diff --git libsemanage-2.5/ChangeLog libsemanage-2.5/ChangeLog

index 9b4d5b7..469c4b0 100644

--- libsemanage-2.5/ChangeLog

+++ libsemanage-2.5/ChangeLog

@@ -1,3 +1,20 @@

+	* Fixes bug preventing the installation of base modules, from James Carter.

+2.6-rc1 2016-09-30

+	* make distclean target work, from Nicolas Iooss.

+	* Do not always print a module name warning, from Miroslav Grepl.

+	* Use pp module name instead of filename when installing module, from Petr Lautrbach.

+	* tests: Do not force using gcc, from Nicolas Iooss.

+	* genhomedircon: remove hardcoded refpolicy strings, from Gary Tierney.

+	* genhomedircon: add support for %group syntax, from Gary Tierney.

+	* genhomedircon: generate contexts for logins mapped to the default user, from Gary Tierney.

+	* Validate and compile file contexts before installing, from Stephen Smalley.

+	* Swap tcp and udp protocol numbers, from Miroslav Vadkerti.

+	* Sort object files for deterministic linking order, from Laurent Bigonville.

+	* Support overriding Makefile RANLIB, from Julien Pivotto.

+	* Respect CC and PKG_CONFIG environment variable, from Julien Pivotto.

+	* Fix multiple spelling errors, from Laurent Bigonville.

+	* genhomedircon: %{USERID} and %{USERNAME} support and code cleanups, from Jason Zaman.

+

 2.5 2016-02-23

 	* Do not overwrite CFLAGS in test Makefile, from Nicolas Iooss.

 	* Fix uninitialized variable in direct_commit and direct_api, from Nicolas Iooss.

diff --git libsemanage-2.5/include/semanage/handle.h libsemanage-2.5/include/semanage/handle.h

index 6cad529..c816590 100644

--- libsemanage-2.5/include/semanage/handle.h

+++ libsemanage-2.5/include/semanage/handle.h

@@ -130,7 +130,7 @@ int semanage_commit(semanage_handle_t *);

 #define SEMANAGE_CAN_READ 1

 #define SEMANAGE_CAN_WRITE 2

 /* returns SEMANAGE_CAN_READ or SEMANAGE_CAN_WRITE if the store is readable

- * or writable, respectively. <0 if an error occured */

+ * or writable, respectively. <0 if an error occurred */

 int semanage_access_check(semanage_handle_t * sh);

 /* returns 0 if not connected, 1 if connected */

diff --git libsemanage-2.5/src/Makefile libsemanage-2.5/src/Makefile

index d1fcc0b..68aab72 100644

--- libsemanage-2.5/src/Makefile

+++ libsemanage-2.5/src/Makefile

@@ -5,6 +5,7 @@ PYTHON ?= python

 PYPREFIX ?= $(notdir $(PYTHON))

 RUBY ?= ruby

 RUBYPREFIX ?= $(notdir $(RUBY))

+PKG_CONFIG ?= pkg-config

 # Installation directories.

 PREFIX ?= $(DESTDIR)/usr

@@ -12,11 +13,11 @@ LIBDIR ?= $(PREFIX)/lib

 SHLIBDIR ?= $(DESTDIR)/lib

 INCLUDEDIR ?= $(PREFIX)/include

 PYLIBVER ?= $(shell $(PYTHON) -c 'import sys;print("python%d.%d" % sys.version_info[0:2])')

-PYINC ?= $(shell pkg-config --cflags $(PYPREFIX))

+PYINC ?= $(shell $(PKG_CONFIG) --cflags $(PYPREFIX))

 PYLIBDIR ?= $(LIBDIR)/$(PYLIBVER)

 RUBYLIBVER ?= $(shell $(RUBY) -e 'print RUBY_VERSION.split(".")[0..1].join(".")')

