diff --git a/389-ds-base.spec b/389-ds-base.spec
index 7722c54..ab229b5 100644
--- a/389-ds-base.spec
+++ b/389-ds-base.spec
@@ -1,7 +1,7 @@
 
 %global pkgname   dirsrv
 # for a pre-release, define the prerel field e.g. .a1 .rc2 - comment out for official release
-%global prerel .a2
+%global prerel .a3
 # also need the relprefix field for a pre-release e.g. .0 - also comment out for official release
 %global relprefix 0.
 
@@ -10,13 +10,14 @@
 Summary:          389 Directory Server (base)
 Name:             389-ds-base
 Version:          1.2.6
-Release:          %{?relprefix}2%{?prerel}%{?dist}
+Release:          %{?relprefix}3%{?prerel}%{?dist}
 License:          GPLv2 with exceptions
 URL:              http://port389.org/
 Group:            System Environment/Daemons
 BuildRoot:        %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Provides:         fedora-ds-base = %{version}-%{release}
 Obsoletes:        fedora-ds-base < 1.2.1-1
+Obsoletes:        %{name}-selinux
 
 BuildRequires:    nspr-devel
 BuildRequires:    nss-devel
@@ -43,6 +44,15 @@ BuildRequires:    /usr/share/selinux/devel/Makefile
 # the following is for the pam passthru auth plug-in
 BuildRequires:    pam-devel
 
+# this is needed for using semanage from our setup scripts
+Requires:         policycoreutils
+
+# these are needed for selinux
+Requires:         selinux-policy >= 2.4.6-203
+Requires(post):   policycoreutils
+Requires(preun):  policycoreutils
+Requires(postun): policycoreutils
+
 # the following are needed for some of our scripts
 Requires:         mozldap-tools
 Requires:         perl-Mozilla-LDAP
@@ -90,15 +100,6 @@ Obsoletes:        fedora-ds-base-devel < 1.2.1-1
 %description      devel
 Development Libraries and headers for the 389 Directory Server base package.
 
-%package          selinux
-Summary:          SELinux policy for 389 Directory Server
-Group:            System Environment/Daemons
-Requires:         selinux-policy >= 2.4.6-203
-Requires:         %{name} = %{version}-%{release}
-
-%description      selinux
-SELinux policy for the 389 Directory Server base package.
-
 %package          selinux-devel
 Summary:          Development interface for 389 Directory Server base SELinux policy
 Group:            Development/Libraries
@@ -222,17 +223,35 @@ else
 --    print("in %{pkgname} post - installing")
     %{pkgname}_upgrading = false
 end
+-- load the selinux policy module
+variants = "%{selinux_variants}"
+for selinuxvariant in string.gfind(variants, "%a+") do
+  os.execute('semodule -s '..selinuxvariant..' -i %{_datadir}/selinux/'..selinuxvariant..'/%{pkgname}.pp > /dev/null 2>&1')
+end
+-- label the files installed by this package
+os.execute('fixfiles -R %{name} restore > /dev/null 2>&1')
 
 
 %preun
-if [ $1 = 0 ]; then
+if [ $1 = 0 ]; then # Final removal
         /sbin/service %{pkgname} stop >/dev/null 2>&1 || :
         /sbin/chkconfig --del %{pkgname}
         /sbin/service %{pkgname}-snmp stop >/dev/null 2>&1 || :
         /sbin/chkconfig --del %{pkgname}-snmp
+        for selinuxvariant in %{selinux_variants}
+        do
+          semodule -s ${selinuxvariant} -r %{pkgname} 2>/dev/null || :
+        done
 fi
 
-%postun -p /sbin/ldconfig
+%postun
+/sbin/ldconfig
+if [ "$1" -ge "1" ]; then # Upgrade
+for selinuxvariant in %{selinux_variants}
+do
+  semodule -s ${selinuxvariant} -i %{_datadir}/selinux/${selinuxvariant}/%{pkgname}.pp 2>/dev/null || :
+done
+fi
 
 %posttrans -p <lua>
 -- if we saved the run level configuration in %pre, restore it now
@@ -274,6 +293,8 @@ if %{pkgname}_upgrading then
 --        print("restarting instance "..inst)
         os.execute('/sbin/service %{pkgname} start '..inst..' >/dev/null 2>&1')
     end
+-- restart the snmp subagent if needed
+    os.execute('/sbin/service %{pkgname}-snmp condrestart > /dev/null 2>&1')
 end
 -- if we upgraded from fedora to 389, the upgrade will shutdown
 -- all old running instances, so we have to start them here
@@ -282,36 +303,6 @@ if %{pkgname}_exists then
     os.execute('/sbin/service %{pkgname} start >/dev/null 2>&1')
 end
    
-%post selinux
-if [ "$1" -le "1" ] ; then # First install
-for selinuxvariant in %{selinux_variants}
-do
-  semodule -s ${selinuxvariant} -i %{_datadir}/selinux/${selinuxvariant}/%{pkgname}.pp 2>/dev/null || :
-done
-fixfiles -R %{name} restore || :
-/sbin/service %{pkgname} condrestart > /dev/null 2>&1 || :
-/sbin/service %{pkgname}-snmp condrestart > /dev/null 2>&1 || :
-fi
-
-%preun selinux
-if [ "$1" -lt "1" ]; then # Final removal
-for selinuxvariant in %{selinux_variants}
-do
-  semodule -s ${selinuxvariant} -r %{pkgname} 2>/dev/null || :
-done
-fixfiles -R %{name} restore || :
-/sbin/service %{pkgname} condrestart > /dev/null 2>&1 || :
-/sbin/service %{pkgname}-snmp condrestart > /dev/null 2>&1 || :
-fi
-
-%postun selinux
-if [ "$1" -ge "1" ]; then # Upgrade
-for selinuxvariant in %{selinux_variants}
-do
-  semodule -s ${selinuxvariant} -i %{_datadir}/selinux/${selinuxvariant}/%{pkgname}.pp 2>/dev/null || :
-done
-fi
-
 
 %files
 %defattr(-,root,root,-)
@@ -326,6 +317,7 @@ fi
 %config(noreplace)%{_sysconfdir}/%{pkgname}/config/template-initconfig
 %config(noreplace)%{_sysconfdir}/sysconfig/%{pkgname}
 %{_datadir}/%{pkgname}
+%{_datadir}/selinux/*/%{pkgname}.pp
 %{_sysconfdir}/rc.d/init.d/%{pkgname}
 %{_sysconfdir}/rc.d/init.d/%{pkgname}-snmp
 %{_bindir}/*
@@ -347,15 +339,17 @@ fi
 %{_includedir}/%{pkgname}
 %{_libdir}/%{pkgname}/*.so
 
-%files selinux
-%defattr(-,root,root,-)
-%{_datadir}/selinux/*/%{pkgname}.pp
-
 %files selinux-devel
 %defattr(-,root,root,-)
 %{_datadir}/%{pkgname}-selinux
 
 %changelog
+* Tue Apr  7 2010 Nathan Kinder <nkinder@redhat.com> - 1.2.6-0.3.a3
+- 1.2.6.a3 release
+- add managed entries plug-in
+- many bug fixes
+- moved selinux subpackage into base package
+
 * Mon Mar  2 2010 Rich Megginson <rmeggins@redhat.com> - 1.2.6-0.2.a2
 - 1.2.6.a2 release
 - add support for matching rules