diff --git a/libselinux-fedora.patch b/libselinux-fedora.patch
index cb3d29b..939d0df 100644
--- a/libselinux-fedora.patch
+++ b/libselinux-fedora.patch
@@ -22,6 +22,98 @@ index 1ecab17..16531fe 100644
  
  OS := $(shell uname)
  export OS
+diff --git libselinux-2.7/include/Makefile libselinux-2.7/include/Makefile
+index 757a6c9..8ab9ce9 100644
+--- libselinux-2.7/include/Makefile
++++ libselinux-2.7/include/Makefile
+@@ -1,12 +1,12 @@
+ # Installation directories.
+-PREFIX ?= $(DESTDIR)/usr
+-INCDIR ?= $(PREFIX)/include/selinux
++PREFIX ?= /usr
++INCDIR = $(PREFIX)/include/selinux
+ 
+ all:
+ 
+ install: all
+-	test -d $(INCDIR) || install -m 755 -d $(INCDIR)
+-	install -m 644 $(wildcard selinux/*.h) $(INCDIR)
++	test -d $(DESTDIR)$(INCDIR) || install -m 755 -d $(DESTDIR)$(INCDIR)
++	install -m 644 $(wildcard selinux/*.h) $(DESTDIR)$(INCDIR)
+ 
+ relabel:
+ 
+diff --git libselinux-2.7/man/Makefile libselinux-2.7/man/Makefile
+index 0643e6a..f634d1f 100644
+--- libselinux-2.7/man/Makefile
++++ libselinux-2.7/man/Makefile
+@@ -1,17 +1,18 @@
+ # Installation directories.
+-MAN8DIR ?= $(DESTDIR)/usr/share/man/man8
+-MAN5DIR ?= $(DESTDIR)/usr/share/man/man5
+-MAN3DIR ?= $(DESTDIR)/usr/share/man/man3
++PREFIX	?= /usr
++MAN8DIR ?= $(PREFIX)/share/man/man8
++MAN5DIR ?= $(PREFIX)/share/man/man5
++MAN3DIR ?= $(PREFIX)/share/man/man3
+ 
+ all:
+ 
+ install: all
+-	mkdir -p $(MAN3DIR)
+-	mkdir -p $(MAN5DIR)
+-	mkdir -p $(MAN8DIR)
+-	install -m 644 man3/*.3 $(MAN3DIR)
+-	install -m 644 man5/*.5 $(MAN5DIR)
+-	install -m 644 man8/*.8 $(MAN8DIR)
++	mkdir -p $(DESTDIR)$(MAN3DIR)
++	mkdir -p $(DESTDIR)$(MAN5DIR)
++	mkdir -p $(DESTDIR)$(MAN8DIR)
++	install -m 644 man3/*.3 $(DESTDIR)$(MAN3DIR)
++	install -m 644 man5/*.5 $(DESTDIR)$(MAN5DIR)
++	install -m 644 man8/*.8 $(DESTDIR)$(MAN8DIR)
+ 
+ relabel:
+ 
+diff --git libselinux-2.7/man/man5/removable_context.5 libselinux-2.7/man/man5/removable_context.5
+index 60aaa93..f16e8bd 100644
+--- libselinux-2.7/man/man5/removable_context.5
++++ libselinux-2.7/man/man5/removable_context.5
+@@ -3,8 +3,7 @@
+ removable_context \- The SELinux removable devices context configuration file
+ .
+ .SH "DESCRIPTION"
+-This file contains the default label that should be used for removable devices that are not defined in the \fImedia\fR file (that is described in
+-.BR selabel_media "(5)). "
++This file contains the default label that should be used for removable devices.
+ .sp
+ .BR selinux_removable_context_path "(3) "
+ will return the active policy path to this file. The default removable context file is:
+@@ -34,4 +33,4 @@ A user, role, type and optional range (for MCS/MLS) separated by colons (:) that
+ system_u:object_r:removable_t:s0
+ .
+ .SH "SEE ALSO"
+-.BR selinux "(8), " selinux_removable_context_path "(3), " selabel_media "(5), " selinux_config "(5) "
++.BR selinux "(8), " selinux_removable_context_path "(3), " selinux_config "(5) "
+diff --git libselinux-2.7/man/man5/selabel_media.5 libselinux-2.7/man/man5/selabel_media.5
+index 395ed0e..b7c28e3 100644
+--- libselinux-2.7/man/man5/selabel_media.5
++++ libselinux-2.7/man/man5/selabel_media.5
+@@ -52,8 +52,6 @@ The default media contexts file is:
+ .RE
+ .sp
+ Where \fI{SELINUXTYPE}\fR is the entry from the selinux configuration file \fIconfig\fR (see \fBselinux_config\fR(5)).