 RUBYPLATFORM ?= $(shell $(RUBY) -e 'print RUBY_PLATFORM')

-RUBYINC ?= $(shell pkg-config --cflags ruby-$(RUBYLIBVER))

+RUBYINC ?= $(shell $(PKG_CONFIG) --cflags ruby-$(RUBYLIBVER))

 RUBYINSTALL ?= $(LIBDIR)/ruby/site_ruby/$(RUBYLIBVER)/$(RUBYPLATFORM)

 LIBBASE=$(shell basename $(LIBDIR))

@@ -50,8 +51,8 @@ SWIGFILES=$(SWIGSO) semanage.py

 SWIGRUBYSO=$(RUBYPREFIX)_semanage.so

 LIBSO=$(TARGET).$(LIBVERSION)

-GENERATED=$(SWIGCOUT) $(SWIGRUBYCOUT) semanageswig_python_exception.i

-SRCS= $(filter-out $(GENERATED),$(wildcard *.c))

+GENERATED=$(SWIGCOUT) $(SWIGRUBYCOUT) semanageswig_python_exception.i $(wildcard conf-*.[ch])

+SRCS= $(filter-out $(GENERATED),$(sort $(wildcard *.c)))

 OBJS= $(patsubst %.c,%.o,$(SRCS)) conf-scan.o conf-parse.o

 LOBJS= $(patsubst %.c,%.lo,$(SRCS)) conf-scan.lo conf-parse.lo

@@ -61,14 +62,12 @@ SWIG_CFLAGS += -Wno-error -Wno-unused-but-set-variable -Wno-unused-variable -Wno

 		-Wno-unused-parameter

 override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE 

-RANLIB=ranlib

+RANLIB ?= ranlib

 SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./

 SWIGRUBY = swig -Wall -ruby -o $(SWIGRUBYCOUT) -outdir ./

-GENERATED=$(SWIGCOUT) $(SWIGRUBYCOUT) $(wildcard conf-*.[ch])

-

 all: $(LIBA) $(LIBSO) $(LIBPC)

 pywrap: all $(SWIGSO)

@@ -162,7 +161,7 @@ clean:

 	-rm -f $(LIBPC) $(OBJS) $(LOBJS) $(LIBA) $(LIBSO) $(SWIGLOBJ) $(SWIGSO) $(TARGET) conf-parse.c conf-parse.h conf-scan.c *.o *.lo *~

 distclean: clean

-	rm -f $(SWIGCOUT) $(SWIGFILES)

+	rm -f $(GENERATED) $(SWIGFILES)

 indent:

 	../../scripts/Lindent $(filter-out $(GENERATED),$(wildcard *.[ch]))

diff --git libsemanage-2.5/src/database.h libsemanage-2.5/src/database.h

index e460379..6a4a164 100644

--- libsemanage-2.5/src/database.h

+++ libsemanage-2.5/src/database.h

@@ -148,7 +148,7 @@ typedef struct dbase_table {

 	 * This function must be invoked before using

 	 * any of the database functions above. It may be invoked

 	 * multiple times, and will update the cache if a commit

-	 * occured between invocations */

+	 * occurred between invocations */

 	int (*cache) (struct semanage_handle * handle, dbase_t * dbase);

 	/* Forgets all changes that haven't been written

diff --git libsemanage-2.5/src/direct_api.c libsemanage-2.5/src/direct_api.c

index 2187b65..8bfbe5c 100644

--- libsemanage-2.5/src/direct_api.c

+++ libsemanage-2.5/src/direct_api.c

@@ -363,6 +363,35 @@ static int semanage_direct_begintrans(semanage_handle_t * sh)

 /********************* utility functions *********************/

+/* Takes a module stored in 'module_data' and parses its headers.

+ * Sets reference variables 'module_name' to module's name, and

+ * 'version' to module's version.  The caller is responsible for

+ * free()ing 'module_name', and 'version'; they will be

+ * set to NULL upon entering this function.  Returns 0 on success, -1

+ * if out of memory.

