diff -NuBbwr debian-dir--1.0/control debian-dir-sel--1.0/control
--- debian-dir--1.0/control	2005-03-03 08:01:30.000000000 -0600
+++ debian-dir-sel--1.0/control	2005-03-03 10:38:30.000000000 -0600
@@ -3,7 +3,7 @@
 Section: base
 Priority: required
 Standards-Version: 3.6.0
-Build-Depends: gettext (>= 0.10.37), debhelper, dh-buildinfo, perl-base, texinfo (>= 4.2), groff, help2man, dbs, autoconf (>= 2.57), automake1.8, libattr1-dev | not+linux-gnu, libacl1-dev | not+linux-gnu, bzip2, bison
+Build-Depends: gettext (>= 0.10.37), debhelper, dh-buildinfo, perl-base, texinfo (>= 4.2), groff, help2man, dbs, autoconf (>= 2.57), automake1.8, libattr1-dev | not+linux-gnu, libacl1-dev | not+linux-gnu, bzip2, bison, libselinux1-dev
 Build-Conflicts: automake1.4
 
 Package: coreutils
diff -NuBbwr debian-dir--1.0/coreutils.dirs debian-dir-sel--1.0/coreutils.dirs
--- debian-dir--1.0/coreutils.dirs	2005-03-03 08:01:30.000000000 -0600
+++ debian-dir-sel--1.0/coreutils.dirs	2005-03-03 10:38:30.000000000 -0600
@@ -1,2 +1,3 @@
 bin
+sbin
 usr/share/doc/coreutils
diff -NuBbwr debian-dir--1.0/patches/60_coreutils-pam.patch debian-dir-sel--1.0/patches/60_coreutils-pam.patch
--- debian-dir--1.0/patches/60_coreutils-pam.patch	1969-12-31 18:00:00.000000000 -0600
+++ debian-dir-sel--1.0/patches/60_coreutils-pam.patch	2005-03-03 10:38:30.000000000 -0600
@@ -0,0 +1,408 @@
+# This is version 1.3 of `coreutils-pam.patch', which was snarfed from
+# Fedora Core CVS at the URL listed below.  It was necessary to cleanup
+# some leading-directory names in order to keep the build system happy,
+# as DBS applies patches using the `-p0' option, but no other modifications
+# (aside from insertion of this header) have been made.
+#
+#	http://cvs.fedora.redhat.com/viewcvs/devel/coreutils/coreutils-pam.patch?rev=1.3&view=auto
+#
+# -- Greg Norris <adric@debian.org>  Sat, 15 Jan 2005 12:41:05 -0600
+#
+--- coreutils-5.2.1/src/Makefile.am.pam	2004-02-23 17:40:54.000000000 +0000
++++ coreutils-5.2.1/src/Makefile.am	2004-02-23 17:40:54.000000000 +0000
+@@ -66,7 +66,7 @@
+ 
+ uptime_LDADD = $(LDADD) $(GETLOADAVG_LIBS)
+ 
+-su_LDADD = $(LDADD) $(LIB_CRYPT)
++su_LDADD = $(LDADD) $(LIB_CRYPT) @LIB_PAM@
+ 
+ $(PROGRAMS): ../lib/libfetish.a
+ 
+--- coreutils-5.2.1/src/su.c	2004-02-23 17:40:54.000000000 +0000
++++ coreutils-5.2.1/src/su.c	2004-12-06 15:47:07.082619911 +0000
+@@ -38,6 +38,16 @@
+    restricts who can su to UID 0 accounts.  RMS considers that to
+    be fascist.
+ 
++#ifdef USE_PAM
++
++   Actually, with PAM, su has nothing to do with whether or not a
++   wheel group is enforced by su.  RMS tries to restrict your access
++   to a su which implements the wheel group, but PAM considers that
++   to be fascist, and gives the user/sysadmin the opportunity to
++   enforce a wheel group by proper editing of /etc/pam.conf
++
++#endif
++
+    Options:
+    -, -l, --login	Make the subshell a login shell.
+ 			Unset all environment variables except
+@@ -81,6 +91,14 @@
+    prototype (returning `int') in <unistd.h>.  */
+ #define getusershell _getusershell_sys_proto_
+ 
++#ifdef USE_PAM
++# include <security/pam_appl.h>
++# include <security/pam_misc.h>
++# include <signal.h>
++# include <sys/wait.h>
++# include <sys/fsuid.h>
++#endif /* USE_PAM */
++
+ #include "system.h"
+ #include "dirname.h"
+ 
+@@ -150,7 +168,9 @@
+ /* The user to become if none is specified.  */
+ #define DEFAULT_USER "root"
+ 
++#ifndef USE_PAM
+ char *crypt ();
++#endif
+ char *getpass ();
+ char *getusershell ();
+ void endusershell ();
+@@ -158,8 +178,12 @@
+ 
+ extern char **environ;
+ 
+-static void run_shell (const char *, const char *, char **)
++static void run_shell (const char *, const char *, char **, const struct passwd *)
++#ifdef USE_PAM
++     ;
++#else
+      ATTRIBUTE_NORETURN;
++#endif
+ 
+ /* The name this program was run with.  */
+ char *program_name;
+@@ -271,7 +295,22 @@
+ }
+ #endif
+ 
++#ifdef USE_PAM
++static pam_handle_t *pamh = NULL;
++static int retval;
++static struct pam_conv conv = {
++  misc_conv,
++  NULL
++};
++
++#define PAM_BAIL_P if (retval) { \
++  pam_end(pamh, PAM_SUCCESS); \
++  return 0; \
++}
++#endif
++
+ /* Ask the user for a password.
++   If PAM is in use, let PAM ask for the password if necessary.
+    Return 1 if the user gives the correct password for entry PW,
+    0 if not.  Return 1 without asking for a password if run by UID 0
+    or if PW has an empty password.  */
+@@ -279,6 +318,34 @@
+ static int
+ correct_password (const struct passwd *pw)
+ {
++#ifdef USE_PAM
++  struct passwd *caller;
++  retval = pam_start(PROGRAM_NAME, pw->pw_name, &conv, &pamh);
++  PAM_BAIL_P;
++
++  if (getuid() != 0 && !isatty(0)) {
++	fprintf(stderr, "standard in must be a tty\n");
++	exit(1);
++  }
++
++  caller = getpwuid(getuid());
++  if(caller != NULL && caller->pw_name != NULL) {
++	  retval = pam_set_item(pamh, PAM_RUSER, caller->pw_name);
++	  PAM_BAIL_P;
++  }
++
++  retval = pam_authenticate(pamh, 0);
++  PAM_BAIL_P;
++  retval = pam_acct_mgmt(pamh, 0);
++  if (retval == PAM_NEW_AUTHTOK_REQD) {
++    /* password has expired.  Offer option to change it. */
++    retval = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
++    PAM_BAIL_P;
++  }
++  PAM_BAIL_P;
++  /* must be authenticated if this point was reached */
++  return 1;
++#else /* !USE_PAM */
+   char *unencrypted, *encrypted, *correct;
+ #if HAVE_GETSPNAM && HAVE_STRUCT_SPWD_SP_PWDP
+   /* Shadow passwd stuff for SVR3 and maybe other systems.  */
+@@ -303,6 +370,7 @@
+   encrypted = crypt (unencrypted, correct);
+   memset (unencrypted, 0, strlen (unencrypted));
+   return strcmp (encrypted, correct) == 0;
++#endif /* !USE_PAM */
+ }
+ 
+ /* Update `environ' for the new shell based on PW, with SHELL being
+@@ -312,16 +380,24 @@
+ modify_environment (const struct passwd *pw, const char *shell)
+ {
+   char *term;
++  char *display;
++  char *xauthority;
+ 
+   if (simulate_login)
+     {
+-      /* Leave TERM unchanged.  Set HOME, SHELL, USER, LOGNAME, PATH.
++      /* Leave TERM, DISPLAY, XAUTHORITY unchanged.  Set HOME, SHELL, USER, LOGNAME, PATH.
+          Unset all other environment variables.  */
+       term = getenv ("TERM");
++      display = getenv ("DISPLAY");
++      xauthority = getenv ("XAUTHORITY");
+       environ = xmalloc (2 * sizeof (char *));
+       environ[0] = 0;
+       if (term)
+ 	xputenv (concat ("TERM", "=", term));
++      if (display)
++	xputenv (concat ("DISPLAY", "=", display));
++      if (xauthority)
++	xputenv (concat ("XAUTHORITY", "=", xauthority));
+       xputenv (concat ("HOME", "=", pw->pw_dir));
+       xputenv (concat ("SHELL", "=", shell));
+       xputenv (concat ("USER", "=", pw->pw_name));
+@@ -358,22 +434,73 @@
+     error (EXIT_FAIL, errno, _("cannot set groups"));
+   endgrent ();
+ #endif
++#ifdef USE_PAM
++  retval = pam_setcred(pamh, PAM_ESTABLISH_CRED);
++  if (retval != PAM_SUCCESS)
++    error (1, 0, pam_strerror(pamh, retval));
++#endif /* USE_PAM */
+   if (setgid (pw->pw_gid))
+     error (EXIT_FAIL, errno, _("cannot set group id"));
+   if (setuid (pw->pw_uid))
+     error (EXIT_FAIL, errno, _("cannot set user id"));
+ }
+ 
++#ifdef USE_PAM
++static int caught=0;
++/* Signal handler for parent process later */
++static void su_catch_sig(int sig)
++{
++  ++caught;
++}
++
++int
++pam_copyenv (pam_handle_t *pamh)
++{
++  char **env;
++
++  env = pam_getenvlist(pamh);
++  if(env) {
++    while(*env) {
++	xputenv(*env);
++	env++;
++    }
++  }
++  return(0);
++}
++#endif
++
+ /* Run SHELL, or DEFAULT_SHELL if SHELL is empty.
+    If COMMAND is nonzero, pass it to the shell with the -c option.
+    If ADDITIONAL_ARGS is nonzero, pass it to the shell as more
+    arguments.  */
+ 
+ static void
+-run_shell (const char *shell, const char *command, char **additional_args)
++run_shell (const char *shell, const char *command, char **additional_args, const struct passwd *pw)
+ {
+   const char **args;
+   int argno = 1;
++#ifdef USE_PAM
++  int child;
++  sigset_t ourset;
++  int status;
++
++  retval = pam_open_session(pamh,0);
++  if (retval != PAM_SUCCESS) {
++    fprintf (stderr, "could not open session\n");
++    exit (1);
++  }
++
++/* do this at the last possible moment, because environment variables may
++   be passed even in the session phase
++*/
++  if(pam_copyenv(pamh) != PAM_SUCCESS)
++     fprintf (stderr, "error copying PAM environment\n");
++  
++  child = fork();
++  if (child == 0) {  /* child shell */
++  change_identity (pw);
++  pam_end(pamh, 0);
++#endif
+ 
+   if (additional_args)
+     args = xmalloc (sizeof (char *)
+@@ -385,6 +512,9 @@
+       char *arg0;
+       char *shell_basename;
+ 
++      if(chdir(pw->pw_dir))
++	      error(0, errno, _("warning: cannot change directory to %s"), pw->pw_dir);
++
+       shell_basename = base_name (shell);
+       arg0 = xmalloc (strlen (shell_basename) + 2);
+       arg0[0] = '-';
+@@ -411,6 +541,61 @@
+     error (0, errno, "%s", shell);
+     exit (exit_status);
+   }
++#ifdef USE_PAM
++  } else if (child == -1) {
++      fprintf(stderr, "can not fork user shell: %s", strerror(errno));
++      exit(1);
++  }
++  /* parent only */
++  sigfillset(&ourset);
++  if (sigprocmask(SIG_BLOCK, &ourset, NULL)) {
++    fprintf(stderr, "%s: signal malfunction\n", PROGRAM_NAME);
++    caught = 1;
++  }
++  if (!caught) {
++    struct sigaction action;
++    action.sa_handler = su_catch_sig;
++    sigemptyset(&action.sa_mask);
++    action.sa_flags = 0;
++    sigemptyset(&ourset);
++    if (sigaddset(&ourset, SIGTERM)
++        || sigaddset(&ourset, SIGALRM)
++        || sigaction(SIGTERM, &action, NULL)
++        || sigprocmask(SIG_UNBLOCK, &ourset, NULL)) {
++      fprintf(stderr, "%s: signal masking malfunction\n", PROGRAM_NAME);
++      caught = 1;
++    }
++  }
++  if (!caught) {
++    do {
++      int pid;
++
++      pid = waitpid(-1, &status, WUNTRACED);
++
++      if (WIFSTOPPED(status)) {
++          kill(getpid(), SIGSTOP);
++          /* once we get here, we must have resumed */
++          kill(pid, SIGCONT);
++      }
++    } while (WIFSTOPPED(status));
++  }
++
++  if (caught) {
++    fprintf(stderr, "\nSession terminated, killing shell...");
++    kill (child, SIGTERM);
++  }
++  retval = pam_close_session(pamh, 0);
++  PAM_BAIL_P;
++  retval = pam_end(pamh, PAM_SUCCESS);
++  PAM_BAIL_P;
++  if (caught) {
++    sleep(2);
++    kill(child, SIGKILL);
++    fprintf(stderr, " ...killed.\n");
++    exit(-1);
++  }
++  exit (WEXITSTATUS(status));
++#endif /* USE_PAM */
+ }
+ 
+ /* Return 1 if SHELL is a restricted shell (one not returned by
+@@ -588,7 +773,8 @@
+ 
++
++#ifndef USE_PAM
+   change_identity (pw);
+-  if (simulate_login && chdir (pw->pw_dir))
+-    error (0, errno, _("warning: cannot change directory to %s"), pw->pw_dir);
++#endif
+ 
+-  run_shell (shell, command, additional_args);
++  run_shell (shell, command, additional_args, pw);
+ }
+--- coreutils-5.2.1/configure.ac.pam	2004-02-23 17:40:54.000000000 +0000
++++ coreutils-5.2.1/configure.ac	2004-02-23 17:40:54.000000000 +0000
+@@ -7,6 +7,13 @@
+ 
+ AM_INIT_AUTOMAKE([1.8 gnits dist-bzip2])
+ 
++dnl Give the chance to enable PAM
++AC_ARG_ENABLE(pam, dnl
++[  --enable-pam              Enable use of the PAM libraries],
++[AC_DEFINE(USE_PAM, 1, [Define if you want to use PAM])
++LIB_PAM="-ldl -lpam -lpam_misc"
++AC_SUBST(LIB_PAM)])
++
+ gl_DEFAULT_POSIX2_VERSION
+ gl_USE_SYSTEM_EXTENSIONS
+ jm_PERL
+--- coreutils-5.2.1/config.hin.pam	2004-02-23 17:40:54.000000000 +0000
++++ coreutils-5.2.1/config.hin	2004-02-23 17:40:54.000000000 +0000
+@@ -1365,6 +1365,9 @@
+ /* Define if you want access control list support. */
+ #undef USE_ACL
+ 
++/* Define if you want to use PAM */
++#undef USE_PAM
++
+ /* Version number of package */
+ #undef VERSION
+ 
+--- coreutils-5.2.1/doc/coreutils.texi.pam	2004-05-18 11:41:14.026354659 +0100
++++ coreutils-5.2.1/doc/coreutils.texi	2004-05-18 11:48:27.056915340 +0100
+@@ -11855,8 +11855,11 @@
+ @findex syslog
+ @command{su} can optionally be compiled to use @code{syslog} to report
+ failed, and optionally successful, @command{su} attempts.  (If the system
+-supports @code{syslog}.)  However, GNU @command{su} does not check if the
+-user is a member of the @code{wheel} group; see below.
++supports @code{syslog}.)
++
++This version of @command{su} has support for using PAM for
++authentication.  You can edit @file{/etc/pam.d/su} to customize its
++behaviour.
+ 
+ The program accepts the following options.  Also see @ref{Common options}.
+ 
+@@ -11937,33 +11940,6 @@
+ the exit status of the subshell otherwise
+ @end display
+ 
+-@cindex wheel group, not supported
+-@cindex group wheel, not supported
+-@cindex fascism
+-@subsection Why GNU @command{su} does not support the @samp{wheel} group
+-
+-(This section is by Richard Stallman.)
+-
+-@cindex Twenex
+-@cindex MIT AI lab
+-Sometimes a few of the users try to hold total power over all the
+-rest.  For example, in 1984, a few users at the MIT AI lab decided to
+-seize power by changing the operator password on the Twenex system and
+-keeping it secret from everyone else.  (I was able to thwart this coup
+-and give power back to the users by patching the kernel, but I
+-wouldn't know how to do that in Unix.)
+-
+-However, occasionally the rulers do tell someone.  Under the usual
+-@command{su} mechanism, once someone learns the root password who
+-sympathizes with the ordinary users, he or she can tell the rest.  The
+-``wheel group'' feature would make this impossible, and thus cement the
+-power of the rulers.
+-
+-I'm on the side of the masses, not that of the rulers.  If you are
+-used to supporting the bosses and sysadmins in whatever they do, you
+-might find this idea strange at first.
