diff --git a/lib/puppet/type/user.rb b/lib/puppet/type/user.rb
index ba91d600d..4e79971b7 100755
--- a/lib/puppet/type/user.rb
+++ b/lib/puppet/type/user.rb
@@ -1,546 +1,546 @@
 require 'etc'
 require 'facter'
 require 'puppet/property/list'
 require 'puppet/property/ordered_list'
 require 'puppet/property/keyvalue'
 
 module Puppet
   newtype(:user) do
     @doc = "Manage users.  This type is mostly built to manage system
       users, so it is lacking some features useful for managing normal
       users.
 
       This resource type uses the prescribed native tools for creating
       groups and generally uses POSIX APIs for retrieving information
       about them.  It does not directly modify `/etc/passwd` or anything.
 
       **Autorequires:** If Puppet is managing the user's primary group (as
       provided in the `gid` attribute), the user resource will autorequire
       that group. If Puppet is managing any role accounts corresponding to the
       user's roles, the user resource will autorequire those role accounts."
 
     feature :allows_duplicates,
       "The provider supports duplicate users with the same UID."
 
     feature :manages_homedir,
       "The provider can create and remove home directories."
 
     feature :manages_passwords,
       "The provider can modify user passwords, by accepting a password
       hash."
 
     feature :manages_password_age,
       "The provider can set age requirements and restrictions for
       passwords."
 
     feature :manages_password_salt,
       "The provider can set a password salt. This is for providers that
        implement PBKDF2 passwords with salt properties."
 
     feature :manages_solaris_rbac,
       "The provider can manage roles and normal users"
 
     feature :manages_expiry,
       "The provider can manage the expiry date for a user."
 
    feature :system_users,
      "The provider allows you to create system users with lower UIDs."
 
     feature :manages_aix_lam,
       "The provider can manage AIX Loadable Authentication Module (LAM) system."
 
     newproperty(:ensure, :parent => Puppet::Property::Ensure) do
       newvalue(:present, :event => :user_created) do
         provider.create
       end
 
       newvalue(:absent, :event => :user_removed) do
         provider.delete
       end
 
       newvalue(:role, :event => :role_created, :required_features => :manages_solaris_rbac) do
         provider.create_role
       end
 
       desc "The basic state that the object should be in."
 
       # If they're talking about the thing at all, they generally want to
       # say it should exist.
       defaultto do
         if @resource.managed?
           :present
         else
           nil
         end
       end
 
       def retrieve
         if provider.exists?
           if provider.respond_to?(:is_role?) and provider.is_role?
             return :role
           else
             return :present
           end
         else
           return :absent
         end
       end
     end
 
     newproperty(:home) do
       desc "The home directory of the user.  The directory must be created
         separately and is not currently checked for existence."
     end
 
     newproperty(:uid) do
       desc "The user ID; must be specified numerically. If no user ID is
         specified when creating a new user, then one will be chosen
         automatically. This will likely result in the same user having
         different UIDs on different systems, which is not recommended. This is
         especially noteworthy when managing the same user on both Darwin and
         other platforms, since Puppet does UID generation on Darwin, but
         the underlying tools do so on other platforms.
 
         On Windows, this property is read-only and will return the user's
         security identifier (SID)."
 
       munge do |value|
         case value
         when String
           if value =~ /^[-0-9]+$/
             value = Integer(value)
           end
         end
 
         return value
       end
     end
 
     newproperty(:gid) do
       desc "The user's primary group.  Can be specified numerically or by name.
 
         Note that users on Windows systems do not have a primary group; manage groups
         with the `groups` attribute instead."
 
       munge do |value|
         if value.is_a?(String) and value =~ /^[-0-9]+$/
           Integer(value)
         else
           value
         end
       end
 
       def insync?(is)
         # We know the 'is' is a number, so we need to convert the 'should' to a number,
         # too.
         @should.each do |value|
           return true if number = Puppet::Util.gid(value) and is == number
         end
 
         false
       end
 
       def sync
         found = false
         @should.each do |value|
           if number = Puppet::Util.gid(value)
             provider.gid = number
             found = true
             break
           end
         end
 
         fail "Could not find group(s) #{@should.join(",")}" unless found
 
         # Use the default event.
       end
     end
 
     newproperty(:comment) do
       desc "A description of the user.  Generally the user's full name."
     end
 
     newproperty(:shell) do
       desc "The user's login shell.  The shell must exist and be
         executable.
 