+ */

+static int parse_module_headers(semanage_handle_t * sh, char *module_data,

+                               size_t data_len, char **module_name,

+                               char **version)

+{

+       struct sepol_policy_file *pf;

+       int file_type;

+       *module_name = *version = NULL;

+

+       if (sepol_policy_file_create(&pf)) {

+               ERR(sh, "Out of memory!");

+               return -1;

+       }

+       sepol_policy_file_set_mem(pf, module_data, data_len);

+       sepol_policy_file_set_handle(pf, sh->sepolh);

+       if (module_data != NULL && data_len > 0)

+           sepol_module_package_info(pf, &file_type, module_name,

+                                     version);

+       sepol_policy_file_free(pf);

+

+       return 0;

+}

+

 #include <stdlib.h>

 #include <bzlib.h>

 #include <string.h>

@@ -588,13 +617,33 @@ static int semanage_direct_update_user_extra(semanage_handle_t * sh, cil_db_t *c

 	}

 	if (size > 0) {

+		/*

+		 * Write the users_extra entries from CIL modules.

+		 * This file is used as our baseline when we do not require

+		 * re-linking.

+		 */

+		ofilename = semanage_path(SEMANAGE_TMP,

+					  SEMANAGE_USERS_EXTRA_LINKED);

+		if (ofilename == NULL) {

+			retval = -1;

+			goto cleanup;

+		}

+		retval = write_file(sh, ofilename, data, size);

+		if (retval < 0)

+			goto cleanup;

+

+		/*

+		 * Write the users_extra file; users_extra.local

+		 * will be merged into this file.

+		 */

 		ofilename = semanage_path(SEMANAGE_TMP, SEMANAGE_USERS_EXTRA);

 		if (ofilename == NULL) {

-			return retval;

+			retval = -1;

+			goto cleanup;

 		}

 		retval = write_file(sh, ofilename, data, size);

 		if (retval < 0)

-			return retval;

+			goto cleanup;

 		pusers_extra->dtable->drop_cache(pusers_extra->dbase);

@@ -623,11 +672,33 @@ static int semanage_direct_update_seuser(semanage_handle_t * sh, cil_db_t *cildb

 	}

 	if (size > 0) {

+		/*

+		 * Write the seusers entries from CIL modules.

+		 * This file is used as our baseline when we do not require

+		 * re-linking.

+		 */

+		ofilename = semanage_path(SEMANAGE_TMP,

+					  SEMANAGE_SEUSERS_LINKED);

+		if (ofilename == NULL) {

+			retval = -1;

+			goto cleanup;

+		}

+		retval = write_file(sh, ofilename, data, size);

+		if (retval < 0)

+			goto cleanup;

+

+		/*

+		 * Write the seusers file; seusers.local will be merged into

+		 * this file.

+		 */

 		ofilename = semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_SEUSERS);

 		if (ofilename == NULL) {

-			return -1;

+			retval = -1;

+			goto cleanup;

 		}

 		retval = write_file(sh, ofilename, data, size);

+		if (retval < 0)

+			goto cleanup;

 		pseusers->dtable->drop_cache(pseusers->dbase);

 	} else {

@@ -1066,21 +1137,18 @@ static int semanage_direct_commit(semanage_handle_t * sh)

 	size_t fc_buffer_len = 0;

 	const char *ofilename = NULL;

 	const char *path;

-	int retval = -1, num_modinfos = 0, i, missing_policy_kern = 0,

-		missing_seusers = 0, missing_fc = 0, missing = 0;

+	int retval = -1, num_modinfos = 0, i;

 	sepol_policydb_t *out = NULL;

 	struct cil_db *cildb = NULL;

 	semanage_module_info_t *modinfos = NULL;

-	/* Declare some variables */

-	int modified = 0, fcontexts_modified, ports_modified,

-	    seusers_modified, users_extra_modified, dontaudit_modified,

-	    preserve_tunables_modified, bools_modified = 0,

+	int do_rebuild, do_write_kernel, do_install;

+	int fcontexts_modified, ports_modified, seusers_modified,

 		disable_dontaudit, preserve_tunables;

 	dbase_config_t *users = semanage_user_dbase_local(sh);

 	dbase_config_t *users_base = semanage_user_base_dbase_local(sh);

 	dbase_config_t *pusers_base = semanage_user_base_dbase_policy(sh);

