--- ypserv-2.31/rpc.yppasswdd/Makefile.am.selinux-context	2016-01-25 15:39:35.038050672 +0100
+++ ypserv-2.31/rpc.yppasswdd/Makefile.am	2016-01-25 15:39:56.203036632 +0100
@@ -26,7 +26,7 @@
 
 rpc_yppasswdd_LDFLAGS = -Wl,-z,relro,-z,now
 
-rpc_yppasswdd_LDADD =  @PIE_LDFLAGS@ $(top_builddir)/lib/libyp.a $(LIBDBM) $(LIBCRYPT) $(LIBSYSTEMD_DAEMON)
+rpc_yppasswdd_LDADD =  @PIE_LDFLAGS@ $(top_builddir)/lib/libyp.a $(LIBDBM) $(LIBCRYPT) $(LIBSYSTEMD_DAEMON) $(LIBSELINUX)
 rpc_yppasswdd_CFLAGS = @PIE_CFLAGS@
 
 if ENABLE_REGENERATE_MAN
--- ypserv-2.31/configure.in.selinux-context.patch	2016-01-25 16:07:01.662180676 +0100
+++ ypserv-2.31/configure.in	2016-01-25 16:07:57.116157640 +0100
@@ -243,6 +243,26 @@
   echo ""
   exit
 fi
+AC_ARG_WITH(selinux,
+    [AC_HELP_STRING([--with-selinux@<:@=yes|no@:>@],[Enables SELinux support [no]])],
+
+  [ if test "$withval" = "yes"; then
+    AC_CHECK_HEADERS([selinux/selinux.h], [],
+        [AC_MSG_ERROR([Missing SELinux header files])])
+    AC_CHECK_LIB(selinux, setfilecon_raw, [],
+        [AC_MSG_ERROR([Missing or incorrect SELinux library])])
+    AC_CHECK_LIB(selinux, getfilecon_raw, [],
+        [AC_MSG_ERROR([Missing or incorrect SELinux library])])
+    AC_CHECK_LIB(selinux, freecon, [],
+          [AC_MSG_ERROR([Missing or incorrect SELinux library])])
+  fi
+ ],[])
+
+AC_SUBST(with_selinux)
+if test "$with_selinux" = "yes"; then
+      AC_DEFINE(WITH_SELINUX, 1, [Define to 1 if SELinux support is enabled])
+fi
+
 
 AC_CHECK_LIB(xcrypt,crypt,LIBCRYPT="-lxcrypt",LIBCRYPT="")
 if test -z "$LIBCRYPT" ; then
--- ypserv-2.31/rpc.yppasswdd/update.c.selinux-context	2013-04-10 16:42:51.000000000 +0200
+++ ypserv-2.31/rpc.yppasswdd/update.c	2018-01-09 08:49:08.165461843 +0100
@@ -42,6 +42,9 @@
 #ifdef HAVE_SHADOW_H
 #include <shadow.h>
 #endif
+#ifdef WITH_SELINUX
+#include <selinux/selinux.h>
+#endif /* WITH_SELINUX */
 #include "compat.h"
 
 #ifndef CHECKROOT
@@ -448,6 +451,9 @@
   FILE *oldpf = NULL, *newpf = NULL, *oldsf = NULL, *newsf = NULL;
   struct stat passwd_stat, shadow_stat;
   char *rootpass = "x";
+#ifdef WITH_SELINUX
+  char  *pSelCon = NULL;
+#endif /* WITH_SELINUX */
 
 #if CHECKROOT
   if ((pw = getpwnam ("root")) != NULL)
@@ -489,6 +495,7 @@
       return 1;
     }
 
+
   /* Open a temp passwd file */
   if ((newpf = fopen (path_passwd_tmp, "w+")) == NULL)
     {
@@ -497,6 +504,7 @@
       fclose (oldpf);
       return 1;
     }
+
   chmod (path_passwd_tmp, passwd_stat.st_mode);
   if (chown (path_passwd_tmp, passwd_stat.st_uid, passwd_stat.st_gid) == -1)
     {
@@ -507,42 +515,104 @@
       return 1;
     }
 
