--- /dev/null	2006-03-24 08:16:09.803715750 +0000

+++ coreutils-5.94/src/chcon.c	2006-03-24 13:23:45.000000000 +0000

@@ -0,0 +1,421 @@

+/* chcontext -- change security context of a pathname */

+

+#include <config.h>

+#include <stdio.h>

+#include <sys/types.h>

+#include <grp.h>

+#include <getopt.h>

+#include <selinux/selinux.h>

+#include <selinux/context.h>

+

+#include "system.h"

+#include "error.h"

+#include "savedir.h"

+#include "group-member.h"

+

+enum Change_status

+{

+  CH_SUCCEEDED,

+  CH_FAILED,

+  CH_NO_CHANGE_REQUESTED

+};

+

+enum Verbosity

+{

+  /* Print a message for each file that is processed.  */

+  V_high,

+

+  /* Print a message for each file whose attributes we change.  */

+  V_changes_only,

+

+  /* Do not be verbose.  This is the default. */

+  V_off

+};

+

+static int change_dir_context (const char *dir, const struct stat *statp);

+

+/* The name the program was run with. */

+char *program_name;

+

+/* If nonzero, and the systems has support for it, change the context

+   of symbolic links rather than any files they point to.  */

+static int change_symlinks;

+

+/* If nonzero, change the context of directories recursively. */

+static int recurse;

+

+/* If nonzero, force silence (no error messages). */

+static int force_silent;

+

+/* Level of verbosity.  */

+static enum Verbosity verbosity = V_off;

+

+/* The name of the context file is being given. */

+static const char *specified_context;

+

+/* Specific components of the context */

+static const char *specified_user;

+static const char *specified_role;

+static const char *specified_range;

+static const char *specified_type;

+

+/* The argument to the --reference option.  Use the context of this file.

+   This file must exist.  */

+static char *reference_file;

+

+/* If nonzero, display usage information and exit.  */

+static int show_help;

+

+/* If nonzero, print the version on standard output and exit.  */

+static int show_version;

+

+static struct option const long_options[] =

+{

+  {"recursive", no_argument, 0, 'R'},

+  {"changes", no_argument, 0, 'c'},

+  {"no-dereference", no_argument, 0, 'h'},

+  {"silent", no_argument, 0, 'f'},

+  {"quiet", no_argument, 0, 'f'},

+  {"reference", required_argument, 0, CHAR_MAX + 1},

+  {"context", required_argument, 0, CHAR_MAX + 2},

+  {"user", required_argument, 0, 'u'},

+  {"role", required_argument, 0, 'r'},      

+  {"type", required_argument, 0, 't'},

+  {"range", required_argument, 0, 'l'},   

+  {"verbose", no_argument, 0, 'v'},

+  {"help", no_argument, &show_help, 1},

+  {"version", no_argument, &show_version, 1},

+  {0, 0, 0, 0}

+};

+

+/* Tell the user how/if the context of FILE has been changed.

+   CHANGED describes what (if anything) has happened. */

+

+static void

+describe_change (const char *file, security_context_t newcontext, enum Change_status changed)

+{

+  const char *fmt;

+  switch (changed)

+    {

+    case CH_SUCCEEDED:

+      fmt = _("context of %s changed to %s\n");

+      break;

+    case CH_FAILED:

+      fmt = _("failed to change context of %s to %s\n");

+      break;

+    case CH_NO_CHANGE_REQUESTED:

+      fmt = _("context of %s retained as %s\n");

+      break;

+    default:

+      abort ();

+    }

+  printf (fmt, file, newcontext);

+}

+

+static int

+compute_context_from_mask (security_context_t context, context_t *ret)

+{

+  context_t newcontext = context_new (context);

+  if (!newcontext)

+    return 1;

+#define SETCOMPONENT(comp) \

+  do { \

+    if (specified_ ## comp) \

+      if (context_ ## comp ## _set (newcontext, specified_ ## comp)) \

+        goto lose; \

+  } while (0)

+      

+  SETCOMPONENT(user);

+  SETCOMPONENT(range);

+  SETCOMPONENT(role);

+  SETCOMPONENT(type);

+#undef SETCOMPONENT

+  

+  *ret = newcontext;

+  return 0;

+ lose:

+  context_free (newcontext);

+  return 1;

+}

+

+/* Change the context of FILE, using specified components.

