--- coreutils-5.2.1/README.selinux	2004-12-29 12:24:03.260876459 -0500

+++ coreutils-5.2.1/README	2004-12-29 12:24:03.417858780 -0500

@@ -7,11 +7,11 @@

 The programs that can be built with this package are:

-  [ basename cat chgrp chmod chown chroot cksum comm cp csplit cut date dd

+  [ basename cat chcon chgrp chmod chown chroot cksum comm cp csplit cut date dd

   df dir dircolors dirname du echo env expand expr factor false fmt fold

   ginstall groups head hostid hostname id join kill link ln logname ls

   md5sum mkdir mkfifo mknod mv nice nl nohup od paste pathchk pinky pr

-  printenv printf ptx pwd readlink rm rmdir runuser seq sha1sum shred sleep sort

+  printenv printf ptx pwd readlink rm rmdir runcon runuser seq sha1sum shred sleep sort

   split stat stty su sum sync tac tail tee test touch tr true tsort tty

   uname unexpand uniq unlink uptime users vdir wc who whoami yes

--- coreutils-5.2.1/src/stat.c.selinux	2004-02-05 08:46:12.000000000 -0500

+++ coreutils-5.2.1/src/stat.c	2004-12-29 12:24:03.419858555 -0500

@@ -42,6 +42,13 @@

 # endif

 #endif

+#ifdef WITH_SELINUX

+#include <selinux/selinux.h>

+#define SECURITY_ID_T security_context_t

+#else

+#define SECURITY_ID_T char *

+#endif

+

 #include "system.h"

 #include "error.h"

@@ -95,6 +102,7 @@

   {"dereference", no_argument, 0, 'L'},

   {"format", required_argument, 0, 'c'},

   {"filesystem", no_argument, 0, 'f'},

+  {"context", no_argument, 0, 'Z'},

   {"terse", no_argument, 0, 't'},

   {GETOPT_HELP_OPTION_DECL},

   {GETOPT_VERSION_OPTION_DECL},

@@ -345,7 +353,7 @@

 /* print statfs info */

 static void

 print_statfs (char *pformat, char m, char const *filename,

-	      void const *data)

+	      void const *data,SECURITY_ID_T scontext)

 {

   STRUCT_STATVFS const *statfsbuf = data;

@@ -407,7 +415,10 @@

       strcat (pformat, PRIdMAX);

       printf (pformat, (intmax_t) (statfsbuf->f_ffree));

       break;

-

+    case 'C':

+      strcat (pformat, "s");

+      printf(scontext);

+      break;

     default:

       strcat (pformat, "c");

       printf (pformat, m);

@@ -417,7 +428,7 @@

 /* print stat info */

 static void

-print_stat (char *pformat, char m, char const *filename, void const *data)

+print_stat (char *pformat, char m, char const *filename, void const *data, SECURITY_ID_T scontext)

 {

   struct stat *statbuf = (struct stat *) data;

   struct passwd *pw_ent;

@@ -553,6 +564,10 @@

       strcat (pformat, "d");

       printf (pformat, (int) statbuf->st_ctime);

       break;

+    case 'C':

+      strcat (pformat, "s");

+      printf(pformat,scontext);

+      break;

     default:

       strcat (pformat, "c");

       printf (pformat, m);

@@ -562,8 +577,8 @@

 static void

 print_it (char const *masterformat, char const *filename,

-	  void (*print_func) (char *, char, char const *, void const *),

-	  void const *data)

+	  void (*print_func) (char *, char, char const *, void const *,SECURITY_ID_T ),

+	  void const *data,  SECURITY_ID_T scontext)

 {

   char *b;

@@ -598,7 +613,7 @@

 	      putchar ('%');

 	      break;

 	    default:

-	      print_func (dest, *p, filename, data);

+	      print_func (dest, *p, filename, data,scontext);

 	      break;

 	    }

 	}

@@ -615,9 +630,17 @@

 /* stat the filesystem and print what we find */

 static void

-do_statfs (char const *filename, int terse, char const *format)

+do_statfs (char const *filename, int terse, int secure, char const *format)

 {

   STRUCT_STATVFS statfsbuf;

+  SECURITY_ID_T scontext = NULL;

+#ifdef WITH_SELINUX

+  if(secure)

