diff --git a/pkgs/os-specific/linux/checkpolicy/default.nix b/pkgs/os-specific/linux/checkpolicy/default.nix
index 2b80114fe475..1f06fb662188 100644
--- a/pkgs/os-specific/linux/checkpolicy/default.nix
+++ b/pkgs/os-specific/linux/checkpolicy/default.nix
@@ -2,12 +2,12 @@
 stdenv.mkDerivation rec {
 
   name = "checkpolicy-${version}";
-  version = "2.2";
+  version = "2.3";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/checkpolicy-${version}.tar.gz";
-    sha256 = "1y5dx4s5k404fgpm7hlhgw8a9b9ksn3q2d3fj6f9rdac9n7nkxlz";
+    sha256 = "0yr0r2cxz9lbj7i0wqgcd4wjvc6zf1fmqk0xjybnkdpcmw8jsqwh";
   };
 
   buildInputs = [ libsepol libselinux bison flex ];
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index e125ac3fe8e9..746f49b519dd 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -8,12 +8,12 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "libselinux-${version}";
-  version = "2.2.2";
+  version = "2.3";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libselinux-${version}.tar.gz";
-    sha256 = "0gjs5cqwhqzmf0avnn0343ip69153k9z35vbp03sjvc02qs3darh";
+    sha256 = "1ckpiv6m5c07rp5vawlhv02w5rq8kc0n95fh2ckq2jnqxi1hn7hb";
   };
 
   buildInputs = [ pkgconfig libsepol pcre ]
diff --git a/pkgs/os-specific/linux/libsemanage/default.nix b/pkgs/os-specific/linux/libsemanage/default.nix
index afd83f730806..599da9e4b3c2 100644
--- a/pkgs/os-specific/linux/libsemanage/default.nix
+++ b/pkgs/os-specific/linux/libsemanage/default.nix
@@ -2,12 +2,12 @@
 stdenv.mkDerivation rec {
 
   name = "libsemanage-${version}";
-  version = "2.2";
+  version = "2.3";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libsemanage-${version}.tar.gz";
-    sha256 = "0xdx0dwcsyw4kv9l6xwdkfg6v7fc9b5y176rkg6n6q0w1zx0pxhi";
+    sha256 = "0jrf66df80mvjhrsbxcnb60j69pg4dh2pydy8vj8dhhiwqsrxq03";
   };
 
   makeFlags = "PREFIX=$(out) DESTDIR=$(out)";
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index bb5dde9a61ed..c469fe93493d 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "libsepol-${version}";
-  version = "2.2";
-  se_release = "20131030";
+  version = "2.3";
+  se_release = "20140506";
   se_url = "${meta.homepage}/releases";
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libsepol-${version}.tar.gz";
-    sha256 = "03zw6clp00cmi49x8iq8svhrp91jrcw0093zpnyhan190rqb593p";
+    sha256 = "13z6xakc2qqyhlvnc5h53jy7lqmh5b5cnpfn51lmvfdpqd18d3fc";
   };
 
   preBuild = '' makeFlags="$makeFlags PREFIX=$out DESTDIR=$out" '';
diff --git a/pkgs/os-specific/linux/policycoreutils/default.nix b/pkgs/os-specific/linux/policycoreutils/default.nix
index 063f89edaa2b..d312e25fc2e4 100644
--- a/pkgs/os-specific/linux/policycoreutils/default.nix
+++ b/pkgs/os-specific/linux/policycoreutils/default.nix
@@ -4,12 +4,12 @@
 stdenv.mkDerivation rec {
 
   name = "policycoreutils-${version}";
-  version = "2.2.5";
+  version = "2.3";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/policycoreutils-${version}.tar.gz";
-    sha256 = "1i0chc3km3wdgzrd556mmhvsglydxrimclnn77s73wy2qfl51y5v";
+    sha256 = "1lpwxr5hw3dwhlp2p7y8jcr18mvfcrclwd8c2idz3lmmb3pglk46";
   };
 
   patchPhase = ''
diff --git a/pkgs/os-specific/linux/setools/default.nix b/pkgs/os-specific/linux/setools/default.nix
index cc1363156dd7..63a43b2b5e93 100644
--- a/pkgs/os-specific/linux/setools/default.nix
+++ b/pkgs/os-specific/linux/setools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, autoreconfHook, pkgconfig, bison, flex
+{ stdenv, fetchurl, fetchpatch, autoreconfHook, pkgconfig, bison, flex
 , python, swig2, tcl, libsepol, libselinux, libxml2, sqlite, bzip2 }:
 
 stdenv.mkDerivation rec {
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "16g987ijaxabc30zyjzia4nafq49rm038y1pm4vca7i3kb67wf24";
   };
 
+  patches = [ ./ftbfs-invalid-operands-of-types.patch ];
+
   # SWIG-TCL is broken in 3.3.8
   configureFlags = ''
     --with-tcl=${tcl}/lib
diff --git a/pkgs/os-specific/linux/setools/ftbfs-invalid-operands-of-types.patch b/pkgs/os-specific/linux/setools/ftbfs-invalid-operands-of-types.patch
new file mode 100644
index 000000000000..97a5727f05b0
--- /dev/null
+++ b/pkgs/os-specific/linux/setools/ftbfs-invalid-operands-of-types.patch
@@ -0,0 +1,15 @@
+https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=750331
+
+Index: setools-git/secmds/replcon.cc
+===================================================================
+--- setools-git.orig/secmds/replcon.cc
++++ setools-git/secmds/replcon.cc
+@@ -60,7 +60,7 @@ static struct option const longopts[] =
+ 	{NULL, 0, NULL, 0}
+ };
+ 
+-extern int lsetfilecon_raw(const char *, security_context_t) __attribute__ ((weak));
++extern int lsetfilecon_raw(const char *, const char *) __attribute__ ((weak));
+ 
+ /**
+  * As that setools must work with older libselinux versions that may