+-.sp
+-Should there not be a valid entry in the \fImedia\fR file, then the default \fIremovable_context\fR file will be read (see \fBremovable_context\fR(5)).
+ .
+ .SH "FILE FORMAT"
+ Each line within the \fImedia\fR file is as follows:
+@@ -90,4 +88,4 @@ this is not set, then it is possible for an invalid context to be returned.
+ .SH "SEE ALSO"
+ .ad l
+ .nh
+-.BR selinux "(8), " selabel_open "(3), " selabel_lookup "(3), " selabel_stats "(3), " selabel_close "(3), " selinux_set_callback "(3), " selinux_media_context_path "(3), " freecon "(3), " selinux_config "(5), " removable_context "(5) "
++.BR selinux "(8), " selabel_open "(3), " selabel_lookup "(3), " selabel_stats "(3), " selabel_close "(3), " selinux_set_callback "(3), " selinux_media_context_path "(3), " freecon "(3), " selinux_config "(5) "
 diff --git libselinux-2.7/man/man8/selinux.8 libselinux-2.7/man/man8/selinux.8
 index e37aee6..bf23b65 100644
 --- libselinux-2.7/man/man8/selinux.8
@@ -42,18 +134,106 @@ index e37aee6..bf23b65 100644
  Every confined service on the system has a man page in the following format:
  .br
 diff --git libselinux-2.7/src/Makefile libselinux-2.7/src/Makefile
-index 2408fae..18df75c 100644
+index 2408fae..18588da 100644
 --- libselinux-2.7/src/Makefile
 +++ libselinux-2.7/src/Makefile
-@@ -148,7 +148,7 @@ $(LIBSO): $(LOBJS)
+@@ -8,19 +8,17 @@ RUBYPREFIX ?= $(notdir $(RUBY))
+ PKG_CONFIG ?= pkg-config
+ 
+ # Installation directories.
+-PREFIX ?= $(DESTDIR)/usr
++PREFIX ?= /usr
+ LIBDIR ?= $(PREFIX)/lib
+-SHLIBDIR ?= $(DESTDIR)/lib
++SHLIBDIR ?= /lib
+ INCLUDEDIR ?= $(PREFIX)/include
+ PYINC ?= $(shell $(PKG_CONFIG) --cflags $(PYPREFIX))
+ PYLIBS ?= $(shell $(PKG_CONFIG) --libs $(PYPREFIX))
+-PYSITEDIR ?= $(DESTDIR)$(shell $(PYTHON) -c 'import site; print(site.getsitepackages()[0])')
++PYSITEDIR ?= $(shell $(PYTHON) -c 'import site; print(site.getsitepackages()[0])')
+ PYCEXT ?= $(shell $(PYTHON) -c 'import imp;print([s for s,m,t in imp.get_suffixes() if t == imp.C_EXTENSION][0])')
+ RUBYINC ?= $(shell $(RUBY) -e 'puts "-I" + RbConfig::CONFIG["rubyarchhdrdir"] + " -I" + RbConfig::CONFIG["rubyhdrdir"]')
+ RUBYLIBS ?= $(shell $(RUBY) -e 'puts "-L" + RbConfig::CONFIG["libdir"] + " -L" + RbConfig::CONFIG["archlibdir"] + " " + RbConfig::CONFIG["LIBRUBYARG_SHARED"]')
+-RUBYINSTALL ?= $(DESTDIR)$(shell $(RUBY) -e 'puts RbConfig::CONFIG["vendorarchdir"]')
+-LIBBASE ?= $(shell basename $(LIBDIR))
+-LIBSEPOLA ?= $(LIBDIR)/libsepol.a
++RUBYINSTALL ?= $(shell $(RUBY) -e 'puts RbConfig::CONFIG["vendorarchdir"]')
+ 
+ VERSION = $(shell cat ../VERSION)
+ LIBVERSION = 1
+@@ -50,6 +48,13 @@ LIBSO=$(TARGET).$(LIBVERSION)
+ AUDIT2WHYLOBJ=$(PYPREFIX)audit2why.lo
+ AUDIT2WHYSO=$(PYPREFIX)audit2why.so
+ 
++# If no specific libsepol.a is specified, fall back on LDFLAGS search path
++# Otherwise, as $(LIBSEPOLA) already appears in the dependencies, there
++# is no need to define a value for LDLIBS_LIBSEPOLA
++ifeq ($(LIBSEPOLA),)
++        LDLIBS_LIBSEPOLA := -l:libsepol.a
++endif
++
+ GENERATED=$(SWIGCOUT) $(SWIGRUBYCOUT) selinuxswig_python_exception.i
+ SRCS= $(filter-out $(GENERATED) audit2why.c, $(sort $(wildcard *.c)))
+ 
+@@ -148,7 +153,7 @@ $(LIBSO): $(LOBJS)
  	ln -sf $@ $(TARGET)
  