+    if (getfilecon(filename,&scontext)<0) {

+      perror (filename);

+      return;

+    }

+#endif

   int i = statfs (filename, &statfsbuf);

   if (i == -1)

@@ -629,23 +652,40 @@

   if (format == NULL)

     {

-      format = (terse

-		? "%n %i %l %t %b %f %a %s %c %d"

-		: "  File: \"%n\"\n"

-		"    ID: %-8i Namelen: %-7l Type: %T\n"

-		"Blocks: Total: %-10b Free: %-10f Available: %-10a Size: %s\n"

-		"Inodes: Total: %-10c Free: %-10d");

-    }

-

-  print_it (format, filename, print_statfs, &statfsbuf);

+      if (terse) {

+	if(secure)

+	  format = "%n %i %l %t %b %f %a %s %c %d %C";

+	else

+	  format = "%n %i %l %t %b %f %a %s %c %d";

+      } 

+      else 

+	{

+	  if(secure)

+	    format = "  File: \"%n\"\n"

+	      "    ID: %-8i Namelen: %-7l Type: %T\n"

+	      "Blocks: Total: %-10b Free: %-10f Available: %-10a Size: %s\n"

+	      "Inodes: Total: %-10c Free: %-10d\n"

+	      "   S_Context: %C\n";

+	  else	

+	    format= "  File: \"%n\"\n"

+	      "    ID: %-8i Namelen: %-7l Type: %T\n"

+	      "Blocks: Total: %-10b Free: %-10f Available: %-10a Size: %s\n"

+	      "Inodes: Total: %-10c Free: %-10d";

+	}	

+    }

+  print_it (format, filename, print_statfs, &statfsbuf,scontext);

+#ifdef WITH_SELINUX

+  if (scontext != NULL)

+    freecon(scontext);

+#endif

 }

-

 /* stat the file and print what we find */

 static void

-do_stat (char const *filename, int follow_links, int terse,

+  do_stat (char const *filename, int follow_links, int terse,int secure,

 	 char const *format)

 {

   struct stat statbuf;

+  SECURITY_ID_T scontext = NULL;

   int i = ((follow_links == 1)

 	   ? stat (filename, &statbuf)

 	   : lstat (filename, &statbuf));

@@ -656,11 +696,28 @@

       return;

     }

+#ifdef WITH_SELINUX

+  if(secure) {

+    if (link) 

+      i=lgetfilecon(filename, &scontext);

+    else

+      i=getfilecon(filename, &scontext);

+    if (i == -1)

+      {

+	perror (filename);

+	return;

+      }

+  }

+#endif

+

   if (format == NULL)

     {

       if (terse != 0)

 	{

-	  format = "%n %s %b %f %u %g %D %i %h %t %T %X %Y %Z %o";

+	   if (secure)

+		  format = "%n %s %b %f %u %g %D %i %h %t %T %X %Y %Z %o %C";

+	   else

+	     format = "%n %s %b %f %u %g %D %i %h %t %T %X %Y %Z %o";

 	}

       else

 	{

@@ -668,7 +725,17 @@

 	  i = statbuf.st_mode & S_IFMT;

 	  if (i == S_IFCHR || i == S_IFBLK)

 	    {

-	      format =

+          	if (secure)

+               		format =

+			  "  File: %N\n"

+			  "  Size: %-10s\tBlocks: %-10b IO Block: %-6o %F\n"

+			  "Device: %Dh/%dd\tInode: %-10i  Links: %-5h"

+			  " Device type: %t,%T\n"

+			  "Access: (%04a/%10.10A)  Uid: (%5u/%8U)   Gid: (%5g/%8G)\n"

+			  "   S_Context: %C\n"

+			  "Access: %x\n" "Modify: %y\n" "Change: %z\n";

+        	else

+	       format =

 		"  File: %N\n"

 		"  Size: %-10s\tBlocks: %-10b IO Block: %-6o %F\n"

 		"Device: %Dh/%dd\tInode: %-10i  Links: %-5h"

@@ -678,6 +745,15 @@

 	    }

 	  else

 	    {

+	   	if (secure)

+		  format =

+		    "  File: %N\n"

+		    "  Size: %-10s\tBlocks: %-10b IO Block: %-6o %F\n"

+		    "Device: %Dh/%dd\tInode: %-10i  Links: %-5h\n"