         This attribute cannot be managed on Windows systems."
     end
 
     newproperty(:password, :required_features => :manages_passwords) do
       desc %q{The user's password, in whatever encrypted format the local
         system requires.
 
         * Most modern Unix-like systems use salted SHA1 password hashes. You can use
           Puppet's built-in `sha1` function to generate a hash from a password.
         * Mac OS X 10.5 and 10.6 also use salted SHA1 hashes.
         * Mac OS X 10.7 (Lion) uses salted SHA512 hashes. The Puppet Labs [stdlib][]
           module contains a `str2saltedsha512` function which can generate password
           hashes for Lion.
         * Windows passwords can only be managed in cleartext, as there is no Windows API
           for setting the password hash.
 
         [stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/
 
         Be sure to enclose any value that includes a dollar sign ($) in single
         quotes (') to avoid accidental variable interpolation.}
 
       validate do |value|
         raise ArgumentError, "Passwords cannot include ':'" if value.is_a?(String) and value.include?(":")
       end
 
       def change_to_s(currentvalue, newvalue)
         if currentvalue == :absent
           return "created password"
         else
           return "changed password"
         end
       end
 
       def is_to_s( currentvalue )
         return '[old password hash redacted]'
       end
       def should_to_s( newvalue )
         return '[new password hash redacted]'
       end
 
     end
 
     newproperty(:password_min_age, :required_features => :manages_password_age) do
       desc "The minimum number of days a password must be used before it may be changed."
 
       munge do |value|
         case value
         when String
           Integer(value)
         else
           value
         end
       end
 
       validate do |value|
         if value.to_s !~ /^-?\d+$/
           raise ArgumentError, "Password minimum age must be provided as a number."
         end
       end
     end
 
     newproperty(:password_max_age, :required_features => :manages_password_age) do
       desc "The maximum number of days a password may be used before it must be changed."
 
       munge do |value|
         case value
         when String
           Integer(value)
         else
           value
         end
       end
 
       validate do |value|
         if value.to_s !~ /^-?\d+$/
           raise ArgumentError, "Password maximum age must be provided as a number."
         end
       end
     end
 
     newproperty(:groups, :parent => Puppet::Property::List) do
       desc "The groups to which the user belongs.  The primary group should
         not be listed, and groups should be identified by name rather than by
         GID.  Multiple groups should be specified as an array."
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Group names must be provided, not GID numbers."
         end
         raise ArgumentError, "Group names must be provided as an array, not a comma-separated list." if value.include?(",")
         raise ArgumentError, "Group names must not be empty. If you want to specify \"no groups\" pass an empty array" if value.empty?
       end
     end
 
     newparam(:name) do
       desc "The user name. While naming limitations vary by operating system,
         it is advisable to restrict names to the lowest common denominator,
         which is a maximum of 8 characters beginning with a letter.
 
         Note that Puppet considers user names to be case-sensitive, regardless
         of the platform's own rules; be sure to always use the same case when
         referring to a given user."
       isnamevar
     end
 
     newparam(:membership) do
       desc "Whether specified groups should be considered the **complete list**
         (`inclusive`) or the **minimum list** (`minimum`) of groups to which
         the user belongs. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newparam(:system, :boolean => true) do
       desc "Whether the user is a system user, according to the OS's criteria;
       on most platforms, a UID less than or equal to 500 indicates a system
       user. Defaults to `false`."
 
       newvalues(:true, :false)
 
       defaultto false
     end
 
     newparam(:allowdupe, :boolean => true) do
       desc "Whether to allow duplicate UIDs. Defaults to `false`."
 
       newvalues(:true, :false)
 
       defaultto false
     end
 
     newparam(:managehome, :boolean => true) do
       desc "Whether to manage the home directory when managing the user.
         This will create the home directory when `ensure => present`, and
         delete the home directory when `ensure => absent`. Defaults to `false`."
 
