diff --git libsemanage-2.8/src/direct_api.c libsemanage-2.8/src/direct_api.c

index c58961b..8e4d116 100644

--- libsemanage-2.8/src/direct_api.c

+++ libsemanage-2.8/src/direct_api.c

@@ -1028,7 +1028,7 @@ static int semanage_direct_write_langext(semanage_handle_t *sh,

 	fp = NULL;

-	ret = 0;

+	return 0;

 cleanup:

 	if (fp != NULL) fclose(fp);

@@ -2177,7 +2177,6 @@ cleanup:

 	semanage_module_info_destroy(sh, modinfo);

 	free(modinfo);

-	if (fp != NULL) fclose(fp);

 	return status;

 }

@@ -2342,16 +2341,6 @@ static int semanage_direct_get_module_info(semanage_handle_t *sh,

 	free(tmp);

 	tmp = NULL;

-	if (fclose(fp) != 0) {

-		ERR(sh,

-		    "Unable to close %s module lang ext file.",

-		    (*modinfo)->name);

-		status = -1;

-		goto cleanup;

-	}

-

-	fp = NULL;

-

 	/* lookup enabled/disabled status */

 	ret = semanage_module_get_path(sh,

 				       *modinfo,

@@ -2395,7 +2384,13 @@ cleanup:

 		free(modinfos);

 	}

-	if (fp != NULL) fclose(fp);

+	if (fp != NULL && fclose(fp) != 0) {

+		ERR(sh,

+		    "Unable to close %s module lang ext file.",

+		    (*modinfo)->name);

+		status = -1;

+	}

+

 	return status;

 }

diff --git libsemanage-2.8/src/genhomedircon.c libsemanage-2.8/src/genhomedircon.c

index 3e61b51..c35f878 100644

--- libsemanage-2.8/src/genhomedircon.c

+++ libsemanage-2.8/src/genhomedircon.c

@@ -1074,10 +1074,20 @@ static int get_group_users(genhomedircon_settings_t * s,

 	const char *grname = selogin + 1;

-	if (getgrnam_r(grname, &grstorage, grbuf,

-			(size_t) grbuflen, &group) != 0) {

-		goto cleanup;

+	errno = 0;

+	while (

+		(retval = getgrnam_r(grname, &grstorage, grbuf, (size_t) grbuflen, &group)) != 0 &&

+		errno == ERANGE

+	) {

+		char *new_grbuf;

+		grbuflen *= 2;

+		new_grbuf = realloc(grbuf, grbuflen);

+		if (new_grbuf == NULL)

+			goto cleanup;

+		grbuf = new_grbuf;

 	}

+	if (retval == -1)

+		goto cleanup;

 	if (group == NULL) {

 		ERR(s->h_semanage, "Can't find group named %s\n", grname);

diff --git libsemanage-2.8/src/semanage_store.c libsemanage-2.8/src/semanage_store.c

index f1984c5..58dded6 100644

--- libsemanage-2.8/src/semanage_store.c

+++ libsemanage-2.8/src/semanage_store.c

@@ -541,14 +541,18 @@ int semanage_create_store(semanage_handle_t * sh, int create)

 	struct stat sb;

 	const char *path = semanage_files[SEMANAGE_ROOT];

 	int fd;

+	mode_t mask;

 	if (stat(path, &sb) == -1) {

 		if (errno == ENOENT && create) {

+			mask = umask(0077);

 			if (mkdir(path, S_IRWXU) == -1) {

+				umask(mask);

 				ERR(sh, "Could not create module store at %s.",

 				    path);

 				return -2;

 			}

+			umask(mask);

 		} else {

 			if (create)

 				ERR(sh,

@@ -567,12 +571,15 @@ int semanage_create_store(semanage_handle_t * sh, int create)

 	path = semanage_path(SEMANAGE_ACTIVE, SEMANAGE_TOPLEVEL);

 	if (stat(path, &sb) == -1) {

 		if (errno == ENOENT && create) {

+			mask = umask(0077);

 			if (mkdir(path, S_IRWXU) == -1) {

+				umask(mask);

 				ERR(sh,

 				    "Could not create module store, active subdirectory at %s.",

 				    path);

 				return -2;

 			}

+			umask(mask);

 		} else {

 			ERR(sh,

 			    "Could not read from module store, active subdirectory at %s.",

@@ -590,12 +597,15 @@ int semanage_create_store(semanage_handle_t * sh, int create)

 	path = semanage_path(SEMANAGE_ACTIVE, SEMANAGE_MODULES);

 	if (stat(path, &sb) == -1) {

 		if (errno == ENOENT && create) {

+			mask = umask(0077);

 			if (mkdir(path, S_IRWXU) == -1) {

+				umask(mask);

 				ERR(sh,

 				    "Could not create module store, active modules subdirectory at %s.",

 				    path);

 				return -2;

 			}

+			umask(mask);

 		} else {

 			ERR(sh,

 			    "Could not read from module store, active modules subdirectory at %s.",

@@ -613,11 +623,14 @@ int semanage_create_store(semanage_handle_t * sh, int create)

 	path = semanage_files[SEMANAGE_READ_LOCK];

 	if (stat(path, &sb) == -1) {

 		if (errno == ENOENT && create) {

+			mask = umask(0077);

 			if ((fd = creat(path, S_IRUSR | S_IWUSR)) == -1) {

+				umask(mask);