+		    "Access: (%04a/%10.10A)  Uid: (%5u/%8U)   Gid: (%5g/%8G)\n"

+		    "S_Context: %C\n"

+		    "Access: %x\n" "Modify: %y\n" "Change: %z\n";

+                else

 	      format =

 		"  File: %N\n"

 		"  Size: %-10s\tBlocks: %-10b IO Block: %-6o %F\n"

@@ -687,7 +763,11 @@

 	    }

 	}

     }

-  print_it (format, filename, print_stat, &statbuf);

+  print_it (format, filename, print_stat, &statbuf,scontext);

+#ifdef WITH_SELINUX

+  if (scontext) 

+    freecon(scontext);

+#endif

 }

 void

@@ -705,6 +785,7 @@

   -f, --filesystem      display filesystem status instead of file status\n\

   -c  --format=FORMAT   use the specified FORMAT instead of the default\n\

   -L, --dereference     follow links\n\

+  -Z, --context         print the security context \n\

   -t, --terse           print the information in terse form\n\

 "), stdout);

       fputs (HELP_OPTION_DESCRIPTION, stdout);

@@ -756,6 +837,7 @@

   %c   Total file nodes in file system\n\

   %d   Free file nodes in file system\n\

   %f   Free blocks in file system\n\

+  %C - Security context in SELinux\n\

 "), stdout);

       fputs (_("\

   %i   File System id in hex\n\

@@ -778,6 +860,7 @@

   int follow_links = 0;

   int fs = 0;

   int terse = 0;

+  int secure = 0;

   char *format = NULL;

   initialize_main (&argc, &argv);

@@ -788,7 +871,7 @@

   atexit (close_stdout);

-  while ((c = getopt_long (argc, argv, "c:fLlt", long_options, NULL)) != -1)

+  while ((c = getopt_long (argc, argv, "c:fLltZ", long_options, NULL)) != -1)

     {

       switch (c)

 	{

@@ -810,6 +893,14 @@

 	case 't':

 	  terse = 1;

 	  break;

+	case 'Z':

+	  if((is_selinux_enabled()>0))

+	    secure = 1;

+	  else {

+	    error (0, 0, _("Kernel is not SELinux enabled"));

+	    usage (EXIT_FAILURE);

+	  }

+	  break;

 	case_GETOPT_HELP_CHAR;

@@ -829,9 +920,9 @@

   for (i = optind; i < argc; i++)

     {

       if (fs == 0)

-	do_stat (argv[i], follow_links, terse, format);

+	do_stat (argv[i], follow_links, terse, secure, format);

       else

-	do_statfs (argv[i], terse, format);

+	do_statfs (argv[i], terse, secure, format);

     }

   exit (G_fail ? EXIT_FAILURE : EXIT_SUCCESS);

--- /dev/null	2004-12-29 02:13:24.827638832 -0500

+++ coreutils-5.2.1/src/runcon.c	2004-12-29 12:24:03.421858330 -0500

@@ -0,0 +1,201 @@

+/*

+ * runcon [ context |

+ *         ( [ -r role ] [-t type] [ -u user ] [ -l levelrange ] )

+ *         command [arg1 [arg2 ...] ]

+ *

+ * attempt to run the specified command with the specified context.

+ * 

+ * -r role  : use the current context with the specified role

+ * -t type  : use the current context with the specified type

+ * -u user  : use the current context with the specified user

+ * -l level : use the current context with the specified level range

+ *

+ * Contexts are interpreted as follows:

+ *

+ * Number of       MLS

+ * components    system?

+ *

+ *     1            -         type

+ *     2            -         role:type

+ *     3            Y         role:type:range

+ *     3            N         user:role:type

+ *     4            Y         user:role:type:range

+ *     4            N         error

+ */

+

+#include <config.h>

+#include <unistd.h>

+#include <stdio.h>

+#include <getopt.h>

+#include <selinux/context.h>

+#include <selinux/selinux.h>

+#include <errno.h>

+#include "system.h"

+extern int errno;

+

+/* The name the program was run with. */

+char *program_name;

+

+void

+usage(char *str)

+{

+  printf(_("Usage: %s [OPTION]... command [args]\n"

+         "Run a program in a different security context.\n\n"

+         "  context       Complete security context\n"

