diff --git a/libselinux/Makefile b/libselinux/Makefile

index fd4f0b1..51469bc 100644

--- a/libselinux/Makefile

+++ b/libselinux/Makefile

@@ -1,4 +1,4 @@

-SUBDIRS = src include utils man

+SUBDIRS = src include utils man golang

 DISABLE_AVC ?= n

 DISABLE_SETRANS ?= n

diff --git a/libselinux/golang/Makefile b/libselinux/golang/Makefile

new file mode 100644

index 0000000..b75677b

--- /dev/null

+++ b/libselinux/golang/Makefile

@@ -0,0 +1,22 @@

+# Installation directories.

+PREFIX ?= $(DESTDIR)/usr

+LIBDIR ?= $(DESTDIR)/usr/lib

+GODIR ?= $(LIBDIR)/golang/src/pkg/github.com/selinux

+all:

+

+install: 

+	[ -d $(GODIR) ] || mkdir -p $(GODIR)

+	install -m 644 selinux.go $(GODIR)

+

+test:

+	@mkdir selinux

+	@cp selinux.go selinux

+	GOPATH=$(pwd) go run test.go 

+	@rm -rf selinux

+

+clean:

+	@rm -f *~

+	@rm -rf selinux

+indent:

+

+relabel:

diff --git a/libselinux/golang/selinux.go b/libselinux/golang/selinux.go

new file mode 100644

index 0000000..6cee26a

--- /dev/null

+++ b/libselinux/golang/selinux.go

@@ -0,0 +1,378 @@

+package selinux

+

+/*

+ The selinux package is a go bindings to libselinux required to add selinux

+ support to docker.

+

+ Author Dan Walsh <dwalsh@redhat.com>

+

+ Used some ideas/code from the go-ini packages https://github.com/vaughan0

+ By Vaughan Newton

+*/

+

+// #cgo pkg-config: libselinux

+// #include <selinux/selinux.h>

+// #include <stdlib.h>

+import "C"

+import (

+	"encoding/binary"

+	"crypto/rand"

+	"unsafe"

+	"fmt"

+	"bufio"

+	"regexp"

+	"io"

+	"os"

+	"strings"

+)

+

+var (

+	assignRegex  = regexp.MustCompile(`^([^=]+)=(.*)$`)

+	mcs_list = make(map[string]bool)

+)

+

+func Matchpathcon(path string, mode int) (string, error) {

+	var con C.security_context_t

+	var scon string

+	rc, err := C.matchpathcon(C.CString(path),C.mode_t(mode), &con)

+	if rc == 0 {

+		scon = C.GoString(con)

+		C.free(unsafe.Pointer(con))

+	}

+	return scon, err

+}

+

+func Setfilecon(path,scon string) (int, error) {

+        rc, err := C.lsetfilecon(C.CString(path),C.CString(scon))

+	return int(rc), err

+}

+

+func Getfilecon(path string) (string, error) {

+	var scon C.security_context_t

+	var fcon string

+        rc, err := C.lgetfilecon(C.CString(path),&scon)

+	if (rc >= 0) {

+		fcon = C.GoString(scon)	

+		err = nil

+	}

+	return fcon, err

+}

+

+func Setfscreatecon(scon string) (int, error) {

+	var (

+		rc C.int

+		err error

+	)

+	if (scon != "") {

+		rc, err = C.setfscreatecon(C.CString(scon))

+	} else {

+		rc, err = C.setfscreatecon(nil)

+	}

+	return int(rc), err

+}

+

+func Getfscreatecon() (string, error) {

+	var scon C.security_context_t

+	var fcon string

+        rc, err := C.getfscreatecon(&scon)

+	if (rc >= 0) {

+		fcon = C.GoString(scon)	

+		err = nil

+		C.freecon(scon)

+	}

+	return fcon, err

+}

+

+func Getcon() (string) {

+	var pcon C.security_context_t

+	C.getcon(&pcon)

+	scon := C.GoString(pcon)

+	C.freecon(pcon)

+	return scon

+}

+

+func Getpidcon(pid int) (string, error) {

+	var pcon C.security_context_t

+	var scon string

+	rc, err := C.getpidcon(C.pid_t(pid), &pcon)

+	if (rc >= 0) {

+		scon = C.GoString(pcon)

+		C.freecon(pcon)

+		err = nil

+	}

+	return scon, err

+}

+

+func Getpeercon(socket int) (string, error) {

+	var pcon C.security_context_t

+	var scon string

+	rc, err := C.getpeercon(C.int(socket), &pcon)

+	if (rc >= 0) {

+		scon = C.GoString(pcon)

+		C.freecon(pcon)