-	dbase_config_t *users_extra = semanage_user_extra_dbase_local(sh);

+	dbase_config_t *pusers_extra = semanage_user_extra_dbase_policy(sh);

 	dbase_config_t *ports = semanage_port_dbase_local(sh);

 	dbase_config_t *pports = semanage_port_dbase_policy(sh);

 	dbase_config_t *bools = semanage_bool_dbase_local(sh);

@@ -1092,13 +1160,22 @@ static int semanage_direct_commit(semanage_handle_t * sh)

 	dbase_config_t *fcontexts = semanage_fcontext_dbase_local(sh);

 	dbase_config_t *pfcontexts = semanage_fcontext_dbase_policy(sh);

 	dbase_config_t *seusers = semanage_seuser_dbase_local(sh);

+	dbase_config_t *pseusers = semanage_seuser_dbase_policy(sh);

+

+	/* Modified flags that we need to use more than once. */

+	ports_modified = ports->dtable->is_modified(ports->dbase);

+	seusers_modified = seusers->dtable->is_modified(seusers->dbase);

+	fcontexts_modified = fcontexts->dtable->is_modified(fcontexts->dbase);

+

+	/* Rebuild if explicitly requested or any module changes occurred. */

+	do_rebuild = sh->do_rebuild | sh->modules_modified;

 	/* Create or remove the disable_dontaudit flag file. */

 	path = semanage_path(SEMANAGE_TMP, SEMANAGE_DISABLE_DONTAUDIT);

 	if (access(path, F_OK) == 0)

-		dontaudit_modified = !(sepol_get_disable_dontaudit(sh->sepolh) == 1);

+		do_rebuild |= !(sepol_get_disable_dontaudit(sh->sepolh) == 1);

 	else

-		dontaudit_modified = (sepol_get_disable_dontaudit(sh->sepolh) == 1);

+		do_rebuild |= (sepol_get_disable_dontaudit(sh->sepolh) == 1);

 	if (sepol_get_disable_dontaudit(sh->sepolh) == 1) {

 		FILE *touch;

 		touch = fopen(path, "w");

@@ -1121,9 +1198,9 @@ static int semanage_direct_commit(semanage_handle_t * sh)

 	/* Create or remove the preserve_tunables flag file. */

 	path = semanage_path(SEMANAGE_TMP, SEMANAGE_PRESERVE_TUNABLES);

 	if (access(path, F_OK) == 0)

-		preserve_tunables_modified = !(sepol_get_preserve_tunables(sh->sepolh) == 1);

+		do_rebuild |= !(sepol_get_preserve_tunables(sh->sepolh) == 1);

 	else

-		preserve_tunables_modified = (sepol_get_preserve_tunables(sh->sepolh) == 1);

+		do_rebuild |= (sepol_get_preserve_tunables(sh->sepolh) == 1);

 	if (sepol_get_preserve_tunables(sh->sepolh) == 1) {

 		FILE *touch;

 		touch = fopen(path, "w");

@@ -1151,54 +1228,75 @@ static int semanage_direct_commit(semanage_handle_t * sh)

 			goto cleanup;

 	}

-	/* Decide if anything was modified */

-	fcontexts_modified = fcontexts->dtable->is_modified(fcontexts->dbase);

-	seusers_modified = seusers->dtable->is_modified(seusers->dbase);

-	users_extra_modified =

-	    users_extra->dtable->is_modified(users_extra->dbase);

-	ports_modified = ports->dtable->is_modified(ports->dbase);

-	bools_modified = bools->dtable->is_modified(bools->dbase);

-

-	modified = sh->modules_modified;

-	modified |= seusers_modified;

-	modified |= users_extra_modified;

-	modified |= ports_modified;

-	modified |= users->dtable->is_modified(users_base->dbase);

-	modified |= ifaces->dtable->is_modified(ifaces->dbase);

-	modified |= nodes->dtable->is_modified(nodes->dbase);

-	modified |= dontaudit_modified;

-	modified |= preserve_tunables_modified;

-

-	/* This is for systems that have already migrated with an older version

-	 * of semanage_migrate_store. The older version did not copy policy.kern so

-	 * the policy binary must be rebuilt here.

