diff --git a/patch-selinux.patch b/patch-selinux.patch
new file mode 100644
index 0000000..b7e781a
--- /dev/null
+++ b/patch-selinux.patch
@@ -0,0 +1,161 @@
+diff -up patch-2.5.4/patch.c.selinux patch-2.5.4/patch.c
+--- patch-2.5.4/patch.c.selinux	2007-10-04 16:58:38.000000000 +0100
++++ patch-2.5.4/patch.c	2007-10-04 16:58:38.000000000 +0100
+@@ -414,6 +414,13 @@ main (int argc, char **argv)
+ 		  if (! inerrno && chmod (outname, instat.st_mode) != 0)
+ 		    pfatal ("Can't set permissions on file %s",
+ 			    quotearg (outname));
++		  if (! inerrno && incontext &&
++		      setfilecon (outname, incontext) != 0)
++		    {
++		      if (errno != ENODATA && errno != ENOTSUP)
++			pfatal ("Can't set security context on file %s",
++				quotearg (outname));
++		    }
+ 		}
+ 	    }
+       }
+diff -up patch-2.5.4/common.h.selinux patch-2.5.4/common.h
+--- patch-2.5.4/common.h.selinux	1999-08-30 07:20:08.000000000 +0100
++++ patch-2.5.4/common.h	2007-10-04 16:58:38.000000000 +0100
+@@ -39,6 +39,8 @@
+ #include <sys/types.h>
+ #include <time.h>
+ 
++#include <selinux/selinux.h>
++
+ #include <sys/stat.h>
+ #if ! defined S_ISDIR && defined S_IFDIR
+ # define S_ISDIR(m) (((m) & S_IFMT) == S_IFDIR)
+@@ -168,6 +170,7 @@ XTERN char *outfile;
+ XTERN int inerrno;
+ XTERN int invc;
+ XTERN struct stat instat;
++XTERN security_context_t incontext;
+ XTERN bool dry_run;
+ XTERN bool posixly_correct;
+ 
+diff -up patch-2.5.4/inp.c.selinux patch-2.5.4/inp.c
+--- patch-2.5.4/inp.c.selinux	2007-10-04 16:58:38.000000000 +0100
++++ patch-2.5.4/inp.c	2007-10-04 16:58:38.000000000 +0100
+@@ -154,7 +154,15 @@ get_input_file (char const *filename, ch
+     char *getbuf;
+ 
+     if (inerrno == -1)
+-      inerrno = stat (inname, &instat) == 0 ? 0 : errno;
++      {
++	inerrno = stat (inname, &instat) == 0 ? 0 : errno;
++	inerrno = getfilecon (inname, &incontext) == 0 ? 0 : errno;
++	if (inerrno == ENODATA || inerrno == ENOTSUP)
++	  {
++	    inerrno = 0;
++	    incontext = NULL;
++	  }
++      }
+ 
+     /* Perhaps look for RCS or SCCS versions.  */
+     if (patch_get
+@@ -196,7 +204,7 @@ get_input_file (char const *filename, ch
+ 	    }
+ 
+ 	    if (cs && version_get (filename, cs, ! inerrno, elsewhere, getbuf,
+-				   &instat))
++				   &instat, &incontext))
+ 	      inerrno = 0;
+ 
+ 	    free (getbuf);
+@@ -213,6 +221,7 @@ get_input_file (char const *filename, ch
+       {
+ 	instat.st_mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH;
+ 	instat.st_size = 0;
++	incontext = NULL;
+       }
+     else if (! S_ISREG (instat.st_mode))
+       fatal ("File %s is not a regular file -- can't patch",
+diff -up patch-2.5.4/util.c.selinux patch-2.5.4/util.c
+--- patch-2.5.4/util.c.selinux	2007-10-04 16:58:38.000000000 +0100
++++ patch-2.5.4/util.c	2007-10-04 16:58:38.000000000 +0100
+@@ -266,7 +266,8 @@ static char const CLEARTOOL_CO[] = "clea
+    *GETBUF and *DIFFBUF must be freed by the caller.  */
+ char const *
+ version_controller (char const *filename, int readonly,
+-		    struct stat const *filestat, char **getbuf, char **diffbuf)
++		    struct stat const *filestat,
++		    char **getbuf, char **diffbuf)
+ {
+   struct stat cstat;
+   char const *filebase = base_name (filename);
+@@ -375,7 +376,8 @@ version_controller (char const *filename
+    Return nonzero if successful.  */
+ int
+ version_get (char const *filename, char const *cs, int exists, int readonly,
+-	     char const *getbuf, struct stat *filestat)
++	     char const *getbuf, struct stat *filestat,
