19 files changed, 1027 insertions, 86 deletions

diff --git a/Completion/Linux/Command/_btrfs b/Completion/Linux/Command/_btrfs
index 1d87fd83a..d8b97a200 100644
--- a/Completion/Linux/Command/_btrfs
+++ b/Completion/Linux/Command/_btrfs
@@ -8,16 +8,16 @@ groups=( subvolume filesystem device scrub balance inspect-internal property
          quota qgroup replace rescue check restore send receive
          help version )
 cmds_1=( create delete list snapshot get-default set-default find-new show sync help )
-cmds_2=( df du show sync defragment resize label usage help )
+cmds_2=( df du show sync defragment resize label mkswapfile usage help )
 cmds_3=( add delete remove ready scan stats usage help )
 cmds_4=( start cancel resume status help )
 cmds_5=( start pause cancel resume status )
-cmds_6=( dump-{super,tree} {inode,logical,subvolid}-resolve min-dev-size rootid tree-stats help )
+cmds_6=( dump-{super,tree} {inode,logical,subvolid}-resolve map-swapfile min-dev-size rootid tree-stats help )
 cmds_7=( get set list )
 cmds_8=( enable disable rescan help )
-cmds_9=( assign remove create destroy show limit help )
+cmds_9=( assign remove create clear-stale destroy show limit help )
 cmds_10=( start status cancel help )
-cmds_11=( chunk-recover fix-device-size super-recover zero-log create-control-device )
+cmds_11=( chunk-recover clear-uuid-tree fix-device-size super-recover zero-log create-control-device )
 
