Now have a function called selinux_context_cmp which will compare two context ignoring the user componant for equivalency. Fixed selinux_verify_file_context to work properly, default_canoncon now checks myflags for MATCHPATHCON_NOTRANS Added selinux_lsetfilecon_default(const char* path) to set a file context to match the entry in file_contexts file. Changing install command to use this function improved perfomance # time install resolv.conf /etc/ real 0m0.251s user 0m0.176s sys 0m0.040s # ls -lZ /etc/resolv.conf -rwxr-xr-x root root system_u:object_r:net_conf_t /etc/resolv.conf # time ./ginstall resolv.conf /etc/ real 0m0.007s user 0m0.000s sys 0m0.008s # ls -lZ /etc/resolv.conf -rwxr-xr-x root root system_u:object_r:net_conf_t /etc/resolv.conf