+#ifdef WITH_SELINUX
+  if (is_selinux_enabled() == 1)
+    {
+      /* Get selinux context of the original file */
+      if (getfilecon_raw(path_passwd, &pSelCon) < 0)
+        {
+          log_msg ("%s failed", logbuf);
+          log_msg ("Can't get selinux context %s: %m", path_passwd);
+          freecon(pSelCon);
+          fclose (oldpf);
+          fclose (newpf);
+          unlink (path_passwd_tmp);
+          return 1;
+        }
+
+      /* Set selinux context for tmp file */
+      if (setfilecon_raw(path_passwd_tmp, pSelCon))
+        {
+          log_msg ("%s failed", logbuf);
+          log_msg ("Can't set selinux context %s: %m", path_passwd_tmp);
+          freecon(pSelCon);
+          fclose (oldpf);
+          fclose (newpf);
+          unlink (path_passwd_tmp);
+          return 1;
+        }
+      freecon(pSelCon);
+      pSelCon=NULL;
+    }
+#    endif /* WITH_SELINUX  */
+
 #ifdef HAVE_GETSPNAM
   /* Open the shadow file for reading. */
   if ((oldsf = fopen (path_shadow, "r")) != NULL)
     {
       if (fstat (fileno (oldsf), &shadow_stat) < 0)
-	{
-	  log_msg ("%s failed", logbuf);
-	  log_msg ("Can't stat %s: %m", path_shadow);
-	  fclose (oldpf);
-	  fclose (newpf);
-	  fclose (oldsf);
-	  return 1;
-	}
+	    {
+	      log_msg ("%s failed", logbuf);
+	      log_msg ("Can't stat %s: %m", path_shadow);
+	      fclose (oldpf);
+	      fclose (newpf);
+	      fclose (oldsf);
+	      return 1;
+	    }
+
 
       if ((newsf = fopen (path_shadow_tmp, "w+")) == NULL)
-	{
-	  int err = errno;
-	  log_msg ("%s failed", logbuf);
-	  log_msg ("Can't open %s.tmp: %s",
-		   path_passwd, strerror (err));
-	  fclose (oldsf);
-	  fclose (newpf);
-	  fclose (oldpf);
-	  return 1;
-	}
+	    {
+	      int err = errno;
+	      log_msg ("%s failed", logbuf);
+	      log_msg ("Can't open %s.tmp: %s",
+	    	   path_passwd, strerror (err));
+	      fclose (oldsf);
+	      fclose (newpf);
+	      fclose (oldpf);
+	      return 1;
+	    }
       chmod (path_shadow_tmp, shadow_stat.st_mode);
       if (chown (path_shadow_tmp, shadow_stat.st_uid,
-		 shadow_stat.st_gid) == -1)
-	{
-	  log_msg ("chown failed", strerror (errno));
-	  fclose (newsf);
-	  fclose (oldsf);
-	  fclose (newpf);
-	  fclose (oldpf);
-	  return 1;
-	}
+	     shadow_stat.st_gid) == -1)
+	    {
+	      log_msg ("chown failed", strerror (errno));
+	      fclose (newsf);
+	      fclose (oldsf);
+	      fclose (newpf);
+	      fclose (oldpf);
+	      return 1;
+	    }
+#ifdef WITH_SELINUX
+      if (is_selinux_enabled() == 1)
+        {
+          if (getfilecon_raw(path_shadow, &pSelCon) < 0)
+          {
+                  log_msg ("%s failed", logbuf);
+                  log_msg ("Can't get selinux context %s: %m", path_shadow);
+              freecon(pSelCon);
+                  fclose (newsf);
+                  fclose (oldsf);
+                  fclose (newpf);
+                  fclose (oldpf);
+                  return 1;
+          }
+          if (setfilecon_raw(path_shadow_tmp, pSelCon))
+                {
+                  log_msg ("%s failed", logbuf);
+                  log_msg ("Can't set selinux context %s: %m", path_shadow_tmp);
+              freecon(pSelCon);
+                  fclose (newsf);
+                  fclose (oldsf);
+                  fclose (newpf);
+                  fclose (oldpf);
+                  return 1;
+                }
+          freecon(pSelCon);
+          pSelCon=NULL;
+        }
+#endif /* WITH_SELINUX */
+
     }
 #endif /* HAVE_GETSPNAM */