 _arguments -C -A "-*" "$args[@]" \
   '(- *)--help[print help information]' \
@@ -25,6 +25,7 @@ _arguments -C -A "-*" "$args[@]" \
   '(-v --verbose -q --quiet --help --version)'{-v,--verbose}'[verbose output of operation]' \
   '(-v --verbose -q --quiet --help --version)'{-q,--quiet}'[suppress all messages except errors]' \
   '(--help --version)--format=[specify output format]:format:(text json)' \
+  '(--help --version)--log=[set log level]:level:(default info verbose debug quiet)' \
   '(--version)1: :->groups' \
   '2: :->cmds' \
   '*:: :->args' && ret=0
@@ -151,7 +152,7 @@ while (( $#state )); do
         filesystem:defragment)
           args+=( '!-v'
             '-r[defragment files recursively]'
-            '-c+[compress files while defragmenting]::compression algorithm:(zlib lzo zstd)'
+            '-c-[compress files while defragmenting]::compression algorithm:(zlib lzo zstd)'
             '-r[defragment files recursively]'
             '-f[flush after defragmenting]'
             '-s[start position]: :_numbers -u bytes -d "beginning of file" offset K M G T P E'
@@ -171,6 +172,13 @@ while (( $#state )); do
             '1: :_guard "^-*" uuid or label'
           )
         ;;
+        filesystem:mkswapfile)
+          args+=(
+            '-s[size]: :_numbers -d "2GiB" size K M G T P E'
+            '(-u --uuid)'{-u,--uuid}'[specify a uuid to use]:uuid:(clear random time)'
+            ':file:_files'
+          )
+        ;;
         filesystem:usage) args+=( '-T[show data in tabular format]' );;
         device:(add|delete|ready|remove))
           args+=(
@@ -194,6 +202,7 @@ while (( $#state )); do
           args+=(
             '(-c --check)'{-c,--check}'[return non-zero if any stat counter is not zero]'
             '(-z --reset)'{-z,--reset}'[reset stats when done]'
+            '-T[show current stats in tabular format]'
             "1:device or mountpoint:_files -g '*(-%,/)'"
           )
         ;;
@@ -233,7 +242,7 @@ while (( $#state )); do
         ;;
         balance:status) args+=( '!-v' '!--verbose' '1:path:_files -/' );;
         balance:(pause|cancel|resume)) args+=( '1:path:_files -/' );;
-        property:set) args+=( '3:value' );&
+        property:set) args+=( '-f[force the change]' '3:value' );&
         property:get) args+=( '2:property:(ro label compression)' );&
         property:list)
           args+=(
@@ -244,8 +253,9 @@ while (( $#state )); do
         quota:(enable|disable)) args+=( '1:path:_files -/' );;
         quota:rescan)
           args+=(
-            '-s[show status of currently running rescan]'
-            '-w[wait for rescan to finish]'
+            '(-s --status)'{-s,--status}'[show status of currently running rescan]'
+            '(-w --wait -W --wait-norescan)'{-w,--wait}'[wait for rescan to finish]'
+            '(-w --wait -W --wait-norescan)'{-w,--wait-norescan}'[wait for rescan to finish without starting it]'
             '1:path:_files -/'
           )
         ;;
@@ -268,11 +278,14 @@ while (( $#state )); do
             '-F[list impacted qgroups \(include ancestral qgroups\)]'
             '-f[list impacted qgroups \(exclude ancestral qgroups\)]'
             '--sort=-[sort qgroups]:sort:_values -s , sort \
-              qgroupid rfer excl max_rfer max_excl'
+              qgroupid rfer excl max_rfer max_excl path'
             '--sync[do filesystem sync before getting information]'
             '1:path:_files -/'
           )
         ;;
+        qgroup:clear-stale)
+          args+=( '(-q --quiet)'{-q,--quiet}'[print only errors]' '1:path:_files -/' )
+        ;;
         qgroup:limit)
           args+=(
             '-c[limit amount of data after compression]'
@@ -287,6 +300,7 @@ while (( $#state )); do
             '-r[read from specified source device only]:srcdev:_files'
             '-f[force overwriting of target]'
             "-B[don't background]"
+            '(-K --nodiscard)'{-K,--nodiscard}"[don't perform whole device TRIM]"
             ':srcdev or devid:_files'
             ':target:_files'
             ':path:->mounts'
@@ -332,6 +346,12 @@ while (( $#state )); do
             '2:filesystem path:_files -/'
           )
         ;;
+        inspect*:map-swapfile)
+          args+=(
+            '(-r --resume-offset)'{-r,--resume-offset}'[print only the value suitable as resume offset for file /sys/power/resume_offset]'
+            ':file:_files'
+          )
+        ;;
         inspect*:min*) args+=( '--id[specify the device id to query]:device id [1]' );;
         inspect*:rootid) args+=( '1:path:_files -/' );;
         inspect*:tree*) args+=( '-b[print raw numbers in bytes]' );;
@@ -395,6 +415,8 @@ while (( $#state )); do
             '*-c[use snapshot as clone source]:clone:_files -/'
             '-f[specify output file]:file:_files'
             '--no-data[send in NO_FILE_DATA mode]'
+            '--proto[specify protocol version]:version'
+            '--compressed-data[send data that is compressed on the filesystem directly without decompressing it]'
             '1:subvolume:_files -/'
           )
         ;;
@@ -405,6 +427,7 @@ while (( $#state )); do
             '(-C --chroot)'{-C,--chroot}'[confine the process to destination path using chroot(1)]'
             '(-E --max-errors)'{-E,--max-errors}'[terminate as soon as specified number of errors occur]:errors [1]'
             '(--dump)-m[specify root mount point of the destination filesystem]:mount point:_directories'
+            '--force-decompress[if the stream contains compressed data, always decompress it]'
             '(-m)--dump[dump stream metadata, one line per operation]'
             '1:mount:->mounts'
           )
diff --git a/Completion/Linux/Command/_chcon b/Completion/Linux/Command/_chcon
deleted file mode 100644
index 2d523f287..000000000
--- a/Completion/Linux/Command/_chcon
+++ /dev/null
@@ -1,24 +0,0 @@
-#compdef chcon
-
-local ign
-
-(( $#words > 2 )) && ign='!'
-_arguments -C -s -S \
-  '(-h --no-dereference)--dereference[dereference symlinks]' \
-  '(-h --no-dereference --dereference)'{-h,--no-dereference}'[operate on symlinks themselves]' \
-  '(1 -u --user -r --role  -l --range -t --type)--reference=[copy security context of specified file]:file:_files' \
-  '(1 --reference -u --user)'{-u+,--user=}'[set user in the target security context]: :_selinux_users' \
-  '(1 --reference -r --role)'{-r+,--role=}'[set role in the target security context]: :_selinux_roles' \
-  '(1 --reference -t --type)'{-t+,--type=}'[set type in the target security context]: :_selinux_types' \
-  '(1 --reference -l --range)'{-l+,--range=}'[set range in the target security context]:selinux range' \
-  '(--recursive -R)'{--recursive,-R}'[recurse subdirectories]' \
-  '(-v --verbose)'{-v,--verbose}'[output a diagnostic for every file processed]' \
-  '(-H -L -P)-H[follow symlinks on the command line]' \
-  '(-H -L -P)-L[follow all symlinks]' \
-  "(-H -L -P)-P[don't follow symlinks (default)]" \
-  '!(--preserve-root)--no-preserve-root' \
-  "--preserve-root[fail to operate recursively on '/']" \
-  '(--reference -u --user -r --role  -l --range -t --type)1:security context:_selinux_contexts' \
-  "${ign}--help[display help information]" \
-  "${ign}--version[display version information]" \
-  '*:file:_files'
diff --git a/Completion/Linux/Command/_chrt b/Completion/Linux/Command/_chrt
index 6789b66cf..5431b0799 100644
--- a/Completion/Linux/Command/_chrt
+++ b/Completion/Linux/Command/_chrt
@@ -62,7 +62,7 @@ elif (( CURRENT == 1 )); then
 else
   shift words
   (( CURRENT-- ))
-  _normal && ret=0
+  _normal -p $service && ret=0
 fi
 
 return ret
diff --git a/Completion/Linux/Command/_cpupower b/Completion/Linux/Command/_cpupower
index 6763bdd12..d342b69d9 100644
--- a/Completion/Linux/Command/_cpupower
+++ b/Completion/Linux/Command/_cpupower
@@ -95,7 +95,7 @@ case $state in
           '-i+[measurement interval]:interval (seconds)'
           '-c[schedule on every core]'
           '-v[increase verbosity]'
-          '*:::command: _normal'
+          '*:::command: _normal -p $service'
         )
       ;;
     esac
diff --git a/Completion/Linux/Command/_ethtool b/Completion/Linux/Command/_ethtool
index 95a8bbfb6..3e3fc0b1d 100644
--- a/Completion/Linux/Command/_ethtool
+++ b/Completion/Linux/Command/_ethtool
@@ -4,7 +4,7 @@ local curcontext="$curcontext"
 local -a state line expl cmds
 local -A opt_args
 
