--- libselinux-2.0.77/./src/avc.c	2009-01-27 14:47:32.000000000 -0500
+++ libselinux-2.0.77.new/./src/avc.c	2009-02-26 15:10:54.181135242 -0500
@@ -20,6 +20,8 @@ struct avc_entry {
 	security_id_t tsid;
 	security_class_t tclass;
 	struct av_decision avd;
+	security_id_t	create_sid;
+	unsigned	create_decided	:1;
 	int used;		/* used recently */
 };
 
@@ -58,6 +60,11 @@ static struct avc_cache_stats cache_stat
 static struct avc_callback_node *avc_callbacks = NULL;
 static struct sidtab avc_sidtab;
 
+/* forward declaration */
+static int avc_update_cache(uint32_t event, security_id_t ssid,
+			    security_id_t tsid, security_class_t tclass,
+			    access_vector_t perms, security_id_t create_sid);
+
 static inline int avc_hash(security_id_t ssid,
 			   security_id_t tsid, security_class_t tclass)
 {
@@ -365,6 +372,8 @@ static inline struct avc_node *avc_claim
 	new->ae.ssid = ssid;
 	new->ae.tsid = tsid;
 	new->ae.tclass = tclass;
+	new->ae.create_sid = NULL;
+	new->ae.create_decided = 0;
 	new->next = avc_cache.slots[hvalue];
 	avc_cache.slots[hvalue] = new;
 
@@ -896,24 +905,52 @@ int avc_compute_create(security_id_t ssi
 		       security_class_t tclass, security_id_t *newsid)
 {
 	int rc;
+	struct avc_entry_ref aeref;
+	security_context_t ctx = NULL;
+
 	*newsid = NULL;
+
+	avc_entry_ref_init(&aeref);
+retry:
 	avc_get_lock(avc_lock);
-	if (ssid->refcnt > 0 && tsid->refcnt > 0) {
-		security_context_t ctx = NULL;
-		rc = security_compute_create_raw(ssid->ctx, tsid->ctx, tclass,
-						 &ctx);
-		if (rc)
-			goto out;
-		rc = sidtab_context_to_sid(&avc_sidtab, ctx, newsid);
-		if (!rc)
-			(*newsid)->refcnt++;
-		freecon(ctx);
-	} else {
+	if (ssid->refcnt <= 0 || tsid->refcnt <= 0) {
 		errno = EINVAL;	/* bad reference count */
 		rc = -1;
+		goto out_err;
 	}
+
+	rc = avc_lookup(ssid, tsid, tclass, 0, &aeref);
+	if (!rc) {
+		/* we found something in the avc */
+		if (aeref.ae->create_decided) {
+			*newsid = aeref.ae->create_sid;
+			goto out;
+		} else {
+			goto compute;
+		}
+	}
+	/* there is nothing in the avd for this tuple, so, lets get something */
+	avc_release_lock(avc_lock);
+	avc_has_perm_noaudit(ssid, tsid, tclass, 0, &aeref, NULL);
+	goto retry;
+
+compute:
+	rc = security_compute_create_raw(ssid->ctx, tsid->ctx, tclass,
+					 &ctx);
+	if (rc)
+		goto out;
+	rc = sidtab_context_to_sid(&avc_sidtab, ctx, newsid);
+	if (rc)
+		goto out;
+
+	avc_update_cache(AVC_CALLBACK_ADD_TRANSITION, ssid, tsid, tclass, 0,
+			 *newsid);
+
 out:
+	if (*newsid)
+		(*newsid)->refcnt++;
 	avc_release_lock(avc_lock);
+	freecon(ctx);
 	return rc;
 }
 
@@ -978,7 +1015,8 @@ static inline int avc_sidcmp(security_id
 }
 
 static inline void avc_update_node(uint32_t event, struct avc_node *node,
-				   access_vector_t perms)
+				   access_vector_t perms,
+				   security_id_t create_sid)
 {
 	switch (event) {
 	case AVC_CALLBACK_GRANT:
@@ -1000,12 +1038,16 @@ static inline void avc_update_node(uint3
 	case AVC_CALLBACK_AUDITDENY_DISABLE:
 		node->ae.avd.auditdeny &= ~perms;
 		break;
+	case AVC_CALLBACK_ADD_TRANSITION:
+		node->ae.create_sid = create_sid;
+		node->ae.create_decided = 1;
+		break;
 	}
 }
 
 static int avc_update_cache(uint32_t event, security_id_t ssid,
 			    security_id_t tsid, security_class_t tclass,
-			    access_vector_t perms)
+			    access_vector_t perms, security_id_t create_sid)
 {
 	struct avc_node *node;
 	int i;
@@ -1019,7 +1061,7 @@ static int avc_update_cache(uint32_t eve
 				if (avc_sidcmp(ssid, node->ae.ssid) &&
 				    avc_sidcmp(tsid, node->ae.tsid) &&
 				    tclass == node->ae.tclass) {
-					avc_update_node(event, node, perms);
+					avc_update_node(event, node, perms, create_sid);
 				}
 			}
 		}
@@ -1027,7 +1069,7 @@ static int avc_update_cache(uint32_t eve
 		/* apply to one node */
 		node = avc_search_node(ssid, tsid, tclass, 0);
 		if (node) {
-			avc_update_node(event, node, perms);
+			avc_update_node(event, node, perms, create_sid);
 		}
 	}
 
@@ -1058,7 +1100,7 @@ static int avc_control(uint32_t event, s
 	 * been invoked to update the cache state.
 	 */
 	if (event != AVC_CALLBACK_TRY_REVOKE)
-		avc_update_cache(event, ssid, tsid, tclass, perms);
+		avc_update_cache(event, ssid, tsid, tclass, perms, NULL);
 
 	for (c = avc_callbacks; c; c = c->next) {
 		if ((c->events & event) &&
@@ -1080,7 +1122,7 @@ static int avc_control(uint32_t event, s
 	if (event == AVC_CALLBACK_TRY_REVOKE) {
 		/* revoke any unretained permissions */
 		perms &= ~tretained;
-		avc_update_cache(event, ssid, tsid, tclass, perms);
+		avc_update_cache(event, ssid, tsid, tclass, perms, NULL);
 		*out_retained = tretained;
 	}
 
--- libselinux-2.0.77/./include/selinux/avc.h	2009-01-27 14:47:32.000000000 -0500
+++ libselinux-2.0.77.new/./include/selinux/avc.h	2009-02-25 21:28:33.519166764 -0500
@@ -353,6 +353,7 @@ int avc_compute_member(security_id_t ssi
 #define AVC_CALLBACK_AUDITALLOW_DISABLE	32
 #define AVC_CALLBACK_AUDITDENY_ENABLE	64
 #define AVC_CALLBACK_AUDITDENY_DISABLE	128
+#define AVC_CALLBACK_ADD_TRANSITION	256
 
 /**
  * avc_add_callback - Register a callback for security events.