  $(LIBPC): $(LIBPC).in ../VERSION
 -	sed -e 's/@VERSION@/$(VERSION)/; s:@prefix@:$(PREFIX):; s:@libdir@:$(LIBBASE):; s:@includedir@:$(INCLUDEDIR):' < $< > $@
-+	sed -e 's/@VERSION@/$(VERSION)/; s:@prefix@:$(PREFIX):; s:@libdir@:$(LIBBASE):; s:@includedir@:$(INCLUDEDIR):; s:@PCRE_MODULE@:$(PCRE_MODULE):' < $< > $@
++	sed -e 's/@VERSION@/$(VERSION)/; s:@prefix@:$(PREFIX):; s:@libdir@:$(LIBDIR):; s:@includedir@:$(INCLUDEDIR):; s:@PCRE_MODULE@:$(PCRE_MODULE):' < $< > $@
  
  selinuxswig_python_exception.i: ../include/selinux/selinux.h
  	bash -e exception.sh > $@ || (rm -f $@ ; false)
+@@ -157,7 +162,7 @@ $(AUDIT2WHYLOBJ): audit2why.c
+ 	$(CC) $(filter-out -Werror, $(CFLAGS)) $(PYINC) -fPIC -DSHARED -c -o $@ $<
+ 
+ $(AUDIT2WHYSO): $(AUDIT2WHYLOBJ) $(LIBSEPOLA)
+-	$(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(PYLIBS)
++	$(CC) $(CFLAGS) $(LDFLAGS) -L. -shared -o $@ $^ -lselinux $(LDLIBS_LIBSEPOLA) $(PYLIBS)
+ 
+ %.o:  %.c policy.h
+ 	$(CC) $(CFLAGS) $(TLSFLAGS) -c -o $@ $<
+@@ -177,26 +182,26 @@ swigify: $(SWIGIF)
+ 	$(SWIG) $<
+ 
+ install: all 
+-	test -d $(LIBDIR) || install -m 755 -d $(LIBDIR)
+-	install -m 644 $(LIBA) $(LIBDIR)
+-	test -d $(SHLIBDIR) || install -m 755 -d $(SHLIBDIR)
+-	install -m 755 $(LIBSO) $(SHLIBDIR)
+-	test -d $(LIBDIR)/pkgconfig || install -m 755 -d $(LIBDIR)/pkgconfig
+-	install -m 644 $(LIBPC) $(LIBDIR)/pkgconfig
+-	ln -sf --relative $(SHLIBDIR)/$(LIBSO) $(LIBDIR)/$(TARGET)
++	test -d $(DESTDIR)$(LIBDIR) || install -m 755 -d $(DESTDIR)$(LIBDIR)
++	install -m 644 $(LIBA) $(DESTDIR)$(LIBDIR)
++	test -d $(DESTDIR)$(SHLIBDIR) || install -m 755 -d $(DESTDIR)$(SHLIBDIR)
++	install -m 755 $(LIBSO) $(DESTDIR)$(SHLIBDIR)
++	test -d $(DESTDIR)$(LIBDIR)/pkgconfig || install -m 755 -d $(DESTDIR)$(LIBDIR)/pkgconfig
++	install -m 644 $(LIBPC) $(DESTDIR)$(LIBDIR)/pkgconfig
++	ln -sf --relative $(DESTDIR)$(SHLIBDIR)/$(LIBSO) $(DESTDIR)$(LIBDIR)/$(TARGET)
+ 
+ install-pywrap: pywrap
+-	test -d $(PYSITEDIR)/selinux || install -m 755 -d $(PYSITEDIR)/selinux
+-	install -m 755 $(SWIGSO) $(PYSITEDIR)/_selinux$(PYCEXT)
+-	install -m 755 $(AUDIT2WHYSO) $(PYSITEDIR)/selinux/audit2why$(PYCEXT)
+-	install -m 644 $(SWIGPYOUT) $(PYSITEDIR)/selinux/__init__.py
++	test -d $(DESTDIR)$(PYSITEDIR)/selinux || install -m 755 -d $(DESTDIR)$(PYSITEDIR)/selinux
++	install -m 755 $(SWIGSO) $(DESTDIR)$(PYSITEDIR)/_selinux$(PYCEXT)
++	install -m 755 $(AUDIT2WHYSO) $(DESTDIR)$(PYSITEDIR)/selinux/audit2why$(PYCEXT)