+-
+-
+ @node Process control
+ @chapter Process control
+ 
diff -NuBbwr debian-dir--1.0/patches/61_coreutils-5.2.1-runuser.patch debian-dir-sel--1.0/patches/61_coreutils-5.2.1-runuser.patch
--- debian-dir--1.0/patches/61_coreutils-5.2.1-runuser.patch	1969-12-31 18:00:00.000000000 -0600
+++ debian-dir-sel--1.0/patches/61_coreutils-5.2.1-runuser.patch	2005-03-03 10:38:30.000000000 -0600
@@ -0,0 +1,232 @@
+# This is version 1.5 of `coreutils-5.2.1-runuser.patch', which was snarfed
+# from Fedora Core CVS at the URL listed below.  It applies cleanly to the
+# Debianized coreutils sources, so at this point no modifications (aside
+# from insertion of this header) have been made.
+#
+#	http://cvs.fedora.redhat.com/viewcvs/devel/coreutils/coreutils-5.2.1-runuser.patch?rev=1.5&view=auto
+#
+# -- Greg Norris <adric@debian.org>  Sat, 15 Jan 2005 12:45:57 -0600
+#
+--- /dev/null	2004-09-30 04:21:43.103661032 -0400
++++ coreutils-5.2.1/man/runuser.1	2004-10-05 09:56:25.919169327 -0400
+@@ -0,0 +1,59 @@
++.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.33.
++.TH RUNUSER "1" "September 2004" "runuser (coreutils) 5.2.1" "User Commands"
++.SH NAME
++runuser \- run a shell with substitute user and group IDs, similar to su, but will not prompt for password.
++.SH SYNOPSIS
++.B runuser
++[\fIOPTION\fR]... [\fI-\fR] [\fIUSER \fR[\fIARG\fR]...]
++.SH DESCRIPTION
++.\" Add any additional description here
++.PP
++Change the effective user id and group id to that of USER.
++.TP
++-, \fB\-l\fR, \fB\-\-login\fR
++make the shell a login shell
++.TP
++\fB\-c\fR, \fB\-\-commmand\fR=\fICOMMAND\fR
++pass a single COMMAND to the shell with \fB\-c\fR
++.TP
++\fB\-f\fR, \fB\-\-fast\fR
++pass \fB\-f\fR to the shell (for csh or tcsh)
++.TP
++\fB\-m\fR, \fB\-\-preserve\-environment\fR
++do not reset environment variables
++.TP
++\fB\-p\fR
++same as \fB\-m\fR
++.TP
++\fB\-s\fR, \fB\-\-shell\fR=\fISHELL\fR
++run SHELL if /etc/shells allows it
++.TP
++\fB\-\-help\fR
++display this help and exit
++.TP
++\fB\-\-version\fR
++output version information and exit
++.PP
++A mere - implies \fB\-l\fR.   If USER not given, assume root.
++.SH AUTHOR
++Written by David MacKenzie, Dan Walsh.
++.SH "REPORTING BUGS"
++Report bugs to <bug-coreutils@gnu.org>.
++.SH COPYRIGHT
++Copyright \(co 2004 Free Software Foundation, Inc.
++.br
++This is free software; see the source for copying conditions.  There is NO
++warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
++.SH "SEE ALSO"
++Since this command is trimmed down version of su use you can use the su manual.
++The full documentation for
++.B su
++is maintained as a Texinfo manual.  If the
++.B info
++and
++.B su
++programs are properly installed at your site, the command
++.IP
++.B info coreutils su
++.PP
++should give you access to the complete manual.
+--- coreutils-5.2.1/man/Makefile.am.runuser	2004-01-23 10:54:23.000000000 -0500
++++ coreutils-5.2.1/man/Makefile.am	2004-10-05 09:56:25.921169102 -0400
+@@ -7,7 +7,7 @@
+   link.1 ln.1 logname.1 \
+   ls.1 md5sum.1 mkdir.1 mkfifo.1 mknod.1 mv.1 nice.1 nl.1 nohup.1 od.1 \
+   paste.1 pathchk.1 pinky.1 pr.1 printenv.1 printf.1 ptx.1 pwd.1 readlink.1 \
+-  rm.1 rmdir.1 seq.1 sha1sum.1 shred.1 sleep.1 sort.1 split.1 stat.1 stty.1 \
++  rm.1 rmdir.1 runuser.1 seq.1 sha1sum.1 shred.1 sleep.1 sort.1 split.1 stat.1 stty.1 \
+   su.1 sum.1 sync.1 tac.1 tail.1 tee.1 test.1 touch.1 tr.1 true.1 tsort.1 \
+   tty.1 uname.1 unexpand.1 uniq.1 unlink.1 uptime.1 users.1 vdir.1 wc.1 \
+   who.1 whoami.1 yes.1
+@@ -81,6 +81,7 @@
+ readlink.1:	$(common_dep)	$(srcdir)/readlink.x	../src/readlink.c
+ rm.1:		$(common_dep)	$(srcdir)/rm.x		../src/rm.c
+ rmdir.1:	$(common_dep)	$(srcdir)/rmdir.x	../src/rmdir.c
++runuser.1:	$(common_dep)	$(srcdir)/runuser.x	../src/runuser.c
+ seq.1:		$(common_dep)	$(srcdir)/seq.x		../src/seq.c
+ sha1sum.1:	$(common_dep)	$(srcdir)/sha1sum.x	../src/md5sum.c
+ shred.1:	$(common_dep)	$(srcdir)/shred.x	../src/shred.c
+--- /dev/null	2004-09-30 04:21:43.103661032 -0400
++++ coreutils-5.2.1/man/runuser.x	2004-10-05 09:56:25.922168989 -0400
+@@ -0,0 +1,4 @@
++[NAME]
++runuser \- run a shell with substitute user and group IDs
++[DESCRIPTION]
++.\" Add any additional description here
+--- coreutils-5.2.1/README.runuser	2004-01-18 02:59:41.000000000 -0500
++++ coreutils-5.2.1/README	2004-10-05 09:56:25.925168651 -0400
+@@ -11,7 +11,7 @@
+   df dir dircolors dirname du echo env expand expr factor false fmt fold
+   ginstall groups head hostid hostname id join kill link ln logname ls
+   md5sum mkdir mkfifo mknod mv nice nl nohup od paste pathchk pinky pr
+-  printenv printf ptx pwd readlink rm rmdir seq sha1sum shred sleep sort
++  printenv printf ptx pwd readlink rm rmdir runuser seq sha1sum shred sleep sort
+   split stat stty su sum sync tac tail tee test touch tr true tsort tty
+   uname unexpand uniq unlink uptime users vdir wc who whoami yes
+ 
+--- coreutils-5.2.1/tests/help-version.runuser	2004-02-17 11:04:23.000000000 -0500
++++ coreutils-5.2.1/tests/help-version	2004-10-05 09:56:25.924168764 -0400
+@@ -130,6 +130,7 @@
+ seq_args=10
+ sleep_args=0
+ su_args=--version
++runuser_args=--version
+ test_args=foo
+ 
+ # This is necessary in the unusual event that there is
+--- coreutils-5.2.1/src/su.c.runuser	2004-10-05 09:56:25.680196251 -0400
++++ coreutils-5.2.1/src/su.c	2004-10-05 09:56:25.915169778 -0400
+@@ -171,6 +171,10 @@
+ #ifndef USE_PAM
+ char *crypt ();
+ #endif
++#ifndef CHECKPASSWD
++#define CHECKPASSWD 1
++#endif
++
+ char *getpass ();
+ char *getusershell ();
+ void endusershell ();
+@@ -740,7 +744,7 @@
+   pw->pw_dir = xstrdup (pw->pw_dir);
+   pw->pw_shell = xstrdup (pw->pw_shell);
+ 
+-  if (!correct_password (pw))
++  if (CHECKPASSWD && !correct_password (pw))
+     {
+ #ifdef SYSLOG_FAILURE
+       log_su (pw, 0);
+--- coreutils-5.2.1/src/Makefile.am.runuser	2004-10-05 09:56:25.677196589 -0400
++++ coreutils-5.2.1/src/Makefile.am	2004-10-05 09:56:25.916169665 -0400
+@@ -1,6 +1,6 @@
+ ## Process this file with automake to produce Makefile.in -*-Makefile-*-
+ 
+-EXTRA_PROGRAMS = chroot df hostid nice pinky stty su uname uptime users who
++EXTRA_PROGRAMS = chroot df hostid nice pinky stty su runuser uname uptime users who
+ 
+ bin_SCRIPTS = groups
+ bin_PROGRAMS = [ chgrp chown chmod cp dd dircolors du \
+@@ -67,6 +67,7 @@
+ uptime_LDADD = $(LDADD) $(GETLOADAVG_LIBS)
+ 
+ su_LDADD = $(LDADD) $(LIB_CRYPT) @LIB_PAM@
++runuser_LDADD = $(LDADD) $(LIB_CRYPT) 
+ 
+ $(PROGRAMS): ../lib/libfetish.a
+ 
+@@ -84,7 +85,7 @@
+ 	chmod +x $@-t
+ 	mv $@-t $@
+ 
+-all-local: su$(EXEEXT)
++all-local: su$(EXEEXT) runuser
+ 
+ installed_su = $(DESTDIR)$(bindir)/`echo su|sed '$(transform)'`
+ 
+@@ -100,7 +101,7 @@
+   chmod $(setuid_root_mode) $(installed_su)
+ 
+ install-root: su$(EXEEXT)
+-	@$(INSTALL_SU)
++	@$(INSTALL_SU)	
+ 
+ install-exec-local: su$(EXEEXT)
+ 	@TMPFILE=$(DESTDIR)$(bindir)/.su-$$$$; \
+--- /dev/null	2004-09-30 04:21:43.103661032 -0400
++++ coreutils-5.2.1/src/runuser.c	2004-10-05 10:04:28.835490381 -0400
+@@ -0,0 +1,53 @@
++#define CHECKPASSWD 0
++#define pam_start my_pam_start
++#define pam_end my_pam_end
++#define pam_setcred my_pam_setcred
++#define pam_open_session my_pam_open_session
++#define pam_close_session my_pam_close_session
++#define pam_strerror my_pam_strerror
++#define pam_getenvlist my_pam_getenvlist
++#include "su.c"
++int pam_start(const char *service_name, const char *user,
++		     const struct pam_conv *pam_conversation,
++	      pam_handle_t **pamh) {
++	return PAM_SUCCESS;
++}
++int pam_end(pam_handle_t *pamh, int pam_status) {
++	return PAM_SUCCESS;
++}
++int pam_setcred(pam_handle_t *pamh, int flags){
++	return PAM_SUCCESS;
++}
++int pam_open_session(pam_handle_t *pamh, int flags){
++	return PAM_SUCCESS;
++}
++int pam_close_session(pam_handle_t *pamh, int flags){
++	return PAM_SUCCESS;
++}
++const char *pam_strerror(pam_handle_t *pamh, int err){
++	return "";
++}
++char **pam_getenvlist(pam_handle_t *pamh){
++	return NULL;
++}
++
++int misc_conv(int num_msg, const struct pam_message **msgm,
++	      struct pam_response **response, void *appdata_ptr) {
++	return PAM_SUCCESS;
++}
++
++int pam_authenticate(pam_handle_t *pamh, int flags) {
++	return PAM_SUCCESS;
++}
++
++int pam_acct_mgmt(pam_handle_t *pamh, int flags) {
++	return PAM_SUCCESS;
++}
++
++int pam_chauthtok (pam_handle_t *pamh, int flags) {
++	return PAM_SUCCESS;
++}
++
++int pam_set_item(pam_handle_t *pamh, int item_type, const void *item) {
++	return PAM_SUCCESS;
++}
diff -NuBbwr debian-dir--1.0/patches/62_coreutils-selinux.patch debian-dir-sel--1.0/patches/62_coreutils-selinux.patch
--- debian-dir--1.0/patches/62_coreutils-selinux.patch	1969-12-31 18:00:00.000000000 -0600
+++ debian-dir-sel--1.0/patches/62_coreutils-selinux.patch	2005-03-03 10:38:30.000000000 -0600
@@ -0,0 +1,2855 @@
+# This is version 1.10 of `coreutils-selinux.patch', which was snarfed from
+# Fedora Core CVS at the URL listed below.  It required minor cleanup (manual
+# fuzzing of offsets) in order to apply to the Debianized coreutils sources,
+# but is otherwise unmodified (aside from insertion of this header).
+#
+#	http://cvs.fedora.redhat.com/viewcvs/devel/coreutils/coreutils-selinux.patch?rev=1.10&view=auto
+#
+# -- Greg Norris <adric@debian.org>  Sat, 15 Jan 2005 12:51:23 -0600
+#
+diff -urN coreutils-5.2.1.orig/config.hin coreutils-5.2.1/config.hin
+--- coreutils-5.2.1.orig/config.hin	2005-01-15 12:04:33.000000000 -0600
++++ coreutils-5.2.1/config.hin	2005-01-15 12:09:49.000000000 -0600
+@@ -1377,6 +1377,9 @@
+ /* Define if sys/ptem.h is required for struct winsize. */
+ #undef WINSIZE_IN_PTEM
+ 
++/* Define if you want to use SELINUX */
++#undef WITH_SELINUX
++
+ /* Define to 1 if your processor stores words with the most significant byte
+    first (like Motorola and SPARC, unlike Intel and VAX). */
+ #undef WORDS_BIGENDIAN
+diff -urN coreutils-5.2.1.orig/configure.ac coreutils-5.2.1/configure.ac
+--- coreutils-5.2.1.orig/configure.ac	2005-01-15 12:04:33.000000000 -0600
++++ coreutils-5.2.1/configure.ac	2005-01-15 12:09:49.000000000 -0600
+@@ -14,6 +14,13 @@
+ LIB_PAM="-ldl -lpam -lpam_misc"
+ AC_SUBST(LIB_PAM)])
+ 
++dnl Give the chance to enable SELINUX
++AC_ARG_ENABLE(selinux, dnl
++[  --enable-selinux              Enable use of the SELINUX libraries],
++[AC_DEFINE(WITH_SELINUX, 1, [Define if you want to use SELINUX])
++LIB_SELINUX="-lselinux"
++AC_SUBST(LIB_SELINUX)])
++
+ gl_DEFAULT_POSIX2_VERSION
+ gl_USE_SYSTEM_EXTENSIONS
+ jm_PERL
+diff -urN coreutils-5.2.1.orig/man/chcon.1 coreutils-5.2.1/man/chcon.1
+--- coreutils-5.2.1.orig/man/chcon.1	1969-12-31 18:00:00.000000000 -0600
++++ coreutils-5.2.1/man/chcon.1	2005-01-15 12:09:49.000000000 -0600
+@@ -0,0 +1,64 @@
++.TH CHCON 1 "July 2003" "chcon (coreutils) 5.0" "User Commands"
++.SH NAME
++chcon \- change security context
++.SH SYNOPSIS
++.B chcon
++[\fIOPTION\fR]...\fI CONTEXT FILE\fR...
++.br
++.B chcon
++[\fIOPTION\fR]...\fI --reference=RFILE FILE\fR...
++.SH DESCRIPTION
++.PP
++." Add any additional description here
++.PP
++Change the security context of each FILE to CONTEXT.
++.TP
++\fB\-c\fR, \fB\-\-changes\fR
++like verbose but report only when a change is made
++.TP
++\fB\-h\fR, \fB\-\-no\-dereference\fR
++affect symbolic links instead of any referenced file (available only on systems with lchown system call)
++.TP
++\fB\-f\fR, \fB\-\-silent\fR, \fB\-\-quiet\fR
++suppress most error messages
++.TP
++\fB\-l\fR, \fB\-\-range\fR
++set range RANGE in the target security context
++.TP
++\fB\-\-reference\fR=\fIRFILE\fR
++use RFILE's context instead of using a CONTEXT value
++.TP
++\fB\-R\fR, \fB\-\-recursive\fR
++change files and directories recursively
++.TP
++\fB\-r\fR, \fB\-\-role\fR
++set role ROLE in the target security context
++.TP
++\fB\-t\fR, \fB\-\-type\fR
++set type TYPE in the target security context
++.TP
++\fB\-u\fR, \fB\-\-user\fR
++set user USER in the target security context
++.TP
++\fB\-v\fR, \fB\-\-verbose\fR
++output a diagnostic for every file processed
++.TP
++\fB\-\-help\fR
++display this help and exit
++.TP
++\fB\-\-version\fR
++output version information and exit
++.SH "REPORTING BUGS"
++Report bugs to <email@host.com>.
++.SH "SEE ALSO"
++The full documentation for
++.B chcon
++is maintained as a Texinfo manual.  If the
++.B info
++and
++.B chcon
++programs are properly installed at your site, the command
++.IP
++.B info chcon
++.PP
++should give you access to the complete manual.