++	     security_context_t *filecontext)
+ {
+   if (patch_get < 0)
+     {
+@@ -400,6 +402,13 @@ version_get (char const *filename, char 
+ 	fatal ("Can't get file %s from %s", quotearg (filename), cs);
+       if (stat (filename, filestat) != 0)
+ 	pfatal ("%s", quotearg (filename));
++      if (filecontext && getfilecon (filename, filecontext) != 0)
++	{
++	  if (errno == ENODATA || errno == ENOTSUP)
++	    *filecontext = NULL;
++	  else
++	    pfatal ("%s", quotearg (filename));
++	}
+     }
+ 
+   return 1;
+diff -up patch-2.5.4/util.h.selinux patch-2.5.4/util.h
+--- patch-2.5.4/util.h.selinux	1999-08-30 07:20:08.000000000 +0100
++++ patch-2.5.4/util.h	2007-10-04 16:58:38.000000000 +0100
+@@ -21,7 +21,7 @@ char *fetchname PARAMS ((char *, int, ti
+ char *savebuf PARAMS ((char const *, size_t));
+ char *savestr PARAMS ((char const *));
+ char const *version_controller PARAMS ((char const *, int, struct stat const *, char **, char **));
+-int version_get PARAMS ((char const *, char const *, int, int, char const *, struct stat *));
++int version_get PARAMS ((char const *, char const *, int, int, char const *, struct stat *, security_context_t *));
+ int create_file PARAMS ((char const *, int, mode_t));
+ int systemic PARAMS ((char const *));
+ char *format_linenum PARAMS ((char[LINENUM_LENGTH_BOUND + 1], LINENUM));
+diff -up patch-2.5.4/pch.c.selinux patch-2.5.4/pch.c
+--- patch-2.5.4/pch.c.selinux	2007-10-04 16:58:38.000000000 +0100
++++ patch-2.5.4/pch.c	2007-10-04 16:58:38.000000000 +0100
+@@ -258,7 +258,12 @@ there_is_another_patch (void)
+ 	  {
+ 	    if (stat (inname, &instat) == 0)
+ 	      {
+-		inerrno = 0;
++		inerrno = getfilecon (inname, &incontext) == 0 ? 0 : errno;
++		if (inerrno == ENODATA || inerrno == ENOTSUP)
++		  {
++		    inerrno = 0;
++		    incontext = NULL;
++		  }
+ 		invc = -1;
+ 	      }
+ 	    else
+@@ -573,7 +578,7 @@ intuit_diff_type (void)
+ 			  if (cs)
+ 			    {
+ 			      if (version_get (name[i], cs, 0, readonly,
+-					       getbuf, &st[i]))
++					       getbuf, &st[i], NULL))
+ 				stat_errno[i] = 0;
+ 			      else
+ 				version_controlled[i] = 0;
+diff -up patch-2.5.4/Makefile.in.selinux patch-2.5.4/Makefile.in
+--- patch-2.5.4/Makefile.in.selinux	2007-10-04 16:59:09.000000000 +0100
++++ patch-2.5.4/Makefile.in	2007-10-04 17:00:59.000000000 +0100
+@@ -36,7 +36,7 @@ DEFS = @DEFS@
+ EXEEXT = @EXEEXT@
+ LDFLAGS = @LDFLAGS@
+ LIBOBJS = @LIBOBJS@
+-LIBS = @LIBS@
++LIBS = @LIBS@ -lselinux
+ PACKAGE = @PACKAGE@
+ U = @U@
+ VERSION = @VERSION@
diff --git a/patch.spec b/patch.spec
index a796c56..cb82bdd 100644
--- a/patch.spec
+++ b/patch.spec
@@ -12,7 +12,8 @@ Patch3: patch-2.5.4-sigsegv.patch
 Patch4: patch-2.5.4-ifdef.patch
 Patch5: patch-2.5.4-program_name.patch
 Patch6: patch-stripcr.patch
-Patch8: patch-parse.patch
+Patch7: patch-parse.patch
+Patch8: patch-selinux.patch
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 %description
@@ -33,7 +34,8 @@ applications.
 %patch4 -p1 -b .ifdef
 %patch5 -p1 -b .program_name
 %patch6 -p1 -b .stripcr
-%patch8 -p1 -b .parse
+%patch7 -p1 -b .parse
+#%patch8 -p1 -b .selinux
 
 %build
 CFLAGS="$RPM_OPT_FLAGS -D_GNU_SOURCE"
@@ -60,6 +62,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/*/*
 
 %changelog
+* Thu Oct  4 2007 Tim Waugh <twaugh@redhat.com>
+- Beginnings of an SELinux patch (bug #165799); not applied yet.
+
 * Wed Aug 29 2007 Tim Waugh <twaugh@redhat.com> 2.5.4-30
 - Added dist tag.
 - More specific license tag.