+         "  -t            type (for same role as parent)\n"

+         "  -u            user identity\n"

+         "  -r            role\n"

+         "  -l            levelrange\n"

+         "    --help      display this help and exit\n"),

+         program_name);

+  exit(1);

+}

+

+int 

+main(int argc,char **argv,char **envp )

+{

+  char *role    = 0;

+  char *range   = 0;

+  char *user    = 0;

+  char *type    = 0;

+  char *context = NULL;

+  security_context_t cur_context = NULL;

+

+  context_t      con;

+

+  program_name = argv[0];

+  setlocale (LC_ALL, "");

+  bindtextdomain (PACKAGE, LOCALEDIR);

+  textdomain (PACKAGE);

+  

+  while (1) {

+    int c;

+    int this_option_optind = optind ? optind : 1;

+    int option_index = 0;

+    static struct option long_options[] = {

+      { "role", 1, 0, 'r' },

+      { "type", 1, 0, 't' },

+      { "user", 1, 0, 'u' },

+      { "range", 1, 0, 'l' },

+      { "help", 0, 0, '?' },

+      { 0, 0, 0, 0 }

+    };

+    c = getopt_long(argc, argv, "s:r:t:u:l:?", long_options, &option_index);

+    if ( c == -1 ) {

+      break;

+    }

+    switch ( c ) {

+    case 'r':

+      if ( role ) {

+	fprintf(stderr,_("multiple roles\n"));

+	exit(1);

+      }

+      role = optarg;

+      break;

+    case 't':

+      if ( type ) {

+	fprintf(stderr,_("multiple types\n"));

+	exit(1);

+      }

+      type = optarg;

+      break;

+    case 'u':

+      if ( user ) {

+	fprintf(stderr,_("multiple users\n"));

+	exit(1);

+      }

+      user = optarg;

+      break;

+    case 'l':

+      if ( range ) {

+	fprintf(stderr,_("multiple levelranges\n"));

+	exit(1);

+      }

+      range = optarg;

+      break;

+    default:

+      fprintf(stderr,_("unrecognised option %c\n"),c);

+    case '?':

+      usage(0);

+      break;

+    }

+  }

+

+ if( is_selinux_enabled() != 1 ) {

+    fprintf( stderr,

+             _("runcon may be used only on a SELinux kernel.\n") );

+    exit(-1);

+  }

+  

+  if ( !(user || role || type || range)) {

+    if ( optind >= argc ) {

+      usage(_("must specify -t, -u, -l, -r, or context"));

+    }

+    context = argv[optind++];

+  }

+  

+  if ( optind >= argc ) {

+    usage(_("no command found"));

+  }

+

+  if ( context ) {

+    con = context_new(context);

+    if (!con) {

+      fprintf(stderr,_("%s is not a valid context\n"), context);

+      exit(1);

+    }

+  }

+  else {

+    if (getcon(&cur_context) < 0) {

+      fprintf(stderr,_("Couldn't get current context.\n"));

+      exit(1);

+    }

+    con = context_new(cur_context);

+    if (!con) {

+      fprintf(stderr,_("%s is not a valid context\n"), cur_context);

+      exit(1);

+    }

+    if ( user ) {

+      if ( context_user_set(con,user)) {

+        fprintf(stderr,_("failed to set new user %s\n"),user);

+        exit(1);

+      }

+    }

+    if ( type ) {

+      if ( context_type_set(con,type)) {

+        fprintf(stderr,_("failed to set new type %s\n"),type);

+        exit(1);

+      }

+    }

+    if ( range ) {

+      if ( context_range_set(con,range)) {

+        fprintf(stderr,_("failed to set new range %s\n"),range);

+        exit(1);

+      }

+    }

+    if ( role ) {

+      if (context_role_set(con,role)) {

+        fprintf(stderr,_("failed to set new role %s\n"),role);

+        exit(1);

+      }

+    }

+  }

+

+  if (security_check_context(context_str(con)) < 0) {

+    fprintf(stderr, _("%s is not a valid context\n"), context_str(con));

+    exit(1);

+  }

+  

+  if (setexeccon(context_str(con))!=0) {

+    fprintf(stderr,_("unable to setup security context %s\n"), context_str(con));

+    exit(1);

+  }

+  if (cur_context!=NULL) 

+    freecon(cur_context);