+diff -urN coreutils-5.2.1.orig/man/chcon.x coreutils-5.2.1/man/chcon.x
+--- coreutils-5.2.1.orig/man/chcon.x	1969-12-31 18:00:00.000000000 -0600
++++ coreutils-5.2.1/man/chcon.x	2005-01-15 12:09:49.000000000 -0600
+@@ -0,0 +1,4 @@
++[NAME]
++chcon \- change file security context
++[DESCRIPTION]
++.\" Add any additional description here
+diff -urN coreutils-5.2.1.orig/man/cp.1 coreutils-5.2.1/man/cp.1
+--- coreutils-5.2.1.orig/man/cp.1	2004-03-02 16:51:05.000000000 -0600
++++ coreutils-5.2.1/man/cp.1	2005-01-15 12:09:49.000000000 -0600
+@@ -57,7 +57,7 @@
+ .TP
+ \fB\-\-preserve\fR[=\fIATTR_LIST\fR]
+ preserve the specified attributes (default:
+-mode,ownership,timestamps), if possible
++mode,ownership,timestamps) and security contexts, if possible
+ additional attributes: links, all
+ .TP
+ \fB\-\-no\-preserve\fR=\fIATTR_LIST\fR
+@@ -109,6 +109,9 @@
+ \fB\-\-help\fR
+ display this help and exit
+ .TP
++\fB\-Z\fR, \fB\-\-context\fR=\fICONTEXT\fR
++set security context of copy to CONTEXT
++.TP
+ \fB\-\-version\fR
+ output version information and exit
+ .PP
+diff -urN coreutils-5.2.1.orig/man/dir.1 coreutils-5.2.1/man/dir.1
+--- coreutils-5.2.1.orig/man/dir.1	2004-03-02 16:51:06.000000000 -0600
++++ coreutils-5.2.1/man/dir.1	2005-01-15 12:09:49.000000000 -0600
+@@ -195,6 +195,20 @@
+ .TP
+ \fB\-1\fR
+ list one file per line
++.PP
++SELINUX options:
++.TP
++\fB\-\-lcontext\fR
++Display security context.   Enable \fB\-l\fR. Lines
++will probably be too wide for most displays.
++.TP
++\fB\-\-context\fR
++Display security context so it fits on most
++displays.  Displays only mode, user, group,
++security context and file name.
++.TP
++\fB\-\-scontext\fR
++Display only security context and file name.
+ .TP
+ \fB\-\-help\fR
+ display this help and exit
+diff -urN coreutils-5.2.1.orig/man/id.1 coreutils-5.2.1/man/id.1
+--- coreutils-5.2.1.orig/man/id.1	2004-03-02 16:52:27.000000000 -0600
++++ coreutils-5.2.1/man/id.1	2005-01-15 12:09:49.000000000 -0600
+@@ -13,6 +13,9 @@
+ \fB\-a\fR
+ ignore, for compatibility with other versions
+ .TP
++\fB\-Z\fR, \fB\-\-context\fR
++print only the security context
++.TP
+ \fB\-g\fR, \fB\-\-group\fR
+ print only the effective group ID
+ .TP
+diff -urN coreutils-5.2.1.orig/man/install.1 coreutils-5.2.1/man/install.1
+--- coreutils-5.2.1.orig/man/install.1	2004-03-02 16:52:27.000000000 -0600
++++ coreutils-5.2.1/man/install.1	2005-01-15 12:09:49.000000000 -0600
+@@ -56,6 +56,11 @@
+ .TP
+ \fB\-v\fR, \fB\-\-verbose\fR
+ print the name of each directory as it is created
++.HP
++\fB\-P\fR, \fB\-\-preserve_context\fR (SELinux) Preserve security context
++.TP
++\fB\-Z\fR, \fB\-\-context\fR=\fICONTEXT\fR
++(SELinux) Set security context of files and directories
+ .TP
+ \fB\-\-help\fR
+ display this help and exit
+diff -urN coreutils-5.2.1.orig/man/ls.1 coreutils-5.2.1/man/ls.1
+--- coreutils-5.2.1.orig/man/ls.1	2004-03-02 16:52:28.000000000 -0600
++++ coreutils-5.2.1/man/ls.1	2005-01-15 12:09:49.000000000 -0600
+@@ -195,6 +195,20 @@
+ .TP
+ \fB\-1\fR
+ list one file per line
++.PP
++SELinux options:
++.TP
++\fB\-\-lcontext\fR
++Display security context.   Enable \fB\-l\fR. Lines
++will probably be too wide for most displays.
++.TP
++\fB\-Z\fR, \fB\-\-context\fR
++Display security context so it fits on most
++displays.  Displays only mode, user, group,
++security context and file name.
++.TP
++\fB\-\-scontext\fR
++Display only security context and file name.
+ .TP
+ \fB\-\-help\fR
+ display this help and exit
+diff -urN coreutils-5.2.1.orig/man/Makefile.am coreutils-5.2.1/man/Makefile.am
+--- coreutils-5.2.1.orig/man/Makefile.am	2005-01-15 12:04:40.000000000 -0600
++++ coreutils-5.2.1/man/Makefile.am	2005-01-15 12:09:49.000000000 -0600
+@@ -10,7 +10,7 @@
+   rm.1 rmdir.1 runuser.1 seq.1 sha1sum.1 shred.1 sleep.1 sort.1 split.1 stat.1 stty.1 \
+   su.1 sum.1 sync.1 tac.1 tail.1 tee.1 test.1 touch.1 tr.1 true.1 tsort.1 \
+   tty.1 uname.1 unexpand.1 uniq.1 unlink.1 uptime.1 users.1 vdir.1 wc.1 \
+-  who.1 whoami.1 yes.1
++  who.1 whoami.1 yes.1 chcon.1 runcon.1
+ 
+ man_aux = $(dist_man_MANS:.1=.x)
+ 
+@@ -113,6 +113,8 @@
+ who.1:		$(common_dep)	$(srcdir)/who.x		../src/who.c
+ whoami.1:	$(common_dep)	$(srcdir)/whoami.x	../src/whoami.c
+ yes.1:		$(common_dep)	$(srcdir)/yes.x		../src/yes.c
++chcon.1:	$(common_dep)	$(srcdir)/chcon.x	../src/chcon.c
++runcon.1:	$(common_dep)	$(srcdir)/runcon.x	../src/runcon.c
+ 
+ SUFFIXES = .x .1
+ 
+diff -urN coreutils-5.2.1.orig/man/Makefile.in coreutils-5.2.1/man/Makefile.in
+--- coreutils-5.2.1.orig/man/Makefile.in	2004-03-11 02:58:00.000000000 -0600
++++ coreutils-5.2.1/man/Makefile.in	2005-01-15 12:09:49.000000000 -0600
+@@ -185,6 +185,7 @@
+ INTLLIBS = @INTLLIBS@
+ KMEM_GROUP = @KMEM_GROUP@
+ LDFLAGS = @LDFLAGS@
++LIBACL = @LIBACL@
+ LIBICONV = @LIBICONV@
+ LIBINTL = @LIBINTL@
+ LIBOBJS = @LIBOBJS@
+@@ -192,6 +193,8 @@
+ LIB_CLOCK_GETTIME = @LIB_CLOCK_GETTIME@
+ LIB_CRYPT = @LIB_CRYPT@
+ LIB_NANOSLEEP = @LIB_NANOSLEEP@
++LIB_PAM = @LIB_PAM@
++LIB_SELINUX = @LIB_SELINUX@
+ LN_S = @LN_S@
+ LTLIBICONV = @LTLIBICONV@
+ LTLIBINTL = @LTLIBINTL@
+@@ -273,7 +276,7 @@
+   rm.1 rmdir.1 seq.1 sha1sum.1 shred.1 sleep.1 sort.1 split.1 stat.1 stty.1 \
+   su.1 sum.1 sync.1 tac.1 tail.1 tee.1 test.1 touch.1 tr.1 true.1 tsort.1 \
+   tty.1 uname.1 unexpand.1 uniq.1 unlink.1 uptime.1 users.1 vdir.1 wc.1 \
+-  who.1 whoami.1 yes.1
++  who.1 whoami.1 yes.1 chcon.1 runcon.1
+ 
+ man_aux = $(dist_man_MANS:.1=.x)
+ EXTRA_DIST = $(man_aux) help2man
+@@ -595,6 +598,8 @@
+ who.1:		$(common_dep)	$(srcdir)/who.x		../src/who.c
+ whoami.1:	$(common_dep)	$(srcdir)/whoami.x	../src/whoami.c
+ yes.1:		$(common_dep)	$(srcdir)/yes.x		../src/yes.c
++chcon.1:	$(common_dep)	$(srcdir)/chcon.x	../src/chcon.c
++runcon.1:	$(common_dep)	$(srcdir)/runcon.x	../src/runcon.c
+ 
+ # Note the use of $t/$*, rather than just `$*' as in other packages.
+ # That is necessary to avoid failures for programs that are also shell built-in
+diff -urN coreutils-5.2.1.orig/man/mkdir.1 coreutils-5.2.1/man/mkdir.1
+--- coreutils-5.2.1.orig/man/mkdir.1	2004-03-02 16:52:28.000000000 -0600
++++ coreutils-5.2.1/man/mkdir.1	2005-01-15 12:09:49.000000000 -0600
+@@ -12,6 +12,8 @@
+ .PP
+ Mandatory arguments to long options are mandatory for short options too.
+ .TP
++\fB\-Z\fR, \fB\-\-context\fR=\fICONTEXT\fR (SELinux) set security context to CONTEXT
++.TP
+ \fB\-m\fR, \fB\-\-mode\fR=\fIMODE\fR
+ set permission mode (as in chmod), not rwxrwxrwx - umask
+ .TP
+diff -urN coreutils-5.2.1.orig/man/mkfifo.1 coreutils-5.2.1/man/mkfifo.1
+--- coreutils-5.2.1.orig/man/mkfifo.1	2004-03-02 16:52:28.000000000 -0600
++++ coreutils-5.2.1/man/mkfifo.1	2005-01-15 12:09:49.000000000 -0600
+@@ -12,6 +12,9 @@
+ .PP
+ Mandatory arguments to long options are mandatory for short options too.
+ .TP
++\fB\-Z\fR, \fB\-\-context\fR=\fICONTEXT\fR
++set security context (quoted string)
++.TP
+ \fB\-m\fR, \fB\-\-mode\fR=\fIMODE\fR
+ set permission mode (as in chmod), not a=rw - umask
+ .TP
+diff -urN coreutils-5.2.1.orig/man/mknod.1 coreutils-5.2.1/man/mknod.1
+--- coreutils-5.2.1.orig/man/mknod.1	2004-03-02 16:52:28.000000000 -0600
++++ coreutils-5.2.1/man/mknod.1	2005-01-15 12:09:49.000000000 -0600
+@@ -12,6 +12,9 @@
+ .PP
+ Mandatory arguments to long options are mandatory for short options too.
+ .TP
++\fB\-Z\fR, \fB\-\-context\fR=\fICONTEXT\fR
++set security context (quoted string)
++.TP
+ \fB\-m\fR, \fB\-\-mode\fR=\fIMODE\fR
+ set permission mode (as in chmod), not a=rw - umask
+ .TP
+diff -urN coreutils-5.2.1.orig/man/runcon.1 coreutils-5.2.1/man/runcon.1
+--- coreutils-5.2.1.orig/man/runcon.1	1969-12-31 18:00:00.000000000 -0600
++++ coreutils-5.2.1/man/runcon.1	2005-01-15 12:09:49.000000000 -0600
+@@ -0,0 +1,39 @@
++.TH RUNCON "1" "July 2003" "runcon (coreutils) 5.0" "selinux"
++.SH NAME
++runcon \- run command with specified security context 
++.SH SYNOPSIS
++.B runcon
++[\fI-t TYPE\fR] [\fI-l LEVEL\fR] [\fI-u USER\fR] [\fI-r ROLE\fR] \fICOMMAND\fR [\fIARGS...\fR]
++.PP
++or
++.PP
++.B runcon
++\fICONTEXT\fR \fICOMMAND\fR [\fIargs...\fR]
++.PP
++.br
++.SH DESCRIPTION
++.PP
++.\" Add any additional description here
++.PP
++Run COMMAND with current security context modified by one or more of LEVEL,
++ROLE, TYPE, and USER, or with completely-specified CONTEXT.
++.TP
++\fB\-t\fR
++change current type to the specified type
++.TP
++\fB\-l\fR
++change current level range to the specified range
++.TP
++\fB\-r\fR
++change current role to the specified role
++.TP
++\fB\-u\fR
++change current user to the specified user
++.PP
++If none of \fI-t\fR, \fI-u\fR, \fI-r\fR, or \fI-l\fR, is specified,
++the first argument is used as the complete context.  Any additional
++arguments after \fICOMMAND\fR are interpreted as arguments to the
++command.
++.PP
++Note that only carefully-chosen contexts are likely to successfully
++run.
+diff -urN coreutils-5.2.1.orig/man/runcon.x coreutils-5.2.1/man/runcon.x
+--- coreutils-5.2.1.orig/man/runcon.x	1969-12-31 18:00:00.000000000 -0600
++++ coreutils-5.2.1/man/runcon.x	2005-01-15 12:09:49.000000000 -0600
+@@ -0,0 +1,2 @@
++[DESCRIPTION]
++.\" Add any additional description here
+diff -urN coreutils-5.2.1.orig/man/stat.1 coreutils-5.2.1/man/stat.1
+--- coreutils-5.2.1.orig/man/stat.1	2004-03-02 16:52:31.000000000 -0600
++++ coreutils-5.2.1/man/stat.1	2005-01-15 12:09:49.000000000 -0600
+@@ -22,6 +22,9 @@
+ \fB\-t\fR, \fB\-\-terse\fR
+ print the information in terse form
+ .TP
++\fB\-Z\fR, \fB\-\-context\fR
++print security context information for SELinux if available.
++.TP
+ \fB\-\-help\fR
+ display this help and exit
+ .TP
+@@ -42,6 +45,9 @@
+ %b
+ Number of blocks allocated (see %B)
+ .TP
++%C
++SELinux security context
++.TP
+ %D
+ Device number in hex
+ .TP
+diff -urN coreutils-5.2.1.orig/man/vdir.1 coreutils-5.2.1/man/vdir.1
+--- coreutils-5.2.1.orig/man/vdir.1	2004-03-02 16:52:33.000000000 -0600
++++ coreutils-5.2.1/man/vdir.1	2005-01-15 12:09:49.000000000 -0600
+@@ -195,6 +195,20 @@
+ .TP
+ \fB\-1\fR
+ list one file per line
++.PP
++SELINUX options:
++.TP
++\fB\-\-lcontext\fR
++Display security context.   Enable \fB\-l\fR. Lines
++will probably be too wide for most displays.
++.TP
++\fB\-\-context\fR
++Display security context so it fits on most
++displays.  Displays only mode, user, group,
++security context and file name.
++.TP
++\fB\-\-scontext\fR
++Display only security context and file name.
+ .TP
+ \fB\-\-help\fR
+ display this help and exit
+diff -urN coreutils-5.2.1.orig/README coreutils-5.2.1/README
+--- coreutils-5.2.1.orig/README	2005-01-15 12:04:40.000000000 -0600
++++ coreutils-5.2.1/README	2005-01-15 12:09:49.000000000 -0600
+@@ -7,11 +7,11 @@
+ 
+ The programs that can be built with this package are:
+ 
+-  [ basename cat chgrp chmod chown chroot cksum comm cp csplit cut date dd
++  [ basename cat chcon chgrp chmod chown chroot cksum comm cp csplit cut date dd
+   df dir dircolors dirname du echo env expand expr factor false fmt fold
+   ginstall groups head hostid hostname id join kill link ln logname ls
+   md5sum mkdir mkfifo mknod mv nice nl nohup od paste pathchk pinky pr
+-  printenv printf ptx pwd readlink rm rmdir runuser seq sha1sum shred sleep sort
++  printenv printf ptx pwd readlink rm rmdir runcon runuser seq sha1sum shred sleep sort
+   split stat stty su sum sync tac tail tee test touch tr true tsort tty
+   uname unexpand uniq unlink uptime users vdir wc who whoami yes
+ 
+diff -urN coreutils-5.2.1.orig/src/chcon.c coreutils-5.2.1/src/chcon.c
+--- coreutils-5.2.1.orig/src/chcon.c	1969-12-31 18:00:00.000000000 -0600
++++ coreutils-5.2.1/src/chcon.c	2005-01-15 12:09:49.000000000 -0600
+@@ -0,0 +1,421 @@
++/* chcontext -- change security context of a pathname */
++
++#include <config.h>
++#include <stdio.h>
++#include <sys/types.h>
++#include <grp.h>
++#include <getopt.h>
++#include <selinux/selinux.h>
++#include <selinux/context.h>
++
++#include "system.h"
++#include "error.h"
++#include "savedir.h"
++#include "group-member.h"
++
++enum Change_status
++{
++  CH_SUCCEEDED,
++  CH_FAILED,
++  CH_NO_CHANGE_REQUESTED
++};
++
++enum Verbosity
++{
++  /* Print a message for each file that is processed.  */
++  V_high,
++
++  /* Print a message for each file whose attributes we change.  */
++  V_changes_only,
++
++  /* Do not be verbose.  This is the default. */
++  V_off
++};
++
++static int change_dir_context (const char *dir, const struct stat *statp);
++
++/* The name the program was run with. */
++char *program_name;
++
++/* If nonzero, and the systems has support for it, change the context
++   of symbolic links rather than any files they point to.  */
++static int change_symlinks;
++
++/* If nonzero, change the context of directories recursively. */
++static int recurse;
++
++/* If nonzero, force silence (no error messages). */
++static int force_silent;
++
++/* Level of verbosity.  */
++static enum Verbosity verbosity = V_off;
++
++/* The name of the context file is being given. */
++static const char *specified_context;
++
++/* Specific components of the context */
++static const char *specified_user;
++static const char *specified_role;
++static const char *specified_range;
++static const char *specified_type;
++
++/* The argument to the --reference option.  Use the context of this file.
