diff --git libsemanage-2.5/ChangeLog libsemanage-2.5/ChangeLog

index 9b4d5b7..10fc784 100644

--- libsemanage-2.5/ChangeLog

+++ libsemanage-2.5/ChangeLog

@@ -1,3 +1,13 @@

+	* genhomedircon: add support for %group syntax, from Gary Tierney.

+	* genhomedircon: generate contexts for logins mapped to the default user, from Gary Tierney.

+	* Validate and compile file contexts before installing, from Stephen Smalley.

+	* Swap tcp and udp protocol numbers, from Miroslav Vadkerti.

+	* Sort object files for deterministic linking order, from Laurent Bigonville.

+	* Support overriding Makefile RANLIB, from Julien Pivotto.

+	* Respect CC and PKG_CONFIG environment variable, from Julien Pivotto.

+	* Fix multiple spelling errors, from Laurent Bigonville.

+	* genhomedircon: %{USERID} and %{USERNAME} support and code cleanups, from Jason Zaman.

+

 2.5 2016-02-23

 	* Do not overwrite CFLAGS in test Makefile, from Nicolas Iooss.

 	* Fix uninitialized variable in direct_commit and direct_api, from Nicolas Iooss.

diff --git libsemanage-2.5/include/semanage/handle.h libsemanage-2.5/include/semanage/handle.h

index 6cad529..c816590 100644

--- libsemanage-2.5/include/semanage/handle.h

+++ libsemanage-2.5/include/semanage/handle.h

@@ -130,7 +130,7 @@ int semanage_commit(semanage_handle_t *);

 #define SEMANAGE_CAN_READ 1

 #define SEMANAGE_CAN_WRITE 2

 /* returns SEMANAGE_CAN_READ or SEMANAGE_CAN_WRITE if the store is readable

- * or writable, respectively. <0 if an error occured */

+ * or writable, respectively. <0 if an error occurred */

 int semanage_access_check(semanage_handle_t * sh);

 /* returns 0 if not connected, 1 if connected */

diff --git libsemanage-2.5/include/semanage/modules.h libsemanage-2.5/include/semanage/modules.h

index 4b93e54..50940e2 100644

--- libsemanage-2.5/include/semanage/modules.h

+++ libsemanage-2.5/include/semanage/modules.h

@@ -39,7 +39,7 @@ int semanage_module_install_file(semanage_handle_t *,

 int semanage_module_remove(semanage_handle_t *, char *module_name);

 /* semanage_module_info is for getting information on installed

-   modules, only name at this time */

+   modules, only name and version at this time */

 typedef struct semanage_module_info semanage_module_info_t;

 /* Look up a module using @modkey. The module's raw data is returned as a

@@ -64,6 +64,7 @@ void semanage_module_info_datum_destroy(semanage_module_info_t *);

 semanage_module_info_t *semanage_module_list_nth(semanage_module_info_t * list,

 						 int n);

 const char *semanage_module_get_name(semanage_module_info_t *);

+const char *semanage_module_get_version(semanage_module_info_t *);

 /* Module Info */

@@ -104,6 +105,14 @@ int semanage_module_info_get_name(semanage_handle_t *sh,

 				  semanage_module_info_t *modinfo,

 				  const char **name);

+/* Get @module_version from @modinfo. Caller should not free @module_version.

+ *

+ * Returns 0 on success and -1 on error.

+ */

+int semanage_module_info_get_version(semanage_handle_t *sh,

+				      semanage_module_info_t *modinfo,

+				      const char **version);

+

 /* Get @lang_ext from @modinfo. Caller should not free @lang_ext.

  *

  * Returns 0 on success and -1 on error.

@@ -138,6 +147,14 @@ int semanage_module_info_set_name(semanage_handle_t *sh,

 				  semanage_module_info_t *modinfo,

 				  const char *name);

+/* Set @version in @modinfo.

+ *

+ * Returns 0 on success and -1 on error.

+ */

+int semanage_module_info_set_version(semanage_handle_t *sh,

+				      semanage_module_info_t *modinfo,

+				      const char *version);

+

 /* Set @lang_ext in @modinfo.