+		err = nil

+	}

+	return scon, err

+}

+

+func Setexeccon(scon string) (int, error) {

+	var val *C.char

+	if ! Selinux_enabled() {

+		return 0, nil

+	}

+	if scon != "" {

+		val = C.CString(scon)

+	} else {

+		val = nil

+	}

+        rc, err := C.setexeccon(val)

+	return int(rc), err

+}

+

+type Context struct {

+	con []string

+}

+func (c *Context) Set_user(user string) {

+	c.con[0]=user

+}

+func (c *Context) Get_user() string {

+	return c.con[0]

+}

+func (c *Context) Set_role(role string) {

+	c.con[1]=role

+}

+func (c *Context) Get_role() string {

+	return c.con[1]

+}

+func (c *Context) Set_type(setype string) {

+	c.con[2]=setype

+}

+func (c *Context) Get_type() string {

+	return c.con[2]

+}

+func (c *Context) Set_level(mls string) {

+	c.con[3]=mls

+}

+func (c *Context) Get_level() string {

+	return c.con[3]

+}

+func (c *Context) Get() string{

+	return strings.Join(c.con,":")

+}

+func (c *Context) Set(scon string) {

+	c.con = strings.SplitN(scon,":",4)

+}

+func New_context(scon string) Context {

+	var con Context

+	con.Set(scon)

+	return con

+}

+

+func Is_selinux_enabled() bool {

+	b := C.is_selinux_enabled()

+	if b > 0 {

+		return true;

+	}

+	return false

+}

+

+func Selinux_enabled() bool {

+	b := C.is_selinux_enabled()

+	if b > 0 {

+		return true;

+	}

+	return false

+}

+

+const (

+	Enforcing = 1

+	Permissive = 0

+	Disabled = -1

+)

+

+func Selinux_getenforce() int {

+	return int(C.security_getenforce())

+}

+

+func Selinux_getenforcemode() (int) {

+	var enforce C.int

+	C.selinux_getenforcemode(&enforce)

+	return int(enforce)

+}

+

+func mcs_add(mcs string) {

+	mcs_list[mcs] = true

+}

+

+func mcs_delete(mcs string) {

+	mcs_list[mcs] = false

+}

+

+func mcs_exists(mcs string) bool {

+	return mcs_list[mcs] 

+}

+

+func Int_to_mcs(id int, catRange uint32) string {

+        if ((id < 1) || (id >523776)) {

+          return "";

+        }

+

+	SETSIZE := int(catRange);

+	TIER := SETSIZE;

+

+	ORD := id;

+	for ;ORD > TIER; {

+		ORD = ORD - TIER;

+		TIER -= 1;

+	}

+	TIER = SETSIZE - TIER;

+	ORD = ORD + TIER;

+	return fmt.Sprintf("s0:c%d,c%d", TIER, ORD);

+}

+

+func uniq_mcs(catRange uint32) string {

+	var n uint32

+	var c1,c2 uint32

+	var mcs string

+	for ;; {

+		binary.Read(rand.Reader, binary.LittleEndian, &n)

+		c1 = n % catRange

+		binary.Read(rand.Reader, binary.LittleEndian, &n)

+		c2 = n % catRange

+		if c1 == c2 {

+			continue

+		} else {

+			if c1 > c2 {

+				t := c1

+				c1 = c2

+				c2 = t

+			}

+		}

+		mcs = fmt.Sprintf("s0:c%d,c%d", c1, c2)

+		if mcs_exists(mcs) {

+			continue

+		}

+		mcs_add(mcs)

+		break

+	}

+	return mcs

+}

+func free_context(process_label string) {

+	var scon Context

+	scon = New_context(process_label)

+	mcs_delete(scon.Get_level())

+}

+

+func Get_lxc_contexts() (process_label string, file_label string) {

+	var val, key string

+	var bufin *bufio.Reader

+	if ! Selinux_enabled() {

+		return

+	}

+	lxc_path := C.GoString(C.selinux_lxc_contexts_path())

+	file_label = "system_u:object_r:svirt_sandbox_file_t:s0"

+	process_label = "system_u:system_r:svirt_lxc_net_t:s0"

+

+	in, err := os.Open(lxc_path)

+	if err != nil {

+		goto exit

+	}

+

+	defer in.Close()

+	bufin = bufio.NewReader(in)

+

+	for done := false; !done; {

+		var line string

+		if line, err = bufin.ReadString('\n'); err != nil {

+			if err == io.EOF {

+				done = true

+			} else {

+				goto exit

+			}

+		}

+		line = strings.TrimSpace(line)