++   This file must exist.  */
++static char *reference_file;
++
++/* If nonzero, display usage information and exit.  */
++static int show_help;
++
++/* If nonzero, print the version on standard output and exit.  */
++static int show_version;
++
++static struct option const long_options[] =
++{
++  {"recursive", no_argument, 0, 'R'},
++  {"changes", no_argument, 0, 'c'},
++  {"no-dereference", no_argument, 0, 'h'},
++  {"silent", no_argument, 0, 'f'},
++  {"quiet", no_argument, 0, 'f'},
++  {"reference", required_argument, 0, CHAR_MAX + 1},
++  {"context", required_argument, 0, CHAR_MAX + 2},
++  {"user", required_argument, 0, 'u'},
++  {"role", required_argument, 0, 'r'},      
++  {"type", required_argument, 0, 't'},
++  {"range", required_argument, 0, 'l'},   
++  {"verbose", no_argument, 0, 'v'},
++  {"help", no_argument, &show_help, 1},
++  {"version", no_argument, &show_version, 1},
++  {0, 0, 0, 0}
++};
++
++/* Tell the user how/if the context of FILE has been changed.
++   CHANGED describes what (if anything) has happened. */
++
++static void
++describe_change (const char *file, security_context_t newcontext, enum Change_status changed)
++{
++  const char *fmt;
++  switch (changed)
++    {
++    case CH_SUCCEEDED:
++      fmt = _("context of %s changed to %s\n");
++      break;
++    case CH_FAILED:
++      fmt = _("failed to change context of %s to %s\n");
++      break;
++    case CH_NO_CHANGE_REQUESTED:
++      fmt = _("context of %s retained as %s\n");
++      break;
++    default:
++      abort ();
++    }
++  printf (fmt, file, newcontext);
++}
++
++static int
++compute_context_from_mask (security_context_t context, context_t *ret)
++{
++  context_t newcontext = context_new (context);
++  if (!newcontext)
++    return 1;
++#define SETCOMPONENT(comp) \
++  do { \
++    if (specified_ ## comp) \
++      if (context_ ## comp ## _set (newcontext, specified_ ## comp)) \
++        goto lose; \
++  } while (0)
++      
++  SETCOMPONENT(user);
++  SETCOMPONENT(range);
++  SETCOMPONENT(role);
++  SETCOMPONENT(type);
++#undef SETCOMPONENT
++  
++  *ret = newcontext;
++  return 0;
++ lose:
++  context_free (newcontext);
++  return 1;
++}
++
++/* Change the context of FILE, using specified components.
++   If it is a directory and -R is given, recurse.
++   Return 0 if successful, 1 if errors occurred. */
++
++static int
++change_file_context (const char *file)
++{
++  struct stat file_stats;
++  security_context_t file_context=NULL;
++  context_t context;
++  security_context_t context_string;
++  int errors = 0;
++  int status = 0;
++
++  if (change_symlinks)
++    status = lgetfilecon(file, &file_context);
++  else 
++    status = getfilecon(file, &file_context);
++
++  if ((status < 0) && (errno != ENODATA))
++    {
++      if (force_silent == 0)
++	error (0, errno, "%s", file);
++      return 1;
++    }
++
++  /* If the file doesn't have a context, and we're not setting all of
++     the context components, there isn't really an obvious default.
++     Thus, we just give up. */
++  if (file_context == NULL && specified_context == NULL)
++    {
++      error (0, 0, _("can't apply partial context to unlabeled file %s"), file);
++      return 1;
++    }
++      
++  if (specified_context == NULL)
++    {
++      if (compute_context_from_mask (file_context, &context))
++	{
++	  error (0, 0, _("couldn't compute security context from %s"), file_context);
++	      return 1;
++	}
++    }
++  else
++    {
++      context = context_new (specified_context);
++      if (!context)
++	error (1, 0,_("invalid context: %s"),specified_context);	    
++    }
++
++  context_string = context_str (context);
++      
++  if (file_context == NULL || strcmp(context_string,file_context)!=0)
++    {
++      int fail;
++
++      if (change_symlinks)
++      	fail = lsetfilecon (file, context_string);
++      else
++      	fail = setfilecon (file, context_string);
++
++      if (verbosity == V_high || (verbosity == V_changes_only && !fail))
++	describe_change (file, context_string, (fail ? CH_FAILED : CH_SUCCEEDED));
++
++      if (fail)
++	{
++	  errors = 1;
++	  if (force_silent == 0)
++	    {
++	      error (0, errno, _("failed to change context of %s to %s"), file, context_string);
++	    }
++	}
++    }
++  else if (verbosity == V_high)
++    {
++      describe_change (file, context_string, CH_NO_CHANGE_REQUESTED);
++    }
++
++  context_free(context);
++  freecon(file_context);
++
++  if (recurse) {
++    if (lstat(file, &file_stats)==0)
++      if (S_ISDIR (file_stats.st_mode))
++	errors |= change_dir_context (file, &file_stats);
++  }
++  return errors;
++}
++
++/* Recursively change context of the files in directory DIR
++   using specified context components.
++   STATP points to the results of lstat on DIR.
++   Return 0 if successful, 1 if errors occurred. */
++
++static int
++change_dir_context (const char *dir, const struct stat *statp)
++{
++  char *name_space, *namep;
++  char *path;			/* Full path of each entry to process. */
++  unsigned dirlength;		/* Length of `dir' and '\0'. */
++  unsigned filelength;		/* Length of each pathname to process. */
++  unsigned pathlength;		/* Bytes allocated for `path'. */
++  int errors = 0;
++
++  errno = 0;
++  name_space = savedir (dir);
++  if (name_space == NULL)
++    {
++      if (errno)
++        {
++	  if (force_silent == 0)
++	    error (0, errno, "%s", dir);
++	  return 1;
++	}
++      else
++	error (1, 0, _("virtual memory exhausted"));
++    }
++
++  dirlength = strlen (dir) + 1;	/* + 1 is for the trailing '/'. */
++  pathlength = dirlength + 1;
++  /* Give `path' a dummy value; it will be reallocated before first use. */
++  path = xmalloc (pathlength);
++  strcpy (path, dir);
++  path[dirlength - 1] = '/';
++
++  for (namep = name_space; *namep; namep += filelength - dirlength)
++    {
++      filelength = dirlength + strlen (namep) + 1;
++      if (filelength > pathlength)
++	{
++	  pathlength = filelength * 2;
++	  path = xrealloc (path, pathlength);
++	}
++      strcpy (path + dirlength, namep);
++      errors |= change_file_context (path);
++    }
++  free (path);
++  free (name_space);
++  return errors;
++}
++
++static void
++usage (int status)
++{
++  if (status != 0)
++    fprintf (stderr, _("Try `%s --help' for more information.\n"),
++	     program_name);
++  else
++    {
++      printf (_("\
++Usage: %s [OPTION]... CONTEXT FILE...\n\
++  or:  %s [OPTION]... [-u USER] [-r ROLE] [-l RANGE] [-t TYPE] FILE...\n\
++  or:  %s [OPTION]... --reference=RFILE FILE...\n\
++"),
++	program_name, program_name, program_name);
++      printf (_("\
++Change the security context of each FILE to CONTEXT.\n\
++\n\
++  -c, --changes          like verbose but report only when a change is made\n\
++  -h, --no-dereference   affect symbolic links instead of any referenced file\n\
++                         (available only on systems with lchown system call)\n\
++  -f, --silent, --quiet  suppress most error messages\n\
++      --reference=RFILE  use RFILE's group instead of using a CONTEXT value\n\
++  -u, --user=USER        set user USER in the target security context\n\
++  -r, --role=ROLE        set role ROLE in the target security context\n\
++  -t, --type=TYPE        set type TYPE in the target security context\n\
++  -l, --range=RANGE      set range RANGE in the target security context\n\
++  -R, --recursive        change files and directories recursively\n\
++  -v, --verbose          output a diagnostic for every file processed\n\
++      --help             display this help and exit\n\
++      --version          output version information and exit\n\
++"));
++      close_stdout ();
++    }
++  exit (status);
++}
++
++int
++main (int argc, char **argv)
++{
++  security_context_t ref_context = NULL;
++  int errors = 0;
++  int optc;
++  int component_specified = 0;
++  
++  program_name = argv[0];
++  setlocale (LC_ALL, "");
++  bindtextdomain (PACKAGE, LOCALEDIR);
++  textdomain (PACKAGE);
++
++  recurse = force_silent = 0;
++  
++  while ((optc = getopt_long (argc, argv, "Rcfhvu:r:t:l:", long_options, NULL)) != -1)
++  {
++	  switch (optc)
++	  {
++	  case 0:
++	    break;
++	  case 'u':
++	    specified_user = optarg;
++	    component_specified = 1;
++	    break;
++	  case 'r':
++	    specified_role = optarg;
++	    component_specified = 1;
++	    break;
++	  case 't':
++	    specified_type = optarg;
++	    component_specified = 1;
++	    break;
++	  case 'l':
++	    specified_range = optarg;
++	    component_specified = 1;
++	    break;
++	  case CHAR_MAX + 1:
++		  reference_file = optarg;
++		  break;
++	  case 'R':
++		  recurse = 1;
++		  break;
++ 	  case 'c':
++		  verbosity = V_changes_only;
++		  break;
++	  case 'f':
++		  force_silent = 1;
++		  break;
++	  case 'h':
++		  change_symlinks = 1;
++		  break;
++	  case 'v':
++		  verbosity = V_high;
++		  break;
++	  default:
++		  usage (1);
++	  }
++  }
++
++  if (show_version)
++  {
++     printf ("chcon (%s) %s\n", GNU_PACKAGE, VERSION);
++     close_stdout ();
++     exit (0);
++  }
++
++  if (show_help)
++    usage (0);
++
++  
++  if (reference_file && component_specified)
++    {
++      error (0, 0, _("conflicting security context specifiers given"));
++      usage (1);
++    }
++
++  if (!(((reference_file || component_specified)
++	 && (argc - optind > 0))
++	|| (argc - optind > 1)))
++    {
++      error (0, 0, _("too few arguments"));
++      usage (1);
++    }
++  
++  if (reference_file)
++    {
++      if (getfilecon (reference_file, &ref_context)<0)
++	error (1, errno, "%s", reference_file);
++      
++      specified_context = ref_context;
++    }
++  else if (!component_specified) {
++    specified_context = argv[optind++];
++  }
++  for (; optind < argc; ++optind)
++     errors |= change_file_context (argv[optind]);
++
++  if (verbosity != V_off)
++    close_stdout ();
++  if (ref_context != NULL)
++    freecon(ref_context);
++  exit (errors);
++}
+diff -urN coreutils-5.2.1.orig/src/copy.c coreutils-5.2.1/src/copy.c
+--- coreutils-5.2.1.orig/src/copy.c	2005-01-15 12:03:37.000000000 -0600
++++ coreutils-5.2.1/src/copy.c	2005-01-15 12:09:49.000000000 -0600
+@@ -42,6 +42,11 @@
+ #include "utimens.h"
+ #include "xreadlink.h"
+ 
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>          /* for is_selinux_enabled() */
++extern int  selinux_enabled;
++#endif
++
+ #define DO_CHOWN(Chown, File, New_uid, New_gid)				\
+   (Chown (File, New_uid, New_gid)					\
+    /* If non-root uses -p, it's ok if we can't preserve ownership.	\
+@@ -1288,6 +1293,34 @@
+      In such cases, set this variable to zero.  */
+   preserve_metadata = 1;
+ 
++#ifdef WITH_SELINUX
++  if (x->preserve_security_context && selinux_enabled)
++    {
++      security_context_t con;
++
++      if (lgetfilecon (src_path, &con) >= 0)
++	{
++	  if (setfscreatecon(con) < 0) 
++	    {
++	      error (0, errno, _("cannot set setfscreatecon %s"), quote (con));
++	      if (x->require_preserve) {
++		freecon(con);
++		return 1;
++	      }
++	    }
++	  freecon(con);
++	}
++      else {
++	if ( errno == ENOTSUP ) {
++	  error (0, errno, _("warning: security context not preserved %s"), quote (src_path));
++	} else if ( errno != ENODATA ) {
++	  error (0, errno, _("cannot lgetfilecon %s"), quote (src_path));
++	  return 1;
++	}
++      }
++  }
++#endif
++
+   if (S_ISDIR (src_mode))
+     {
+       struct dir_list *dir;
+@@ -1357,8 +1390,13 @@
+ 	}
+ 
+       /* Are we crossing a file system boundary?  */
+-      if (x->one_file_system && device != 0 && device != src_sb.st_dev)
++      if (x->one_file_system && device != 0 && device != src_sb.st_dev) {
++#ifdef WITH_SELINUX
++	if (x->preserve_security_context && selinux_enabled)
++	  setfscreatecon(NULL);
++#endif
+ 	return 0;
++      }
+ 
+       /* Copy the contents of the directory.  */
+ 
+@@ -1491,6 +1529,11 @@
+ 	    }
+ 	}
+ 
++#ifdef WITH_SELINUX
++      if (x->preserve_security_context && selinux_enabled)
++	setfscreatecon(NULL);
++#endif
++
+       /* There's no need to preserve timestamps or permissions.  */
+       preserve_metadata = 0;
+ 
+@@ -1523,7 +1566,7 @@
+   if (command_line_arg)
+     record_file (x->dest_info, dst_path, NULL);
+ 
+-  if ( ! preserve_metadata)
++  if ( ! preserve_metadata) 
+     return 0;
+ 
+   /* POSIX says that `cp -p' must restore the following:
+@@ -1629,6 +1672,11 @@
+ 
+ un_backup:
+ 
++#ifdef WITH_SELINUX
++  if (x->preserve_security_context && selinux_enabled)
++    setfscreatecon(NULL);
++#endif
++
+   /* We have failed to create the destination file.
+      If we've just added a dev/ino entry via the remember_copied
+      call above (i.e., unless we've just failed to create a hard link),
+diff -urN coreutils-5.2.1.orig/src/copy.h coreutils-5.2.1/src/copy.h
+--- coreutils-5.2.1.orig/src/copy.h	2005-01-15 12:03:37.000000000 -0600
++++ coreutils-5.2.1/src/copy.h	2005-01-15 12:09:49.000000000 -0600
+@@ -105,6 +105,9 @@
+   int preserve_ownership;
+   int preserve_mode;
+   int preserve_timestamps;
++#ifdef WITH_SELINUX
++  int preserve_security_context;
++#endif
+ 
+   /* Enabled for mv, and for cp by the --preserve=links option.