  *

  * Returns 0 on success and -1 on error.

diff --git libsemanage-2.5/man/man5/semanage.conf.5 libsemanage-2.5/man/man5/semanage.conf.5

index 8f8de55..1009d97 100644

--- libsemanage-2.5/man/man5/semanage.conf.5

+++ libsemanage-2.5/man/man5/semanage.conf.5

@@ -33,7 +33,7 @@ Specify an alternative root path to use for the store. The default is "/"

 .TP

 .B store-root

-Specify an alternative store_root path to use. The default is "/var/lib/selinux"

+Specify an alternative store_root path to use. The default is "/etc/selinux"

 .TP

 .B compiler-directory

diff --git libsemanage-2.5/src/Makefile libsemanage-2.5/src/Makefile

index d1fcc0b..96ee652 100644

--- libsemanage-2.5/src/Makefile

+++ libsemanage-2.5/src/Makefile

@@ -5,6 +5,7 @@ PYTHON ?= python

 PYPREFIX ?= $(notdir $(PYTHON))

 RUBY ?= ruby

 RUBYPREFIX ?= $(notdir $(RUBY))

+PKG_CONFIG ?= pkg-config

 # Installation directories.

 PREFIX ?= $(DESTDIR)/usr

@@ -12,11 +13,11 @@ LIBDIR ?= $(PREFIX)/lib

 SHLIBDIR ?= $(DESTDIR)/lib

 INCLUDEDIR ?= $(PREFIX)/include

 PYLIBVER ?= $(shell $(PYTHON) -c 'import sys;print("python%d.%d" % sys.version_info[0:2])')

-PYINC ?= $(shell pkg-config --cflags $(PYPREFIX))

+PYINC ?= $(shell $(PKG_CONFIG) --cflags $(PYPREFIX))

 PYLIBDIR ?= $(LIBDIR)/$(PYLIBVER)

 RUBYLIBVER ?= $(shell $(RUBY) -e 'print RUBY_VERSION.split(".")[0..1].join(".")')

 RUBYPLATFORM ?= $(shell $(RUBY) -e 'print RUBY_PLATFORM')

-RUBYINC ?= $(shell pkg-config --cflags ruby-$(RUBYLIBVER))

+RUBYINC ?= $(shell $(PKG_CONFIG) --cflags ruby-$(RUBYLIBVER))

 RUBYINSTALL ?= $(LIBDIR)/ruby/site_ruby/$(RUBYLIBVER)/$(RUBYPLATFORM)

 LIBBASE=$(shell basename $(LIBDIR))

@@ -51,7 +52,7 @@ SWIGRUBYSO=$(RUBYPREFIX)_semanage.so

 LIBSO=$(TARGET).$(LIBVERSION)

 GENERATED=$(SWIGCOUT) $(SWIGRUBYCOUT) semanageswig_python_exception.i

-SRCS= $(filter-out $(GENERATED),$(wildcard *.c))

+SRCS= $(filter-out $(GENERATED),$(sort $(wildcard *.c)))

 OBJS= $(patsubst %.c,%.o,$(SRCS)) conf-scan.o conf-parse.o

 LOBJS= $(patsubst %.c,%.lo,$(SRCS)) conf-scan.lo conf-parse.lo

@@ -61,7 +62,7 @@ SWIG_CFLAGS += -Wno-error -Wno-unused-but-set-variable -Wno-unused-variable -Wno

 		-Wno-unused-parameter

 override CFLAGS += -I../include -I$(INCLUDEDIR) -D_GNU_SOURCE 

-RANLIB=ranlib

+RANLIB ?= ranlib

 SWIG = swig -Wall -python -o $(SWIGCOUT) -outdir ./

diff --git libsemanage-2.5/src/conf-parse.y libsemanage-2.5/src/conf-parse.y

index b527e89..e2b6028 100644

--- libsemanage-2.5/src/conf-parse.y

+++ libsemanage-2.5/src/conf-parse.y

@@ -340,7 +340,7 @@ static int semanage_conf_init(semanage_conf_t * conf)

 	conf->store_type = SEMANAGE_CON_DIRECT;

 	conf->store_path = strdup(basename(selinux_policy_root()));

 	conf->ignoredirs = NULL;