+	/*

+	 * This is for systems that have already migrated with an older version

+	 * of semanage_migrate_store. The older version did not copy

+	 * policy.kern so the policy binary must be rebuilt here.

+	 * This also ensures that any linked files that are required

+	 * in order to skip re-linking are present; otherwise, we force

+	 * a rebuild.

 	 */

-	if (!sh->do_rebuild && !modified) {

+	if (!do_rebuild) {

 		path = semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_KERNEL);

-

 		if (access(path, F_OK) != 0) {

-			missing_policy_kern = 1;

+			do_rebuild = 1;

+			goto rebuild;

 		}

 		path = semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_FC);

-

 		if (access(path, F_OK) != 0) {

-			missing_fc = 1;

+			do_rebuild = 1;

+			goto rebuild;

 		}

 		path = semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_SEUSERS);

+		if (access(path, F_OK) != 0) {

+			do_rebuild = 1;

+			goto rebuild;

+		}

+		path = semanage_path(SEMANAGE_TMP, SEMANAGE_LINKED);

 		if (access(path, F_OK) != 0) {

-			missing_seusers = 1;

+			do_rebuild = 1;

+			goto rebuild;

 		}

-	}

-	missing |= missing_policy_kern;

-	missing |= missing_fc;

-	missing |= missing_seusers;

+		path = semanage_path(SEMANAGE_TMP, SEMANAGE_SEUSERS_LINKED);

+		if (access(path, F_OK) != 0) {

+			do_rebuild = 1;

+			goto rebuild;

+		}

-	/* If there were policy changes, or explicitly requested, rebuild the policy */

-	if (sh->do_rebuild || modified || missing) {

+		path = semanage_path(SEMANAGE_TMP, SEMANAGE_USERS_EXTRA_LINKED);

+		if (access(path, F_OK) != 0) {

+			do_rebuild = 1;

+			goto rebuild;

+		}

+	}

+

+rebuild:

+	/*

+	 * Now that we know whether or not a rebuild is required,

+	 * we can determine what else needs to be done.

+	 * We need to write the kernel policy if we are rebuilding

+	 * or if any other policy component that lives in the kernel

+	 * policy has been modified.

+	 * We need to install the policy files if any of the managed files

+	 * that live under /etc/selinux (kernel policy, seusers, file contexts)

+	 * will be modified.

+	 */

+	do_write_kernel = do_rebuild | ports_modified |

+		bools->dtable->is_modified(bools->dbase) |

+		ifaces->dtable->is_modified(ifaces->dbase) |

+		nodes->dtable->is_modified(nodes->dbase) |

+		users->dtable->is_modified(users_base->dbase);

+	do_install = do_write_kernel | seusers_modified | fcontexts_modified;

+

+	/*

+	 * If there were policy changes, or explicitly requested, or

+	 * any required files are missing, rebuild the policy.

+	 */

+	if (do_rebuild) {

 		/* =================== Module expansion =============== */

 		retval = semanage_get_active_modules(sh, &modinfos, &num_modinfos);

@@ -1287,43 +1385,72 @@ static int semanage_direct_commit(semanage_handle_t * sh)

 			goto cleanup;

 		cil_db_destroy(&cildb);

-	

+

+		/* Write the linked policy before merging local changes. */

+		retval = semanage_write_policydb(sh, out,

+						 SEMANAGE_LINKED);

+		if (retval < 0)

+			goto cleanup;

 	} else {

-		/* Load already linked policy */

+		/* Load the existing linked policy, w/o local changes */

 		retval = sepol_policydb_create(&out;;

 		if (retval < 0)

 			goto cleanup;

-		retval = semanage_read_policydb(sh, out);

+		retval = semanage_read_policydb(sh, out, SEMANAGE_LINKED);

 		if (retval < 0)

 			goto cleanup;

-	}

-	if (sh->do_rebuild || modified || bools_modified) {

-		/* Attach to policy databases that work with a policydb. */

-		dbase_policydb_attach((dbase_policydb_t *) pusers_base->dbase, out);

