diff --git a/lib/puppet/util/selinux.rb b/lib/puppet/util/selinux.rb
index feb5c3266..a8f04e6b8 100644
--- a/lib/puppet/util/selinux.rb
+++ b/lib/puppet/util/selinux.rb
@@ -1,222 +1,222 @@
 # Provides utility functions to help interface Puppet to SELinux.
 #
 # This requires the very new SELinux Ruby bindings.  These bindings closely
 # mirror the SELinux C library interface.
 #
 # Support for the command line tools is not provided because the performance
 # was abysmal.  At this time (2008-11-02) the only distribution providing
 # these Ruby SELinux bindings which I am aware of is Fedora (in libselinux-ruby).
 
 Puppet.features.selinux? # check, but continue even if it's not
 
 require 'pathname'
 
 module Puppet::Util::SELinux
 
   def selinux_support?
     return false unless defined?(Selinux)
     if Selinux.is_selinux_enabled == 1
       return true
     end
     false
   end
 
   # Retrieve and return the full context of the file.  If we don't have
   # SELinux support or if the SELinux call fails then return nil.
   def get_selinux_current_context(file)
     return nil unless selinux_support?
     retval = Selinux.lgetfilecon(file)
     if retval == -1
       return nil
     end
     retval[1]
   end
 
   # Retrieve and return the default context of the file.  If we don't have
   # SELinux support or if the SELinux call fails to file a default then return nil.
   def get_selinux_default_context(file)
     return nil unless selinux_support?
     # If the filesystem has no support for SELinux labels, return a default of nil
     # instead of what matchpathcon would return
     return nil unless selinux_label_support?(file)
     # If the file exists we should pass the mode to matchpathcon for the most specific
     # matching.  If not, we can pass a mode of 0.
     begin
       filestat = file_lstat(file)
       mode = filestat.mode
     rescue Errno::EACCES, Errno::ENOENT
       mode = 0
     end
 
     retval = Selinux.matchpathcon(file, mode)
     if retval == -1
       return nil
     end
     retval[1]
   end
 
   # Take the full SELinux context returned from the tools and parse it
   # out to the three (or four) component parts.  Supports :seluser, :selrole,
   # :seltype, and on systems with range support, :selrange.
   def parse_selinux_context(component, context)
     if context.nil? or context == "unlabeled"
       return nil
     end
-    unless context =~ /^([a-z0-9_]+):([a-z0-9_]+):([a-zA-Z0-9_]+)(?::([a-zA-Z0-9:,._-]+))?/
+    unless context =~ /^([^:]+):([^:]+):([^:]+)(?::([a-zA-Z0-9:,._-]+))?/
       raise Puppet::Error, "Invalid context to parse: #{context}"
     end
     ret = {
       :seluser => $1,
       :selrole => $2,
       :seltype => $3,
       :selrange => $4,
     }
     ret[component]
   end
 
   # This updates the actual SELinux label on the file.  You can update
   # only a single component or update the entire context.
   # The caveat is that since setting a partial context makes no sense the
   # file has to already exist.  Puppet (via the File resource) will always
   # just try to set components, even if all values are specified by the manifest.
   # I believe that the OS should always provide at least a fall-through context
   # though on any well-running system.
   def set_selinux_context(file, value, component = false)
     return nil unless selinux_support? && selinux_label_support?(file)
 
     if component
       # Must first get existing context to replace a single component
       context = Selinux.lgetfilecon(file)[1]
       if context == -1
         # We can't set partial context components when no context exists
         # unless/until we can find a way to make Puppet call this method
         # once for all selinux file label attributes.
         Puppet.warning "Can't set SELinux context on file unless the file already has some kind of context"
         return nil
       end
       context = context.split(':')
       case component
         when :seluser
           context[0] = value
         when :selrole
           context[1] = value
         when :seltype
           context[2] = value
         when :selrange
           context[3] = value
         else
           raise ArguementError, "set_selinux_context component must be one of :seluser, :selrole, :seltype, or :selrange"
       end
       context = context.join(':')
     else
       context = value
     end
 
     retval = Selinux.lsetfilecon(file, context)
     if retval == 0
       return true
     else
       Puppet.warning "Failed to set SELinux context #{context} on #{file}"
       return false
     end
   end
 