-	conf->store_root_path = strdup("/var/lib/selinux");

+	conf->store_root_path = strdup("/etc/selinux");

 	conf->compiler_directory_path = strdup("/usr/libexec/selinux/hll");

 	conf->policyvers = sepol_policy_kern_vers_max();

 	conf->target_platform = SEPOL_TARGET_SELINUX;

diff --git libsemanage-2.5/src/database.h libsemanage-2.5/src/database.h

index e460379..6a4a164 100644

--- libsemanage-2.5/src/database.h

+++ libsemanage-2.5/src/database.h

@@ -148,7 +148,7 @@ typedef struct dbase_table {

 	 * This function must be invoked before using

 	 * any of the database functions above. It may be invoked

 	 * multiple times, and will update the cache if a commit

-	 * occured between invocations */

+	 * occurred between invocations */

 	int (*cache) (struct semanage_handle * handle, dbase_t * dbase);

 	/* Forgets all changes that haven't been written

diff --git libsemanage-2.5/src/direct_api.c libsemanage-2.5/src/direct_api.c

index 2187b65..1efe141 100644

--- libsemanage-2.5/src/direct_api.c

+++ libsemanage-2.5/src/direct_api.c

@@ -146,9 +146,6 @@ int semanage_direct_connect(semanage_handle_t * sh)

 		if (semanage_create_store(sh, 1))

 			goto err;

-	if (semanage_access_check(sh) < SEMANAGE_CAN_READ)

-		goto err;

-

 	sh->u.direct.translock_file_fd = -1;

 	sh->u.direct.activelock_file_fd = -1;

@@ -275,7 +272,9 @@ int semanage_direct_connect(semanage_handle_t * sh)

 	/* set the disable dontaudit value */

 	path = semanage_path(SEMANAGE_ACTIVE, SEMANAGE_DISABLE_DONTAUDIT);

-	if (access(path, F_OK) == 0)

+

+	struct stat sb;

+	if (stat(path, &sb) == 0)

 		sepol_set_disable_dontaudit(sh->sepolh, 1);

 	else

 		sepol_set_disable_dontaudit(sh->sepolh, 0);

@@ -345,10 +344,6 @@ static int semanage_direct_disconnect(semanage_handle_t * sh)

 static int semanage_direct_begintrans(semanage_handle_t * sh)

 {

-

-	if (semanage_access_check(sh) != SEMANAGE_CAN_WRITE) {

-		return -1;

-	}

 	if (semanage_get_trans_lock(sh) < 0) {

 		return -1;

 	}

@@ -363,6 +358,35 @@ static int semanage_direct_begintrans(semanage_handle_t * sh)

 /********************* utility functions *********************/

+/* Takes a module stored in 'module_data' and parses its headers.

+ * Sets reference variables 'module_name' to module's name, and

+ * 'version' to module's version.  The caller is responsible for

+ * free()ing 'module_name', and 'version'; they will be

+ * set to NULL upon entering this function.  Returns 0 on success, -1

+ * if out of memory.

+ */

+static int parse_module_headers(semanage_handle_t * sh, char *module_data,

+                               size_t data_len, char **module_name,

+                               char **version)

+{

+       struct sepol_policy_file *pf;

+       int file_type;

+       *module_name = *version = NULL;

+

+       if (sepol_policy_file_create(&pf)) {

+               ERR(sh, "Out of memory!");

+               return -1;

+       }

+       sepol_policy_file_set_mem(pf, module_data, data_len);

+       sepol_policy_file_set_handle(pf, sh->sepolh);

+       if (module_data != NULL && data_len > 0)

+           sepol_module_package_info(pf, &file_type, module_name,

+                                     version);

+       sepol_policy_file_free(pf);

+

+       return 0;

+}

+

 #include <stdlib.h>

 #include <bzlib.h>

 #include <string.h>

@@ -588,13 +612,33 @@ static int semanage_direct_update_user_extra(semanage_handle_t * sh, cil_db_t *c

 	}

 	if (size > 0) {

+		/*

+		 * Write the users_extra entries from CIL modules.

+		 * This file is used as our baseline when we do not require

+		 * re-linking.

