diff -up at-3.1.10/atd.c.mailselinux at-3.1.10/atd.c
--- at-3.1.10/atd.c.mailselinux	2008-09-17 10:45:38.000000000 +0200
+++ at-3.1.10/atd.c	2008-09-17 10:49:48.000000000 +0200
@@ -224,6 +224,69 @@ myfork()
 #define ATD_MAIL_NAME    "mailx"
 #endif
 
+#ifdef WITH_SELINUX
+static int set_selinux_context(const char *name, const char *filename) {
+	security_context_t user_context=NULL;
+	security_context_t  file_context=NULL;
+	struct av_decision avd;
+	int retval=-1;
+	char *seuser=NULL;
+	char *level=NULL;
+
+	if (getseuserbyname(name, &seuser, &level) == 0) {
+		retval=get_default_context_with_level(seuser, level, NULL, &user_context);
+		free(seuser);
+		free(level);
+		if (retval) {
+			if (security_getenforce()==1) {
+				perr("execle: couldn't get security context for user %s\n", name);
+			} else {
+				syslog(LOG_ERR, "execle: couldn't get security context for user %s\n", name);
+				return -1;
+			}
+		}
+	}
+
+	/*
+	 * Since crontab files are not directly executed,
+	 * crond must ensure that the crontab file has
+	 * a context that is appropriate for the context of
+	 * the user cron job.  It performs an entrypoint
+	 * permission check for this purpose.
+	 */
+	if (fgetfilecon(STDIN_FILENO, &file_context) < 0)
+		perr("fgetfilecon FAILED %s", filename);
+	
+	retval = security_compute_av(user_context,
+				     file_context,
+				     SECCLASS_FILE,
+				     FILE__ENTRYPOINT,
+				     &avd);
+	freecon(file_context);
+	if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) {
+	     	if (security_getenforce()==1) {
+			perr("Not allowed to set exec context to %s for user  %s\n", user_context,name);
+                } else {
+			syslog(LOG_ERR, "Not allowed to set exec context to %s for user  %s\n", user_context,name);
+			retval = -1;
+			goto err;
+                }
+	}
+	if (setexeccon(user_context) < 0) {
+		if (security_getenforce()==1) {
+			perr("Could not set exec context to %s for user  %s\n", user_context,name);
+			retval = -1;
+		} else {
+			syslog(LOG_ERR, "Could not set exec context to %s for user  %s\n", user_context,name);
+		}
+	}
+ err:
+	freecon(user_context);
+	return 0;
+}
+#endif
+
+
 static void
 run_file(const char *filename, uid_t uid, gid_t gid)
 {
@@ -486,61 +549,8 @@ run_file(const char *filename, uid_t uid
 
 #ifdef WITH_SELINUX
            if (selinux_enabled>0) {
-          security_context_t user_context=NULL;
-               security_context_t  file_context=NULL;
-               int retval=0;
-               struct av_decision avd;
-               char *seuser=NULL;
-               char *level=NULL;
-
-               if (getseuserbyname(pentry->pw_name, &seuser, &level) == 0) {
-                  retval=get_default_context_with_level(seuser, level, NULL, &user_context);
-                  free(seuser);
-                  free(level);
-                  if (retval) {
-                      if (security_getenforce()==1) {
-                          perr("execle: couldn't get security context for user %s\n", pentry->pw_name);
-                      } else {
-                          syslog(LOG_ERR, "execle: couldn't get security context for user %s\n", pentry->pw_name);
-                          goto out;
-                      }
-                  }
-               }
-
-             /*
-              * Since crontab files are not directly executed,
-              * crond must ensure that the crontab file has
-              * a context that is appropriate for the context of
-              * the user cron job.  It performs an entrypoint
-              * permission check for this purpose.
-              */
-        if (fgetfilecon(STDIN_FILENO, &file_context) < 0) {
-                     if (security_getenforce() > 0) {
-                         perr("fgetfilecon FAILED %s", filename);
-                     } else {
-                         syslog(LOG_ERR, "fgetfilecon FAILED %s", filename);
-                         goto out;
-                     }
-             }
-             retval = security_compute_av(user_context,
-                                          file_context,
-                                          SECCLASS_FILE,
-                                          FILE__ENTRYPOINT,
-                                          &avd);
-             freecon(file_context);
-             if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) {
-               if (security_getenforce()==1)
-                 perr("Not allowed to set exec context to %s for user  %s\n", user_context,pentry->pw_name);
-             }
-
-             if (setexeccon(user_context) < 0) {
-               if (security_getenforce()==1) {
-                 perr("Could not set exec context to %s for user  %s\n", user_context,pentry->pw_name);
-               } else {
-                 syslog(LOG_ERR, "Could not set exec context to %s for user  %s\n", user_context,pentry->pw_name);
-               }
-             }
-             freecon(user_context);
+               if (set_selinux_context(pentry->pw_name, filename) < 0)
+                   perr("SELinux Failed to set context\n");
            }
 #endif
 
@@ -654,47 +664,8 @@ run_file(const char *filename, uid_t uid
 
 #ifdef WITH_SELINUX
            if (selinux_enabled>0) {
-             security_context_t user_context=NULL;
-             security_context_t  file_context=NULL;
-             int retval=0;
-             struct av_decision avd;
-
-             if (get_default_context(pentry->pw_name, NULL, &user_context))
-               perr("execle: couldn't get security context for user %s\n", pentry->pw_name);
-             /*
-              * Since crontab files are not directly executed,
-              * crond must ensure that the crontab file has
-              * a context that is appropriate for the context of
-              * the user cron job.  It performs an entrypoint
-              * permission check for this purpose.
-              */
-             if (fgetfilecon(STDIN_FILENO, &file_context) < 0)
-               perr("fgetfilecon FAILED %s", filename);
-
-             retval = security_compute_av(user_context,
-                                          file_context,
-                                          SECCLASS_FILE,
-                                          FILE__ENTRYPOINT,
-                                          &avd);
-             freecon(file_context);
-             if (retval || ((FILE__ENTRYPOINT & avd.allowed) != FILE__ENTRYPOINT)) {
-           if (security_getenforce()==1) {
-                    perr("Not allowed to set exec context to %s for user  %s\n", user_context,pentry->pw_name);
-                } else {
-                    syslog(LOG_ERR, "Not allowed to set exec context to %s for user  %s\n", user_context,pentry->pw_name);
-                    goto out;
-                }
-        }
-
-             if (setexeccon(user_context) < 0) {
-               if (security_getenforce()==1) {
-                 perr("Could not set exec context to %s for user  %s\n", user_context,pentry->pw_name);
-               } else {
-                 syslog(LOG_ERR, "Could not set exec context to %s for user  %s\n", user_context,pentry->pw_name);
-               }
-             }
-        out:
-                freecon(user_context);
+               if (set_selinux_context(pentry->pw_name, filename) < 0)
+                   perr("SELinux Failed to set context\n");
            }
 #endif
             execl(ATD_MAIL_PROGRAM, ATD_MAIL_NAME, mailname, (char *) NULL);