+   If it is a directory and -R is given, recurse.

+   Return 0 if successful, 1 if errors occurred. */

+

+static int

+change_file_context (const char *file)

+{

+  struct stat file_stats;

+  security_context_t file_context=NULL;

+  context_t context;

+  security_context_t context_string;

+  int errors = 0;

+  int status = 0;

+

+  if (change_symlinks)

+    status = lgetfilecon(file, &file_context);

+  else 

+    status = getfilecon(file, &file_context);

+

+  if ((status < 0) && (errno != ENODATA))

+    {

+      if (force_silent == 0)

+	error (0, errno, "%s", file);

+      return 1;

+    }

+

+  /* If the file doesn't have a context, and we're not setting all of

+     the context components, there isn't really an obvious default.

+     Thus, we just give up. */

+  if (file_context == NULL && specified_context == NULL)

+    {

+      error (0, 0, _("can't apply partial context to unlabeled file %s"), file);

+      return 1;

+    }

+      

+  if (specified_context == NULL)

+    {

+      if (compute_context_from_mask (file_context, &context))

+	{

+	  error (0, 0, _("couldn't compute security context from %s"), file_context);

+	      return 1;

+	}

+    }

+  else

+    {

+      context = context_new (specified_context);

+      if (!context)

+	error (1, 0,_("invalid context: %s"),specified_context);	    

+    }

+

+  context_string = context_str (context);

+      

+  if (file_context == NULL || strcmp(context_string,file_context)!=0)

+    {

+      int fail;

+

+      if (change_symlinks)

+      	fail = lsetfilecon (file, context_string);

+      else

+      	fail = setfilecon (file, context_string);

+

+      if (verbosity == V_high || (verbosity == V_changes_only && !fail))

+	describe_change (file, context_string, (fail ? CH_FAILED : CH_SUCCEEDED));

+

+      if (fail)

+	{

+	  errors = 1;

+	  if (force_silent == 0)

+	    {

+	      error (0, errno, _("failed to change context of %s to %s"), file, context_string);

+	    }

+	}

+    }

+  else if (verbosity == V_high)

+    {

+      describe_change (file, context_string, CH_NO_CHANGE_REQUESTED);

+    }

+

+  context_free(context);

+  freecon(file_context);

+

+  if (recurse) {

+    if (lstat(file, &file_stats)==0)

+      if (S_ISDIR (file_stats.st_mode))

+	errors |= change_dir_context (file, &file_stats);

+  }

+  return errors;

+}

+

+/* Recursively change context of the files in directory DIR

+   using specified context components.

+   STATP points to the results of lstat on DIR.

+   Return 0 if successful, 1 if errors occurred. */

+

+static int

+change_dir_context (const char *dir, const struct stat *statp)

+{

+  char *name_space, *namep;

+  char *path;			/* Full path of each entry to process. */

+  unsigned dirlength;		/* Length of `dir' and '\0'. */

+  unsigned filelength;		/* Length of each pathname to process. */

+  unsigned pathlength;		/* Bytes allocated for `path'. */

+  int errors = 0;

+

+  errno = 0;

+  name_space = savedir (dir);

+  if (name_space == NULL)

+    {

+      if (errno)

+        {

+	  if (force_silent == 0)

+	    error (0, errno, "%s", dir);

+	  return 1;

+	}

+      else

+	error (1, 0, _("virtual memory exhausted"));

+    }

+

+  dirlength = strlen (dir) + 1;	/* + 1 is for the trailing '/'. */

+  pathlength = dirlength + 1;