+		 */

+		ofilename = semanage_path(SEMANAGE_TMP,

+					  SEMANAGE_USERS_EXTRA_LINKED);

+		if (ofilename == NULL) {

+			retval = -1;

+			goto cleanup;

+		}

+		retval = write_file(sh, ofilename, data, size);

+		if (retval < 0)

+			goto cleanup;

+

+		/*

+		 * Write the users_extra file; users_extra.local

+		 * will be merged into this file.

+		 */

 		ofilename = semanage_path(SEMANAGE_TMP, SEMANAGE_USERS_EXTRA);

 		if (ofilename == NULL) {

-			return retval;

+			retval = -1;

+			goto cleanup;

 		}

 		retval = write_file(sh, ofilename, data, size);

 		if (retval < 0)

-			return retval;

+			goto cleanup;

 		pusers_extra->dtable->drop_cache(pusers_extra->dbase);

@@ -623,11 +667,33 @@ static int semanage_direct_update_seuser(semanage_handle_t * sh, cil_db_t *cildb

 	}

 	if (size > 0) {

+		/*

+		 * Write the seusers entries from CIL modules.

+		 * This file is used as our baseline when we do not require

+		 * re-linking.

+		 */

+		ofilename = semanage_path(SEMANAGE_TMP,

+					  SEMANAGE_SEUSERS_LINKED);

+		if (ofilename == NULL) {

+			retval = -1;

+			goto cleanup;

+		}

+		retval = write_file(sh, ofilename, data, size);

+		if (retval < 0)

+			goto cleanup;

+

+		/*

+		 * Write the seusers file; seusers.local will be merged into

+		 * this file.

+		 */

 		ofilename = semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_SEUSERS);

 		if (ofilename == NULL) {

-			return -1;

+			retval = -1;

+			goto cleanup;

 		}

 		retval = write_file(sh, ofilename, data, size);

+		if (retval < 0)

+			goto cleanup;

 		pseusers->dtable->drop_cache(pseusers->dbase);

 	} else {

@@ -1037,8 +1103,9 @@ static int semanage_compile_hll_modules(semanage_handle_t *sh,

 			goto cleanup;

 		}

+		struct stat sb;

 		if (semanage_get_ignore_module_cache(sh) == 0 &&

-				access(cil_path, F_OK) == 0) {

+				stat(cil_path, &sb) == 0) {

 			continue;

 		}

@@ -1066,21 +1133,18 @@ static int semanage_direct_commit(semanage_handle_t * sh)

 	size_t fc_buffer_len = 0;

 	const char *ofilename = NULL;

 	const char *path;

-	int retval = -1, num_modinfos = 0, i, missing_policy_kern = 0,

-		missing_seusers = 0, missing_fc = 0, missing = 0;

+	int retval = -1, num_modinfos = 0, i;

 	sepol_policydb_t *out = NULL;

 	struct cil_db *cildb = NULL;

 	semanage_module_info_t *modinfos = NULL;

-	/* Declare some variables */

-	int modified = 0, fcontexts_modified, ports_modified,

-	    seusers_modified, users_extra_modified, dontaudit_modified,

-	    preserve_tunables_modified, bools_modified = 0,

+	int do_rebuild, do_write_kernel, do_install;

+	int fcontexts_modified, ports_modified, seusers_modified,

 		disable_dontaudit, preserve_tunables;

 	dbase_config_t *users = semanage_user_dbase_local(sh);

 	dbase_config_t *users_base = semanage_user_base_dbase_local(sh);

 	dbase_config_t *pusers_base = semanage_user_base_dbase_policy(sh);

-	dbase_config_t *users_extra = semanage_user_extra_dbase_local(sh);

+	dbase_config_t *pusers_extra = semanage_user_extra_dbase_policy(sh);

 	dbase_config_t *ports = semanage_port_dbase_local(sh);

 	dbase_config_t *pports = semanage_port_dbase_policy(sh);

 	dbase_config_t *bools = semanage_bool_dbase_local(sh);

@@ -1092,13 +1156,23 @@ static int semanage_direct_commit(semanage_handle_t * sh)

 	dbase_config_t *fcontexts = semanage_fcontext_dbase_local(sh);

 	dbase_config_t *pfcontexts = semanage_fcontext_dbase_policy(sh);

 	dbase_config_t *seusers = semanage_seuser_dbase_local(sh);