-		dbase_policydb_attach((dbase_policydb_t *) pports->dbase, out);

-		dbase_policydb_attach((dbase_policydb_t *) pifaces->dbase, out);

-		dbase_policydb_attach((dbase_policydb_t *) pbools->dbase, out);

-		dbase_policydb_attach((dbase_policydb_t *) pnodes->dbase, out);

+		path = semanage_path(SEMANAGE_TMP, SEMANAGE_SEUSERS_LINKED);

+		if (access(path, F_OK) == 0) {

+			retval = semanage_copy_file(path,

+						    semanage_path(SEMANAGE_TMP,

+								  SEMANAGE_STORE_SEUSERS),

+						    sh->conf->file_mode);

+			if (retval < 0)

+				goto cleanup;

+			pseusers->dtable->drop_cache(pseusers->dbase);

+		} else {

+			pseusers->dtable->clear(sh, pseusers->dbase);

+		}

-		/* ============= Apply changes, and verify  =============== */

+		path = semanage_path(SEMANAGE_TMP, SEMANAGE_USERS_EXTRA_LINKED);

+		if (access(path, F_OK) == 0) {

+			retval = semanage_copy_file(path,

+						    semanage_path(SEMANAGE_TMP,

+								  SEMANAGE_USERS_EXTRA),

+						    sh->conf->file_mode);

+			if (retval < 0)

+				goto cleanup;

+			pusers_extra->dtable->drop_cache(pusers_extra->dbase);

+		} else {

+			pusers_extra->dtable->clear(sh, pusers_extra->dbase);

+		}

+	}

-		retval = semanage_base_merge_components(sh);

-		if (retval < 0)

-			goto cleanup;

+	/* Attach our databases to the policydb we just created or loaded. */

+	dbase_policydb_attach((dbase_policydb_t *) pusers_base->dbase, out);

+	dbase_policydb_attach((dbase_policydb_t *) pports->dbase, out);

+	dbase_policydb_attach((dbase_policydb_t *) pifaces->dbase, out);

+	dbase_policydb_attach((dbase_policydb_t *) pbools->dbase, out);

+	dbase_policydb_attach((dbase_policydb_t *) pnodes->dbase, out);

+

+	/* Merge local changes */

+	retval = semanage_base_merge_components(sh);

+	if (retval < 0)

+		goto cleanup;

-		retval = semanage_write_policydb(sh, out);

+	if (do_write_kernel) {

+		/* Write new kernel policy. */

+		retval = semanage_write_policydb(sh, out,

+						 SEMANAGE_STORE_KERNEL);

 		if (retval < 0)

 			goto cleanup;

+		/* Run the kernel policy verifier, if any. */

 		retval = semanage_verify_kernel(sh);

 		if (retval < 0)

 			goto cleanup;

-	} else {

-		retval = semanage_base_merge_components(sh);

-		if (retval < 0)

-			goto cleanup;

 	}

 	/* ======= Post-process: Validate non-policydb components ===== */

@@ -1332,21 +1459,21 @@ static int semanage_direct_commit(semanage_handle_t * sh)

 	 * Note: those are still cached, even though they've been 

 	 * merged into the main file_contexts. We won't check the 

 	 * large file_contexts - checked at compile time */

-	if (sh->do_rebuild || modified || fcontexts_modified) {

+	if (do_rebuild || fcontexts_modified) {

 		retval = semanage_fcontext_validate_local(sh, out);

 		if (retval < 0)

 			goto cleanup;

 	}

 	/* Validate local seusers against policy */

-	if (sh->do_rebuild || modified || seusers_modified) {

+	if (do_rebuild || seusers_modified) {

 		retval = semanage_seuser_validate_local(sh, out);

 		if (retval < 0)

 			goto cleanup;

 	}

 	/* Validate local ports for overlap */

-	if (sh->do_rebuild || modified || ports_modified) {

+	if (do_rebuild || ports_modified) {

 		retval = semanage_port_validate_local(sh);

 		if (retval < 0)

 			goto cleanup;