+

+  if ( execvp(argv[optind],argv+optind) ) {

+    perror("execvp");

+    exit(1);

+  }

+  return 1; /* can't reach this statement.... */

+}

--- coreutils-5.2.1/src/mkdir.c.selinux	2004-01-21 17:27:02.000000000 -0500

+++ coreutils-5.2.1/src/mkdir.c	2004-12-29 12:24:03.422858217 -0500

@@ -34,6 +34,10 @@

 #define AUTHORS "David MacKenzie"

+#ifdef WITH_SELINUX

+#include <selinux/selinux.h>          /* for is_selinux_enabled() */

+#endif

+

 /* The name this program was run with. */

 char *program_name;

@@ -42,6 +46,9 @@

 static struct option const longopts[] =

 {

+#ifdef WITH_SELINUX

+  {"context", required_argument, NULL, 'Z'},

+#endif

   {"mode", required_argument, NULL, 'm'},

   {"parents", no_argument, NULL, 'p'},

   {"verbose", no_argument, NULL, 'v'},

@@ -63,6 +70,11 @@

 Create the DIRECTORY(ies), if they do not already exist.\n\

 \n\

 "), stdout);

+#ifdef WITH_SELINUX

+      printf (_("\

+  -Z, --context=CONTEXT (SELinux) set security context to CONTEXT\n\

+"));

+#endif

       fputs (_("\

 Mandatory arguments to long options are mandatory for short options too.\n\

 "), stdout);

@@ -98,7 +110,11 @@

   create_parents = 0;

+#ifdef WITH_SELINUX

+  while ((optc = getopt_long (argc, argv, "pm:vZ:", longopts, NULL)) != -1)

+#else

   while ((optc = getopt_long (argc, argv, "pm:v", longopts, NULL)) != -1)

+#endif

     {

       switch (optc)

 	{

@@ -113,6 +129,20 @@

 	case 'v': /* --verbose  */

 	  verbose_fmt_string = _("created directory %s");

 	  break;

+#ifdef WITH_SELINUX

+ 	case 'Z':

+ 	  /* politely decline if we're not on a selinux-enabled kernel. */

+	  if( !(is_selinux_enabled()>0)) {

+ 	    fprintf( stderr, "Sorry, --context (-Z) can be used only on "

+ 		             "a selinux-enabled kernel.\n" );

+ 	    exit( 1 );

+ 	  }

+	  if (setfscreatecon(optarg)) {

+ 	    fprintf( stderr, "Sorry, cannot set default context to %s.\n", optarg);

+ 	    exit( 1 );

+ 	  }

+ 	  break;

+#endif

 	case_GETOPT_HELP_CHAR;

 	case_GETOPT_VERSION_CHAR (PROGRAM_NAME, AUTHORS);

 	default:

--- coreutils-5.2.1/src/mv.c.selinux	2004-12-29 12:24:02.845923189 -0500

+++ coreutils-5.2.1/src/mv.c	2004-12-29 12:24:03.424857992 -0500

@@ -34,6 +34,11 @@

 #include "quote.h"

 #include "remove.h"

+#ifdef WITH_SELINUX

+#include <selinux/selinux.h>          /* for is_selinux_enabled() */

+int selinux_enabled=0;

+#endif

+

 /* The official name of this program (e.g., no `g' prefix).  */

 #define PROGRAM_NAME "mv"

@@ -124,6 +129,9 @@

   x->preserve_links = 1;

   x->preserve_mode = 1;

   x->preserve_timestamps = 1;

+#ifdef WITH_SELINUX

+  x->preserve_security_context = 1;

+#endif

   x->require_preserve = 0;  /* FIXME: maybe make this an option */

   x->recursive = 1;

   x->sparse_mode = SPARSE_AUTO;  /* FIXME: maybe make this an option */

@@ -376,6 +384,10 @@

   cp_option_init (&x);

+#ifdef WITH_SELINUX

+  selinux_enabled= (is_selinux_enabled()>0);

+#endif

+

   /* FIXME: consider not calling getenv for SIMPLE_BACKUP_SUFFIX unless

      we'll actually use backup_suffix_string.  */

   backup_suffix_string = getenv ("SIMPLE_BACKUP_SUFFIX");