+		if len(line) == 0 {

+			// Skip blank lines

+			continue

+		}

+		if line[0] == ';' || line[0] == '#' {

+			// Skip comments

+			continue

+		}

+		if groups := assignRegex.FindStringSubmatch(line); groups != nil {

+			key, val = strings.TrimSpace(groups[1]), strings.TrimSpace(groups[2])

+			if key == "process" {

+				process_label = strings.Trim(val,"\"")

+			}

+			if key == "file" {

+				file_label = strings.Trim(val,"\"")

+			}

+		}

+	}

+exit:

+	var scon Context

+	mcs := Int_to_mcs(os.Getpid(), 1024)

+	scon = New_context(process_label)

+	scon.Set_level(mcs)

+	process_label = scon.Get()

+	scon = New_context(file_label)

+	scon.Set_level(mcs)

+	file_label = scon.Get()

+	return process_label, file_label

+}

+

+func CopyLevel (src, dest string) (string, error) {

+	if ! Selinux_enabled() {

+		return "", nil

+	}

+	if src == "" {

+		return "", nil

+	}

+	rc, err := C.security_check_context(C.CString(src))

+	if rc != 0 {

+		return "", err

+	}

+	rc, err = C.security_check_context(C.CString(dest))

+	if rc != 0 {

+		return "", err

+	}

+	scon := New_context(src)

+	tcon := New_context(dest)

+	tcon.Set_level(scon.Get_level())

+	return tcon.Get(), nil

+}

+

+func Test() {

+	var plabel,flabel string

+	if ! Selinux_enabled() {

+		return

+	}

+

+	plabel, flabel = Get_lxc_contexts()

+	fmt.Println(plabel)

+	fmt.Println(flabel)

+	free_context(plabel)

+	plabel, flabel = Get_lxc_contexts()

+	fmt.Println(plabel)

+	fmt.Println(flabel)

+	free_context(plabel)

+	if Selinux_enabled() {

+		fmt.Println("Enabled")

+	} else {

+		fmt.Println("Disabled")

+	}

+	fmt.Println("getenforce ", Selinux_getenforce())

+	fmt.Println("getenforcemode ", Selinux_getenforcemode())

+	flabel,_ = Matchpathcon("/home/dwalsh/.emacs", 0)

+	fmt.Println(flabel)

+	pid := os.Getpid()

+	fmt.Printf("PID:%d MCS:%s\n", pid, Int_to_mcs(pid, 1023))

+	fmt.Println(Getcon())

+	fmt.Println(Getfilecon("/etc/passwd"))

+	fmt.Println(Getpidcon(1))

+	Setfscreatecon("unconfined_u:unconfined_r:unconfined_t:s0")

+	fmt.Println(Getfscreatecon())

+	Setfscreatecon("")

+	fmt.Println(Getfscreatecon())

+	fmt.Println(Getpidcon(1))

+}

diff --git a/libselinux/golang/test.go b/libselinux/golang/test.go

new file mode 100644

index 0000000..fed6de8

--- /dev/null

+++ b/libselinux/golang/test.go

@@ -0,0 +1,9 @@

+package main

+

+import (

+	"./selinux"

+)

+

+func main() {

+	selinux.Test()

+}

diff --git a/libselinux/man/man3/getfscreatecon.3 b/libselinux/man/man3/getfscreatecon.3

index c7675be..677ece4 100644

--- a/libselinux/man/man3/getfscreatecon.3

+++ b/libselinux/man/man3/getfscreatecon.3

@@ -49,6 +49,11 @@ Signal handlers that perform a

 must take care to

 save, reset, and restore the fscreate context to avoid unexpected behavior.

 .

+

+.br

+.B Note:

+Contexts are thread specific.

+

 .SH "RETURN VALUE"

 On error \-1 is returned.

 On success 0 is returned.

diff --git a/libselinux/man/man3/getkeycreatecon.3 b/libselinux/man/man3/getkeycreatecon.3

index d6a118c..b503535 100644

--- a/libselinux/man/man3/getkeycreatecon.3

+++ b/libselinux/man/man3/getkeycreatecon.3

@@ -48,6 +48,10 @@ Signal handlers that perform a

 .BR setkeycreatecon ()

 must take care to

 save, reset, and restore the keycreate context to avoid unexpected behavior.

+

+.br

+.B Note:

+Contexts are thread specific.

 .

 .SH "RETURN VALUE"

 On error \-1 is returned.

diff --git a/libselinux/man/man3/getsockcreatecon.3 b/libselinux/man/man3/getsockcreatecon.3

index 99e9436..673738c 100644

--- a/libselinux/man/man3/getsockcreatecon.3

+++ b/libselinux/man/man3/getsockcreatecon.3

@@ -49,6 +49,11 @@ Signal handlers that perform a

 must take care to

 save, reset, and restore the sockcreate context to avoid unexpected behavior.