   # Since this call relies on get_selinux_default_context it also needs a
   # full non-relative path to the file.  Fortunately, that seems to be all
   # Puppet uses.  This will set the file's SELinux context to the policy's
   # default context (if any) if it differs from the context currently on
   # the file.
   def set_selinux_default_context(file)
     new_context = get_selinux_default_context(file)
     return nil unless new_context
     cur_context = get_selinux_current_context(file)
     if new_context != cur_context
       set_selinux_context(file, new_context)
       return new_context
     end
     nil
   end
 
   ########################################################################
   # Internal helper methods from here on in, kids.  Don't fiddle.
   private
 
   # Check filesystem a path resides on for SELinux support against
   # whitelist of known-good filesystems.
   # Returns true if the filesystem can support SELinux labels and
   # false if not.
   def selinux_label_support?(file)
     fstype = find_fs(file)
     return false if fstype.nil?
     filesystems = ['ext2', 'ext3', 'ext4', 'gfs', 'gfs2', 'xfs', 'jfs', 'btrfs']
     filesystems.include?(fstype)
   end
 
   # Internal helper function to read and parse /proc/mounts
   def read_mounts
     mounts = ""
     begin
       if File.method_defined? "read_nonblock"
         # If possible we use read_nonblock in a loop rather than read to work-
         # a linux kernel bug.  See ticket #1963 for details.
         mountfh = File.open("/proc/mounts")
         mounts += mountfh.read_nonblock(1024) while true
       else
         # Otherwise we shell out and let cat do it for us
         mountfh = IO.popen("/bin/cat /proc/mounts")
         mounts = mountfh.read
       end
     rescue EOFError
       # that's expected
     rescue
       return nil
     ensure
       mountfh.close if mountfh
     end
 
     mntpoint = {}
 
     # Read all entries in /proc/mounts.  The second column is the
     # mountpoint and the third column is the filesystem type.
     # We skip rootfs because it is always mounted at /
     mounts.each_line do |line|
       params = line.split(' ')
       next if params[2] == 'rootfs'
       mntpoint[params[1]] = params[2]
     end
     mntpoint
   end
 
   # Internal helper function to return which type of filesystem a given file
   # path resides on
   def find_fs(path)
     return nil unless mounts = read_mounts
 
     # cleanpath eliminates useless parts of the path (like '.', or '..', or
     # multiple slashes), without touching the filesystem, and without
     # following symbolic links.  This gives the right (logical) tree to follow
     # while we try and figure out what file-system the target lives on.
     path = Pathname(path).cleanpath
     unless path.absolute?
       raise Puppet::DevError, "got a relative path in SELinux find_fs: #{path}"
     end
 
     # Now, walk up the tree until we find a match for that path in the hash.
     path.ascend do |segment|
       return mounts[segment.to_s] if mounts.has_key?(segment.to_s)
     end
 
     # Should never be reached...
     return mounts['/']
   end
 
   ##
   # file_lstat is an internal, private method to allow precise stubbing and
   # mocking without affecting the rest of the system.
   #
   # @return [File::Stat] File.lstat result
   def file_lstat(path)
     Puppet::FileSystem.lstat(path)
   end
   private :file_lstat
 end
diff --git a/spec/unit/util/selinux_spec.rb b/spec/unit/util/selinux_spec.rb
index b15a1971c..1a8a13a8c 100755
--- a/spec/unit/util/selinux_spec.rb
+++ b/spec/unit/util/selinux_spec.rb
@@ -1,289 +1,293 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
 
 require 'pathname'
 require 'puppet/util/selinux'
 include Puppet::Util::SELinux
 
 unless defined?(Selinux)
   module Selinux
     def self.is_selinux_enabled
       false
     end
   end
 end
 
 describe Puppet::Util::SELinux do
 
   describe "selinux_support?" do
     before do
     end
     it "should return :true if this system has SELinux enabled" do
       Selinux.expects(:is_selinux_enabled).returns 1
       selinux_support?.should be_true
     end
 
     it "should return :false if this system lacks SELinux" do
       Selinux.expects(:is_selinux_enabled).returns 0
       selinux_support?.should be_false
     end
 
     it "should return nil if /proc/mounts does not exist" do
       File.stubs(:open).with("/proc/mounts").raises("No such file or directory - /proc/mounts")
       read_mounts.should == nil
     end
   end
 
   describe "read_mounts" do
     before :each do
       fh = stub 'fh', :close => nil
       File.stubs(:open).with("/proc/mounts").returns fh
       fh.expects(:read_nonblock).times(2).returns("rootfs / rootfs rw 0 0\n/dev/root / ext3 rw,relatime,errors=continue,user_xattr,acl,data=ordered 0 0\n/dev /dev tmpfs rw,relatime,mode=755 0 0\n/proc /proc proc rw,relatime 0 0\n/sys /sys sysfs rw,relatime 0 0\n192.168.1.1:/var/export /mnt/nfs nfs rw,relatime,vers=3,rsize=32768,wsize=32768,namlen=255,hard,nointr,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=192.168.1.1,mountvers=3,mountproto=udp,addr=192.168.1.1 0 0\n").then.raises EOFError
     end
 
     it "should parse the contents of /proc/mounts" do
       read_mounts.should  == {
         '/' => 'ext3',
         '/sys' => 'sysfs',
         '/mnt/nfs' => 'nfs',
         '/proc' => 'proc',
         '/dev' => 'tmpfs' }
     end
   end
 
   describe "filesystem detection" do
     before :each do
       self.stubs(:read_mounts).returns({
         '/'        => 'ext3',
         '/sys'     => 'sysfs',
         '/mnt/nfs' => 'nfs',
         '/proc'    => 'proc',
         '/dev'     => 'tmpfs' })
     end
 
     it "should match a path on / to ext3" do
       find_fs('/etc/puppet/testfile').should == "ext3"
     end
 
     it "should match a path on /mnt/nfs to nfs" do
       find_fs('/mnt/nfs/testfile/foobar').should == "nfs"
     end
 
     it "should return true for a capable filesystem" do
       selinux_label_support?('/etc/puppet/testfile').should be_true
     end
 
     it "should return false for a noncapable filesystem" do
       selinux_label_support?('/mnt/nfs/testfile').should be_false
     end
 
     it "(#8714) don't follow symlinks when determining file systems", :unless => Puppet.features.microsoft_windows? do
       scratch = Pathname(PuppetSpec::Files.tmpdir('selinux'))
 
       self.stubs(:read_mounts).returns({
           '/'             => 'ext3',
           scratch + 'nfs' => 'nfs',
         })
 
       (scratch + 'foo').make_symlink('nfs/bar')
       selinux_label_support?(scratch + 'foo').should be_true
     end
 
     it "should handle files that don't exist" do
       scratch = Pathname(PuppetSpec::Files.tmpdir('selinux'))
       selinux_label_support?(scratch + 'nonesuch').should be_true
     end
   end
 
   describe "get_selinux_current_context" do
     it "should return nil if no SELinux support" do
       self.expects(:selinux_support?).returns false
       get_selinux_current_context("/foo").should be_nil
     end
 
     it "should return a context" do
       self.expects(:selinux_support?).returns true
       Selinux.expects(:lgetfilecon).with("/foo").returns [0, "user_u:role_r:type_t:s0"]
       get_selinux_current_context("/foo").should == "user_u:role_r:type_t:s0"
     end
 
     it "should return nil if lgetfilecon fails" do
       self.expects(:selinux_support?).returns true
       Selinux.expects(:lgetfilecon).with("/foo").returns -1
       get_selinux_current_context("/foo").should be_nil
     end
   end
 
   describe "get_selinux_default_context" do
     it "should return nil if no SELinux support" do
       self.expects(:selinux_support?).returns false
       get_selinux_default_context("/foo").should be_nil
     end
 
     it "should return a context if a default context exists" do
       self.expects(:selinux_support?).returns true
       fstat = stub 'File::Stat', :mode => 0
       Puppet::FileSystem.expects(:lstat).with('/foo').returns(fstat)
       self.expects(:find_fs).with("/foo").returns "ext3"
       Selinux.expects(:matchpathcon).with("/foo", 0).returns [0, "user_u:role_r:type_t:s0"]
 
       get_selinux_default_context("/foo").should == "user_u:role_r:type_t:s0"
     end
 
     it "handles permission denied errors by issuing a warning" do
       self.stubs(:selinux_support?).returns true
       self.stubs(:selinux_label_support?).returns true
       Selinux.stubs(:matchpathcon).with("/root/chuj", 0).returns(-1)
       self.stubs(:file_lstat).with("/root/chuj").raises(Errno::EACCES, "/root/chuj")
 
       get_selinux_default_context("/root/chuj").should be_nil
     end
 
     it "handles no such file or directory errors by issuing a warning" do
       self.stubs(:selinux_support?).returns true
       self.stubs(:selinux_label_support?).returns true
       Selinux.stubs(:matchpathcon).with("/root/chuj", 0).returns(-1)
       self.stubs(:file_lstat).with("/root/chuj").raises(Errno::ENOENT, "/root/chuj")
 
       get_selinux_default_context("/root/chuj").should be_nil
     end
 
     it "should return nil if matchpathcon returns failure" do
       self.expects(:selinux_support?).returns true
       fstat = stub 'File::Stat', :mode => 0
       Puppet::FileSystem.expects(:lstat).with('/foo').returns(fstat)
       self.expects(:find_fs).with("/foo").returns "ext3"
       Selinux.expects(:matchpathcon).with("/foo", 0).returns -1
 
       get_selinux_default_context("/foo").should be_nil
     end
 
     it "should return nil if selinux_label_support returns false" do
       self.expects(:selinux_support?).returns true
       self.expects(:find_fs).with("/foo").returns "nfs"
       get_selinux_default_context("/foo").should be_nil
     end
 
   end
 
   describe "parse_selinux_context" do
     it "should return nil if no context is passed" do
       parse_selinux_context(:seluser, nil).should be_nil
     end
 
     it "should return nil if the context is 'unlabeled'" do
       parse_selinux_context(:seluser, "unlabeled").should be_nil
     end
 
     it "should return the user type when called with :seluser" do
       parse_selinux_context(:seluser, "user_u:role_r:type_t:s0").should == "user_u"
+      parse_selinux_context(:seluser, "user-withdash_u:role_r:type_t:s0").should == "user-withdash_u"
     end
 
     it "should return the role type when called with :selrole" do
       parse_selinux_context(:selrole, "user_u:role_r:type_t:s0").should == "role_r"
+      parse_selinux_context(:selrole, "user_u:role-withdash_r:type_t:s0").should == "role-withdash_r"
     end
 
     it "should return the type type when called with :seltype" do
       parse_selinux_context(:seltype, "user_u:role_r:type_t:s0").should == "type_t"
+      parse_selinux_context(:seltype, "user_u:role_r:type-withdash_t:s0").should == "type-withdash_t"
     end
 
     it "should return nil for :selrange when no range is returned" do
       parse_selinux_context(:selrange, "user_u:role_r:type_t").should be_nil
     end
 
     it "should return the range type when called with :selrange" do
       parse_selinux_context(:selrange, "user_u:role_r:type_t:s0").should == "s0"
+      parse_selinux_context(:selrange, "user_u:role_r:type-withdash_t:s0").should == "s0"
     end
 
     describe "with a variety of SELinux range formats" do
       ['s0', 's0:c3', 's0:c3.c123', 's0:c3,c5,c8', 'TopSecret', 'TopSecret,Classified', 'Patient_Record'].each do |range|
         it "should parse range '#{range}'" do
           parse_selinux_context(:selrange, "user_u:role_r:type_t:#{range}").should == range
         end
       end
     end
   end
 
   describe "set_selinux_context" do
     before :each do
       fh = stub 'fh', :close => nil
       File.stubs(:open).with("/proc/mounts").returns fh
       fh.stubs(:read_nonblock).returns(
         "rootfs / rootfs rw 0 0\n/dev/root / ext3 rw,relatime,errors=continue,user_xattr,acl,data=ordered 0 0\n"+
         "/dev /dev tmpfs rw,relatime,mode=755 0 0\n/proc /proc proc rw,relatime 0 0\n"+
         "/sys /sys sysfs rw,relatime 0 0\n"
         ).then.raises EOFError
     end
 
     it "should return nil if there is no SELinux support" do
       self.expects(:selinux_support?).returns false
       set_selinux_context("/foo", "user_u:role_r:type_t:s0").should be_nil
     end
 
     it "should return nil if selinux_label_support returns false" do
       self.expects(:selinux_support?).returns true
       self.expects(:selinux_label_support?).with("/foo").returns false
       set_selinux_context("/foo", "user_u:role_r:type_t:s0").should be_nil
     end
 
     it "should use lsetfilecon to set a context" do
       self.expects(:selinux_support?).returns true
       Selinux.expects(:lsetfilecon).with("/foo", "user_u:role_r:type_t:s0").returns 0
       set_selinux_context("/foo", "user_u:role_r:type_t:s0").should be_true
     end
 
     it "should use lsetfilecon to set user_u user context" do
       self.expects(:selinux_support?).returns true
       Selinux.expects(:lgetfilecon).with("/foo").returns [0, "foo:role_r:type_t:s0"]
       Selinux.expects(:lsetfilecon).with("/foo", "user_u:role_r:type_t:s0").returns 0
       set_selinux_context("/foo", "user_u", :seluser).should be_true
     end
 
     it "should use lsetfilecon to set role_r role context" do
       self.expects(:selinux_support?).returns true
       Selinux.expects(:lgetfilecon).with("/foo").returns [0, "user_u:foo:type_t:s0"]
       Selinux.expects(:lsetfilecon).with("/foo", "user_u:role_r:type_t:s0").returns 0
       set_selinux_context("/foo", "role_r", :selrole).should be_true
     end
 
     it "should use lsetfilecon to set type_t type context" do
       self.expects(:selinux_support?).returns true
       Selinux.expects(:lgetfilecon).with("/foo").returns [0, "user_u:role_r:foo:s0"]
       Selinux.expects(:lsetfilecon).with("/foo", "user_u:role_r:type_t:s0").returns 0
       set_selinux_context("/foo", "type_t", :seltype).should be_true
     end
 
     it "should use lsetfilecon to set s0:c3,c5 range context" do
       self.expects(:selinux_support?).returns true
       Selinux.expects(:lgetfilecon).with("/foo").returns [0, "user_u:role_r:type_t:s0"]
       Selinux.expects(:lsetfilecon).with("/foo", "user_u:role_r:type_t:s0:c3,c5").returns 0
       set_selinux_context("/foo", "s0:c3,c5", :selrange).should be_true
     end
   end
 
   describe "set_selinux_default_context" do
     it "should return nil if there is no SELinux support" do
       self.expects(:selinux_support?).returns false
       set_selinux_default_context("/foo").should be_nil
     end
 
     it "should return nil if no default context exists" do
       self.expects(:get_selinux_default_context).with("/foo").returns nil
       set_selinux_default_context("/foo").should be_nil
     end
 
     it "should do nothing and return nil if the current context matches the default context" do
       self.expects(:get_selinux_default_context).with("/foo").returns "user_u:role_r:type_t"
       self.expects(:get_selinux_current_context).with("/foo").returns "user_u:role_r:type_t"
       set_selinux_default_context("/foo").should be_nil
     end
 
     it "should set and return the default context if current and default do not match" do
       self.expects(:get_selinux_default_context).with("/foo").returns "user_u:role_r:type_t"
       self.expects(:get_selinux_current_context).with("/foo").returns "olduser_u:role_r:type_t"
       self.expects(:set_selinux_context).with("/foo", "user_u:role_r:type_t").returns true
       set_selinux_default_context("/foo").should == "user_u:role_r:type_t"
     end
   end
 
 end