on prefix matching
+	  between the pathname regex stems and the specified path
+	  prefix (stem must be a prefix of the specified path prefix).
+
 * Wed Nov 30 2005 Dan Walsh <dwalsh@redhat.com> 1.27.26-1
 - Update to latest from NSA
 	* Change getsebool to return on/off instead of active/inactive
diff --git a/sources b/sources
index c97d05d..962e360 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-a8e7fc154bca655757a7e8970085d50d  libselinux-1.27.26.tgz
+7852c01a73a5532cd09b918114873755  libselinux-1.27.28.tgz