+  /* Give `path' a dummy value; it will be reallocated before first use. */

+  path = xmalloc (pathlength);

+  strcpy (path, dir);

+  path[dirlength - 1] = '/';

+

+  for (namep = name_space; *namep; namep += filelength - dirlength)

+    {

+      filelength = dirlength + strlen (namep) + 1;

+      if (filelength > pathlength)

+	{

+	  pathlength = filelength * 2;

+	  path = xrealloc (path, pathlength);

+	}

+      strcpy (path + dirlength, namep);

+      errors |= change_file_context (path);

+    }

+  free (path);

+  free (name_space);

+  return errors;

+}

+

+static void

+usage (int status)

+{

+  if (status != 0)

+    fprintf (stderr, _("Try `%s --help' for more information.\n"),

+	     program_name);

+  else

+    {

+      printf (_("\

+Usage: %s [OPTION]... CONTEXT FILE...\n\

+  or:  %s [OPTION]... [-u USER] [-r ROLE] [-l RANGE] [-t TYPE] FILE...\n\

+  or:  %s [OPTION]... --reference=RFILE FILE...\n\

+"),

+	program_name, program_name, program_name);

+      printf (_("\

+Change the security context of each FILE to CONTEXT.\n\

+\n\

+  -c, --changes          like verbose but report only when a change is made\n\

+  -h, --no-dereference   affect symbolic links instead of any referenced file\n\

+                         (available only on systems with lchown system call)\n\

+  -f, --silent, --quiet  suppress most error messages\n\

+      --reference=RFILE  use RFILE's group instead of using a CONTEXT value\n\

+  -u, --user=USER        set user USER in the target security context\n\

+  -r, --role=ROLE        set role ROLE in the target security context\n\

+  -t, --type=TYPE        set type TYPE in the target security context\n\

+  -l, --range=RANGE      set range RANGE in the target security context\n\

+  -R, --recursive        change files and directories recursively\n\

+  -v, --verbose          output a diagnostic for every file processed\n\

+      --help             display this help and exit\n\

+      --version          output version information and exit\n\

+"));

+      close_stdout ();

+    }

+  exit (status);

+}

+

+int

+main (int argc, char **argv)

+{

+  security_context_t ref_context = NULL;

+  int errors = 0;

+  int optc;

+  int component_specified = 0;

+  

+  program_name = argv[0];

+  setlocale (LC_ALL, "");

+  bindtextdomain (PACKAGE, LOCALEDIR);

+  textdomain (PACKAGE);

+

+  recurse = force_silent = 0;

+  

+  while ((optc = getopt_long (argc, argv, "Rcfhvu:r:t:l:", long_options, NULL)) != -1)

+  {

+	  switch (optc)

+	  {

+	  case 0:

+	    break;

+	  case 'u':

+	    specified_user = optarg;

+	    component_specified = 1;

+	    break;

+	  case 'r':

+	    specified_role = optarg;

+	    component_specified = 1;

+	    break;

+	  case 't':

+	    specified_type = optarg;

+	    component_specified = 1;

+	    break;

+	  case 'l':

+	    specified_range = optarg;

+	    component_specified = 1;

+	    break;

+	  case CHAR_MAX + 1:

+		  reference_file = optarg;

+		  break;

+	  case 'R':

+		  recurse = 1;

+		  break;

+ 	  case 'c':

+		  verbosity = V_changes_only;

+		  break;

+	  case 'f':

+		  force_silent = 1;

+		  break;

+	  case 'h':

+		  change_symlinks = 1;

+		  break;

+	  case 'v':

+		  verbosity = V_high;

+		  break;

+	  default:

+		  usage (1);

+	  }

+  }

+

+  if (show_version)

+  {

+     printf ("chcon (%s) %s\n", GNU_PACKAGE, VERSION);

+     close_stdout ();

+     exit (0);

+  }

+

+  if (show_help)

