diff --git a/src/script.c b/src/script.c
index 2f252ae..72b92cf 100644
--- a/src/script.c
+++ b/src/script.c
@@ -32,6 +32,7 @@
#include <stdlib.h>

#ifdef WITH_LIBSELINUX
+#include <ctype.h> // isspace
#include <selinux/selinux.h>
#endif

@@ -141,23 +142,97 @@ maintscript_pre_exec(struct command *cmd)
       return cmd->filename + instdirlen;
}

+#ifdef WITH_LIBSELINUX
+/*
+ * derived from get_init_context()
+ * https://github.com/SELinuxProject/selinux/blob/master/policycoreutils/run_init/run_init.c
+ *
+ * Get the CONTEXT associated with the context for the dpkg maint scripts.
+ *
+ * in:          nothing
+ * out:         The CONTEXT associated with the context.
+ * return:      0 on success, -1 on failure.
+ */
+static int
+get_dpkg_context(char **context)
+{
+       FILE *fp;
+       char buf[255], *bufp;
+       size_t buf_len;
+       char context_file[4096];
+       snprintf(context_file, sizeof(context_file) - 1, "%s/%s",
selinux_contexts_path(), "dpkg_context");
+       fp = fopen(context_file, "r");
+       if (!fp) {
+               ohshite(_("Could not open file %s\n"), context_file);
+               return -1;
+       }
+
+       while (1) {             /* loop until we find a non-empty line */
+
+               if (!fgets(buf, sizeof buf, fp)) {
+                       break;
+               }
+
+               buf_len = strlen(buf);
+               if (buf[buf_len - 1] == '\n') {
+                        buf[buf_len - 1] = 0;
+               }
+
+               bufp = buf;
+               while (*bufp && isspace(*bufp)) {
+                        bufp++;
+               }
+
+               if (*bufp) {
+                       *context = strdup(bufp);
+                       if (!(*context)) {
+                               goto out;
+                       }
+                       fclose(fp);
+                       return 0;
+               }
+       }
+      out:
+       fclose(fp);
+       ohshit(_("No context in file %s\n"), context_file);
+       return -1;
+}
+#endif
+
/**
 * Set a new security execution context for the maintainer script.
- *
- * Try to create a new execution context based on the current one and the
- * specific maintainer script filename. If it's the same as the current
- * one, use the given fallback.
 */
static int
-maintscript_set_exec_context(struct command *cmd, const char *fallback)
+maintscript_set_exec_context(void)
{
+#ifdef WITH_LIBSELINUX
       int rc = 0;
+       char *dpkg_context = NULL;

-#ifdef WITH_LIBSELINUX
-       rc = setexecfilecon(cmd->filename, fallback);
-#endif
+       if (is_selinux_enabled() < 1) {
+               return 0;
+       }

-       return rc < 0 ? rc : 0;
+       if ((rc = get_dpkg_context(&dpkg_context)) < 0) {
+               ohshit(_("Can not get dpkg_context"));
+               goto out;
+       }
+
+       if ((rc = setexeccon(dpkg_context)) < 0) {
+               ohshite(_("Can not set exec content to %s"), dpkg_context);
+               goto out;;
+       }
+
+      out:
+       if (rc < 0 && security_getenforce() == 0) {
+               rc = 0;
+       }
+
+       free(dpkg_context);
+       return rc;
+#else
+       return 0;
+#endif
}

static int
@@ -190,7 +265,7 @@ maintscript_exec(struct pkginfo *pkg, struct pkgbin *pkgbin,

               cmd->filename = cmd->argv[0] = maintscript_pre_exec(cmd);

-               if (maintscript_set_exec_context(cmd, "dpkg_script_t") < 0)
+               if (maintscript_set_exec_context() < 0)
                       ohshite(_("cannot set security execution context for "
                                 "maintainer script"));

--
2.11.0


The policy patch would look like this:

From: cgzones <cgzones@googlemail.com>
Date: Tue, 10 Jan 2017 14:19:54 +0100
Subject: add dpkg_context appcontext

---
 Makefile                               | 2 +-
 config/appconfig-mcs/dpkg_context      | 1 +
 config/appconfig-mls/dpkg_context      | 1 +
 config/appconfig-standard/dpkg_context | 1 +
 4 files changed, 4 insertions(+), 1 deletion(-)
 create mode 100644 config/appconfig-mcs/dpkg_context
 create mode 100644 config/appconfig-mls/dpkg_context
 create mode 100644 config/appconfig-standard/dpkg_context

diff --git a/Makefile b/Makefile
index 154beb57c..1ad9e079f 100644
--- a/Makefile
+++ b/Makefile
@@ -250,7 +250,7 @@ seusers := $(appconf)/seusers
 appdir := $(contextpath)
 user_default_contexts := $(wildcard
config/appconfig-$(TYPE)/*_default_contexts)
 user_default_contexts_names := $(addprefix
$(contextpath)/users/,$(subst _default_contexts,,$(notdir
$(user_default_contexts))))
-appfiles := $(addprefix $(appdir)/,default_contexts default_type
initrc_context failsafe_context userhelper_context removable_context
dbus_contexts sepgsql_contexts x_contexts customizable_types
securetty_types lxc_contexts virtual_domain_context
virtual_image_context) $(contextpath)/files/media $(fcsubspath)
$(user_default_contexts_names)
+appfiles := $(addprefix $(appdir)/,default_contexts default_type
initrc_context dpkg_context failsafe_context userhelper_context
removable_context dbus_contexts sepgsql_contexts x_contexts
customizable_types securetty_types lxc_contexts virtual_domain_context
virtual_image_context) $(contextpath)/files/media $(fcsubspath)
$(user_default_contexts_names)
 net_contexts := $(builddir)net_contexts

 all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d)
diff --git a/config/appconfig-mcs/dpkg_context
b/config/appconfig-mcs/dpkg_context
new file mode 100644
index 000000000..f7ed03c8c
--- /dev/null
+++ b/config/appconfig-mcs/dpkg_context
@@ -0,0 +1 @@
+system_u:system_r:dpkg_script_t:s0
diff --git a/config/appconfig-mls/dpkg_context
b/config/appconfig-mls/dpkg_context
new file mode 100644
index 000000000..555917148
--- /dev/null
+++ b/config/appconfig-mls/dpkg_context
@@ -0,0 +1 @@
+system_u:system_r:dpkg_script_t:s0-mls_systemhigh
diff --git a/config/appconfig-standard/dpkg_context
b/config/appconfig-standard/dpkg_context
new file mode 100644
index 000000000..7c56bf1f5
--- /dev/null
+++ b/config/appconfig-standard/dpkg_context
@@ -0,0 +1 @@
+system_u:system_r:dpkg_script_t