+	dbase_config_t *pseusers = semanage_seuser_dbase_policy(sh);

+

+	/* Modified flags that we need to use more than once. */

+	ports_modified = ports->dtable->is_modified(ports->dbase);

+	seusers_modified = seusers->dtable->is_modified(seusers->dbase);

+	fcontexts_modified = fcontexts->dtable->is_modified(fcontexts->dbase);

+

+	/* Rebuild if explicitly requested or any module changes occurred. */

+	do_rebuild = sh->do_rebuild | sh->modules_modified;

 	/* Create or remove the disable_dontaudit flag file. */

 	path = semanage_path(SEMANAGE_TMP, SEMANAGE_DISABLE_DONTAUDIT);

-	if (access(path, F_OK) == 0)

-		dontaudit_modified = !(sepol_get_disable_dontaudit(sh->sepolh) == 1);

+	struct stat sb;

+	if (stat(path, &sb) == 0)

+		do_rebuild |= !(sepol_get_disable_dontaudit(sh->sepolh) == 1);

 	else

-		dontaudit_modified = (sepol_get_disable_dontaudit(sh->sepolh) == 1);

+		do_rebuild |= (sepol_get_disable_dontaudit(sh->sepolh) == 1);

 	if (sepol_get_disable_dontaudit(sh->sepolh) == 1) {

 		FILE *touch;

 		touch = fopen(path, "w");

@@ -1120,10 +1194,10 @@ static int semanage_direct_commit(semanage_handle_t * sh)

 	/* Create or remove the preserve_tunables flag file. */

 	path = semanage_path(SEMANAGE_TMP, SEMANAGE_PRESERVE_TUNABLES);

-	if (access(path, F_OK) == 0)

-		preserve_tunables_modified = !(sepol_get_preserve_tunables(sh->sepolh) == 1);

+	if (stat(path, &sb) == 0)

+		do_rebuild |= !(sepol_get_preserve_tunables(sh->sepolh) == 1);

 	else

-		preserve_tunables_modified = (sepol_get_preserve_tunables(sh->sepolh) == 1);

+		do_rebuild |= (sepol_get_preserve_tunables(sh->sepolh) == 1);

 	if (sepol_get_preserve_tunables(sh->sepolh) == 1) {

 		FILE *touch;

 		touch = fopen(path, "w");

@@ -1151,54 +1225,75 @@ static int semanage_direct_commit(semanage_handle_t * sh)

 			goto cleanup;

 	}

-	/* Decide if anything was modified */

-	fcontexts_modified = fcontexts->dtable->is_modified(fcontexts->dbase);

-	seusers_modified = seusers->dtable->is_modified(seusers->dbase);

-	users_extra_modified =

-	    users_extra->dtable->is_modified(users_extra->dbase);

-	ports_modified = ports->dtable->is_modified(ports->dbase);

-	bools_modified = bools->dtable->is_modified(bools->dbase);

-

-	modified = sh->modules_modified;

-	modified |= seusers_modified;

-	modified |= users_extra_modified;

-	modified |= ports_modified;

-	modified |= users->dtable->is_modified(users_base->dbase);

-	modified |= ifaces->dtable->is_modified(ifaces->dbase);

-	modified |= nodes->dtable->is_modified(nodes->dbase);

-	modified |= dontaudit_modified;

-	modified |= preserve_tunables_modified;

-

-	/* This is for systems that have already migrated with an older version

-	 * of semanage_migrate_store. The older version did not copy policy.kern so

-	 * the policy binary must be rebuilt here.

+	/*

+	 * This is for systems that have already migrated with an older version

+	 * of semanage_migrate_store. The older version did not copy

+	 * policy.kern so the policy binary must be rebuilt here.

+	 * This also ensures that any linked files that are required

+	 * in order to skip re-linking are present; otherwise, we force

+	 * a rebuild.