--- coreutils-5.2.1/src/ls.c.selinux	2004-12-29 12:24:02.848922851 -0500

+++ coreutils-5.2.1/src/ls.c	2004-12-29 12:24:03.429857429 -0500

@@ -121,6 +121,18 @@

 #define AUTHORS "Richard Stallman", "David MacKenzie"

+#ifdef WITH_SELINUX

+#include <selinux/selinux.h>

+int selinux_enabled= 0;

+static int print_scontext       = 0;

+#define check_selinux() if (!selinux_enabled) { \

+	    fprintf( stderr, "Sorry, this option can only be used " \

+		             "on a SELinux kernel.\n" ); \

+	    exit( EXIT_FAILURE ); \

+}

+

+#endif

+

 #define obstack_chunk_alloc malloc

 #define obstack_chunk_free free

@@ -165,7 +177,8 @@

     symbolic_link DT_INIT (DT_LNK),

     sock DT_INIT (DT_SOCK),

     arg_directory DT_INIT (2 * (DT_UNKNOWN | DT_FIFO | DT_CHR | DT_DIR | DT_BLK

-				| DT_REG | DT_LNK | DT_SOCK))

+				| DT_REG | DT_LNK | DT_SOCK)),

+    command_line

   };

 struct fileinfo

@@ -174,6 +187,7 @@

     char *name;

     struct stat stat;

+    int stat_failed;

     /* For symbolic link, name of the file linked to, otherwise zero. */

     char *linkname;

@@ -192,6 +206,10 @@

     /* For long listings, true if the file has an access control list.  */

     bool have_acl;

 #endif

+

+#ifdef WITH_SELINUX

+    security_context_t scontext;

+#endif

   };

 #if HAVE_ACL || USE_ACL

@@ -227,7 +245,8 @@

 static int file_interesting (const struct dirent *next);

 static uintmax_t gobble_file (const char *name, enum filetype type,

 			      int explicit_arg, const char *dirname);

-static void print_color_indicator (const char *name, mode_t mode, int linkok);

+static void print_color_indicator (const char *name, mode_t mode, int linkok,

+				   int stat_failed);

 static void put_indicator (const struct bin_str *ind);

 static int put_indicator_direct (const struct bin_str *ind);

 static void add_ignore_pattern (const char *pattern);

@@ -247,7 +266,7 @@

 static void print_long_format (const struct fileinfo *f);

 static void print_many_per_line (void);

 static void print_name_with_quoting (const char *p, mode_t mode,

-				     int linkok,

+				     int linkok, int stat_failed,

 				     struct obstack *stack);

 static void prep_non_filename_text (void);

 static void print_type_indicator (mode_t mode);

@@ -256,6 +275,9 @@

 static void sort_files (void);

 static void parse_ls_color (void);

 void usage (int status);

+#ifdef WITH_SELINUX

+static void print_scontext_format (const struct fileinfo *f);

+#endif

 /* The name the program was run with, stripped of any leading path. */

 char *program_name;

@@ -354,7 +376,11 @@

     one_per_line,		/* -1 */

     many_per_line,		/* -C */

     horizontal,			/* -x */

-    with_commas			/* -m */

+    with_commas,	        /* -m */

+#ifdef WITH_SELINUX

+    security_format,		/* -Z */

+#endif

+    invalid_format

   };

 static enum format format;

@@ -679,6 +705,11 @@

   SHOW_CONTROL_CHARS_OPTION,

   SI_OPTION,

   SORT_OPTION,

+#ifdef WITH_SELINUX

+  CONTEXT_OPTION,

+  LCONTEXT_OPTION,

+  SCONTEXT_OPTION,

+#endif

   TIME_OPTION,

   TIME_STYLE_OPTION

 };