+      If nonzero, attempt to preserve in the destination files any
+diff -urN coreutils-5.2.1.orig/src/cp.c coreutils-5.2.1/src/cp.c
+--- coreutils-5.2.1.orig/src/cp.c	2005-01-15 12:03:37.000000000 -0600
++++ coreutils-5.2.1/src/cp.c	2005-01-15 12:09:49.000000000 -0600
+@@ -49,6 +49,11 @@
+ 
+ #define AUTHORS "Torbjorn Granlund", "David MacKenzie", "Jim Meyering"
+ 
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>          /* for is_selinux_enabled() */
++int selinux_enabled=0;
++#endif
++
+ #ifndef _POSIX_VERSION
+ uid_t geteuid ();
+ #endif
+@@ -143,6 +148,9 @@
+   {"update", no_argument, NULL, 'u'},
+   {"verbose", no_argument, NULL, 'v'},
+   {"version-control", required_argument, NULL, 'V'}, /* Deprecated. FIXME. */
++#ifdef WITH_SELINUX
++  {"context", required_argument, NULL, 'Z'},
++#endif
+   {GETOPT_HELP_OPTION_DECL},
+   {GETOPT_VERSION_OPTION_DECL},
+   {NULL, 0, NULL, 0}
+@@ -192,6 +200,9 @@
+                                  additional attributes: links, all\n\
+ "), stdout);
+       fputs (_("\
++  -c                           same as --preserve=context\n\
++"), stdout);
++      fputs (_("\
+       --no-preserve=ATTR_LIST  don't preserve the specified attributes\n\
+       --parents                append source path to DIRECTORY\n\
+   -P                           same as `--no-dereference'\n\
+@@ -219,6 +230,7 @@
+                                  destination file is missing\n\
+   -v, --verbose                explain what is being done\n\
+   -x, --one-file-system        stay on this file system\n\
++  -Z, --context=CONTEXT        set security context of copy to CONTEXT\n\
+ "), stdout);
+       fputs (HELP_OPTION_DESCRIPTION, stdout);
+       fputs (VERSION_OPTION_DESCRIPTION, stdout);
+@@ -748,8 +760,8 @@
+ 	{
+ 	  new_dest = (char *) dest;
+ 	}
+-
+-      return copy (source, new_dest, new_dst, x, &unused, NULL);
++      ret=copy (source, new_dest, new_dst, x, &unused, NULL);
++      return ret;
+     }
+ 
+   /* unreachable */
+@@ -773,6 +785,10 @@
+   x->preserve_mode = 0;
+   x->preserve_timestamps = 0;
+ 
++#ifdef WITH_SELINUX
++  x->preserve_security_context = 0;
++#endif
++
+   x->require_preserve = 0;
+   x->recursive = 0;
+   x->sparse_mode = SPARSE_AUTO;
+@@ -800,19 +816,20 @@
+       PRESERVE_TIMESTAMPS,
+       PRESERVE_OWNERSHIP,
+       PRESERVE_LINK,
++      PRESERVE_CONTEXT,
+       PRESERVE_ALL
+     };
+   static enum File_attribute const preserve_vals[] =
+     {
+       PRESERVE_MODE, PRESERVE_TIMESTAMPS,
+-      PRESERVE_OWNERSHIP, PRESERVE_LINK, PRESERVE_ALL
++      PRESERVE_OWNERSHIP, PRESERVE_LINK, PRESERVE_CONTEXT, PRESERVE_ALL
+     };
+ 
+   /* Valid arguments to the `--preserve' option. */
+   static char const* const preserve_args[] =
+     {
+       "mode", "timestamps",
+-      "ownership", "links", "all", 0
++      "ownership", "links", "context", "all", 0
+     };
+ 
+   char *arg_writable = xstrdup (arg);
+@@ -847,11 +864,16 @@
+ 	  x->preserve_links = on_off;
+ 	  break;
+ 
++	case PRESERVE_CONTEXT:
++	  x->preserve_security_context = on_off;
++	  break;
++
+ 	case PRESERVE_ALL:
+ 	  x->preserve_mode = on_off;
+ 	  x->preserve_timestamps = on_off;
+ 	  x->preserve_ownership = on_off;
+ 	  x->preserve_links = on_off;
++	  x->preserve_security_context = on_off;
+ 	  break;
+ 
+ 	default:
+@@ -875,6 +897,10 @@
+   struct cp_options x;
+   int copy_contents = 0;
+   char *target_directory = NULL;
++#ifdef WITH_SELINUX
++  security_context_t scontext = NULL;
++  selinux_enabled= (is_selinux_enabled()>0);
++#endif
+ 
+   initialize_main (&argc, &argv);
+   program_name = argv[0];
+@@ -890,7 +916,11 @@
+      we'll actually use backup_suffix_string.  */
+   backup_suffix_string = getenv ("SIMPLE_BACKUP_SUFFIX");
+ 
++#ifdef WITH_SELINUX
++  while ((c = getopt_long (argc, argv, "abcdfHilLprsuvxPRS:V:Z:", long_opts, NULL))
++#else
+   while ((c = getopt_long (argc, argv, "abdfHilLprsuvxPRS:V:", long_opts, NULL))
++#endif
+ 	 != -1)
+     {
+       switch (c)
+@@ -981,6 +1011,36 @@
+ 	  x.preserve_timestamps = 1;
+ 	  x.require_preserve = 1;
+ 	  break;
++#ifdef WITH_SELINUX
++	case 'c':
++	  if ( scontext != NULL ) { 
++	      (void) fprintf(stderr, "%s: cannot force target context <-- %s and preserve it\n", argv[0], scontext);
++	    exit( 1 );
++	  }
++	  else if (selinux_enabled) 
++	    x.preserve_security_context = 1;
++	  break;
++
++	case 'Z':
++	  /* politely decline if we're not on a selinux-enabled kernel. */
++	  if( !selinux_enabled ) {
++	    fprintf( stderr, "Warning:  ignoring --context (-Z). "
++		             "It requires a SELinux enabled kernel.\n" );
++	    break;
++	  }
++	  if ( x.preserve_security_context ) {
++	    (void) fprintf(stderr, "%s: cannot force target context to '%s' and preserve it\n", argv[0], optarg);
++	    exit( 1 );
++	  }
++	  scontext = optarg;
++	  /* if there's a security_context given set new path 
++	     components to that context, too */
++	  if ( setfscreatecon(scontext) < 0 ) {
++	    (void) fprintf(stderr, _("cannot set default security context %s"), scontext);
++	    exit( 1 );
++	  }
++	  break;
++#endif
+ 
+ 	case PARENTS_OPTION:
+ 	  flag_path = 1;
+diff -urN coreutils-5.2.1.orig/src/id.c coreutils-5.2.1/src/id.c
+--- coreutils-5.2.1.orig/src/id.c	2004-01-21 16:27:02.000000000 -0600
++++ coreutils-5.2.1/src/id.c	2005-01-15 12:09:49.000000000 -0600
+@@ -45,6 +45,20 @@
+ 
+ int getugroups ();
+ 
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++static void print_context (char* context);
++/* Print the SELinux context */
++static void
++print_context(char *context)
++{
++  printf ("%s", context);
++}
++
++/* If nonzero, output only the SELinux context. -Z */
++static int just_context = 0;
++
++#endif
+ static void print_user (uid_t uid);
+ static void print_group (gid_t gid);
+ static void print_group_list (const char *username);
+@@ -63,8 +77,14 @@
+ /* Nonzero if errors have been encountered.  */
+ static int problems = 0;
+ 
++/* The SELinux context */
++/* Set `context' to a known invalid value so print_full_info() will *
++ * know when `context' has not been set to a meaningful value.      */
++static security_context_t context=NULL;
++
+ static struct option const longopts[] =
+ {
++  {"context", no_argument, NULL, 'Z'},
+   {"group", no_argument, NULL, 'g'},
+   {"groups", no_argument, NULL, 'G'},
+   {"name", no_argument, NULL, 'n'},
+@@ -88,6 +108,7 @@
+ Print information for USERNAME, or the current user.\n\
+ \n\
+   -a              ignore, for compatibility with other versions\n\
++  -Z, --context   print only the context\n\
+   -g, --group     print only the effective group ID\n\
+   -G, --groups    print all group IDs\n\
+   -n, --name      print a name instead of a number, for -ugG\n\
+@@ -109,6 +130,7 @@
+ main (int argc, char **argv)
+ {
+   int optc;
++  int selinux_enabled=(is_selinux_enabled()>0);
+ 
+   /* If nonzero, output the list of all group IDs. -G */
+   int just_group_list = 0;
+@@ -127,7 +149,7 @@
+ 
+   atexit (close_stdout);
+ 
+-  while ((optc = getopt_long (argc, argv, "agnruG", longopts, NULL)) != -1)
++  while ((optc = getopt_long (argc, argv, "agnruGZ", longopts, NULL)) != -1)
+     {
+       switch (optc)
+ 	{
+@@ -136,6 +158,17 @@
+ 	case 'a':
+ 	  /* Ignore -a, for compatibility with SVR4.  */
+ 	  break;
++#ifdef WITH_SELINUX
++        case 'Z':
++	  /* politely decline if we're not on a selinux-enabled kernel. */
++	  if( !selinux_enabled ) {
++	    fprintf( stderr, "Sorry, --context (-Z) can be used only on "
++		             "a selinux-enabled kernel.\n" );
++	    exit( 1 );
++	  }
++          just_context = 1;
++          break;
++#endif
+ 	case 'g':
+ 	  just_group = 1;
+ 	  break;
+@@ -158,8 +191,28 @@
+ 	}
+     }
+ 
+-  if (just_user + just_group + just_group_list > 1)
+-    error (EXIT_FAILURE, 0, _("cannot print only user and only group"));
++#ifdef WITH_SELINUX
++  if (argc - optind == 1)
++    selinux_enabled = 0;
++
++  if( just_context  && !selinux_enabled)
++    error (1, 0, _("\
++cannot display context when selinux not enabled or when displaying the id\n\
++of a different user"));
++
++  /* If we are on a selinux-enabled kernel, get our context.    *
++   * Otherwise, leave the context variable alone - it has *
++   * been initialized known invalid value; if we see this invalid   *
++   * value later, we will know we are on a non-selinux kernel.         */
++  if( selinux_enabled )
++    {
++      if (getcon(&context))
++        error (1, 0, "can't get process context");
++    }
++#endif
++
++  if (just_user + just_group + just_group_list + just_context > 1)
++    error (EXIT_FAILURE, 0, _("cannot print \"only\" of more than one choice"));
+ 
+   if (just_user + just_group + just_group_list == 0 && (use_real || use_name))
+     error (EXIT_FAILURE, 0,
+@@ -190,6 +243,10 @@
+     print_group (use_real ? rgid : egid);
+   else if (just_group_list)
+     print_group_list (argv[optind]);
++#ifdef WITH_SELINUX
++  else if (just_context)
++    print_context (context);
++#endif
+   else
+     print_full_info (argv[optind]);
+   putchar ('\n');
+@@ -397,4 +454,9 @@
+     free (groups);
+   }
+ #endif /* HAVE_GETGROUPS */
++#ifdef WITH_SELINUX
++  if ( context != NULL ) {
++    printf(" context=%s",context);
++  }
++#endif
+ }
+diff -urN coreutils-5.2.1.orig/src/install.c coreutils-5.2.1/src/install.c
+--- coreutils-5.2.1.orig/src/install.c	2005-01-15 12:03:37.000000000 -0600
++++ coreutils-5.2.1/src/install.c	2005-01-15 12:11:01.000000000 -0600
+@@ -46,6 +46,43 @@
+ # include <sys/wait.h>
+ #endif
+ 
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>          /* for is_selinux_enabled() */
++int selinux_enabled=0;
++static int use_default_selinux_context = 1;
++/* Modify file context to match the specified policy,  
++   If an error occurs the file will remain with the default directory 
++   context.*/
++static void setdefaultfilecon(const char *path) {
++	struct stat st;
++	security_context_t scontext=NULL;
++	if (selinux_enabled != 1) {
++		/* Indicate no context found. */
++		return;
++	}
++	if (lstat(path, &st) != 0)
++		return;
++
++	/* If there's an error determining the context, or it has none, 
++	   return to allow default context */
++	if ((matchpathcon(path, st.st_mode, &scontext) != 0) ||
++	    (strcmp(scontext, "<<none>>") == 0)) {
++		if (scontext != NULL) {
++			freecon(scontext);
++		}
++		return;
++	}
++	if (lsetfilecon(path, scontext) < 0) {
++		if (errno != ENOTSUP) {
++			error (0, errno,
++			       _("warning: failed to change context of %s to %s"), path, scontext);
++		}
++	}
++	freecon(scontext);
++	return;
++}
++#endif
++
+ struct passwd *getpwnam ();
+ struct group *getgrnam ();
+ 
+@@ -119,11 +156,17 @@
+ static struct option const long_options[] =
+ {
+   {"backup", optional_argument, NULL, 'b'},
++#ifdef WITH_SELINUX
++  {"context", required_argument, NULL, 'Z'},
++#endif
+   {"directory", no_argument, NULL, 'd'},
+   {"group", required_argument, NULL, 'g'},
+   {"mode", required_argument, NULL, 'm'},
+   {"owner", required_argument, NULL, 'o'},
+   {"preserve-timestamps", no_argument, NULL, 'p'},
++#ifdef WITH_SELINUX
++  {"preserve_context", no_argument, NULL, 'P'},
++#endif
+   {"strip", no_argument, NULL, 's'},
+   {"suffix", required_argument, NULL, 'S'},
+   {"version-control", required_argument, NULL, 'V'}, /* Deprecated. FIXME. */
+@@ -164,6 +207,9 @@
+ 
+   x->update = 0;
+   x->verbose = 0;
++#ifdef WITH_SELINUX
++  x->preserve_security_context = 0;
++#endif
+   x->dest_info = NULL;
+   x->src_info = NULL;
+ }
+@@ -181,6 +227,11 @@
+   struct cp_options x;
+   int n_files;
+   char **file;
++#ifdef WITH_SELINUX
++  security_context_t scontext = NULL;
++ /* set iff kernel has extra selinux system calls */
++  selinux_enabled = (is_selinux_enabled()>0);
++#endif
+ 
+   initialize_main (&argc, &argv);
+   program_name = argv[0];
+@@ -202,7 +253,11 @@
+      we'll actually use backup_suffix_string.  */
+   backup_suffix_string = getenv ("SIMPLE_BACKUP_SUFFIX");
+ 
++#ifdef WITH_SELINUX
++  while ((optc = getopt_long (argc, argv, "bcCsDdg:m:o:pPvV:S:Z:", long_options,
++#else
+   while ((optc = getopt_long (argc, argv, "bcsDdg:m:o:pvV:S:", long_options,
++#endif
+ 			      NULL)) != -1)
+     {
+       switch (optc)
+@@ -252,6 +307,41 @@
+ 	  make_backups = 1;
+ 	  backup_suffix_string = optarg;
+ 	  break;
++#ifdef WITH_SELINUX
++ 	case 'P':
++	/* politely decline if we're not on a selinux-enabled kernel. */
++	  if( !selinux_enabled ) {
++ 	    fprintf( stderr, "Warning:  ignoring --preserve_context (-P) "
++		             "because the kernel is not selinux-enabled.\n" );
++ 	    break;
++ 	  }
++ 	  if ( scontext!=NULL ) { /* scontext could be NULL because of calloc() failure */
++ 	      (void) fprintf(stderr, "%s: cannot force target context to '%s' and preserve it\n", argv[0], scontext);
++ 	    exit( 1 );
++ 	  }
++ 	  x.preserve_security_context = 1;
++ 	  use_default_selinux_context = 0;
++ 	  break ;
++ 	case 'Z':
++ 	  /* politely decline if we're not on a selinux-enabled kernel. */
++	  if( !selinux_enabled) {
++ 	    fprintf( stderr, "Warning:  ignoring --context (-Z) "
++ 		             "because the kernel is not selinux-enabled.\n" );
++ 	    break;
++ 	  }
++ 	  if ( x.preserve_security_context ) {
++
++	     	    (void) fprintf(stderr, "%s: cannot force target context == '%s' and preserve it\n", argv[0], optarg);
++ 	    exit( 1 );
++ 	  }
++ 	  scontext = optarg;
++ 	  use_default_selinux_context = 0;
++	  if (setfscreatecon(scontext)) {
++ 	    (void) fprintf(stderr, "%s: cannot setup default context == '%s'\n", argv[0], scontext);
++	    exit(1);
++	  }
++ 	  break;
++#endif