 .

+

+.br

+.B Note:

+Contexts are thread specific.

+

 .SH "RETURN VALUE"

 On error \-1 is returned.

 On success 0 is returned.

diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile

index 02dd829..6dfdb46 100644

--- a/libselinux/src/Makefile

+++ b/libselinux/src/Makefile

@@ -114,7 +114,7 @@ $(LIBA): $(OBJS)

 	$(RANLIB) $@

 $(LIBSO): $(LOBJS)

-	$(CC) $(CFLAGS) -shared -o $@ $^ -lpcre -ldl $(LDFLAGS) -L$(LIBDIR) -Wl,-soname,$(LIBSO),-z,defs,-z,relro

+	$(CC) $(CFLAGS) -shared -o $@ $^ -lpcre -llzma -ldl $(LDFLAGS) -L$(LIBDIR) -Wl,-soname,$(LIBSO),-z,defs,-z,relro

 	ln -sf $@ $(TARGET) 

 $(LIBPC): $(LIBPC).in ../VERSION

diff --git a/libselinux/src/avc_sidtab.c b/libselinux/src/avc_sidtab.c

index 0b696bb..506e236 100644

--- a/libselinux/src/avc_sidtab.c

+++ b/libselinux/src/avc_sidtab.c

@@ -81,6 +81,11 @@ sidtab_context_to_sid(struct sidtab *s,

 	int hvalue, rc = 0;

 	struct sidtab_node *cur;

+	if (! ctx) {

+		errno=EINVAL;

+		return -1;

+	}

+

 	*sid = NULL;

 	hvalue = sidtab_hash(ctx);

diff --git a/libselinux/src/canonicalize_context.c b/libselinux/src/canonicalize_context.c

index 176c45a..6075025 100644

--- a/libselinux/src/canonicalize_context.c

+++ b/libselinux/src/canonicalize_context.c

@@ -17,6 +17,11 @@ int security_canonicalize_context_raw(const security_context_t con,

 	size_t size;

 	int fd, ret;

+	if (! con) {

+		errno=EINVAL;

+		return -1;

+	}

+

 	if (!selinux_mnt) {

 		errno = ENOENT;

 		return -1;

diff --git a/libselinux/src/check_context.c b/libselinux/src/check_context.c

index 33ab5e3..1277bdd 100644

--- a/libselinux/src/check_context.c

+++ b/libselinux/src/check_context.c

@@ -14,6 +14,11 @@ int security_check_context_raw(const security_context_t con)

 	char path[PATH_MAX];

 	int fd, ret;

+	if (! con) {

+		errno=EINVAL;

+		return -1;

+	}

+

 	if (!selinux_mnt) {

 		errno = ENOENT;

 		return -1;

diff --git a/libselinux/src/compute_av.c b/libselinux/src/compute_av.c

index 5962c0b..61ea454 100644

--- a/libselinux/src/compute_av.c

+++ b/libselinux/src/compute_av.c

@@ -26,6 +26,11 @@ int security_compute_av_flags_raw(const security_context_t scon,

 		return -1;

 	}

+	if ((! scon) || (! tcon)) {

+		errno=EINVAL;

+		return -1;

+	}

+

 	snprintf(path, sizeof path, "%s/access", selinux_mnt);

 	fd = open(path, O_RDWR);

 	if (fd < 0)

diff --git a/libselinux/src/compute_create.c b/libselinux/src/compute_create.c

index 3c05be3..34a1ccd 100644

--- a/libselinux/src/compute_create.c

+++ b/libselinux/src/compute_create.c

@@ -64,6 +64,11 @@ int security_compute_create_name_raw(const security_context_t scon,

 		return -1;

 	}

+	if ((! scon) || (! tcon)) {

+		errno=EINVAL;

+		return -1;

+	}

+

 	snprintf(path, sizeof path, "%s/create", selinux_mnt);

 	fd = open(path, O_RDWR);

 	if (fd < 0)

diff --git a/libselinux/src/compute_member.c b/libselinux/src/compute_member.c

index dad0a77..7850986 100644

--- a/libselinux/src/compute_member.c

+++ b/libselinux/src/compute_member.c

@@ -25,6 +25,11 @@ int security_compute_member_raw(const security_context_t scon,

 		return -1;

 	}

+	if ((! scon) || (! tcon)) {

+		errno=EINVAL;

+		return -1;