@@ -722,6 +753,11 @@

   {"time-style", required_argument, 0, TIME_STYLE_OPTION},

   {"color", optional_argument, 0, COLOR_OPTION},

   {"block-size", required_argument, 0, BLOCK_SIZE_OPTION},

+#ifdef WITH_SELINUX

+  {"context", no_argument, 0, CONTEXT_OPTION},

+  {"lcontext", no_argument, 0, LCONTEXT_OPTION},

+  {"scontext", no_argument, 0, SCONTEXT_OPTION},

+#endif

   {"author", no_argument, 0, AUTHOR_OPTION},

   {GETOPT_HELP_OPTION_DECL},

   {GETOPT_VERSION_OPTION_DECL},

@@ -731,13 +767,21 @@

 static char const *const format_args[] =

 {

   "verbose", "long", "commas", "horizontal", "across",

-  "vertical", "single-column", 0

+  "vertical", "single-column", 

+#ifdef WITH_SELINUX

+  "context",

+#endif

+  0

 };

 static enum format const format_types[] =

 {

   long_format, long_format, with_commas, horizontal, horizontal,

-  many_per_line, one_per_line

+  many_per_line, one_per_line,

+#ifdef WITH_SELINUX

+  security_format,

+#endif

+  invalid_format

 };

 static char const *const sort_args[] =

@@ -1101,6 +1145,9 @@

   format_needs_stat = sort_type == sort_time || sort_type == sort_size

     || format == long_format

+#ifdef WITH_SELINUX

+    || format == security_format || print_scontext

+#endif

     || dereference == DEREF_ALWAYS

     || print_block_size || print_inode;

   format_needs_type = (format_needs_stat == 0

@@ -1125,7 +1172,7 @@

   for (; i < argc; i++)

     {

-      gobble_file (argv[i], unknown, 1, "");

+      gobble_file (argv[i], command_line, 1, "");

     }

   if (dir_defaulted)

@@ -1223,6 +1270,11 @@

   /* Record whether there is an option specifying sort type.  */

   int sort_type_specified = 0;

+#ifdef WITH_SELINUX

+  /* 1 iff kernel has new selinux system calls */

+  selinux_enabled= (is_selinux_enabled()>0);

+#endif

+

   qmark_funny_chars = 0;

   /* initialize all switches to default settings */

@@ -1273,6 +1325,9 @@

   all_files = 0;

   really_all_files = 0;

   ignore_patterns = 0;

+#ifdef WITH_SELINUX

+  print_scontext       = 0;

+#endif

   /* FIXME: put this in a function.  */

   {

@@ -1350,7 +1405,7 @@

   }

   while ((c = getopt_long (argc, argv,

-			   "abcdfghiklmnopqrstuvw:xABCDFGHI:LNQRST:UX1",

+			   "abcdfghiklmnopqrstuvw:xABCDFGHI:LNQRST:UX1Z",

 			   long_options, NULL)) != -1)

     {

       switch (c)

@@ -1470,6 +1525,13 @@

 	  format = horizontal;

 	  break;

+#ifdef WITH_SELINUX

+	case 'Z':

+	  check_selinux();

+	  print_scontext = 1;

+	  format = security_format;

+	  break;

+#endif

 	case 'A':

 	  really_all_files = 0;

 	  all_files = 1;

@@ -1637,6 +1699,25 @@

 	case_GETOPT_VERSION_CHAR (PROGRAM_NAME, AUTHORS);

+#ifdef WITH_SELINUX

+

+	case CONTEXT_OPTION: /* new security format */

+		check_selinux();

+		print_scontext = 1;

+		format = security_format;

+		break;

+	case LCONTEXT_OPTION: /* long format plus security context */

+		check_selinux();

+		print_scontext = 1;

+		format = long_format;

+		break;

+	case SCONTEXT_OPTION: /* short form of new security format */

+		check_selinux();

+		print_scontext = 0;

+		format = security_format;

+		break;

+#endif

+

 	default:

 	  usage (EXIT_FAILURE);

 	}

@@ -2300,6 +2381,12 @@

       free (files[i].name);

       if (files[i].linkname)

 	free (files[i].linkname);

+#ifdef WITH_SELINUX

+      if (files[i].scontext) {

+	freecon (files[i].scontext);

+	files[i].scontext=NULL;

+      }

+#endif

     }

   files_index = 0;

@@ -2336,11 +2423,14 @@

   f->linkname = 0;

   f->linkmode = 0;

   f->linkok = 0;

+#ifdef WITH_SELINUX

+  f->scontext = NULL;

+#endif

   if (explicit_arg

       || format_needs_stat

       || (format_needs_type

-	  && (type == unknown

+	  && (type == unknown || type == command_line

 	      /* FIXME: remove this disjunct.

 		 I don't think we care about symlinks here, but for now

@@ -2373,6 +2463,11 @@

 	{

 	case DEREF_ALWAYS: