diff --git a/.gitignore b/.gitignore
index a8c404c..c40d6ec 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@
 /fapolicyd-0.8.9.tar.gz
 /fapolicyd-0.8.10.tar.gz
 /fapolicyd-0.9.tar.gz
+/fapolicyd-selinux-0.1.tar.gz
diff --git a/fapolicyd.spec b/fapolicyd.spec
index f12bdd7..1fac4e4 100644
--- a/fapolicyd.spec
+++ b/fapolicyd.spec
@@ -1,10 +1,15 @@
+%global selinuxtype targeted
+%global moduletype contrib
+%define semodule_version 0.1
+
 Summary: Application Whitelisting Daemon
 Name: fapolicyd
 Version: 0.9
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPLv3+
 URL: http://people.redhat.com/sgrubb/fapolicyd
 Source0: https://people.redhat.com/sgrubb/fapolicyd/%{name}-%{version}.tar.gz
+Source1: https://github.com/linux-application-whitelisting/%{name}-selinux/releases/download/v%{semodule_version}/%{name}-selinux-%{semodule_version}.tar.gz
 BuildRequires: kernel-headers
 BuildRequires: autoconf automake make gcc libtool
 BuildRequires: systemd-devel libgcrypt-devel rpm-devel file-devel
@@ -22,10 +27,27 @@ to decide file access rights. Applications that are known via a reputation
 source are allowed access while unknown applications are not. The daemon
 makes use of the kernel's fanotify interface to determine file access rights.
 
+%package        selinux
+Summary:        Fapolicyd selinux
+Group:          Applications/System
+Requires:       %{name} = %{version}-%{release}
+BuildRequires:  selinux-policy
+BuildRequires:  selinux-policy-devel
+BuildArch: noarch
+%{?selinux_requires}
+
+%description    selinux
+The %{name}-selinux package contains selinux policy for the %{name} daemon.
+
+
+
 %prep
 
 %setup -q
 
+# selinux
+%setup -q -D -T -a 1
+
 sed -i "s/%python2_path%/`readlink -f %{__python2} | sed 's/\//\\\\\//g'`/g" init/%{name}.rules
 sed -i "s/%python3_path%/`readlink -f %{__python3} | sed 's/\//\\\\\//g'`/g" init/%{name}.rules
 
@@ -34,6 +56,15 @@ sed -i "s/%python3_path%/`readlink -f %{__python3} | sed 's/\//\\\\\//g'`/g" ini
 %configure --with-audit
 make CFLAGS="%{optflags}" %{?_smp_mflags}
 
+# selinux
+pushd %{name}-selinux-%{semodule_version}
+make
+popd
+
+# selinux
+%pre selinux
+%selinux_relabel_pre -s %{selinuxtype}
+
 %install
 make DESTDIR="%{buildroot}" INSTALL='install -p' install
 mkdir -p %{buildroot}/%{python3_sitelib}/dnf-plugins/
@@ -42,6 +73,13 @@ install -p -m 644 -D init/%{name}-tmpfiles.conf %{buildroot}/%{_tmpfilesdir}/%{n
 mkdir -p %{buildroot}/%{_localstatedir}/lib/%{name}
 mkdir -p %{buildroot}/run/%{name}
 
+# selinux
+install -d %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
+install -m 0644 %{name}-selinux-%{semodule_version}/%{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
+install -d -p %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}
+install -p -m 644 %{name}-selinux-%{semodule_version}/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if
+
+
 %pre
 getent passwd %{name} >/dev/null || useradd -r -M -d %{_localstatedir}/lib/%{name} -s /sbin/nologin -c "Application Whitelisting Daemon" %{name}
 
@@ -77,7 +115,28 @@ getent passwd %{name} >/dev/null || useradd -r -M -d %{_localstatedir}/lib/%{nam
 %{python3_sitelib}/dnf-plugins/%{name}-dnf-plugin.py
 %{python3_sitelib}/dnf-plugins/__pycache__/%{name}-dnf-plugin.*.pyc
 
+
+%files selinux
+%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
+%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
+%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if
+
+%post selinux
+%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
+
+%postun selinux
+if [ $1 -eq 0 ]; then
+    %selinux_modules_uninstall -s %{selinuxtype} %{name}
+fi
+
+%posttrans selinux
+%selinux_relabel_post -s %{selinuxtype}
+
+
 %changelog
+* Mon Oct 07 2019 Radovan Sroka <rsroka@redhat.com> - 0.9-2
+- Added fapolicyd-selinux subpackage
+
 * Mon Oct 07 2019 Radovan Sroka <rsroka@redhat.com> - 0.9-1
 - rebase to v0.9
 
diff --git a/sources b/sources
index 05d1f23..5dfcce0 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 SHA512 (fapolicyd-0.9.tar.gz) = 9a7fc929730403cf1430051e8f2c34568f43e38119f2bb09393886f7d8880354941f70cca34a2da2ca5ad9d65bd1e4854037a0deb9d7b0656f841b33019e2146
+SHA512 (fapolicyd-selinux-0.1.tar.gz) = 6a36a6f27c6b8fbb07f69630b26bc62e9f53ebea3ab86f47cd26a4c14e42975f5a44e1291f9622e6d7d0a9d40f45fdf2ac0f76e939bc8fc75e65df1639410114