 				ERR(sh, "Could not create lock file at %s.",

 				    path);

 				return -2;

 			}

+			umask(mask);

 			close(fd);

 		} else {

 			ERR(sh, "Could not read lock file at %s.", path);

@@ -763,6 +776,7 @@ static int semanage_copy_dir_flags(const char *src, const char *dst, int flag)

 	struct stat sb;

 	struct dirent **names = NULL;

 	char path[PATH_MAX], path2[PATH_MAX];

+	mode_t mask;

 	if ((len = scandir(src, &names, semanage_filename_select, NULL)) == -1) {

 		fprintf(stderr, "Could not read the contents of %s: %s\n", src, strerror(errno));

@@ -770,10 +784,13 @@ static int semanage_copy_dir_flags(const char *src, const char *dst, int flag)

 	}

 	if (stat(dst, &sb) != 0) {

+		mask = umask(0077);

 		if (mkdir(dst, S_IRWXU) != 0) {

+			umask(mask);

 			fprintf(stderr, "Could not create %s: %s\n", dst, strerror(errno));

 			goto cleanup;

 		}

+		umask(mask);

 	}

 	for (i = 0; i < len; i++) {

@@ -785,14 +802,20 @@ static int semanage_copy_dir_flags(const char *src, const char *dst, int flag)

 		}

 		snprintf(path2, sizeof(path2), "%s/%s", dst, names[i]->d_name);

 		if (S_ISDIR(sb.st_mode)) {

+			mask = umask(0077);

 			if (mkdir(path2, 0700) == -1 ||

 			    semanage_copy_dir_flags(path, path2, flag) == -1) {

+				umask(mask);

 				goto cleanup;

 			}

+			umask(mask);

 		} else if (S_ISREG(sb.st_mode) && flag == 1) {

+			mask = umask(0077);

 			if (semanage_copy_file(path, path2, sb.st_mode) < 0) {

+				umask(mask);

 				goto cleanup;

 			}

+			umask(mask);

 		}

 	}

 	retval = 0;

@@ -872,16 +895,20 @@ int semanage_mkdir(semanage_handle_t *sh, const char *path)

 {

 	int status = 0;

 	struct stat sb;

+	mode_t mask;

 	/* check if directory already exists */

 	if (stat(path, &sb) != 0) {

 		/* make the modules directory */

+		mask = umask(0077);

 		if (mkdir(path, S_IRWXU) != 0) {

+			umask(mask);

 			ERR(sh, "Cannot make directory at %s", path);

 			status = -1;

 			goto cleanup;

 		}

+		umask(mask);

 	}

 	else {

 		/* check that it really is a directory */

@@ -906,6 +933,7 @@ int semanage_make_sandbox(semanage_handle_t * sh)

 	const char *sandbox = semanage_path(SEMANAGE_TMP, SEMANAGE_TOPLEVEL);

 	struct stat buf;

 	int errsv;

+	mode_t mask;

 	if (stat(sandbox, &buf) == -1) {

 		if (errno != ENOENT) {

@@ -922,12 +950,15 @@ int semanage_make_sandbox(semanage_handle_t * sh)

 		}

 	}

+	mask = umask(0077);

 	if (mkdir(sandbox, S_IRWXU) == -1 ||

 	    semanage_copy_dir(semanage_path(SEMANAGE_ACTIVE, SEMANAGE_TOPLEVEL),

 			      sandbox) == -1) {

+		umask(mask);

 		ERR(sh, "Could not copy files to sandbox %s.", sandbox);

 		goto cleanup;

 	}

+	umask(mask);

 	return 0;

       cleanup:

diff --git libsemanage-2.8/src/seusers_local.c libsemanage-2.8/src/seusers_local.c

index 413ebdd..a79e2d3 100644

--- libsemanage-2.8/src/seusers_local.c

+++ libsemanage-2.8/src/seusers_local.c

@@ -71,17 +71,18 @@ static int semanage_seuser_audit(semanage_handle_t * handle,

 	const char *sep = "-";

 	int rc = -1;

 	strcpy(msg, "login");

+	if (previous) {

+		name = semanage_seuser_get_name(previous);

+		psename = semanage_seuser_get_sename(previous);

+		pmls = semanage_seuser_get_mlsrange(previous);

+		proles = semanage_user_roles(handle, psename);

+	}

 	if (seuser) {

 		name = semanage_seuser_get_name(seuser);

 		sename = semanage_seuser_get_sename(seuser);

 		mls = semanage_seuser_get_mlsrange(seuser);

 		roles = semanage_user_roles(handle, sename);

 	}

-	if (previous) {

-		psename = semanage_seuser_get_sename(previous);

-		pmls = semanage_seuser_get_mlsrange(previous);

-		proles = semanage_user_roles(handle, psename);

-	}

 	if (audit_type != AUDIT_ROLE_REMOVE) {

 		if (sename && (!psename || strcmp(psename, sename) != 0)) {

 			strcat(msg,sep);