diff --git a/.gitignore b/.gitignore
index 85cfc2e..1783a9f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,5 @@
 /usbguard-0.7.1.tar.gz
 /usbguard-0.7.2.tar.gz
 /usbguard-0.7.6.tar.gz
+/usbguard-selinux-0.0.1.tar.gz
+/usbguard-selinux-0.0.2.tar.gz
diff --git a/sources b/sources
index 3f72679..a2586cd 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 SHA512 (usbguard-0.7.6.tar.gz) = 0b0d42276e48baac2dc1f9031eec25e3f622a8d6178cb0400b97c7d32005bfa158b60fd286fdc66206a8684658fefaf6389ef93511e942f025e75671d7455628
+SHA512 (usbguard-selinux-0.0.2.tar.gz) = b0e88b8c7022c2fd8874af5f5c70342e9c27093f15c56a058e24c6515775d4de3d347a7a6d3b32e20fba6be347439ae7438176c9e1ceebf06a5f372697a2aeec
diff --git a/usbguard.spec b/usbguard.spec
index 14f0611..3704900 100644
--- a/usbguard.spec
+++ b/usbguard.spec
@@ -1,13 +1,18 @@
+%global selinuxtype targeted
+%global moduletype contrib
+%define semodule_version 0.0.2
+
 Name:           usbguard
 Version:        0.7.6
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A tool for implementing USB device usage policy
 License:        GPLv2+
 ## Not installed
 # src/ThirdParty/Catch: Boost Software License - Version 1.0
 URL:            https://usbguard.github.io/
 Source0:        https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz
-Source1:        usbguard-daemon.conf
+Source1:        https://github.com/USBGuard/usbguard/releases/download/%{name}-selinux-%{semodule_version}/%{name}-selinux-%{semodule_version}.tar.gz
+Source2:        usbguard-daemon.conf
 
 Requires: systemd
 Requires(post): systemd
@@ -15,6 +20,7 @@ Requires(preun): systemd
 Requires(postun): systemd
 Requires(post): /sbin/ldconfig
 Requires(postun): /sbin/ldconfig
+Recommends: %{name}-selinux
 
 BuildRequires: gcc
 BuildRequires: gcc-c++
@@ -75,10 +81,26 @@ Requires:       polkit
 The %{name}-dbus package contains an optional component that provides
 a D-Bus interface to the USBGuard daemon component.
 
+%package        selinux
+Summary:        USBGuard selinux
+Group:          Applications/System
+Requires:       %{name} = %{version}-%{release}
+BuildRequires:  selinux-policy
+BuildRequires:  selinux-policy-devel
+BuildArch: noarch
+%{?selinux_requires}
 
+%description    selinux
+The %{name}-selinux package contains selinux policy for the USBGuard
+daemon.
+
+# usbguard
 %prep
 %setup -q
 
+# selinux
+%setup -q -D -T -a 1
+
 # Remove bundled library sources before build
 rm -rf src/ThirdParty/{Catch,PEGTL}
 
@@ -96,9 +118,18 @@ autoreconf -i -v --no-recursive ./
 
 make %{?_smp_mflags}
 
+# selinux
+pushd %{name}-selinux-%{semodule_version}
+make
+popd
+
 %check
 make check
 
+# selinux
+%pre selinux
+%selinux_relabel_pre -s %{selinuxtype}
+
 %install
 make install INSTALL='install -p' DESTDIR=%{buildroot}
 
@@ -107,6 +138,12 @@ mkdir -p %{buildroot}%{_sysconfdir}/usbguard
 mkdir -p %{buildroot}%{_sysconfdir}/usbguard/IPCAccessControl.d
 install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf
 
+# selinux
+install -d %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
+install -m 0644 %{name}-selinux-%{semodule_version}/%{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
+install -d -p %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}
+install -p -m 644 %{name}-selinux-%{semodule_version}/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if
+
 # Cleanup
 find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';'
 
@@ -165,8 +202,28 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';'
 %postun dbus
 %systemd_postun_with_restart usbguard-dbus.service
 
+%files selinux
+%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
+%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
+%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if
+
+%post selinux
+%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
+
+%postun selinux
+if [ $1 -eq 0 ]; then
+    %selinux_modules_uninstall -s %{selinuxtype} %{name}
+fi
+
+%posttrans selinux
+%selinux_relabel_post -s %{selinuxtype}
+
+
 
 %changelog
+* Wed Nov 13 2019 Radovan Sroka <rsroka@redhat.com> - 0.7.6-2
+- added selinux subpackage
+
 * Mon Nov 11 2019 Radovan Sroka <rsroka@redhat.com> - 0.7.6-1
 - rebase to 0.7.6
 - removed usbguard-applet subpackage which is not in upstream anymore