+	}

+

 	snprintf(path, sizeof path, "%s/member", selinux_mnt);

 	fd = open(path, O_RDWR);

 	if (fd < 0)

diff --git a/libselinux/src/compute_relabel.c b/libselinux/src/compute_relabel.c

index 656f00a..2560e78 100644

--- a/libselinux/src/compute_relabel.c

+++ b/libselinux/src/compute_relabel.c

@@ -25,6 +25,11 @@ int security_compute_relabel_raw(const security_context_t scon,

 		return -1;

 	}

+	if ((! scon) || (! tcon)) {

+		errno=EINVAL;

+		return -1;

+	}

+

 	snprintf(path, sizeof path, "%s/relabel", selinux_mnt);

 	fd = open(path, O_RDWR);

 	if (fd < 0)

diff --git a/libselinux/src/compute_user.c b/libselinux/src/compute_user.c

index 3b39ddd..af20735 100644

--- a/libselinux/src/compute_user.c

+++ b/libselinux/src/compute_user.c

@@ -24,6 +24,11 @@ int security_compute_user_raw(const security_context_t scon,

 		return -1;

 	}

+	if (! scon) {

+		errno=EINVAL;

+		return -1;

+	}

+

 	snprintf(path, sizeof path, "%s/user", selinux_mnt);

 	fd = open(path, O_RDWR);

 	if (fd < 0)

diff --git a/libselinux/src/fsetfilecon.c b/libselinux/src/fsetfilecon.c

index 9963f7a..37f9d74 100644

--- a/libselinux/src/fsetfilecon.c

+++ b/libselinux/src/fsetfilecon.c

@@ -9,8 +9,12 @@

 int fsetfilecon_raw(int fd, const security_context_t context)

 {

-	int rc = fsetxattr(fd, XATTR_NAME_SELINUX, context, strlen(context) + 1,

-			 0);

+	int rc;

+	if (! context) {

+		errno=EINVAL;

+		return -1;

+	}

+	rc = fsetxattr(fd, XATTR_NAME_SELINUX, context, strlen(context) + 1, 0);

 	if (rc < 0 && errno == ENOTSUP) {

 		security_context_t ccontext = NULL;

 		int err = errno;

diff --git a/libselinux/src/load_policy.c b/libselinux/src/load_policy.c

index e419f1a..275672d 100644

--- a/libselinux/src/load_policy.c

+++ b/libselinux/src/load_policy.c

@@ -16,6 +16,82 @@

 #include <dlfcn.h>

 #include "policy.h"

 #include <limits.h>

+#include <lzma.h>

+

+static char *lzmaread(int fd, size_t *rsize) {

+	int capacity = 64*1024;

+	char *buf = NULL;

+	int tmpsize = 8 * 1024;

+	unsigned char tmp[tmpsize];

+	unsigned char tmp_out[tmpsize];

+	size_t size = 0;

+	lzma_stream strm = LZMA_STREAM_INIT;

+	lzma_action action = LZMA_RUN;

+	lzma_ret ret;

+	

+	FILE *stream = fdopen (fd, "r");

+	if (!stream) {

+		return NULL;

+	}

+	ret = lzma_stream_decoder(&strm, UINT64_MAX,

+				  LZMA_CONCATENATED);

+	

+	strm.avail_in = 0;

+	strm.next_out = tmp_out;

+	strm.avail_out = tmpsize;

+	

+	buf = (char *) malloc (capacity);

+	if (!buf)

+		goto err;

+	

+	while (1) {

+		if (strm.avail_in == 0) {

+			strm.next_in = tmp;

+			strm.avail_in = fread(tmp, 1, tmpsize, stream);

+			

+			if (ferror(stream)) {

+				// POSIX says that fread() sets errno if

+				// an error occurred. ferror() doesn't

+				// touch errno.

+				goto err;

+			}

+			if (feof(stream)) action = LZMA_FINISH;

+		}

+		

+		ret = lzma_code(&strm, action);

+		

+		// Write and check write error before checking decoder error.

+		// This way as much data as possible gets written to output

+		// even if decoder detected an error.

+		if (strm.avail_out == 0 || ret != LZMA_OK) {

+			const size_t num =  tmpsize - strm.avail_out;

+			if (num > capacity) {

+				buf = (char*) realloc (buf, size*2);

+				capacity = size;

+			}

+			memcpy (buf+size, tmp_out, num);

+			capacity -= num;

+			size += num;

+			strm.next_out = tmp_out;

+			strm.avail_out = tmpsize;

+		}

+		if (ret != LZMA_OK) {

+			if (ret == LZMA_STREAM_END) {

+				break;

+			} else {

+				goto err;

+			}

+		}

+	}