+    usage (0);

+

+  

+  if (reference_file && component_specified)

+    {

+      error (0, 0, _("conflicting security context specifiers given"));

+      usage (1);

+    }

+

+  if (!(((reference_file || component_specified)

+	 && (argc - optind > 0))

+	|| (argc - optind > 1)))

+    {

+      error (0, 0, _("too few arguments"));

+      usage (1);

+    }

+  

+  if (reference_file)

+    {

+      if (getfilecon (reference_file, &ref_context)<0)

+	error (1, errno, "%s", reference_file);

+      

+      specified_context = ref_context;

+    }

+  else if (!component_specified) {

+    specified_context = argv[optind++];

+  }

+  for (; optind < argc; ++optind)

+     errors |= change_file_context (argv[optind]);

+

+  if (verbosity != V_off)

+    close_stdout ();

+  if (ref_context != NULL)

+    freecon(ref_context);

+  exit (errors);

+}

--- coreutils-5.94/src/mv.c.selinux	2006-03-24 13:23:38.000000000 +0000

+++ coreutils-5.94/src/mv.c	2006-03-24 13:23:44.000000000 +0000

@@ -34,6 +34,11 @@

 #include "quote.h"

 #include "remove.h"

+#ifdef WITH_SELINUX

+#include <selinux/selinux.h>          /* for is_selinux_enabled() */

+int selinux_enabled=0;

+#endif

+

 /* The official name of this program (e.g., no `g' prefix).  */

 #define PROGRAM_NAME "mv"

@@ -127,6 +132,9 @@

   x->preserve_links = true;

   x->preserve_mode = true;

   x->preserve_timestamps = true;

+#ifdef WITH_SELINUX

+  x->preserve_security_context = 1;

+#endif

   x->require_preserve = false;  /* FIXME: maybe make this an option */

   x->recursive = true;

   x->sparse_mode = SPARSE_AUTO;  /* FIXME: maybe make this an option */

@@ -365,6 +373,10 @@

   cp_option_init (&x);

+#ifdef WITH_SELINUX

+  selinux_enabled= (is_selinux_enabled()>0);

+#endif

+

   /* FIXME: consider not calling getenv for SIMPLE_BACKUP_SUFFIX unless

      we'll actually use backup_suffix_string.  */

   backup_suffix_string = getenv ("SIMPLE_BACKUP_SUFFIX");

--- coreutils-5.94/src/mkdir.c.selinux	2005-06-15 00:55:47.000000000 +0100

+++ coreutils-5.94/src/mkdir.c	2006-03-24 13:23:44.000000000 +0000

@@ -34,11 +34,18 @@

 #define AUTHORS "David MacKenzie"

+#ifdef WITH_SELINUX

+#include <selinux/selinux.h>          /* for is_selinux_enabled() */

+#endif

+

 /* The name this program was run with. */

 char *program_name;

 static struct option const longopts[] =

 {

+#ifdef WITH_SELINUX

+  {"context", required_argument, NULL, 'Z'},

+#endif

   {"mode", required_argument, NULL, 'm'},

   {"parents", no_argument, NULL, 'p'},

   {"verbose", no_argument, NULL, 'v'},

@@ -60,6 +67,11 @@

 Create the DIRECTORY(ies), if they do not already exist.\n\

 \n\

 "), stdout);

+#ifdef WITH_SELINUX

+      printf (_("\

+  -Z, --context=CONTEXT (SELinux) set security context to CONTEXT\n\

+"));

+#endif

       fputs (_("\

 Mandatory arguments to long options are mandatory for short options too.\n\

 "), stdout);

@@ -95,7 +107,11 @@

   atexit (close_stdout);

+#ifdef WITH_SELINUX

+  while ((optc = getopt_long (argc, argv, "pm:vZ:", longopts, NULL)) != -1)

+#else

   while ((optc = getopt_long (argc, argv, "pm:v", longopts, NULL)) != -1)