+ 	case_GETOPT_HELP_CHAR;
+ 	case_GETOPT_VERSION_CHAR (PROGRAM_NAME, AUTHORS);
+ 	default:
+@@ -474,6 +564,10 @@
+       err = 1;
+     }
+ 
++#ifdef WITH_SELINUX
++  if (use_default_selinux_context)
++	  setdefaultfilecon(path);
++#endif
+   return err;
+ }
+ 
+@@ -628,6 +722,11 @@
+   -S, --suffix=SUFFIX override the usual backup suffix\n\
+   -v, --verbose       print the name of each directory as it is created\n\
+ "), stdout);
++      fputs (_("\
++  -P, --preserve_context (SELinux) Preserve security context\n\
++  -Z, --context=CONTEXT  (SELinux) Set security context of files and directories\n\
++"), stdout);
++
+       fputs (HELP_OPTION_DESCRIPTION, stdout);
+       fputs (VERSION_OPTION_DESCRIPTION, stdout);
+       fputs (_("\
+diff -urN coreutils-5.2.1.orig/src/ls.c coreutils-5.2.1/src/ls.c
+--- coreutils-5.2.1.orig/src/ls.c	2005-01-15 12:03:37.000000000 -0600
++++ coreutils-5.2.1/src/ls.c	2005-01-15 12:09:49.000000000 -0600
+@@ -121,6 +121,18 @@
+ 
+ #define AUTHORS "Richard Stallman", "David MacKenzie"
+ 
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++int selinux_enabled= 0;
++static int print_scontext       = 0;
++#define check_selinux() if (!selinux_enabled) { \
++	    fprintf( stderr, "Sorry, this option can only be used " \
++		             "on a SELinux kernel.\n" ); \
++	    exit( EXIT_FAILURE ); \
++}
++
++#endif
++
+ #define obstack_chunk_alloc malloc
+ #define obstack_chunk_free free
+ 
+@@ -165,7 +177,8 @@
+     symbolic_link DT_INIT (DT_LNK),
+     sock DT_INIT (DT_SOCK),
+     arg_directory DT_INIT (2 * (DT_UNKNOWN | DT_FIFO | DT_CHR | DT_DIR | DT_BLK
+-				| DT_REG | DT_LNK | DT_SOCK))
++				| DT_REG | DT_LNK | DT_SOCK)),
++    command_line
+   };
+ 
+ struct fileinfo
+@@ -174,6 +187,7 @@
+     char *name;
+ 
+     struct stat stat;
++    int stat_failed;
+ 
+     /* For symbolic link, name of the file linked to, otherwise zero. */
+     char *linkname;
+@@ -192,6 +206,10 @@
+     /* For long listings, true if the file has an access control list.  */
+     bool have_acl;
+ #endif
++
++#ifdef WITH_SELINUX
++    security_context_t scontext;
++#endif
+   };
+ 
+ #if HAVE_ACL || USE_ACL
+@@ -227,7 +245,8 @@
+ static int file_interesting (const struct dirent *next);
+ static uintmax_t gobble_file (const char *name, enum filetype type,
+ 			      int explicit_arg, const char *dirname);
+-static void print_color_indicator (const char *name, mode_t mode, int linkok);
++static void print_color_indicator (const char *name, mode_t mode, int linkok,
++				   int stat_failed);
+ static void put_indicator (const struct bin_str *ind);
+ static int put_indicator_direct (const struct bin_str *ind);
+ static void add_ignore_pattern (const char *pattern);
+@@ -247,7 +266,7 @@
+ static void print_long_format (const struct fileinfo *f);
+ static void print_many_per_line (void);
+ static void print_name_with_quoting (const char *p, mode_t mode,
+-				     int linkok,
++				     int linkok, int stat_failed,
+ 				     struct obstack *stack);
+ static void prep_non_filename_text (void);
+ static void print_type_indicator (mode_t mode);
+@@ -256,6 +275,9 @@
+ static void sort_files (void);
+ static void parse_ls_color (void);
+ void usage (int status);
++#ifdef WITH_SELINUX
++static void print_scontext_format (const struct fileinfo *f);
++#endif
+ 
+ /* The name the program was run with, stripped of any leading path. */
+ char *program_name;
+@@ -354,7 +376,11 @@
+     one_per_line,		/* -1 */
+     many_per_line,		/* -C */
+     horizontal,			/* -x */
+-    with_commas			/* -m */
++    with_commas,	        /* -m */
++#ifdef WITH_SELINUX
++    security_format,		/* -Z */
++#endif
++    invalid_format
+   };
+ 
+ static enum format format;
+@@ -675,6 +701,11 @@
+   SHOW_CONTROL_CHARS_OPTION,
+   SI_OPTION,
+   SORT_OPTION,
++#ifdef WITH_SELINUX
++  CONTEXT_OPTION,
++  LCONTEXT_OPTION,
++  SCONTEXT_OPTION,
++#endif
+   TIME_OPTION,
+   TIME_STYLE_OPTION
+ };
+@@ -718,6 +749,11 @@
+   {"time-style", required_argument, 0, TIME_STYLE_OPTION},
+   {"color", optional_argument, 0, COLOR_OPTION},
+   {"block-size", required_argument, 0, BLOCK_SIZE_OPTION},
++#ifdef WITH_SELINUX
++  {"context", no_argument, 0, CONTEXT_OPTION},
++  {"lcontext", no_argument, 0, LCONTEXT_OPTION},
++  {"scontext", no_argument, 0, SCONTEXT_OPTION},
++#endif
+   {"author", no_argument, 0, AUTHOR_OPTION},
+   {GETOPT_HELP_OPTION_DECL},
+   {GETOPT_VERSION_OPTION_DECL},
+@@ -727,13 +763,21 @@
+ static char const *const format_args[] =
+ {
+   "verbose", "long", "commas", "horizontal", "across",
+-  "vertical", "single-column", 0
++  "vertical", "single-column", 
++#ifdef WITH_SELINUX
++  "context",
++#endif
++  0
+ };
+ 
+ static enum format const format_types[] =
+ {
+   long_format, long_format, with_commas, horizontal, horizontal,
+-  many_per_line, one_per_line
++  many_per_line, one_per_line,
++#ifdef WITH_SELINUX
++  security_format,
++#endif
++  invalid_format
+ };
+ 
+ static char const *const sort_args[] =
+@@ -1097,6 +1141,9 @@
+ 
+   format_needs_stat = sort_type == sort_time || sort_type == sort_size
+     || format == long_format
++#ifdef WITH_SELINUX
++    || format == security_format || print_scontext
++#endif
+     || dereference == DEREF_ALWAYS
+     || print_block_size || print_inode;
+   format_needs_type = (format_needs_stat == 0
+@@ -1121,7 +1168,7 @@
+ 
+   for (; i < argc; i++)
+     {
+-      gobble_file (argv[i], unknown, 1, "");
++      gobble_file (argv[i], command_line, 1, "");
+     }
+ 
+   if (dir_defaulted)
+@@ -1219,6 +1266,11 @@
+   /* Record whether there is an option specifying sort type.  */
+   int sort_type_specified = 0;
+ 
++#ifdef WITH_SELINUX
++  /* 1 iff kernel has new selinux system calls */
++  selinux_enabled= (is_selinux_enabled()>0);
++#endif
++
+   qmark_funny_chars = 0;
+ 
+   /* initialize all switches to default settings */
+@@ -1269,6 +1321,9 @@
+   all_files = 0;
+   really_all_files = 0;
+   ignore_patterns = 0;
++#ifdef WITH_SELINUX
++  print_scontext       = 0;
++#endif
+ 
+   /* FIXME: put this in a function.  */
+   {
+@@ -1346,7 +1401,7 @@
+   }
+ 
+   while ((c = getopt_long (argc, argv,
+-			   "abcdfghiklmnopqrstuvw:xABCDFGHI:LNQRST:UX1",
++			   "abcdfghiklmnopqrstuvw:xABCDFGHI:LNQRST:UX1Z",
+ 			   long_options, NULL)) != -1)
+     {
+       switch (c)
+@@ -1466,6 +1521,13 @@
+ 	  format = horizontal;
+ 	  break;
+ 
++#ifdef WITH_SELINUX
++	case 'Z':
++	  check_selinux();
++	  print_scontext = 1;
++	  format = security_format;
++	  break;
++#endif
+ 	case 'A':
+ 	  really_all_files = 0;
+ 	  all_files = 1;
+@@ -1633,6 +1695,25 @@
+ 
+ 	case_GETOPT_VERSION_CHAR (PROGRAM_NAME, AUTHORS);
+ 
++#ifdef WITH_SELINUX
++
++	case CONTEXT_OPTION: /* new security format */
++		check_selinux();
++		print_scontext = 1;
++		format = security_format;
++		break;
++	case LCONTEXT_OPTION: /* long format plus security context */
++		check_selinux();
++		print_scontext = 1;
++		format = long_format;
++		break;
++	case SCONTEXT_OPTION: /* short form of new security format */
++		check_selinux();
++		print_scontext = 0;
++		format = security_format;
++		break;
++#endif
++
+ 	default:
+ 	  usage (EXIT_FAILURE);
+ 	}
+@@ -2294,6 +2375,12 @@
+       free (files[i].name);
+       if (files[i].linkname)
+ 	free (files[i].linkname);
++#ifdef WITH_SELINUX
++      if (files[i].scontext) {
++	freecon (files[i].scontext);
++	files[i].scontext=NULL;
++      }
++#endif
+     }
+ 
+   files_index = 0;
+@@ -2330,11 +2417,14 @@
+   f->linkname = 0;
+   f->linkmode = 0;
+   f->linkok = 0;
++#ifdef WITH_SELINUX
++  f->scontext = NULL;
++#endif
+ 
+   if (explicit_arg
+       || format_needs_stat
+       || (format_needs_type
+-	  && (type == unknown
++	  && (type == unknown || type == command_line
+ 
+ 	      /* FIXME: remove this disjunct.
+ 		 I don't think we care about symlinks here, but for now
+@@ -2367,6 +2457,11 @@
+ 	{
+ 	case DEREF_ALWAYS:
+ 	  err = stat (path, &f->stat);
++#ifdef WITH_SELINUX
++	  if (err>=0) 
++	    if (selinux_enabled && (format == security_format || print_scontext))
++	      getfilecon(path, &f->scontext);
++#endif
+ 	  break;
+ 
+ 	case DEREF_COMMAND_LINE_ARGUMENTS:
+@@ -2375,6 +2470,11 @@
+ 	    {
+ 	      int need_lstat;
+ 	      err = stat (path, &f->stat);
++#ifdef WITH_SELINUX
++	      if (err>=0) 
++		if (selinux_enabled && (format == security_format || print_scontext))
++		  getfilecon(path, &f->scontext);
++#endif
+ 
+ 	      if (dereference == DEREF_COMMAND_LINE_ARGUMENTS)
+ 		break;
+@@ -2393,18 +2493,42 @@
+ 
+ 	default: /* DEREF_NEVER */
+ 	  err = lstat (path, &f->stat);
++#ifdef WITH_SELINUX
++	  if (err>=0) 
++	    if (selinux_enabled && (format == security_format || print_scontext))
++	      lgetfilecon(path, &f->scontext);
++#endif
+ 	  break;
+ 	}
+ 
+-      if (err < 0)
++      f->stat_failed = (err < 0);
++      if (f->stat_failed)
+ 	{
+-	  error (0, errno, "%s", quotearg_colon (path));
+-	  exit_status = 1;
++	  /* We treat stat failures for files the user named special.
++	     There is no guarantee that these files really exist so
++	     we do not print any information.  */
++	  if (type == command_line)
++	    {
++	      error (0, errno, "%s", quotearg_colon (path));
++	      exit_status = 1;
++	      return 0;
++	    }
++
++	  f->filetype = type;
++	  memset (&f->stat, '\0', sizeof (f->stat));
++
++	  f->name = xstrdup (name);
++	  files_index++;
++
+ 	  return 0;
+ 	}
+ 
+ #if HAVE_ACL || USE_ACL
+-      if (format == long_format)
++      if (format == long_format
++#ifdef WITH_SELINUX
++	  || format == security_format
++#endif
++	  )
+ 	{
+ 	  int n = file_has_acl (path, &f->stat);
+ 	  f->have_acl = (0 < n);
+@@ -2887,6 +3011,16 @@
+ 	  DIRED_PUTCHAR ('\n');
+ 	}
+       break;
++
++#ifdef WITH_SELINUX
++    case security_format:
++      for (i = 0; i < files_index; i++)
++      {
++        print_scontext_format (files + i);
++        DIRED_PUTCHAR ('\n');
++      }
++      break;
++#endif
+     }
+ }
+ 
+@@ -2968,9 +3102,9 @@
+    WIDTH.  */
+ 
+ static void
+-format_user (uid_t u, int width)
++format_user (uid_t u, int width, int stat_failed)
+ {
+-  char const *name = (numeric_ids ? NULL : getuser (u));
++  char const *name = stat_failed ? "?" : (numeric_ids ? NULL : getuser (u));
+   if (name)
+     printf ("%-*s ", width, name);
+   else
+@@ -2982,9 +3116,9 @@
+ /* Likewise, for groups.  */
+ 
+ static void
+-format_group (gid_t g, int width)
++format_group (gid_t g, int width, int stat_failed)
+ {
+-  char const *name = (numeric_ids ? NULL : getgroup (g));
++  char const *name = stat_failed ? "?" : (numeric_ids ? NULL : getgroup (g));
+   if (name)
+     printf ("%-*s ", width, name);
+   else
+@@ -3089,7 +3223,7 @@
+     {
+       char hbuf[INT_BUFSIZE_BOUND (uintmax_t)];
+       sprintf (p, "%*s ", inode_number_width,
+-	       umaxtostr (f->stat.st_ino, hbuf));
++	       f->stat_failed ? "?" : umaxtostr (f->stat.st_ino, hbuf));
+       p += inode_number_width + 1;
+     }
+ 
+@@ -3097,8 +3231,10 @@
+     {
+       char hbuf[LONGEST_HUMAN_READABLE + 1];
+       sprintf (p, "%*s ", block_size_width,
+-	       human_readable (ST_NBLOCKS (f->stat), hbuf, human_output_opts,
+-			       ST_NBLOCKSIZE, output_block_size));
++	       f->stat_failed
++	       ? "?"
++	       : human_readable (ST_NBLOCKS (f->stat), hbuf, human_output_opts,
++				 ST_NBLOCKSIZE, output_block_size));
+       p += block_size_width + 1;
+     }
+ 
+@@ -3107,10 +3243,18 @@
+   {
+     char hbuf[INT_BUFSIZE_BOUND (uintmax_t)];
+     sprintf (p, "%s %*s ", modebuf, nlink_width,
+-	     umaxtostr (f->stat.st_nlink, hbuf));
++	     f->stat_failed ? "?" : umaxtostr (f->stat.st_nlink, hbuf));
+   }
+   p += sizeof modebuf + nlink_width + 1;
+ 
++#ifdef WITH_SELINUX
++
++  if ( print_scontext ) {
++    sprintf (p, "%-32s ", f->scontext ?: "");
++    p += strlen (p);
++  }
++#endif
++
+   DIRED_INDENT ();
+ 
+   if (print_owner | print_group | print_author)
+@@ -3118,18 +3262,19 @@
+       DIRED_FPUTS (buf, stdout, p - buf);
+ 
+       if (print_owner)
+-	format_user (f->stat.st_uid, owner_width);
++	format_user (f->stat.st_uid, owner_width, f->stat_failed);
+ 
+       if (print_group)
+-	format_group (f->stat.st_gid, group_width);
++	format_group (f->stat.st_gid, group_width, f->stat_failed);
+ 
+       if (print_author)
+-	format_user (f->stat.st_author, author_width);
++	format_user (f->stat.st_author, author_width, f->stat_failed);
+ 
+       p = buf;
+     }
+ 
+-  if (S_ISCHR (f->stat.st_mode) || S_ISBLK (f->stat.st_mode))
++  if (!f->stat_failed
++      && (S_ISCHR (f->stat.st_mode) || S_ISBLK (f->stat.st_mode)))
+     {
+       char majorbuf[INT_BUFSIZE_BOUND (uintmax_t)];
+       char minorbuf[INT_BUFSIZE_BOUND (uintmax_t)];
+@@ -3147,13 +3292,15 @@
+       char hbuf[LONGEST_HUMAN_READABLE + 1];
+       uintmax_t size = unsigned_file_size (f->stat.st_size);
+       sprintf (p, "%*s ", file_size_width,
+-	       human_readable (size, hbuf, human_output_opts,
+-			       1, file_output_block_size));
++	       f->stat_failed
++	       ? "?"
++	       : human_readable (size, hbuf, human_output_opts,
++				 1, file_output_block_size));
+     }
+ 
+   p += file_size_width + 1;
+ 
+-  if ((when_local = localtime (&when)))
++  if (!f->stat_failed && (when_local = localtime (&when)))
+     {
+       time_t six_months_ago;
+       int recent;
+@@ -3208,15 +3355,17 @@
+ 	 print it as a huge integer number of seconds.  */
+       char hbuf[INT_BUFSIZE_BOUND (intmax_t)];
+       sprintf (p, "%*s ", long_time_expected_width (),
+-	       (TYPE_SIGNED (time_t)
+-		? imaxtostr (when, hbuf)
+-		: umaxtostr (when, hbuf)));
++	       f->stat_failed
++	       ? "?"