       newvalues(:true, :false)
 
       defaultto false
 
       validate do |val|
         if val.to_s == "true"
-          raise ArgumentError, "User provider #{provider.class.name} can not manage home directories" unless provider.class.manages_homedir?
+          raise ArgumentError, "User provider #{provider.class.name} can not manage home directories" if provider and not provider.class.manages_homedir?
         end
       end
     end
 
     newproperty(:expiry, :required_features => :manages_expiry) do
       desc "The expiry date for this user. Must be provided in
            a zero-padded YYYY-MM-DD format --- e.g. 2010-02-19."
 
       validate do |value|
         if value !~ /^\d{4}-\d{2}-\d{2}$/
           raise ArgumentError, "Expiry dates must be YYYY-MM-DD"
         end
       end
     end
 
     # Autorequire the group, if it's around
     autorequire(:group) do
       autos = []
 
       if obj = @parameters[:gid] and groups = obj.shouldorig
         groups = groups.collect { |group|
           if group =~ /^\d+$/
             Integer(group)
           else
             group
           end
         }
         groups.each { |group|
           case group
           when Integer
             if resource = catalog.resources.find { |r| r.is_a?(Puppet::Type.type(:group)) and r.should(:gid) == group }
               autos << resource
             end
           else
             autos << group
           end
         }
       end
 
       if obj = @parameters[:groups] and groups = obj.should
         autos += groups.split(",")
       end
 
       autos
     end
 
     # Provide an external hook.  Yay breaking out of APIs.
     def exists?
       provider.exists?
     end
 
     def retrieve
       absent = false
       properties.inject({}) { |prophash, property|
         current_value = :absent
 
         if absent
           prophash[property] = :absent
         else
           current_value = property.retrieve
           prophash[property] = current_value
         end
 
         if property.name == :ensure and current_value == :absent
           absent = true
         end
         prophash
       }
     end
 
     newproperty(:roles, :parent => Puppet::Property::List, :required_features => :manages_solaris_rbac) do
       desc "The roles the user has.  Multiple roles should be
         specified as an array."
 
       def membership
         :role_membership
       end
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Role names must be provided, not numbers"
         end
         raise ArgumentError, "Role names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     #autorequire the roles that the user has
     autorequire(:user) do
       reqs = []
 
       if roles_property = @parameters[:roles] and roles = roles_property.should
         reqs += roles.split(',')
       end
 
       reqs
     end
 
     newparam(:role_membership) do
       desc "Whether specified roles should be considered the **complete list**
         (`inclusive`) or the **minimum list** (`minimum`) of roles the user
         has. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:auths, :parent => Puppet::Property::List, :required_features => :manages_solaris_rbac) do
       desc "The auths the user has.  Multiple auths should be
         specified as an array."
 
       def membership
         :auth_membership
       end
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Auth names must be provided, not numbers"
         end
         raise ArgumentError, "Auth names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     newparam(:auth_membership) do
       desc "Whether specified auths should be considered the **complete list**
         (`inclusive`) or the **minimum list** (`minimum`) of auths the user
         has. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:profiles, :parent => Puppet::Property::OrderedList, :required_features => :manages_solaris_rbac) do
       desc "The profiles the user has.  Multiple profiles should be
         specified as an array."
 
       def membership
         :profile_membership
       end
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Profile names must be provided, not numbers"
         end
         raise ArgumentError, "Profile names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     newparam(:profile_membership) do
       desc "Whether specified roles should be treated as the **complete list**
         (`inclusive`) or the **minimum list** (`minimum`) of roles
         of which the user is a member. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:keys, :parent => Puppet::Property::KeyValue, :required_features => :manages_solaris_rbac) do
       desc "Specify user attributes in an array of key = value pairs."
 
       def membership
         :key_membership
       end
 
       validate do |value|
         raise ArgumentError, "Key/value pairs must be separated by an =" unless value.include?("=")
       end
     end
 
     newparam(:key_membership) do
       desc "Whether specified key/value pairs should be considered the
         **complete list** (`inclusive`) or the **minimum list** (`minimum`) of
         the user's attributes. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:project, :required_features => :manages_solaris_rbac) do
       desc "The name of the project associated with a user."
     end
 
     newparam(:ia_load_module, :required_features => :manages_aix_lam) do
       desc "The name of the I&A module to use to manage this user."
     end
 
     newproperty(:attributes, :parent => Puppet::Property::KeyValue, :required_features => :manages_aix_lam) do
       desc "Specify AIX attributes for the user in an array of attribute = value pairs."
 