 	 */

-	if (!sh->do_rebuild && !modified) {

+	if (!do_rebuild) {

 		path = semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_KERNEL);

-

-		if (access(path, F_OK) != 0) {

-			missing_policy_kern = 1;

+		if (stat(path, &sb) != 0) {

+			do_rebuild = 1;

+			goto rebuild;

 		}

 		path = semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_FC);

-

-		if (access(path, F_OK) != 0) {

-			missing_fc = 1;

+		if (stat(path, &sb) != 0) {

+			do_rebuild = 1;

+			goto rebuild;

 		}

 		path = semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_SEUSERS);

+		if (stat(path, &sb) != 0) {

+			do_rebuild = 1;

+			goto rebuild;

+		}

-		if (access(path, F_OK) != 0) {

-			missing_seusers = 1;

+		path = semanage_path(SEMANAGE_TMP, SEMANAGE_LINKED);

+		if (stat(path, &sb) != 0) {

+			do_rebuild = 1;

+			goto rebuild;

 		}

-	}

-	missing |= missing_policy_kern;

-	missing |= missing_fc;

-	missing |= missing_seusers;

+		path = semanage_path(SEMANAGE_TMP, SEMANAGE_SEUSERS_LINKED);

+		if (stat(path, &sb) != 0) {

+			do_rebuild = 1;

+			goto rebuild;

+		}

+

+		path = semanage_path(SEMANAGE_TMP, SEMANAGE_USERS_EXTRA_LINKED);

+		if (stat(path, &sb) != 0) {

+			do_rebuild = 1;

+			goto rebuild;

+		}

+	}

-	/* If there were policy changes, or explicitly requested, rebuild the policy */

-	if (sh->do_rebuild || modified || missing) {

+rebuild:

+	/*

+	 * Now that we know whether or not a rebuild is required,

+	 * we can determine what else needs to be done.

+	 * We need to write the kernel policy if we are rebuilding

+	 * or if any other policy component that lives in the kernel

+	 * policy has been modified.

+	 * We need to install the policy files if any of the managed files

+	 * that live under /etc/selinux (kernel policy, seusers, file contexts)

+	 * will be modified.

+	 */

+	do_write_kernel = do_rebuild | ports_modified |

+		bools->dtable->is_modified(bools->dbase) |

+		ifaces->dtable->is_modified(ifaces->dbase) |

+		nodes->dtable->is_modified(nodes->dbase) |

+		users->dtable->is_modified(users_base->dbase);

+	do_install = do_write_kernel | seusers_modified | fcontexts_modified;

+

+	/*

+	 * If there were policy changes, or explicitly requested, or

+	 * any required files are missing, rebuild the policy.

+	 */

+	if (do_rebuild) {

 		/* =================== Module expansion =============== */

 		retval = semanage_get_active_modules(sh, &modinfos, &num_modinfos);

@@ -1287,43 +1382,72 @@ static int semanage_direct_commit(semanage_handle_t * sh)

 			goto cleanup;

 		cil_db_destroy(&cildb);

-	

+

+		/* Write the linked policy before merging local changes. */

+		retval = semanage_write_policydb(sh, out,

+						 SEMANAGE_LINKED);

+		if (retval < 0)

+			goto cleanup;

 	} else {

-		/* Load already linked policy */

+		/* Load the existing linked policy, w/o local changes */

 		retval = sepol_policydb_create(&out;;

 		if (retval < 0)

 			goto cleanup;

-		retval = semanage_read_policydb(sh, out);

+		retval = semanage_read_policydb(sh, out, SEMANAGE_LINKED);

 		if (retval < 0)

 			goto cleanup;

-	}

-	if (sh->do_rebuild || modified || bools_modified) {

-		/* Attach to policy databases that work with a policydb. */

-		dbase_policydb_attach((dbase_policydb_t *) pusers_base->dbase, out);

-		dbase_policydb_attach((dbase_policydb_t *) pports->dbase, out);

-		dbase_policydb_attach((dbase_policydb_t *) pifaces->dbase, out);

-		dbase_policydb_attach((dbase_policydb_t *) pbools->dbase, out);

-		dbase_policydb_attach((dbase_policydb_t *) pnodes->dbase, out);

+		path = semanage_path(SEMANAGE_TMP, SEMANAGE_SEUSERS_LINKED);