+#endif

     {

       switch (optc)

 	{

@@ -108,6 +124,20 @@

 	case 'v': /* --verbose  */

 	  verbose_fmt_string = _("created directory %s");

 	  break;

+#ifdef WITH_SELINUX

+ 	case 'Z':

+ 	  /* politely decline if we're not on a selinux-enabled kernel. */

+	  if( !(is_selinux_enabled()>0)) {

+ 	    fprintf( stderr, "Sorry, --context (-Z) can be used only on "

+ 		             "a selinux-enabled kernel.\n" );

+ 	    exit( 1 );

+ 	  }

+	  if (setfscreatecon(optarg)) {

+ 	    fprintf( stderr, "Sorry, cannot set default context to %s.\n", optarg);

+ 	    exit( 1 );

+ 	  }

+ 	  break;

+#endif

 	case_GETOPT_HELP_CHAR;

 	case_GETOPT_VERSION_CHAR (PROGRAM_NAME, AUTHORS);

 	default:

--- coreutils-5.94/src/cp.c.selinux	2006-03-24 13:23:38.000000000 +0000

+++ coreutils-5.94/src/cp.c	2006-03-24 13:23:45.000000000 +0000

@@ -51,6 +51,11 @@

 #define AUTHORS "Torbjorn Granlund", "David MacKenzie", "Jim Meyering"

+#ifdef WITH_SELINUX

+#include <selinux/selinux.h>          /* for is_selinux_enabled() */

+int selinux_enabled=0;

+#endif

+

 /* Used by do_copy, make_dir_parents_private, and re_protect

    to keep a list of leading directories whose protections

    need to be fixed after copying. */

@@ -141,6 +146,9 @@

   {"target-directory", required_argument, NULL, 't'},

   {"update", no_argument, NULL, 'u'},

   {"verbose", no_argument, NULL, 'v'},

+#ifdef WITH_SELINUX

+  {"context", required_argument, NULL, 'Z'},

+#endif

   {GETOPT_HELP_OPTION_DECL},

   {GETOPT_VERSION_OPTION_DECL},

   {NULL, 0, NULL, 0}

@@ -194,6 +202,9 @@

                                  additional attributes: links, all\n\

 "), stdout);

       fputs (_("\

+  -c                           same as --preserve=context\n\

+"), stdout);

+      fputs (_("\

       --no-preserve=ATTR_LIST  don't preserve the specified attributes\n\

       --parents                use full source file name under DIRECTORY\n\

 "), stdout);

@@ -219,6 +230,7 @@

                                  destination file is missing\n\

   -v, --verbose                explain what is being done\n\

   -x, --one-file-system        stay on this file system\n\

+  -Z, --context=CONTEXT        set security context of copy to CONTEXT\n\

 "), stdout);

       fputs (HELP_OPTION_DESCRIPTION, stdout);

       fputs (VERSION_OPTION_DESCRIPTION, stdout);

@@ -741,6 +753,10 @@

   x->preserve_mode = false;

   x->preserve_timestamps = false;

+#ifdef WITH_SELINUX

+  x->preserve_security_context = false;

+#endif

+

   x->require_preserve = false;

   x->recursive = false;

   x->sparse_mode = SPARSE_AUTO;

@@ -768,18 +784,19 @@

       PRESERVE_TIMESTAMPS,

       PRESERVE_OWNERSHIP,

       PRESERVE_LINK,

+      PRESERVE_CONTEXT,

       PRESERVE_ALL

     };

   static enum File_attribute const preserve_vals[] =

     {

       PRESERVE_MODE, PRESERVE_TIMESTAMPS,

-      PRESERVE_OWNERSHIP, PRESERVE_LINK, PRESERVE_ALL

+      PRESERVE_OWNERSHIP, PRESERVE_LINK, PRESERVE_CONTEXT, PRESERVE_ALL

     };