       def membership
         :attribute_membership
       end
 
       def delimiter
         " "
       end
 
       validate do |value|
         raise ArgumentError, "Attributes value pairs must be separated by an =" unless value.include?("=")
       end
     end
 
     newparam(:attribute_membership) do
       desc "Whether specified attribute value pairs should be treated as the
         **complete list** (`inclusive`) or the **minimum list** (`minimum`) of
         attribute/value pairs for the user. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:salt, :required_features => :manages_password_salt) do
       desc "This is the 32 byte salt used to generate the PBKDF2 password used in
             OS X"
     end
 
     newproperty(:iterations, :required_features => :manages_password_salt) do
       desc "This is the number of iterations of a chained computation of the
             password hash (http://en.wikipedia.org/wiki/PBKDF2).  This parameter
             is used in OS X"
 
       munge do |value|
         if value.is_a?(String) and value =~/^[-0-9]+$/
           Integer(value)
         else
           value
         end
       end
     end
   end
 end
diff --git a/lib/puppet/util/selinux.rb b/lib/puppet/util/selinux.rb
index 315af7db6..53ab664f0 100644
--- a/lib/puppet/util/selinux.rb
+++ b/lib/puppet/util/selinux.rb
@@ -1,211 +1,227 @@
 # Provides utility functions to help interface Puppet to SELinux.
 #
 # This requires the very new SELinux Ruby bindings.  These bindings closely
 # mirror the SELinux C library interface.
 #
 # Support for the command line tools is not provided because the performance
 # was abysmal.  At this time (2008-11-02) the only distribution providing
 # these Ruby SELinux bindings which I am aware of is Fedora (in libselinux-ruby).
 
 Puppet.features.selinux? # check, but continue even if it's not
 
 require 'pathname'
 
 module Puppet::Util::SELinux
 
   def selinux_support?
     return false unless defined?(Selinux)
     if Selinux.is_selinux_enabled == 1
       return true
     end
     false
   end
 
   # Retrieve and return the full context of the file.  If we don't have
   # SELinux support or if the SELinux call fails then return nil.
   def get_selinux_current_context(file)
     return nil unless selinux_support?
     retval = Selinux.lgetfilecon(file)
     if retval == -1
       return nil
     end
     retval[1]
   end
 
   # Retrieve and return the default context of the file.  If we don't have
   # SELinux support or if the SELinux call fails to file a default then return nil.
   def get_selinux_default_context(file)
     return nil unless selinux_support?
     # If the filesystem has no support for SELinux labels, return a default of nil
     # instead of what matchpathcon would return
     return nil unless selinux_label_support?(file)
     # If the file exists we should pass the mode to matchpathcon for the most specific
     # matching.  If not, we can pass a mode of 0.
     begin
-      filestat = File.lstat(file)
+      filestat = file_lstat(file)
+    rescue Errno::EACCES, Errno::ENOENT => detail
+      warning "Could not stat; #{detail}"
+    end
+
+    if filestat
       mode = filestat.mode
-    rescue Errno::ENOENT
+    else
       mode = 0
     end
+
     retval = Selinux.matchpathcon(file, mode)
     if retval == -1
       return nil
     end
     retval[1]
   end
 
   # Take the full SELinux context returned from the tools and parse it
   # out to the three (or four) component parts.  Supports :seluser, :selrole,
   # :seltype, and on systems with range support, :selrange.
   def parse_selinux_context(component, context)
     if context.nil? or context == "unlabeled"
       return nil
     end
     unless context =~ /^([a-z0-9_]+):([a-z0-9_]+):([a-zA-Z0-9_]+)(?::([a-zA-Z0-9:,._-]+))?/
       raise Puppet::Error, "Invalid context to parse: #{context}"
     end
     ret = {
       :seluser => $1,
       :selrole => $2,
       :seltype => $3,
       :selrange => $4,
     }
     ret[component]
   end
 
   # This updates the actual SELinux label on the file.  You can update
   # only a single component or update the entire context.
   # The caveat is that since setting a partial context makes no sense the
   # file has to already exist.  Puppet (via the File resource) will always
   # just try to set components, even if all values are specified by the manifest.
   # I believe that the OS should always provide at least a fall-through context
   # though on any well-running system.
   def set_selinux_context(file, value, component = false)
     return nil unless selinux_support? && selinux_label_support?(file)
 
     if component
       # Must first get existing context to replace a single component
       context = Selinux.lgetfilecon(file)[1]
       if context == -1
         # We can't set partial context components when no context exists
         # unless/until we can find a way to make Puppet call this method
         # once for all selinux file label attributes.
         Puppet.warning "Can't set SELinux context on file unless the file already has some kind of context"
         return nil
       end
       context = context.split(':')
       case component
         when :seluser
           context[0] = value
         when :selrole
           context[1] = value
         when :seltype
           context[2] = value
         when :selrange
           context[3] = value
         else
           raise ArguementError, "set_selinux_context component must be one of :seluser, :selrole, :seltype, or :selrange"
       end
       context = context.join(':')
     else
       context = value
     end
 
     retval = Selinux.lsetfilecon(file, context)
     if retval == 0
       return true
     else
       Puppet.warning "Failed to set SELinux context #{context} on #{file}"
       return false
     end
   end
 
   # Since this call relies on get_selinux_default_context it also needs a
   # full non-relative path to the file.  Fortunately, that seems to be all
   # Puppet uses.  This will set the file's SELinux context to the policy's
   # default context (if any) if it differs from the context currently on
   # the file.
   def set_selinux_default_context(file)
     new_context = get_selinux_default_context(file)
     return nil unless new_context
     cur_context = get_selinux_current_context(file)
     if new_context != cur_context
       set_selinux_context(file, new_context)
       return new_context
     end
     nil
   end
 
   ########################################################################
   # Internal helper methods from here on in, kids.  Don't fiddle.
   private
 
   # Check filesystem a path resides on for SELinux support against
   # whitelist of known-good filesystems.
   # Returns true if the filesystem can support SELinux labels and
   # false if not.
   def selinux_label_support?(file)
     fstype = find_fs(file)
     return false if fstype.nil?
     filesystems = ['ext2', 'ext3', 'ext4', 'gfs', 'gfs2', 'xfs', 'jfs']
     filesystems.include?(fstype)
   end
 
   # Internal helper function to read and parse /proc/mounts
   def read_mounts
     mounts = ""
     begin
       if File.method_defined? "read_nonblock"
         # If possible we use read_nonblock in a loop rather than read to work-
         # a linux kernel bug.  See ticket #1963 for details.
         mountfh = File.open("/proc/mounts")
         mounts += mountfh.read_nonblock(1024) while true
       else
         # Otherwise we shell out and let cat do it for us
         mountfh = IO.popen("/bin/cat /proc/mounts")
         mounts = mountfh.read
       end
     rescue EOFError
       # that's expected
     rescue
       return nil
     ensure
       mountfh.close if mountfh
     end
 
     mntpoint = {}
 
     # Read all entries in /proc/mounts.  The second column is the
     # mountpoint and the third column is the filesystem type.
     # We skip rootfs because it is always mounted at /
     mounts.each_line do |line|
       params = line.split(' ')
       next if params[2] == 'rootfs'
       mntpoint[params[1]] = params[2]
     end
     mntpoint
   end
 
   # Internal helper function to return which type of filesystem a given file
   # path resides on
   def find_fs(path)
     return nil unless mounts = read_mounts
 
     # cleanpath eliminates useless parts of the path (like '.', or '..', or
     # multiple slashes), without touching the filesystem, and without
     # following symbolic links.  This gives the right (logical) tree to follow
     # while we try and figure out what file-system the target lives on.
     path = Pathname(path).cleanpath
     unless path.absolute?
       raise Puppet::DevError, "got a relative path in SELinux find_fs: #{path}"
     end
 
     # Now, walk up the tree until we find a match for that path in the hash.
     path.ascend do |segment|
       return mounts[segment.to_s] if mounts.has_key?(segment.to_s)
     end
 
     # Should never be reached...
     return mounts['/']
   end
+
+  ##
+  # file_lstat is an internal, private method to allow precise stubbing and
+  # mocking without affecting the rest of the system.
+  #
+  # @return [File::Stat] File.lstat result
+  def file_lstat(path)
+    File.lstat(path)
+  end
+  private :file_lstat
 end
diff --git a/spec/unit/util/selinux_spec.rb b/spec/unit/util/selinux_spec.rb
index aac3bd4a0..2b7f14395 100755
--- a/spec/unit/util/selinux_spec.rb
+++ b/spec/unit/util/selinux_spec.rb
@@ -1,269 +1,289 @@
 #! /usr/bin/env ruby
 require 'spec_helper'
 
 require 'pathname'
 require 'puppet/util/selinux'
 include Puppet::Util::SELinux
 
 unless defined?(Selinux)
   module Selinux
     def self.is_selinux_enabled
       false
     end
   end
 end
 
 describe Puppet::Util::SELinux do
 
   describe "selinux_support?" do
     before do
     end
     it "should return :true if this system has SELinux enabled" do
       Selinux.expects(:is_selinux_enabled).returns 1
       selinux_support?.should be_true
     end
 
     it "should return :false if this system lacks SELinux" do
       Selinux.expects(:is_selinux_enabled).returns 0
       selinux_support?.should be_false
     end
 
     it "should return nil if /proc/mounts does not exist" do
       File.stubs(:open).with("/proc/mounts").raises("No such file or directory - /proc/mounts")
       read_mounts.should == nil
     end
   end
 
   describe "read_mounts" do
     before :each do
       fh = stub 'fh', :close => nil
       File.stubs(:open).with("/proc/mounts").returns fh
       fh.expects(:read_nonblock).times(2).returns("rootfs / rootfs rw 0 0\n/dev/root / ext3 rw,relatime,errors=continue,user_xattr,acl,data=ordered 0 0\n/dev /dev tmpfs rw,relatime,mode=755 0 0\n/proc /proc proc rw,relatime 0 0\n/sys /sys sysfs rw,relatime 0 0\n192.168.1.1:/var/export /mnt/nfs nfs rw,relatime,vers=3,rsize=32768,wsize=32768,namlen=255,hard,nointr,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=192.168.1.1,mountvers=3,mountproto=udp,addr=192.168.1.1 0 0\n").then.raises EOFError
     end
 
     it "should parse the contents of /proc/mounts" do
       read_mounts.should  == {
         '/' => 'ext3',
         '/sys' => 'sysfs',
         '/mnt/nfs' => 'nfs',
         '/proc' => 'proc',
         '/dev' => 'tmpfs' }
     end
   end
 
   describe "filesystem detection" do
     before :each do
       self.stubs(:read_mounts).returns({
         '/'        => 'ext3',
         '/sys'     => 'sysfs',
         '/mnt/nfs' => 'nfs',
         '/proc'    => 'proc',
         '/dev'     => 'tmpfs' })
     end
 
     it "should match a path on / to ext3" do
       find_fs('/etc/puppet/testfile').should == "ext3"
     end
 
     it "should match a path on /mnt/nfs to nfs" do
       find_fs('/mnt/nfs/testfile/foobar').should == "nfs"
     end
 
     it "should reture true for a capable filesystem" do
       selinux_label_support?('/etc/puppet/testfile').should be_true
     end
 
     it "should return false for a noncapable filesystem" do
       selinux_label_support?('/mnt/nfs/testfile').should be_false
     end
 
     it "(#8714) don't follow symlinks when determining file systems", :unless => Puppet.features.microsoft_windows? do
       scratch = Pathname(PuppetSpec::Files.tmpdir('selinux'))
 
       self.stubs(:read_mounts).returns({
           '/'             => 'ext3',
           scratch + 'nfs' => 'nfs',
         })
 
       (scratch + 'foo').make_symlink('nfs/bar')
       selinux_label_support?(scratch + 'foo').should be_true
     end
 
     it "should handle files that don't exist" do
       scratch = Pathname(PuppetSpec::Files.tmpdir('selinux'))
       selinux_label_support?(scratch + 'nonesuch').should be_true
     end
   end
 
   describe "get_selinux_current_context" do
     it "should return nil if no SELinux support" do
       self.expects(:selinux_support?).returns false
       get_selinux_current_context("/foo").should be_nil
     end
 
     it "should return a context" do
       self.expects(:selinux_support?).returns true
       Selinux.expects(:lgetfilecon).with("/foo").returns [0, "user_u:role_r:type_t:s0"]
       get_selinux_current_context("/foo").should == "user_u:role_r:type_t:s0"
     end
 
     it "should return nil if lgetfilecon fails" do
       self.expects(:selinux_support?).returns true
       Selinux.expects(:lgetfilecon).with("/foo").returns -1
       get_selinux_current_context("/foo").should be_nil
     end
   end
 
   describe "get_selinux_default_context" do
     it "should return nil if no SELinux support" do
       self.expects(:selinux_support?).returns false
       get_selinux_default_context("/foo").should be_nil
     end
 
     it "should return a context if a default context exists" do
       self.expects(:selinux_support?).returns true
       fstat = stub 'File::Stat', :mode => 0
       File.expects(:lstat).with("/foo").returns fstat
       self.expects(:find_fs).with("/foo").returns "ext3"
       Selinux.expects(:matchpathcon).with("/foo", 0).returns [0, "user_u:role_r:type_t:s0"]
       get_selinux_default_context("/foo").should == "user_u:role_r:type_t:s0"
     end
 
+    it "handles permission denied errors by issuing a warning" do
+      self.stubs(:selinux_support?).returns true
+      self.stubs(:selinux_label_support?).returns true
+      Selinux.stubs(:matchpathcon).with("/root/chuj", 0).returns(-1)
+      self.stubs(:file_lstat).with("/root/chuj").raises(Errno::EACCES, "/root/chuj")
+
+      self.expects(:warning).with("Could not stat; Permission denied - /root/chuj")
+      get_selinux_default_context("/root/chuj").should be_nil
+    end
+
+    it "handles no such file or directory errors by issuing a warning" do
+      self.stubs(:selinux_support?).returns true
+      self.stubs(:selinux_label_support?).returns true
+      Selinux.stubs(:matchpathcon).with("/root/chuj", 0).returns(-1)
+      self.stubs(:file_lstat).with("/root/chuj").raises(Errno::ENOENT, "/root/chuj")
+
+      self.expects(:warning).with("Could not stat; No such file or directory - /root/chuj")
+      get_selinux_default_context("/root/chuj").should be_nil
+    end
+
     it "should return nil if matchpathcon returns failure" do
       self.expects(:selinux_support?).returns true
       fstat = stub 'File::Stat', :mode => 0
       File.expects(:lstat).with("/foo").returns fstat
       self.expects(:find_fs).with("/foo").returns "ext3"
       Selinux.expects(:matchpathcon).with("/foo", 0).returns -1
       get_selinux_default_context("/foo").should be_nil
     end
 
     it "should return nil if selinux_label_support returns false" do
       self.expects(:selinux_support?).returns true
       self.expects(:find_fs).with("/foo").returns "nfs"
       get_selinux_default_context("/foo").should be_nil
     end
 
   end
 
   describe "parse_selinux_context" do
     it "should return nil if no context is passed" do
       parse_selinux_context(:seluser, nil).should be_nil
     end
 
     it "should return nil if the context is 'unlabeled'" do
       parse_selinux_context(:seluser, "unlabeled").should be_nil
     end
 
     it "should return the user type when called with :seluser" do
       parse_selinux_context(:seluser, "user_u:role_r:type_t:s0").should == "user_u"
     end
 
     it "should return the role type when called with :selrole" do
       parse_selinux_context(:selrole, "user_u:role_r:type_t:s0").should == "role_r"
     end
 
     it "should return the type type when called with :seltype" do
       parse_selinux_context(:seltype, "user_u:role_r:type_t:s0").should == "type_t"
     end
 
     it "should return nil for :selrange when no range is returned" do
       parse_selinux_context(:selrange, "user_u:role_r:type_t").should be_nil
     end
 
     it "should return the range type when called with :selrange" do
       parse_selinux_context(:selrange, "user_u:role_r:type_t:s0").should == "s0"
     end
 
     describe "with a variety of SELinux range formats" do
       ['s0', 's0:c3', 's0:c3.c123', 's0:c3,c5,c8', 'TopSecret', 'TopSecret,Classified', 'Patient_Record'].each do |range|
         it "should parse range '#{range}'" do
           parse_selinux_context(:selrange, "user_u:role_r:type_t:#{range}").should == range
         end
       end
     end
   end
 
   describe "set_selinux_context" do
     before :each do
       fh = stub 'fh', :close => nil
       File.stubs(:open).with("/proc/mounts").returns fh
       fh.stubs(:read_nonblock).returns(
         "rootfs / rootfs rw 0 0\n/dev/root / ext3 rw,relatime,errors=continue,user_xattr,acl,data=ordered 0 0\n"+
         "/dev /dev tmpfs rw,relatime,mode=755 0 0\n/proc /proc proc rw,relatime 0 0\n"+
         "/sys /sys sysfs rw,relatime 0 0\n"
         ).then.raises EOFError
     end
 
     it "should return nil if there is no SELinux support" do
       self.expects(:selinux_support?).returns false
       set_selinux_context("/foo", "user_u:role_r:type_t:s0").should be_nil
     end
 
     it "should return nil if selinux_label_support returns false" do
       self.expects(:selinux_support?).returns true
       self.expects(:selinux_label_support?).with("/foo").returns false
       set_selinux_context("/foo", "user_u:role_r:type_t:s0").should be_nil
     end
 
     it "should use lsetfilecon to set a context" do
       self.expects(:selinux_support?).returns true
       Selinux.expects(:lsetfilecon).with("/foo", "user_u:role_r:type_t:s0").returns 0
       set_selinux_context("/foo", "user_u:role_r:type_t:s0").should be_true
     end
 
     it "should use lsetfilecon to set user_u user context" do
       self.expects(:selinux_support?).returns true
       Selinux.expects(:lgetfilecon).with("/foo").returns [0, "foo:role_r:type_t:s0"]
       Selinux.expects(:lsetfilecon).with("/foo", "user_u:role_r:type_t:s0").returns 0
       set_selinux_context("/foo", "user_u", :seluser).should be_true
     end
 
     it "should use lsetfilecon to set role_r role context" do
       self.expects(:selinux_support?).returns true
       Selinux.expects(:lgetfilecon).with("/foo").returns [0, "user_u:foo:type_t:s0"]
       Selinux.expects(:lsetfilecon).with("/foo", "user_u:role_r:type_t:s0").returns 0
       set_selinux_context("/foo", "role_r", :selrole).should be_true
     end
 
     it "should use lsetfilecon to set type_t type context" do
       self.expects(:selinux_support?).returns true
       Selinux.expects(:lgetfilecon).with("/foo").returns [0, "user_u:role_r:foo:s0"]
       Selinux.expects(:lsetfilecon).with("/foo", "user_u:role_r:type_t:s0").returns 0
       set_selinux_context("/foo", "type_t", :seltype).should be_true
     end
 
     it "should use lsetfilecon to set s0:c3,c5 range context" do
       self.expects(:selinux_support?).returns true
       Selinux.expects(:lgetfilecon).with("/foo").returns [0, "user_u:role_r:type_t:s0"]
       Selinux.expects(:lsetfilecon).with("/foo", "user_u:role_r:type_t:s0:c3,c5").returns 0
       set_selinux_context("/foo", "s0:c3,c5", :selrange).should be_true
     end
   end
 
   describe "set_selinux_default_context" do
     it "should return nil if there is no SELinux support" do
       self.expects(:selinux_support?).returns false
       set_selinux_default_context("/foo").should be_nil
     end
 
     it "should return nil if no default context exists" do
       self.expects(:get_selinux_default_context).with("/foo").returns nil
       set_selinux_default_context("/foo").should be_nil
     end
 
     it "should do nothing and return nil if the current context matches the default context" do
       self.expects(:get_selinux_default_context).with("/foo").returns "user_u:role_r:type_t"
       self.expects(:get_selinux_current_context).with("/foo").returns "user_u:role_r:type_t"
       set_selinux_default_context("/foo").should be_nil
     end
 
     it "should set and return the default context if current and default do not match" do
       self.expects(:get_selinux_default_context).with("/foo").returns "user_u:role_r:type_t"
       self.expects(:get_selinux_current_context).with("/foo").returns "olduser_u:role_r:type_t"
       self.expects(:set_selinux_context).with("/foo", "user_u:role_r:type_t").returns true
       set_selinux_default_context("/foo").should == "user_u:role_r:type_t"
     end
   end
 
 end