++	install -m 644 $(SWIGPYOUT) $(DESTDIR)$(PYSITEDIR)/selinux/__init__.py
+ 
+ install-rubywrap: rubywrap
+-	test -d $(RUBYINSTALL) || install -m 755 -d $(RUBYINSTALL) 
+-	install -m 755 $(SWIGRUBYSO) $(RUBYINSTALL)/selinux.so
++	test -d $(DESTDIR)$(RUBYINSTALL) || install -m 755 -d $(DESTDIR)$(RUBYINSTALL) 
++	install -m 755 $(SWIGRUBYSO) $(DESTDIR)$(RUBYINSTALL)/selinux.so
+ 
+ relabel:
+-	/sbin/restorecon $(SHLIBDIR)/$(LIBSO)
++	/sbin/restorecon $(DESTDIR)$(SHLIBDIR)/$(LIBSO)
+ 
+ clean-pywrap:
+ 	-rm -f $(SWIGLOBJ) $(SWIGSO) $(AUDIT2WHYLOBJ) $(AUDIT2WHYSO)
 diff --git libselinux-2.7/src/avc.c libselinux-2.7/src/avc.c
 index 96b2678..5230efd 100644
 --- libselinux-2.7/src/avc.c
@@ -227,10 +407,17 @@ index 52707d0..0cbe12d 100644
  		char * ccontext = NULL;
  		int err = errno;
 diff --git libselinux-2.7/src/libselinux.pc.in libselinux-2.7/src/libselinux.pc.in
-index 2cd04d3..2e90a84 100644
+index 2cd04d3..7c66b1f 100644
 --- libselinux-2.7/src/libselinux.pc.in
 +++ libselinux-2.7/src/libselinux.pc.in
-@@ -7,6 +7,6 @@ Name: libselinux
+@@ -1,12 +1,12 @@
+ prefix=@prefix@
+ exec_prefix=${prefix}
+-libdir=${exec_prefix}/@libdir@
++libdir=@libdir@
+ includedir=@includedir@
+ 
+ Name: libselinux
  Description: SELinux utility library
  Version: @VERSION@
  URL: http://userspace.selinuxproject.org/
@@ -277,6 +464,31 @@ index d05969c..3f0200e 100644
  	if (rc < 0 && errno == ENOTSUP) {
  		char * ccontext = NULL;
  		int err = errno;
+diff --git libselinux-2.7/utils/Makefile libselinux-2.7/utils/Makefile
+index eb4851a..d06ffd6 100644
+--- libselinux-2.7/utils/Makefile
++++ libselinux-2.7/utils/Makefile
+@@ -1,8 +1,6 @@
+ # Installation directories.
+-PREFIX ?= $(DESTDIR)/usr
+-LIBDIR ?= $(PREFIX)/lib
++PREFIX ?= /usr
+ SBINDIR ?= $(PREFIX)/sbin
+-INCLUDEDIR ?= $(PREFIX)/include
+ 
+ OS ?= $(shell uname)
+ 
+@@ -63,8 +61,8 @@ sefcontext_compile: sefcontext_compile.o ../src/regex.o
+ all: $(TARGETS)
+ 
+ install: all
+-	-mkdir -p $(SBINDIR)
+-	install -m 755 $(TARGETS) $(SBINDIR)
++	-mkdir -p $(DESTDIR)$(SBINDIR)
++	install -m 755 $(TARGETS) $(DESTDIR)$(SBINDIR)
+ 
+ clean:
+ 	rm -f $(TARGETS) *.o *~
 diff --git libselinux-2.7/utils/matchpathcon.c libselinux-2.7/utils/matchpathcon.c
 index 67e4a43..9756d7d 100644
 --- libselinux-2.7/utils/matchpathcon.c
diff --git a/libselinux.spec b/libselinux.spec
index 37609e2..5d6dc97 100644
--- a/libselinux.spec
+++ b/libselinux.spec
@@ -3,13 +3,13 @@
 %endif
 
 %define ruby_inc %(pkg-config --cflags ruby)
-%define libsepolver 2.7-3
+%define libsepolver 2.7-5
 %{!?python_sitearch: %define python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib(1)")}
 
 Summary: SELinux library and simple utilities
 Name: libselinux
 Version: 2.7
-Release: 11%{?dist}
+Release: 12%{?dist}
 License: Public Domain
 # https://github.com/SELinuxProject/selinux/wiki/Releases
 Source: https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20170804/libselinux-2.7.tar.gz
@@ -19,7 +19,7 @@ Url: https://github.com/SELinuxProject/selinux/wiki
 # download https://raw.githubusercontent.com/fedora-selinux/scripts/master/selinux/make-fedora-selinux-patch.sh
 # run:
 # $ VERSION=2.7 ./make-fedora-selinux-patch.sh libselinux
-# HEAD https://github.com/fedora-selinux/selinux/commit/4247fad665261169b430895f0ab10f56eb33dd10
+# HEAD https://github.com/fedora-selinux/selinux/commit/4e253a0231ca085df03b55c4c0490ad6a0e261eb
 Patch1: libselinux-fedora.patch
 BuildRequires: gcc
 BuildRequires: python2 python2-devel ruby-devel ruby libsepol-static >= %{libsepolver} swig pcre2-devel xz-devel
@@ -150,9 +150,9 @@ InstallPythonWrapper() {
 
   make \
     PYTHON=$BinaryName \
-    DESTDIR="%{buildroot}" LIBDIR="%{buildroot}%{_libdir}" \
-    SHLIBDIR="%{buildroot}/%{_lib}" BINDIR="%{buildroot}%{_bindir}" \
-    SBINDIR="%{buildroot}%{_sbindir}" \
+    DESTDIR="%{buildroot}" LIBDIR="%{_libdir}" \
+    SHLIBDIR="%{_lib}" BINDIR="%{_bindir}" \
+    SBINDIR="%{_sbindir}" \
     LIBSEPOLA="%{_libdir}/libsepol.a" \
     install-pywrap
 }
@@ -170,7 +170,7 @@ InstallPythonWrapper %{__python}
 InstallPythonWrapper %{__python3}
 %endif # with_python3
 
-make DESTDIR="%{buildroot}" LIBDIR="%{buildroot}%{_libdir}" SHLIBDIR="%{buildroot}%{_libdir}" BINDIR="%{buildroot}%{_bindir}" SBINDIR="%{buildroot}%{_sbindir}" RUBYINSTALL=%{buildroot}%{ruby_vendorarchdir} install install-rubywrap
+make DESTDIR="%{buildroot}" LIBDIR="%{_libdir}" SHLIBDIR="%{_libdir}" BINDIR="%{_bindir}" SBINDIR="%{_sbindir}" RUBYINSTALL=%{ruby_vendorarchdir} install install-rubywrap
 
 # Nuke the files we don't want to distribute
 rm -f %{buildroot}%{_sbindir}/compute_*
@@ -244,6 +244,10 @@ rm -f %{buildroot}%{_mandir}/man8/togglesebool*
 %{ruby_vendorarchdir}/selinux.so
 
 %changelog
+* Tue Mar 13 2018 Petr Lautrbach <plautrba@redhat.com> - 2.7-12
+- Correct manpages regarding removable_context
+- build: follow standard semantics for DESTDIR and PREFIX
+
 * Fri Feb 09 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2.7-11
 - Escape macros in %%changelog