   /* Valid arguments to the `--preserve' option. */

   static char const* const preserve_args[] =

     {

       "mode", "timestamps",

-      "ownership", "links", "all", NULL

+      "ownership", "links", "context", "all", NULL

     };

   ARGMATCH_VERIFY (preserve_args, preserve_vals);

@@ -815,11 +832,16 @@

 	  x->preserve_links = on_off;

 	  break;

+	case PRESERVE_CONTEXT:

+	  x->preserve_security_context = on_off;

+	  break;

+

 	case PRESERVE_ALL:

 	  x->preserve_mode = on_off;

 	  x->preserve_timestamps = on_off;

 	  x->preserve_ownership = on_off;

 	  x->preserve_links = on_off;

+	  x->preserve_security_context = on_off;

 	  break;

 	default:

@@ -844,6 +866,10 @@

   bool copy_contents = false;

   char *target_directory = NULL;

   bool no_target_directory = false;

+#ifdef WITH_SELINUX

+  security_context_t scontext = NULL;

+  selinux_enabled= (is_selinux_enabled()>0);

+#endif

   initialize_main (&argc, &argv);

   program_name = argv[0];

@@ -859,7 +885,11 @@

      we'll actually use backup_suffix_string.  */

   backup_suffix_string = getenv ("SIMPLE_BACKUP_SUFFIX");

+#ifdef WITH_SELINUX

+  while ((c = getopt_long (argc, argv, "abcdfHilLprst:uvxPRS:TZ:",

+#else

   while ((c = getopt_long (argc, argv, "abdfHilLprst:uvxPRS:T",

+#endif

 			   long_opts, NULL))

 	 != -1)

     {

@@ -950,6 +980,36 @@

 	case 'R':

 	  x.recursive = true;

 	  break;

+#ifdef WITH_SELINUX

+	case 'c':

+	  if ( scontext != NULL ) { 

+	      (void) fprintf(stderr, "%s: cannot force target context <-- %s and preserve it\n", argv[0], scontext);

+	    exit( 1 );

+	  }

+	  else if (selinux_enabled) 

+	    x.preserve_security_context = 1;

+	  break;

+

+	case 'Z':

+	  /* politely decline if we're not on a selinux-enabled kernel. */

+	  if( !selinux_enabled ) {

+	    fprintf( stderr, "Warning:  ignoring --context (-Z). "

+		             "It requires a SELinux enabled kernel.\n" );

+	    break;

+	  }

+	  if ( x.preserve_security_context ) {

+	    (void) fprintf(stderr, "%s: cannot force target context to '%s' and preserve it\n", argv[0], optarg);

+	    exit( 1 );

+	  }

+	  scontext = optarg;

+	  /* if there's a security_context given set new path 

+	     components to that context, too */

+	  if ( setfscreatecon(scontext) < 0 ) {

+	    (void) fprintf(stderr, _("cannot set default security context %s"), scontext);

+	    exit( 1 );

+	  }

+	  break;

+#endif

 	case REPLY_OPTION: /* Deprecated */

 	  x.interactive = XARGMATCH ("--reply", optarg,

--- coreutils-5.94/src/install.c.selinux	2006-03-24 13:23:44.000000000 +0000

+++ coreutils-5.94/src/install.c	2006-03-24 13:23:45.000000000 +0000

@@ -48,6 +48,43 @@

 # include <sys/wait.h>

 #endif

+#ifdef WITH_SELINUX

+#include <selinux/selinux.h>          /* for is_selinux_enabled() */

+int selinux_enabled=0;

+static int use_default_selinux_context = 1;

+/* Modify file context to match the specified policy,  

+   If an error occurs the file will remain with the default directory 

+   context.*/

+static void setdefaultfilecon(const char *path) {

+	struct stat st;

+	security_context_t scontext=NULL;

+	if (selinux_enabled != 1) {

+		/* Indicate no context found. */

+		return;

+	}

+	if (lstat(path, &st) != 0)