+		if (stat(path, &sb) == 0) {

+			retval = semanage_copy_file(path,

+						    semanage_path(SEMANAGE_TMP,

+								  SEMANAGE_STORE_SEUSERS),

+						    sh->conf->file_mode);

+			if (retval < 0)

+				goto cleanup;

+			pseusers->dtable->drop_cache(pseusers->dbase);

+		} else {

+			pseusers->dtable->clear(sh, pseusers->dbase);

+		}

+

+		path = semanage_path(SEMANAGE_TMP, SEMANAGE_USERS_EXTRA_LINKED);

+		if (stat(path, &sb) == 0) {

+			retval = semanage_copy_file(path,

+						    semanage_path(SEMANAGE_TMP,

+								  SEMANAGE_USERS_EXTRA),

+						    sh->conf->file_mode);

+			if (retval < 0)

+				goto cleanup;

+			pusers_extra->dtable->drop_cache(pusers_extra->dbase);

+		} else {

+			pusers_extra->dtable->clear(sh, pusers_extra->dbase);

+		}

+	}

-		/* ============= Apply changes, and verify  =============== */

+	/* Attach our databases to the policydb we just created or loaded. */

+	dbase_policydb_attach((dbase_policydb_t *) pusers_base->dbase, out);

+	dbase_policydb_attach((dbase_policydb_t *) pports->dbase, out);

+	dbase_policydb_attach((dbase_policydb_t *) pifaces->dbase, out);

+	dbase_policydb_attach((dbase_policydb_t *) pbools->dbase, out);

+	dbase_policydb_attach((dbase_policydb_t *) pnodes->dbase, out);

-		retval = semanage_base_merge_components(sh);

-		if (retval < 0)

-			goto cleanup;

+	/* Merge local changes */

+	retval = semanage_base_merge_components(sh);

+	if (retval < 0)

+		goto cleanup;

-		retval = semanage_write_policydb(sh, out);

+	if (do_write_kernel) {

+		/* Write new kernel policy. */

+		retval = semanage_write_policydb(sh, out,

+						 SEMANAGE_STORE_KERNEL);

 		if (retval < 0)

 			goto cleanup;

+		/* Run the kernel policy verifier, if any. */

 		retval = semanage_verify_kernel(sh);

 		if (retval < 0)

 			goto cleanup;

-	} else {

-		retval = semanage_base_merge_components(sh);

-		if (retval < 0)

-			goto cleanup;

 	}

 	/* ======= Post-process: Validate non-policydb components ===== */

@@ -1332,21 +1456,21 @@ static int semanage_direct_commit(semanage_handle_t * sh)

 	 * Note: those are still cached, even though they've been 

 	 * merged into the main file_contexts. We won't check the 

 	 * large file_contexts - checked at compile time */

-	if (sh->do_rebuild || modified || fcontexts_modified) {

+	if (do_rebuild || fcontexts_modified) {

 		retval = semanage_fcontext_validate_local(sh, out);

 		if (retval < 0)

 			goto cleanup;

 	}

 	/* Validate local seusers against policy */

-	if (sh->do_rebuild || modified || seusers_modified) {

+	if (do_rebuild || seusers_modified) {

 		retval = semanage_seuser_validate_local(sh, out);

 		if (retval < 0)

 			goto cleanup;

 	}

 	/* Validate local ports for overlap */

-	if (sh->do_rebuild || modified || ports_modified) {

+	if (do_rebuild || ports_modified) {

 		retval = semanage_port_validate_local(sh);

 		if (retval < 0)

 			goto cleanup;

@@ -1367,33 +1491,27 @@ static int semanage_direct_commit(semanage_handle_t * sh)

 	}

 	path = semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_FC_LOCAL);

-	if (access(path, F_OK) == 0) {

-		retval = semanage_copy_file(semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_FC_LOCAL),

-							semanage_final_path(SEMANAGE_FINAL_TMP, SEMANAGE_FC_LOCAL),

-							sh->conf->file_mode);

-		if (retval < 0) {

-			goto cleanup;

-		}

+	retval = semanage_copy_file(semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_FC_LOCAL),

+						semanage_final_path(SEMANAGE_FINAL_TMP, SEMANAGE_FC_LOCAL),

+						sh->conf->file_mode);