++	       : (TYPE_SIGNED (time_t)
++		  ? imaxtostr (when, hbuf)
++		  : umaxtostr (when, hbuf)));
+       p += strlen (p);
+     }
+ 
+   DIRED_FPUTS (buf, stdout, p - buf);
+   print_name_with_quoting (f->name, FILE_OR_LINK_MODE (f), f->linkok,
+-			   &dired_obstack);
++			   f->stat_failed, &dired_obstack);
+ 
+   if (f->filetype == symbolic_link)
+     {
+@@ -3224,7 +3373,7 @@
+ 	{
+ 	  DIRED_FPUTS_LITERAL (" -> ", stdout);
+ 	  print_name_with_quoting (f->linkname, f->linkmode, f->linkok - 1,
+-				   NULL);
++				   f->stat_failed, NULL);
+ 	  if (indicator_style != none)
+ 	    print_type_indicator (f->linkmode);
+ 	}
+@@ -3406,10 +3555,10 @@
+ 
+ static void
+ print_name_with_quoting (const char *p, mode_t mode, int linkok,
+-			 struct obstack *stack)
++			 int stat_failed, struct obstack *stack)
+ {
+   if (print_with_color)
+-    print_color_indicator (p, mode, linkok);
++    print_color_indicator (p, mode, linkok, stat_failed);
+ 
+   if (stack)
+     PUSH_CURRENT_DIRED_POS (stack);
+@@ -3454,7 +3603,8 @@
+ 	    human_readable (ST_NBLOCKS (f->stat), buf, human_output_opts,
+ 			    ST_NBLOCKSIZE, output_block_size));
+ 
+-  print_name_with_quoting (f->name, FILE_OR_LINK_MODE (f), f->linkok, NULL);
++  print_name_with_quoting (f->name, FILE_OR_LINK_MODE (f), f->linkok,
++			   f->stat_failed, NULL);
+ 
+   if (indicator_style != none)
+     print_type_indicator (f->stat.st_mode);
+@@ -3493,7 +3643,8 @@
+ }
+ 
+ static void
+-print_color_indicator (const char *name, mode_t mode, int linkok)
++print_color_indicator (const char *name, mode_t mode, int linkok,
++		       int stat_failed)
+ {
+   int type = C_FILE;
+   struct color_ext_type *ext;	/* Color extension */
+@@ -3523,6 +3674,8 @@
+ 	type = C_CHR;
+       else if (S_ISDOOR (mode))
+ 	type = C_DOOR;
++      else if (stat_failed)
++	type = C_ORPHAN;
+ 
+       if (type == C_FILE && (mode & S_IXUGO) != 0)
+ 	type = C_EXEC;
+@@ -4018,6 +4171,16 @@
+   -X                         sort alphabetically by entry extension\n\
+   -1                         list one file per line\n\
+ "), stdout);
++#ifdef WITH_SELINUX
++printf(_("\nSELINUX options:\n\n\
++      --lcontext             Display security context.   Enable -l. Lines\n\
++                               will probably be too wide for most displays.\n\
++      -Z, --context          Display security context so it fits on most\n\
++                               displays.  Displays only mode, user, group,\n\
++                               security context and file name.\n\
++      --scontext             Display only security context and file name.\n\
++\n\n"));
++#endif
+       fputs (HELP_OPTION_DESCRIPTION, stdout);
+       fputs (VERSION_OPTION_DESCRIPTION, stdout);
+       fputs (_("\n\
+@@ -4036,3 +4199,83 @@
+     }
+   exit (status);
+ }
++
++#ifdef WITH_SELINUX
++
++static void
++print_scontext_format (const struct fileinfo *f)
++{
++  char modebuf[12];
++
++  /* 7 fields that may require LONGEST_HUMAN_READABLE bytes,
++     1 10-byte mode string,
++     9 spaces, one following each of these fields, and
++     1 trailing NUL byte.  */
++
++  char init_bigbuf[7 * LONGEST_HUMAN_READABLE + 10  + 9 + 1];
++  char *buf = init_bigbuf;
++  size_t bufsize = sizeof (init_bigbuf);
++  size_t s;
++  char *p;
++  const char *fmt;
++  char *user_name;
++  char *group_name;
++  int rv;
++  char *scontext;
++
++  p = buf;
++
++  if ( print_scontext ) { /* zero means terse listing */
++    mode_string (f->stat.st_mode, modebuf);
++    modebuf[10] = (FILE_HAS_ACL (f) ? '+' : ' ');
++    modebuf[11] = '\0';
++
++    /* print mode */
++
++    (void) sprintf (p, "%s ", modebuf);
++    p += strlen (p);
++
++    /* print standard user and group */
++
++    user_name = f->stat_failed ? "?" :
++	    (numeric_ids ? NULL : getuser (f->stat.st_uid));
++    if (user_name)
++      (void) sprintf (p, "%-8.8s ", user_name);
++    else
++      (void) sprintf (p, "%-8u ", (unsigned int) f->stat.st_uid);
++    p += strlen (p);
++
++    if ( print_group ) {
++      group_name = f->stat_failed ? "?" :
++	      (numeric_ids ? NULL : getgroup (f->stat.st_gid));
++      if (group_name)
++	(void) sprintf (p, "%-8.8s ", group_name);
++      else
++	(void) sprintf (p, "%-8u ", (unsigned int) f->stat.st_gid);
++      p += strlen (p);
++    }
++  }
++
++  (void) sprintf (p, "%-32s ", f->scontext ?: "");
++  p += strlen (p);
++ 
++  DIRED_INDENT ();
++  DIRED_FPUTS (buf, stdout, p - buf);
++  print_name_with_quoting (f->name, f->stat.st_mode, f->linkok,
++			   f->stat_failed,  &dired_obstack);
++ 
++  if (f->filetype == symbolic_link) {
++      if (f->linkname) {
++	  DIRED_FPUTS_LITERAL (" -> ", stdout);
++	  print_name_with_quoting (f->linkname, f->linkmode, f->linkok - 1,
++				   f->stat_failed, NULL);
++	  if (indicator_style != none)
++	    print_type_indicator (f->linkmode);
++      }
++  }
++  else {
++    if (indicator_style != none)
++      print_type_indicator (f->stat.st_mode);
++  }
++}
++#endif
+diff -urN coreutils-5.2.1.orig/src/Makefile.am coreutils-5.2.1/src/Makefile.am
+--- coreutils-5.2.1.orig/src/Makefile.am	2005-01-15 12:04:40.000000000 -0600
++++ coreutils-5.2.1/src/Makefile.am	2005-01-15 12:09:49.000000000 -0600
+@@ -3,13 +3,13 @@
+ EXTRA_PROGRAMS = chroot df hostid nice pinky stty su runuser uname uptime users who
+ 
+ bin_SCRIPTS = groups
+-bin_PROGRAMS = [ chgrp chown chmod cp dd dircolors du \
++bin_PROGRAMS = [ chgrp chown chmod chcon cp dd dircolors du \
+   ginstall link ln dir vdir ls mkdir \
+   mkfifo mknod mv nohup readlink rm rmdir shred stat sync touch unlink \
+   cat cksum comm csplit cut expand fmt fold head join md5sum \
+   nl od paste pr ptx sha1sum sort split sum tac tail tr tsort unexpand uniq wc \
+   basename date dirname echo env expr factor false \
+-  hostname id kill logname pathchk printenv printf pwd seq sleep tee \
++  hostname id kill logname pathchk printenv printf pwd runcon seq sleep tee \
+   test true tty whoami yes \
+   $(OPTIONAL_BIN_PROGS) $(DF_PROG)
+ 
+@@ -32,13 +32,20 @@
+ # replacement functions defined in libfetish.a.
+ LDADD = ../lib/libfetish.a $(LIBINTL) ../lib/libfetish.a
+ 
+-dir_LDADD = $(LDADD) $(LIB_CLOCK_GETTIME) @LIBACL@
+-ls_LDADD = $(LDADD) $(LIB_CLOCK_GETTIME) @LIBACL@
++dir_LDADD = $(LDADD) $(LIB_CLOCK_GETTIME) @LIBACL@ @LIB_SELINUX@
++ls_LDADD = $(LDADD) $(LIB_CLOCK_GETTIME) @LIBACL@ @LIB_SELINUX@
+ shred_LDADD = $(LDADD) $(LIB_CLOCK_GETTIME)
+-vdir_LDADD = $(LDADD) $(LIB_CLOCK_GETTIME) @LIBACL@
+-cp_LDADD = $(LDADD) @LIBACL@
+-ginstall_LDADD = $(LDADD) @LIBACL@
+-mv_LDADD = $(LDADD) @LIBACL@
++vdir_LDADD = $(LDADD) $(LIB_CLOCK_GETTIME) @LIBACL@ @LIB_SELINUX@
++cp_LDADD = $(LDADD) @LIBACL@ @LIB_SELINUX@
++ginstall_LDADD = $(LDADD) @LIBACL@ @LIB_SELINUX@
++mv_LDADD = $(LDADD) @LIBACL@ @LIB_SELINUX@
++chcon_LDADD = $(LDADD) @LIB_SELINUX@
++id_LDADD = $(LDADD) @LIB_SELINUX@
++mkdir_LDADD = $(LDADD) @LIB_SELINUX@
++mkfifo_LDADD = $(LDADD) @LIB_SELINUX@
++mknod_LDADD = $(LDADD) @LIB_SELINUX@
++stat_LDADD = $(LDADD) @LIB_SELINUX@
++runcon_LDADD = $(LDADD) @LIB_SELINUX@
+ 
+ ## If necessary, add -lm to resolve use of pow in lib/strtod.c.
+ sort_LDADD = $(LDADD) $(POW_LIB)
+diff -urN coreutils-5.2.1.orig/src/mkdir.c coreutils-5.2.1/src/mkdir.c
+--- coreutils-5.2.1.orig/src/mkdir.c	2004-01-21 16:27:02.000000000 -0600
++++ coreutils-5.2.1/src/mkdir.c	2005-01-15 12:09:49.000000000 -0600
+@@ -34,6 +34,10 @@
+ 
+ #define AUTHORS "David MacKenzie"
+ 
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>          /* for is_selinux_enabled() */
++#endif
++
+ /* The name this program was run with. */
+ char *program_name;
+ 
+@@ -42,6 +46,9 @@
+ 
+ static struct option const longopts[] =
+ {
++#ifdef WITH_SELINUX
++  {"context", required_argument, NULL, 'Z'},
++#endif
+   {"mode", required_argument, NULL, 'm'},
+   {"parents", no_argument, NULL, 'p'},
+   {"verbose", no_argument, NULL, 'v'},
+@@ -63,6 +70,11 @@
+ Create the DIRECTORY(ies), if they do not already exist.\n\
+ \n\
+ "), stdout);
++#ifdef WITH_SELINUX
++      printf (_("\
++  -Z, --context=CONTEXT (SELinux) set security context to CONTEXT\n\
++"));
++#endif
+       fputs (_("\
+ Mandatory arguments to long options are mandatory for short options too.\n\
+ "), stdout);
+@@ -98,7 +110,11 @@
+ 
+   create_parents = 0;
+ 
++#ifdef WITH_SELINUX
++  while ((optc = getopt_long (argc, argv, "pm:vZ:", longopts, NULL)) != -1)
++#else
+   while ((optc = getopt_long (argc, argv, "pm:v", longopts, NULL)) != -1)
++#endif
+     {
+       switch (optc)
+ 	{
+@@ -113,6 +129,20 @@
+ 	case 'v': /* --verbose  */
+ 	  verbose_fmt_string = _("created directory %s");
+ 	  break;
++#ifdef WITH_SELINUX
++ 	case 'Z':
++ 	  /* politely decline if we're not on a selinux-enabled kernel. */
++	  if( !(is_selinux_enabled()>0)) {
++ 	    fprintf( stderr, "Sorry, --context (-Z) can be used only on "
++ 		             "a selinux-enabled kernel.\n" );
++ 	    exit( 1 );
++ 	  }
++	  if (setfscreatecon(optarg)) {
++ 	    fprintf( stderr, "Sorry, cannot set default context to %s.\n", optarg);
++ 	    exit( 1 );
++ 	  }
++ 	  break;
++#endif
+ 	case_GETOPT_HELP_CHAR;
+ 	case_GETOPT_VERSION_CHAR (PROGRAM_NAME, AUTHORS);
+ 	default:
+diff -urN coreutils-5.2.1.orig/src/mkfifo.c coreutils-5.2.1/src/mkfifo.c
+--- coreutils-5.2.1.orig/src/mkfifo.c	2004-01-21 16:27:02.000000000 -0600
++++ coreutils-5.2.1/src/mkfifo.c	2005-01-15 12:09:49.000000000 -0600
+@@ -32,11 +32,18 @@
+ 
+ #define AUTHORS "David MacKenzie"
+ 
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>          /* for is_selinux_enabled() */
++#endif
++
+ /* The name this program was run with. */
+ char *program_name;
+ 
+ static struct option const longopts[] =
+ {
++#ifdef WITH_SELINUX
++  {"context", required_argument, NULL, 'Z'},
++#endif
+   {"mode", required_argument, NULL, 'm'},
+   {GETOPT_HELP_OPTION_DECL},
+   {GETOPT_VERSION_OPTION_DECL},
+@@ -57,6 +64,11 @@
+ Create named pipes (FIFOs) with the given NAMEs.\n\
+ \n\
+ "), stdout);
++#ifdef WITH_SELINUX
++      printf (_("\
++  -Z, --context=CONTEXT   set security context (quoted string)\n\
++"), stdout);
++#endif
+       fputs (_("\
+ Mandatory arguments to long options are mandatory for short options too.\n\
+ "), stdout);
+@@ -93,7 +105,11 @@
+ #ifndef S_ISFIFO
+   error (EXIT_FAILURE, 0, _("fifo files not supported"));
+ #else
++#ifdef WITH_SELINUX
++  while ((optc = getopt_long (argc, argv, "m:Z:", longopts, NULL)) != -1)
++#else
+   while ((optc = getopt_long (argc, argv, "m:", longopts, NULL)) != -1)
++#endif
+     {
+       switch (optc)
+ 	{
+@@ -102,6 +118,19 @@
+ 	case 'm':
+ 	  specified_mode = optarg;
+ 	  break;
++#ifdef WITH_SELINUX
++ 	case 'Z':
++ 	  if( !(is_selinux_enabled()>0)) {
++ 	    fprintf( stderr, "Sorry, --context (-Z) can be used only on "
++		             "a selinux-enabled kernel.\n" );
++ 	    exit( 1 );
++ 	  }
++	  if (setfscreatecon(optarg)) {
++ 	    fprintf( stderr, "Sorry, cannot set default context to %s.\n", optarg);
++ 	    exit( 1 );
++ 	  }
++ 	  break;
++#endif
+ 	case_GETOPT_HELP_CHAR;
+ 	case_GETOPT_VERSION_CHAR (PROGRAM_NAME, AUTHORS);
+ 	default:
+diff -urN coreutils-5.2.1.orig/src/mknod.c coreutils-5.2.1/src/mknod.c
+--- coreutils-5.2.1.orig/src/mknod.c	2004-01-21 16:27:02.000000000 -0600
++++ coreutils-5.2.1/src/mknod.c	2005-01-15 12:09:49.000000000 -0600
+@@ -36,8 +36,15 @@
+ /* The name this program was run with. */
+ char *program_name;
+ 
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++#endif
++
+ static struct option const longopts[] =
+ {
++#ifdef WITH_SELINUX
++  {"context", required_argument, NULL, 'Z'},
++#endif
+   {"mode", required_argument, NULL, 'm'},
+   {GETOPT_HELP_OPTION_DECL},
+   {GETOPT_VERSION_OPTION_DECL},
+@@ -58,6 +65,11 @@
+ Create the special file NAME of the given TYPE.\n\
+ \n\
+ "), stdout);
++#ifdef WITH_SELINUX
++      fputs(_("\
++  -Z, --context=CONTEXT   set security context (quoted string)\n\
++"), stdout);
++#endif
+       fputs (_("\
+ Mandatory arguments to long options are mandatory for short options too.\n\
+ "), stdout);
+@@ -103,7 +115,11 @@
+ 
+   specified_mode = NULL;
+ 
++#ifdef WITH_SELINUX
++  while ((optc = getopt_long (argc, argv, "m:Z:", longopts, NULL)) != -1)
++#else
+   while ((optc = getopt_long (argc, argv, "m:", longopts, NULL)) != -1)
++#endif
+     {
+       switch (optc)
+ 	{
+@@ -112,6 +128,20 @@
+ 	case 'm':
+ 	  specified_mode = optarg;
+ 	  break;
++#ifdef WITH_SELINUX
++ 	case 'Z':
++ 	  /* politely decline if we're not on a selinux-enabled kernel. */
++	  if( !(is_selinux_enabled()>0)) {
++ 	    fprintf( stderr, "Sorry, --context (-Z) can be used only on "
++		             "a selinux-enabled kernel.\n" );
++ 	    exit( 1 );
++ 	  }
++	  if (setfscreatecon(optarg)) {
++ 	    fprintf( stderr, "Sorry, cannot set default context to %s.\n", optarg);
++ 	    exit( 1 );
++ 	  }
++ 	  break;
++#endif
+ 	case_GETOPT_HELP_CHAR;
+ 	case_GETOPT_VERSION_CHAR (PROGRAM_NAME, AUTHORS);
+ 	default:
+diff -urN coreutils-5.2.1.orig/src/mv.c coreutils-5.2.1/src/mv.c
+--- coreutils-5.2.1.orig/src/mv.c	2005-01-15 12:03:37.000000000 -0600
++++ coreutils-5.2.1/src/mv.c	2005-01-15 12:09:49.000000000 -0600
+@@ -34,6 +34,11 @@
+ #include "quote.h"
+ #include "remove.h"
+ 
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>          /* for is_selinux_enabled() */
++int selinux_enabled=0;
++#endif
++
+ /* The official name of this program (e.g., no `g' prefix).  */
+ #define PROGRAM_NAME "mv"
+ 
+@@ -124,6 +129,9 @@
+   x->preserve_links = 1;
+   x->preserve_mode = 1;
+   x->preserve_timestamps = 1;
++#ifdef WITH_SELINUX
++  x->preserve_security_context = 1;
++#endif
+   x->require_preserve = 0;  /* FIXME: maybe make this an option */
+   x->recursive = 1;
+   x->sparse_mode = SPARSE_AUTO;  /* FIXME: maybe make this an option */
+@@ -376,6 +384,10 @@
+ 
+   cp_option_init (&x);
+ 
++#ifdef WITH_SELINUX
++  selinux_enabled= (is_selinux_enabled()>0);
++#endif
++
+   /* FIXME: consider not calling getenv for SIMPLE_BACKUP_SUFFIX unless
+      we'll actually use backup_suffix_string.  */
+   backup_suffix_string = getenv ("SIMPLE_BACKUP_SUFFIX");
+diff -urN coreutils-5.2.1.orig/src/runcon.c coreutils-5.2.1/src/runcon.c
+--- coreutils-5.2.1.orig/src/runcon.c	1969-12-31 18:00:00.000000000 -0600
++++ coreutils-5.2.1/src/runcon.c	2005-01-15 12:09:49.000000000 -0600
+@@ -0,0 +1,201 @@
++/*
++ * runcon [ context |
++ *         ( [ -r role ] [-t type] [ -u user ] [ -l levelrange ] )
++ *         command [arg1 [arg2 ...] ]
++ *
++ * attempt to run the specified command with the specified context.
++ * 
++ * -r role  : use the current context with the specified role
++ * -t type  : use the current context with the specified type
++ * -u user  : use the current context with the specified user
++ * -l level : use the current context with the specified level range
++ *
++ * Contexts are interpreted as follows:
++ *
++ * Number of       MLS
++ * components    system?