@@ -1415,9 +1542,8 @@ static int semanage_direct_commit(semanage_handle_t * sh)

 	sepol_policydb_free(out);

 	out = NULL;

-	if (sh->do_rebuild || modified || bools_modified || fcontexts_modified) {

+	if (do_install)

 		retval = semanage_install_sandbox(sh);

-	}

 cleanup:

 	for (i = 0; i < num_modinfos; i++) {

@@ -1429,14 +1555,12 @@ cleanup:

 		free(mod_filenames[i]);

 	}

-	if (modified || bools_modified) {

-		/* Detach from policydb, so it can be freed */

-		dbase_policydb_detach((dbase_policydb_t *) pusers_base->dbase);

-		dbase_policydb_detach((dbase_policydb_t *) pports->dbase);

-		dbase_policydb_detach((dbase_policydb_t *) pifaces->dbase);

-		dbase_policydb_detach((dbase_policydb_t *) pnodes->dbase);

-		dbase_policydb_detach((dbase_policydb_t *) pbools->dbase);

-	}

+	/* Detach from policydb, so it can be freed */

+	dbase_policydb_detach((dbase_policydb_t *) pusers_base->dbase);

+	dbase_policydb_detach((dbase_policydb_t *) pports->dbase);

+	dbase_policydb_detach((dbase_policydb_t *) pifaces->dbase);

+	dbase_policydb_detach((dbase_policydb_t *) pnodes->dbase);

+	dbase_policydb_detach((dbase_policydb_t *) pbools->dbase);

 	free(mod_filenames);

 	sepol_policydb_free(out);

@@ -1524,7 +1648,9 @@ static int semanage_direct_install_file(semanage_handle_t * sh,

 	char *path = NULL;

 	char *filename;

 	char *lang_ext = NULL;

+	char *module_name = NULL;

 	char *separator;

+	char *version = NULL;

 	if ((data_len = map_file(sh, install_filename, &data, &compressed)) <= 0) {

 		ERR(sh, "Unable to read file %s\n", install_filename);

@@ -1564,10 +1690,29 @@ static int semanage_direct_install_file(semanage_handle_t * sh,

 		lang_ext = separator + 1;

 	}

-	retval = semanage_direct_install(sh, data, data_len, filename, lang_ext);

+	if (strcmp(lang_ext, "pp") == 0) {

+		retval = parse_module_headers(sh, data, data_len, &module_name, &version);

+		free(version);

+		if (retval != 0)

+			goto cleanup;

+	}

+

+	if (module_name == NULL) {

+		module_name = strdup(filename);

+		if (module_name == NULL) {

+			ERR(sh, "No memory available for module_name.\n");

+			retval = -1;

+			goto cleanup;

+		}

+	} else if (strcmp(module_name, filename) != 0) {

+		fprintf(stderr, "Warning: SELinux userspace will refer to the module from %s as %s rather than %s\n", install_filename, module_name, filename);

+	}

+

+	retval = semanage_direct_install(sh, data, data_len, module_name, lang_ext);

 cleanup:

 	if (data_len > 0) munmap(data, data_len);

+	free(module_name);

 	free(path);

 	return retval;

@@ -1931,7 +2076,7 @@ int semanage_direct_mls_enabled(semanage_handle_t * sh)

 	if (retval < 0)

 		goto cleanup;

-	retval = semanage_read_policydb(sh, p);

+	retval = semanage_read_policydb(sh, p, SEMANAGE_STORE_KERNEL);

 	if (retval < 0)

 		goto cleanup;

diff --git libsemanage-2.5/src/exception.sh libsemanage-2.5/src/exception.sh

index 94619d2..d18959c 100644

--- libsemanage-2.5/src/exception.sh

+++ libsemanage-2.5/src/exception.sh

@@ -9,6 +9,6 @@ echo "

 }

 "