+		return;

+

+	/* If there's an error determining the context, or it has none, 

+	   return to allow default context */

+	if ((matchpathcon(path, st.st_mode, &scontext) != 0) ||

+	    (strcmp(scontext, "<<none>>") == 0)) {

+		if (scontext != NULL) {

+			freecon(scontext);

+		}

+		return;

+	}

+	if (lsetfilecon(path, scontext) < 0) {

+		if (errno != ENOTSUP) {

+			error (0, errno,

+			       _("warning: failed to change context of %s to %s"), path, scontext);

+		}

+	}

+	freecon(scontext);

+	return;

+}

+#endif

+

 #if ! HAVE_ENDGRENT

 # define endgrent() ((void) 0)

 #endif

@@ -109,12 +146,18 @@

 static struct option const long_options[] =

 {

   {"backup", optional_argument, NULL, 'b'},

+#ifdef WITH_SELINUX

+  {"context", required_argument, NULL, 'Z'},

+#endif

   {"directory", no_argument, NULL, 'd'},

   {"group", required_argument, NULL, 'g'},

   {"mode", required_argument, NULL, 'm'},

   {"no-target-directory", no_argument, NULL, 'T'},

   {"owner", required_argument, NULL, 'o'},

   {"preserve-timestamps", no_argument, NULL, 'p'},

+#ifdef WITH_SELINUX

+  {"preserve_context", no_argument, NULL, 'P'},

+#endif

   {"strip", no_argument, NULL, 's'},

   {"suffix", required_argument, NULL, 'S'},

   {"target-directory", required_argument, NULL, 't'},

@@ -154,6 +197,9 @@

   x->stdin_tty = false;

   x->update = false;

+#ifdef WITH_SELINUX

+  x->preserve_security_context = 0;

+#endif

   x->verbose = false;

   x->dest_info = NULL;

   x->src_info = NULL;

@@ -195,6 +241,11 @@

   bool no_target_directory = false;

   int n_files;

   char **file;

+#ifdef WITH_SELINUX

+  security_context_t scontext = NULL;

+ /* set iff kernel has extra selinux system calls */

+  selinux_enabled = (is_selinux_enabled()>0);

+#endif

   initialize_main (&argc, &argv);

   program_name = argv[0];

@@ -216,7 +267,11 @@

      we'll actually use backup_suffix_string.  */

   backup_suffix_string = getenv ("SIMPLE_BACKUP_SUFFIX");

+#ifdef WITH_SELINUX

+  while ((optc = getopt_long (argc, argv, "bcsDdg:m:o:pPt:TvS:Z:", long_options,

+#else

   while ((optc = getopt_long (argc, argv, "bcsDdg:m:o:pt:TvS:", long_options,

+#endif

 			      NULL)) != -1)

     {

       switch (optc)

@@ -278,6 +333,41 @@

 	case 'T':

 	  no_target_directory = true;

 	  break;

+#ifdef WITH_SELINUX

+ 	case 'P':

+	/* politely decline if we're not on a selinux-enabled kernel. */

+	  if( !selinux_enabled ) {

+ 	    fprintf( stderr, "Warning:  ignoring --preserve_context (-P) "

+		             "because the kernel is not selinux-enabled.\n" );

+ 	    break;

+ 	  }

+ 	  if ( scontext!=NULL ) { /* scontext could be NULL because of calloc() failure */

+ 	      (void) fprintf(stderr, "%s: cannot force target context to '%s' and preserve it\n", argv[0], scontext);

+ 	    exit( 1 );

+ 	  }

+ 	  x.preserve_security_context = 1;

+ 	  use_default_selinux_context = 0;

+ 	  break ;

+ 	case 'Z':

+ 	  /* politely decline if we're not on a selinux-enabled kernel. */

+	  if( !selinux_enabled) {

+ 	    fprintf( stderr, "Warning:  ignoring --context (-Z) "