+	if (retval < 0 && errno != ENOENT) {

+		goto cleanup;

 	}

 	path = semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_FC);

-	if (access(path, F_OK) == 0) {

-		retval = semanage_copy_file(semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_FC),

-							semanage_final_path(SEMANAGE_FINAL_TMP, SEMANAGE_FC),

-							sh->conf->file_mode);

-		if (retval < 0) {

-			goto cleanup;

-		}

+	retval = semanage_copy_file(semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_FC),

+						semanage_final_path(SEMANAGE_FINAL_TMP, SEMANAGE_FC),

+						sh->conf->file_mode);

+	if (retval < 0 && errno != ENOENT) {

+		goto cleanup;

 	}

 	path = semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_SEUSERS);

-	if (access(path, F_OK) == 0) {

-		retval = semanage_copy_file(semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_SEUSERS),

-							semanage_final_path(SEMANAGE_FINAL_TMP, SEMANAGE_SEUSERS),

-							sh->conf->file_mode);

-		if (retval < 0) {

-			goto cleanup;

-		}

+	retval = semanage_copy_file(semanage_path(SEMANAGE_TMP, SEMANAGE_STORE_SEUSERS),

+						semanage_final_path(SEMANAGE_FINAL_TMP, SEMANAGE_SEUSERS),

+						sh->conf->file_mode);

+	if (retval < 0 && errno != ENOENT) {

+		goto cleanup;

 	}

 	/* run genhomedircon if its enabled, this should be the last operation

@@ -1415,9 +1533,8 @@ static int semanage_direct_commit(semanage_handle_t * sh)

 	sepol_policydb_free(out);

 	out = NULL;

-	if (sh->do_rebuild || modified || bools_modified || fcontexts_modified) {

+	if (do_install)

 		retval = semanage_install_sandbox(sh);

-	}

 cleanup:

 	for (i = 0; i < num_modinfos; i++) {

@@ -1429,14 +1546,12 @@ cleanup:

 		free(mod_filenames[i]);

 	}

-	if (modified || bools_modified) {

-		/* Detach from policydb, so it can be freed */

-		dbase_policydb_detach((dbase_policydb_t *) pusers_base->dbase);

-		dbase_policydb_detach((dbase_policydb_t *) pports->dbase);

-		dbase_policydb_detach((dbase_policydb_t *) pifaces->dbase);

-		dbase_policydb_detach((dbase_policydb_t *) pnodes->dbase);

-		dbase_policydb_detach((dbase_policydb_t *) pbools->dbase);

-	}

+	/* Detach from policydb, so it can be freed */

+	dbase_policydb_detach((dbase_policydb_t *) pusers_base->dbase);

+	dbase_policydb_detach((dbase_policydb_t *) pports->dbase);

+	dbase_policydb_detach((dbase_policydb_t *) pifaces->dbase);

+	dbase_policydb_detach((dbase_policydb_t *) pnodes->dbase);

+	dbase_policydb_detach((dbase_policydb_t *) pbools->dbase);

 	free(mod_filenames);

 	sepol_policydb_free(out);

@@ -1600,7 +1715,8 @@ static int semanage_direct_extract(semanage_handle_t * sh,

 		goto cleanup;

 	}

-	if (access(module_path, F_OK) != 0) {

+	struct stat sb;

+	if (stat(module_path, &sb) != 0) {

 		ERR(sh, "Module does not exist: %s", module_path);

 		rc = -1;

 		goto cleanup;

@@ -1630,7 +1746,7 @@ static int semanage_direct_extract(semanage_handle_t * sh,

 		goto cleanup;

 	}

-	if (extract_cil == 1 && strcmp(_modinfo->lang_ext, "cil") && access(input_file, F_OK) != 0) {

+	if (extract_cil == 1 && strcmp(_modinfo->lang_ext, "cil") && stat(input_file, &sb) != 0) {

 		rc = semanage_compile_module(sh, _modinfo);

 		if (rc < 0) {

 			goto cleanup;

@@ -1931,7 +2047,7 @@ int semanage_direct_mls_enabled(semanage_handle_t * sh)

 	if (retval < 0)

 		goto cleanup;