--- a/toys/posix/cp.c	2015-07-13 10:51:26.000000000 +0530
+++ b/toys/posix/cp.c	2015-07-13 15:06:57.000000000 +0530
@@ -9,7 +9,7 @@
 
 USE_CP(NEWTOY(cp, "<2"USE_CP_PRESERVE("(preserve):;")"RHLPp"USE_CP_MORE("rdaslvnF(remove-destination)")"fi[-HLP"USE_CP_MORE("d")"]"USE_CP_MORE("[-ni]"), TOYFLAG_BIN))
 USE_MV(NEWTOY(mv, "<2"USE_CP_MORE("vnF")"fi"USE_CP_MORE("[-ni]"), TOYFLAG_BIN))
-USE_INSTALL(NEWTOY(install, "<1cdDpsvm:o:g:", TOYFLAG_USR|TOYFLAG_BIN))
+USE_INSTALL(NEWTOY(install, "<1"USE_INSTALL_Z("Z:")"cdDpsvm:o:g:", TOYFLAG_USR|TOYFLAG_BIN))
 
 config CP
   bool "cp"
@@ -96,6 +96,15 @@
     -p	Preserve timestamps
     -s	Call "strip -p"
     -v	Verbose
+
+config INSTALL_Z
+  bool
+  default y
+  depends on INSTALL && !TOYBOX_LSM_NONE
+  help
+    usage: [-Z context]
+
+    -Z  set security context
 */
 
 #define FOR_cp
@@ -108,6 +117,7 @@
       char *group;
       char *user;
       char *mode;
+      char *context;
     } i;
     struct {
       char *preserve;
@@ -432,6 +442,13 @@
   char **ss;
   int flags = toys.optflags;
 
+  if (CFG_INSTALL_Z && (toys.optflags&FLAG_Z)) {
+    if (lsm_enabled()) {
+      if (0>lsm_set_create(TT.i.context))
+        perror_exit("bad -Z '%s'", TT.i.context);
+    } else error_msg("%s disabled", lsm_name());
+  }
+
   if (flags & FLAG_d) {
     for (ss = toys.optargs; *ss; ss++) {
       if (mkpathat(AT_FDCWD, *ss, 0777, 3)) perror_msg("%s", *ss);