+ 		             "because the kernel is not selinux-enabled.\n" );

+ 	    break;

+ 	  }

+ 	  if ( x.preserve_security_context ) {

+

+	     	    (void) fprintf(stderr, "%s: cannot force target context == '%s' and preserve it\n", argv[0], optarg);

+ 	    exit( 1 );

+ 	  }

+ 	  scontext = optarg;

+ 	  use_default_selinux_context = 0;

+	  if (setfscreatecon(scontext)) {

+ 	    (void) fprintf(stderr, "%s: cannot setup default context == '%s'\n", argv[0], scontext);

+	    exit(1);

+	  }

+ 	  break;

+#endif

 	case_GETOPT_HELP_CHAR;

 	case_GETOPT_VERSION_CHAR (PROGRAM_NAME, AUTHORS);

 	default:

@@ -519,6 +609,10 @@

       ok = false;

     }

+#ifdef WITH_SELINUX

+  if (use_default_selinux_context)

+    setdefaultfilecon(name);

+#endif

   return ok;

 }

@@ -663,6 +757,11 @@

   -T, --no-target-directory  treat DEST as a normal file\n\

   -v, --verbose       print the name of each directory as it is created\n\

 "), stdout);

+      fputs (_("\

+  -P, --preserve_context (SELinux) Preserve security context\n\

+  -Z, --context=CONTEXT  (SELinux) Set security context of files and directories\n\

+"), stdout);

+

       fputs (HELP_OPTION_DESCRIPTION, stdout);

       fputs (VERSION_OPTION_DESCRIPTION, stdout);

       fputs (_("\

--- coreutils-5.94/src/copy.h.selinux	2006-03-24 13:23:38.000000000 +0000

+++ coreutils-5.94/src/copy.h	2006-03-24 13:23:45.000000000 +0000

@@ -127,6 +127,9 @@

   bool preserve_ownership;

   bool preserve_mode;

   bool preserve_timestamps;

+#ifdef WITH_SELINUX

+  bool preserve_security_context;

+#endif

   /* Enabled for mv, and for cp by the --preserve=links option.

      If true, attempt to preserve in the destination files any

--- coreutils-5.94/src/Makefile.am.selinux	2006-03-24 13:23:43.000000000 +0000

+++ coreutils-5.94/src/Makefile.am	2006-03-24 13:23:45.000000000 +0000

@@ -20,13 +20,13 @@

 EXTRA_PROGRAMS = chroot df hostid nice pinky stty su runuser uname uptime users who

 bin_SCRIPTS = groups

-bin_PROGRAMS = [ chgrp chown chmod cp dd dircolors du \

+bin_PROGRAMS = [ chgrp chown chmod chcon cp dd dircolors du \

   ginstall link ln dir vdir ls mkdir \

   mkfifo mknod mv nohup readlink rm rmdir shred stat sync touch unlink \

   cat cksum comm csplit cut expand fmt fold head join md5sum \

   nl od paste pr ptx sha1sum sort split sum tac tail tr tsort unexpand uniq wc \

   basename date dirname echo env expr factor false \

-  hostname id kill logname pathchk printenv printf pwd seq sleep tee \

+  hostname id kill logname pathchk printenv printf pwd runcon seq sleep tee \

   test true tty whoami yes \

   $(OPTIONAL_BIN_PROGS) $(DF_PROG)

@@ -50,9 +50,9 @@

 LDADD = ../lib/libcoreutils.a $(LIBINTL) ../lib/libcoreutils.a

 # for eaccess in lib/euidaccess.c.

-cp_LDADD = $(LDADD) $(LIB_EACCESS) @LIBACL@

-ginstall_LDADD = $(LDADD) $(LIB_EACCESS) @LIBACL@

-mv_LDADD = $(LDADD) $(LIB_EACCESS) @LIBACL@

+cp_LDADD = $(LDADD) $(LIB_EACCESS) @LIBACL@ @LIB_SELINUX@