 }

-gcc -x c -c -I../include - -aux-info temp.aux < ../include/semanage/semanage.h

+${CC:-gcc} -x c -c -I../include - -aux-info temp.aux < ../include/semanage/semanage.h

 for i in `awk '/extern int/ { print $6 }' temp.aux`; do except $i ; done

 rm -f -- temp.aux -.o

diff --git libsemanage-2.5/src/genhomedircon.c libsemanage-2.5/src/genhomedircon.c

index 1a9e87e..3fc9e7a 100644

--- libsemanage-2.5/src/genhomedircon.c

+++ libsemanage-2.5/src/genhomedircon.c

@@ -48,6 +48,8 @@

 #include <errno.h>

 #include <unistd.h>

 #include <regex.h>

+#include <grp.h>

+#include <search.h>

 /* paths used in get_home_dirs() */

 #define PATH_ETC_USERADD "/etc/default/useradd"

@@ -73,37 +75,44 @@

    which are searched for and replaced */

 #define TEMPLATE_HOME_ROOT "HOME_ROOT"

 #define TEMPLATE_HOME_DIR "HOME_DIR"

+/* these are legacy */

 #define TEMPLATE_USER "USER"

 #define TEMPLATE_ROLE "ROLE"

-#define TEMPLATE_SEUSER "system_u"

-#define TEMPLATE_LEVEL "s0"

-

-#define FALLBACK_USER "user_u"

-#define FALLBACK_USER_PREFIX "user"

-#define FALLBACK_USER_LEVEL "s0"

+/* new names */

+#define TEMPLATE_USERNAME "%{USERNAME}"

+#define TEMPLATE_USERID "%{USERID}"

+

+#define FALLBACK_SENAME "user_u"

+#define FALLBACK_PREFIX "user"

+#define FALLBACK_LEVEL "s0"

+#define FALLBACK_NAME "[^/]+"

+#define FALLBACK_UIDGID "[0-9]+"

 #define DEFAULT_LOGIN "__default__"

-typedef struct {

-	const char *fcfilepath;

-	int usepasswd;

-	const char *homedir_template_path;

-	char *fallback_user;

-	char *fallback_user_prefix;

-	char *fallback_user_level;

-	semanage_handle_t *h_semanage;

-	sepol_policydb_t *policydb;

-} genhomedircon_settings_t;

+#define CONTEXT_NONE "<<none>>"

 typedef struct user_entry {

 	char *name;

+	char *uid;

+	char *gid;

 	char *sename;

 	char *prefix;

 	char *home;

 	char *level;

+	char *login;

 	struct user_entry *next;

 } genhomedircon_user_entry_t;

 typedef struct {

+	const char *fcfilepath;

+	int usepasswd;

+	const char *homedir_template_path;

+	genhomedircon_user_entry_t *fallback;

+	semanage_handle_t *h_semanage;

+	sepol_policydb_t *policydb;

+} genhomedircon_settings_t;

+

+typedef struct {

 	const char *search_for;

 	const char *replace_with;

 } replacement_pair_t;

@@ -461,11 +470,29 @@ static int HOME_DIR_PRED(const char *string)

 	return semanage_is_prefix(string, TEMPLATE_HOME_DIR);

 }

+/* new names */

+static int USERNAME_CONTEXT_PRED(const char *string)

+{

+	return (int)(

+		(strstr(string, TEMPLATE_USERNAME) != NULL) ||

+		(strstr(string, TEMPLATE_USERID) != NULL)

+	);

+}

+

+/* This will never match USER if USERNAME or USERID are found. */

 static int USER_CONTEXT_PRED(const char *string)

 {

+	if (USERNAME_CONTEXT_PRED(string))

+		return 0;

+

 	return (int)(strstr(string, TEMPLATE_USER) != NULL);

 }

+static int STR_COMPARATOR(const void *a, const void *b)

+{

+	return strcmp((const char *) a, (const char *) b);

+}

+

 /* make_tempate

  * @param	s	  the settings holding the paths to various files

  * @param	pred	function pointer to function to use as filter for slurp

@@ -548,23 +575,12 @@ static int check_line(genhomedircon_settings_t * s, Ustr *line)

 	return result;

 }

-static int write_home_dir_context(genhomedircon_settings_t * s, FILE * out,