++ *
++ *     1            -         type
++ *     2            -         role:type
++ *     3            Y         role:type:range
++ *     3            N         user:role:type
++ *     4            Y         user:role:type:range
++ *     4            N         error
++ */
++
++#include <config.h>
++#include <unistd.h>
++#include <stdio.h>
++#include <getopt.h>
++#include <selinux/context.h>
++#include <selinux/selinux.h>
++#include <errno.h>
++#include "system.h"
++extern int errno;
++
++/* The name the program was run with. */
++char *program_name;
++
++void
++usage(char *str)
++{
++  printf(_("Usage: %s [OPTION]... command [args]\n"
++         "Run a program in a different security context.\n\n"
++         "  context       Complete security context\n"
++         "  -t            type (for same role as parent)\n"
++         "  -u            user identity\n"
++         "  -r            role\n"
++         "  -l            levelrange\n"
++         "    --help      display this help and exit\n"),
++         program_name);
++  exit(1);
++}
++
++int 
++main(int argc,char **argv,char **envp )
++{
++  char *role    = 0;
++  char *range   = 0;
++  char *user    = 0;
++  char *type    = 0;
++  char *context = NULL;
++  security_context_t cur_context = NULL;
++
++  context_t      con;
++
++  program_name = argv[0];
++  setlocale (LC_ALL, "");
++  bindtextdomain (PACKAGE, LOCALEDIR);
++  textdomain (PACKAGE);
++  
++  while (1) {
++    int c;
++    int this_option_optind = optind ? optind : 1;
++    int option_index = 0;
++    static struct option long_options[] = {
++      { "role", 1, 0, 'r' },
++      { "type", 1, 0, 't' },
++      { "user", 1, 0, 'u' },
++      { "range", 1, 0, 'l' },
++      { "help", 0, 0, '?' },
++      { 0, 0, 0, 0 }
++    };
++    c = getopt_long(argc, argv, "s:r:t:u:l:?", long_options, &option_index);
++    if ( c == -1 ) {
++      break;
++    }
++    switch ( c ) {
++    case 'r':
++      if ( role ) {
++	fprintf(stderr,_("multiple roles\n"));
++	exit(1);
++      }
++      role = optarg;
++      break;
++    case 't':
++      if ( type ) {
++	fprintf(stderr,_("multiple types\n"));
++	exit(1);
++      }
++      type = optarg;
++      break;
++    case 'u':
++      if ( user ) {
++	fprintf(stderr,_("multiple users\n"));
++	exit(1);
++      }
++      user = optarg;
++      break;
++    case 'l':
++      if ( range ) {
++	fprintf(stderr,_("multiple levelranges\n"));
++	exit(1);
++      }
++      range = optarg;
++      break;
++    default:
++      fprintf(stderr,_("unrecognised option %c\n"),c);
++    case '?':
++      usage(0);
++      break;
++    }
++  }
++
++ if( is_selinux_enabled() != 1 ) {
++    fprintf( stderr,
++             _("runcon may be used only on a SELinux kernel.\n") );
++    exit(-1);
++  }
++  
++  if ( !(user || role || type || range)) {
++    if ( optind >= argc ) {
++      usage(_("must specify -t, -u, -l, -r, or context"));
++    }
++    context = argv[optind++];
++  }
++  
++  if ( optind >= argc ) {
++    usage(_("no command found"));
++  }
++
++  if ( context ) {
++    con = context_new(context);
++    if (!con) {
++      fprintf(stderr,_("%s is not a valid context\n"), context);
++      exit(1);
++    }
++  }
++  else {
++    if (getcon(&cur_context) < 0) {
++      fprintf(stderr,_("Couldn't get current context.\n"));
++      exit(1);
++    }
++    con = context_new(cur_context);
++    if (!con) {
++      fprintf(stderr,_("%s is not a valid context\n"), cur_context);
++      exit(1);
++    }
++    if ( user ) {
++      if ( context_user_set(con,user)) {
++        fprintf(stderr,_("failed to set new user %s\n"),user);
++        exit(1);
++      }
++    }
++    if ( type ) {
++      if ( context_type_set(con,type)) {
++        fprintf(stderr,_("failed to set new type %s\n"),type);
++        exit(1);
++      }
++    }
++    if ( range ) {
++      if ( context_range_set(con,range)) {
++        fprintf(stderr,_("failed to set new range %s\n"),range);
++        exit(1);
++      }
++    }
++    if ( role ) {
++      if (context_role_set(con,role)) {
++        fprintf(stderr,_("failed to set new role %s\n"),role);
++        exit(1);
++      }
++    }
++  }
++
++  if (security_check_context(context_str(con)) < 0) {
++    fprintf(stderr, _("%s is not a valid context\n"), context_str(con));
++    exit(1);
++  }
++  
++  if (setexeccon(context_str(con))!=0) {
++    fprintf(stderr,_("unable to setup security context %s\n"), context_str(con));
++    exit(1);
++  }
++  if (cur_context!=NULL) 
++    freecon(cur_context);
++
++  if ( execvp(argv[optind],argv+optind) ) {
++    perror("execvp");
++    exit(1);
++  }
++  return 1; /* can't reach this statement.... */
++}
+diff -urN coreutils-5.2.1.orig/src/stat.c coreutils-5.2.1/src/stat.c
+--- coreutils-5.2.1.orig/src/stat.c	2004-02-05 07:46:12.000000000 -0600
++++ coreutils-5.2.1/src/stat.c	2005-01-15 12:09:49.000000000 -0600
+@@ -42,6 +42,13 @@
+ # endif
+ #endif
+ 
++#ifdef WITH_SELINUX
++#include <selinux/selinux.h>
++#define SECURITY_ID_T security_context_t
++#else
++#define SECURITY_ID_T char *
++#endif
++
+ #include "system.h"
+ 
+ #include "error.h"
+@@ -95,6 +102,7 @@
+   {"dereference", no_argument, 0, 'L'},
+   {"format", required_argument, 0, 'c'},
+   {"filesystem", no_argument, 0, 'f'},
++  {"context", no_argument, 0, 'Z'},
+   {"terse", no_argument, 0, 't'},
+   {GETOPT_HELP_OPTION_DECL},
+   {GETOPT_VERSION_OPTION_DECL},
+@@ -345,7 +353,7 @@
+ /* print statfs info */
+ static void
+ print_statfs (char *pformat, char m, char const *filename,
+-	      void const *data)
++	      void const *data,SECURITY_ID_T scontext)
+ {
+   STRUCT_STATVFS const *statfsbuf = data;
+ 
+@@ -407,7 +415,10 @@
+       strcat (pformat, PRIdMAX);
+       printf (pformat, (intmax_t) (statfsbuf->f_ffree));
+       break;
+-
++    case 'C':
++      strcat (pformat, "s");
++      printf(scontext);
++      break;
+     default:
+       strcat (pformat, "c");
+       printf (pformat, m);
+@@ -417,7 +428,7 @@
+ 
+ /* print stat info */
+ static void
+-print_stat (char *pformat, char m, char const *filename, void const *data)
++print_stat (char *pformat, char m, char const *filename, void const *data, SECURITY_ID_T scontext)
+ {
+   struct stat *statbuf = (struct stat *) data;
+   struct passwd *pw_ent;
+@@ -553,6 +564,10 @@
+       strcat (pformat, "d");
+       printf (pformat, (int) statbuf->st_ctime);
+       break;
++    case 'C':
++      strcat (pformat, "s");
++      printf(pformat,scontext);
++      break;
+     default:
+       strcat (pformat, "c");
+       printf (pformat, m);
+@@ -562,8 +577,8 @@
+ 
+ static void
+ print_it (char const *masterformat, char const *filename,
+-	  void (*print_func) (char *, char, char const *, void const *),
+-	  void const *data)
++	  void (*print_func) (char *, char, char const *, void const *,SECURITY_ID_T ),
++	  void const *data,  SECURITY_ID_T scontext)
+ {
+   char *b;
+ 
+@@ -598,7 +613,7 @@
+ 	      putchar ('%');
+ 	      break;
+ 	    default:
+-	      print_func (dest, *p, filename, data);
++	      print_func (dest, *p, filename, data,scontext);
+ 	      break;
+ 	    }
+ 	}
+@@ -615,9 +630,17 @@
+ 
+ /* stat the filesystem and print what we find */
+ static void
+-do_statfs (char const *filename, int terse, char const *format)
++do_statfs (char const *filename, int terse, int secure, char const *format)
+ {
+   STRUCT_STATVFS statfsbuf;
++  SECURITY_ID_T scontext = NULL;
++#ifdef WITH_SELINUX
++  if(secure)
++    if (getfilecon(filename,&scontext)<0) {
++      perror (filename);
++      return;
++    }
++#endif
+   int i = statfs (filename, &statfsbuf);
+ 
+   if (i == -1)
+@@ -629,23 +652,40 @@
+ 
+   if (format == NULL)
+     {
+-      format = (terse
+-		? "%n %i %l %t %b %f %a %s %c %d"
+-		: "  File: \"%n\"\n"
+-		"    ID: %-8i Namelen: %-7l Type: %T\n"
+-		"Blocks: Total: %-10b Free: %-10f Available: %-10a Size: %s\n"
+-		"Inodes: Total: %-10c Free: %-10d");
+-    }
+-
+-  print_it (format, filename, print_statfs, &statfsbuf);
++      if (terse) {
++	if(secure)
++	  format = "%n %i %l %t %b %f %a %s %c %d %C";
++	else
++	  format = "%n %i %l %t %b %f %a %s %c %d";
++      } 
++      else 
++	{
++	  if(secure)
++	    format = "  File: \"%n\"\n"
++	      "    ID: %-8i Namelen: %-7l Type: %T\n"
++	      "Blocks: Total: %-10b Free: %-10f Available: %-10a Size: %s\n"
++	      "Inodes: Total: %-10c Free: %-10d\n"
++	      "   S_Context: %C\n";
++	  else	
++	    format= "  File: \"%n\"\n"
++	      "    ID: %-8i Namelen: %-7l Type: %T\n"
++	      "Blocks: Total: %-10b Free: %-10f Available: %-10a Size: %s\n"
++	      "Inodes: Total: %-10c Free: %-10d";
++	}	
++    }
++  print_it (format, filename, print_statfs, &statfsbuf,scontext);
++#ifdef WITH_SELINUX
++  if (scontext != NULL)
++    freecon(scontext);
++#endif
+ }
+-
+ /* stat the file and print what we find */
+ static void
+-do_stat (char const *filename, int follow_links, int terse,
++  do_stat (char const *filename, int follow_links, int terse,int secure,
+ 	 char const *format)
+ {
+   struct stat statbuf;
++  SECURITY_ID_T scontext = NULL;
+   int i = ((follow_links == 1)
+ 	   ? stat (filename, &statbuf)
+ 	   : lstat (filename, &statbuf));
+@@ -656,11 +696,28 @@
+       return;
+     }
+ 
++#ifdef WITH_SELINUX
++  if(secure) {
++    if (link) 
++      i=lgetfilecon(filename, &scontext);
++    else
++      i=getfilecon(filename, &scontext);
++    if (i == -1)
++      {
++	perror (filename);
++	return;
++      }
++  }
++#endif
++
+   if (format == NULL)
+     {
+       if (terse != 0)
+ 	{
+-	  format = "%n %s %b %f %u %g %D %i %h %t %T %X %Y %Z %o";
++	   if (secure)
++		  format = "%n %s %b %f %u %g %D %i %h %t %T %X %Y %Z %o %C";
++	   else
++	     format = "%n %s %b %f %u %g %D %i %h %t %T %X %Y %Z %o";
+ 	}
+       else
+ 	{
+@@ -668,7 +725,17 @@
+ 	  i = statbuf.st_mode & S_IFMT;
+ 	  if (i == S_IFCHR || i == S_IFBLK)
+ 	    {
+-	      format =
++          	if (secure)
++               		format =
++			  "  File: %N\n"
++			  "  Size: %-10s\tBlocks: %-10b IO Block: %-6o %F\n"
++			  "Device: %Dh/%dd\tInode: %-10i  Links: %-5h"
++			  " Device type: %t,%T\n"
++			  "Access: (%04a/%10.10A)  Uid: (%5u/%8U)   Gid: (%5g/%8G)\n"
++			  "   S_Context: %C\n"
++			  "Access: %x\n" "Modify: %y\n" "Change: %z\n";
++        	else
++	       format =
+ 		"  File: %N\n"
+ 		"  Size: %-10s\tBlocks: %-10b IO Block: %-6o %F\n"
+ 		"Device: %Dh/%dd\tInode: %-10i  Links: %-5h"
+@@ -678,6 +745,15 @@
+ 	    }
+ 	  else
+ 	    {
++	   	if (secure)
++		  format =
++		    "  File: %N\n"
++		    "  Size: %-10s\tBlocks: %-10b IO Block: %-6o %F\n"
++		    "Device: %Dh/%dd\tInode: %-10i  Links: %-5h\n"
++		    "Access: (%04a/%10.10A)  Uid: (%5u/%8U)   Gid: (%5g/%8G)\n"
++		    "S_Context: %C\n"
++		    "Access: %x\n" "Modify: %y\n" "Change: %z\n";
++                else
+ 	      format =
+ 		"  File: %N\n"
+ 		"  Size: %-10s\tBlocks: %-10b IO Block: %-6o %F\n"
+@@ -687,7 +763,11 @@
+ 	    }
+ 	}
+     }
+-  print_it (format, filename, print_stat, &statbuf);
++  print_it (format, filename, print_stat, &statbuf,scontext);
++#ifdef WITH_SELINUX
++  if (scontext) 
++    freecon(scontext);
++#endif
+ }
+ 
+ void
+@@ -705,6 +785,7 @@
+   -f, --filesystem      display filesystem status instead of file status\n\
+   -c  --format=FORMAT   use the specified FORMAT instead of the default\n\
+   -L, --dereference     follow links\n\
++  -Z, --context         print the security context \n\
+   -t, --terse           print the information in terse form\n\
+ "), stdout);
+       fputs (HELP_OPTION_DESCRIPTION, stdout);
+@@ -756,6 +837,7 @@
+   %c   Total file nodes in file system\n\
+   %d   Free file nodes in file system\n\
+   %f   Free blocks in file system\n\
++  %C - Security context in SELinux\n\
+ "), stdout);
+       fputs (_("\
+   %i   File System id in hex\n\
+@@ -778,6 +860,7 @@
+   int follow_links = 0;
+   int fs = 0;
+   int terse = 0;
++  int secure = 0;
+   char *format = NULL;
+ 
+   initialize_main (&argc, &argv);
+@@ -788,7 +871,7 @@
+ 
+   atexit (close_stdout);
+ 
+-  while ((c = getopt_long (argc, argv, "c:fLlt", long_options, NULL)) != -1)
++  while ((c = getopt_long (argc, argv, "c:fLltZ", long_options, NULL)) != -1)
+     {
+       switch (c)
+ 	{
+@@ -810,6 +893,14 @@
+ 	case 't':
+ 	  terse = 1;
+ 	  break;
++	case 'Z':
++	  if((is_selinux_enabled()>0))
++	    secure = 1;
++	  else {
++	    error (0, 0, _("Kernel is not SELinux enabled"));
++	    usage (EXIT_FAILURE);
++	  }
++	  break;
+ 
+ 	case_GETOPT_HELP_CHAR;
+ 
+@@ -829,9 +920,9 @@
+   for (i = optind; i < argc; i++)
+     {
+       if (fs == 0)
+-	do_stat (argv[i], follow_links, terse, format);
++	do_stat (argv[i], follow_links, terse, secure, format);
+       else
+-	do_statfs (argv[i], terse, format);
++	do_statfs (argv[i], terse, secure, format);
+     }
+ 
+   exit (G_fail ? EXIT_FAILURE : EXIT_SUCCESS);
+diff -urN coreutils-5.2.1.orig/tests/help-version coreutils-5.2.1/tests/help-version
+--- coreutils-5.2.1.orig/tests/help-version	2005-01-15 12:04:40.000000000 -0600
++++ coreutils-5.2.1/tests/help-version	2005-01-15 12:09:49.000000000 -0600
+@@ -42,6 +42,8 @@
+ 
+     # Skip `test'; it doesn't accept --help or --version.
+     test $i = test && continue;
++    test $i = chcon && continue;
++    test $i = runcon && continue;
+ 
+     # false fails even when invoked with --help or --version.
+     if test $i = false; then
+@@ -155,7 +157,7 @@
+ 
+ for i in $all_programs; do
+   # Skip these.
+-  case $i in chroot|stty|tty|false) continue;; esac
++  case $i in chroot|stty|tty|false|chcon|runcon) continue;; esac
+ 
+   rm -rf $tmp_in $tmp_in2 $tmp_dir $tmp_out
+   echo > $tmp_in
diff -NuBbwr debian-dir--1.0/rules debian-dir-sel--1.0/rules
--- debian-dir--1.0/rules	2005-03-03 08:01:30.000000000 -0600
+++ debian-dir-sel--1.0/rules	2005-03-03 10:38:30.000000000 -0600
@@ -35,7 +35,8 @@
 		LDFLAGS=$(LDFLAGS) ./configure \
 		--build=$(DEB_BUILD_GNU_TYPE) --host=$(DEB_HOST_GNU_TYPE) \
 		--prefix=/usr -v \
-		--infodir=/usr/share/info --mandir=/usr/share/man
+		--infodir=/usr/share/info --mandir=/usr/share/man \
+		--enable-pam --enable-selinux
 
 	touch configure-stamp
 
@@ -101,6 +102,10 @@
 	sed s/\"1\"/\"8\"/1 $(d)/usr/share/man/man1/chroot.1 > $(d)/usr/share/man/man8/chroot.8
 	rm $(d)/usr/share/man/man1/chroot.1
 
+	# The install target doesn't include `runuser' for some reason.  As a
+	# temporary workaround, catch the beastie here.
+	cp $(BUILD_TREE)/src/runuser $(d)/sbin/runuser
+
 	cp $(BUILD_TREE)/AUTHORS \
 		$(BUILD_TREE)/NEWS $(BUILD_TREE)/README \
 		$(BUILD_TREE)/THANKS \