-_arguments -C \
+_arguments -C -A "-*" \
   '--debug[turn on debugging messages]:mask:((1\:parser\ information))' \
   '--json[output results in JSON]' \
   '(-I --include-statistics)'{-I,--include-statistics}'[include command-related statistics in the output]' \
@@ -59,12 +59,21 @@ _arguments -C \
   '--cable-test[perform cable test and report the results]' \
   '--cable-test-tdr[perform cable test and report Time Domain Reflectometer data]' \
   '--show-tunnels[show tunnel-related device capabilities and state]' \
+  '--show-module[show transceiver module settings]' \
+  '--set-module[set transceiver module settings]' \
+  '--get-plca-cfg[get PLCA configuration]' \
+  '--set-plca-cfg[set PLCA configuration]' \
+  '--get-plca-status[get PLCA status information]' \
+  '--show-mm[show MAC merge layer state]' \
+  '--set-mm[set MAC merge layer parameters]' \
+  '--show-pse[show settings for power sourcing equipment]' \
+  '--set-pse[set power sourcing equipment settings]' \
   '--monitor[listen to netlink notifications and displays them]::command:(
     --all -s --change -k --show-features --show-offload -K
     --features --offload  --show-priv-flags --set-priv-flags -g --show-ring
     -G --set-ring -l --show-channels -L --set-channels -c --show-coalesce
     -C --coalesce -a --show-pause -A --pause --show-eee --set-eee
-    --cable-test --cable-test-tdr
+    --cable-test --cable-test-tdr --show-module --set-module
   )' && return
 
 if [[ -n $state ]]; then
@@ -79,22 +88,30 @@ if [[ -n $state ]]; then
     fi
   ;;
   autoneg|adaptive-[rt]x|raw|hex|sg|tso|ufo|gso|lro|eee|tx-lpi|downshift) ;&
-  fast-link-down|energy-detect-power-down|mode)
+  cqe-mode-[rt]x|fast-link-down|energy-detect-power-down|mode) ;&
+  [tr]x-push|enable|*-enabled)
     _wanted onoff expl 'enabled' compadd off on
   ;;
   rx-usecs|rx-frames|rx-usecs-irq|rx-frames-irq|tx-usecs|tx-frames) ;&
   tx-usecs-irq|tx-frames-irq|stats-block-usecs|pkt-rate-low|rx-usecs-low) ;&
   rx-frames-low|tx-usecs-low|tx-frames-low|pkt-rate-high|rx-usecs-high) ;&
-  rx-frames-high|tx-usecs-high|tx-frames-high|sample-interval|dmac|rx-mini) ;&
-  rx-jumbo|offset|length|magic|value|phyad|proto|tos|tclass|l4proto|src-port) ;&
+  rx-frames-high|tx-usecs-high|tx-frames-high|sample-interval|dmac) ;&
+  tx-aggr-max-bytes|tx-aggr-max-frame|tx-aggr-time-usec) ;&
+  rx-mini|rx-jumbo|rx-buf-len|cqe-size|tx-push-buf-len) ;&
+  offset|length|magic|value|phyad|proto|tos|tclass|l4proto|src-port) ;&
   dst-port|spi|l4data|vlan-etype|vlan|user-def|action|vf|queue|loc) ;&
   page|bank|i2c|first|last|step|pair|lanes) ;&
-  rx-copybreak|tx-copybreak|pfc-prevention-tout) ;&
-  other|combined|tx-timer|count|msecs)
+  rx-copybreak|tx-copybreak|tx-buf-size|pfc-prevention-tout) ;&
+  other|combined|tx-timer|count|msecs) ;&
+  node-id|node-cnt|to-tmr|burst-cnt|burst-tmr) ;&
+  tx-min-frag-size)
     _message -e numbers 'number'
   ;;
+  podl-pse-admin-control)
+    _wanted values expl 'value' compadd enable disable
+  ;;
   speed)
-        _wanted -x speed expl 'speed' compadd 10 100 1000
+    _wanted -x speed expl 'speed' compadd 10 100 1000
   ;;
   duplex)
     _wanted duplex expl 'duplex mode' compadd half full
@@ -166,8 +183,14 @@ if [[ -n $state ]]; then
   context)
     _message -e contexts 'RSS context'
   ;;
+  power-mode-policy)
+    _wanted policies expl 'policy' compadd high auto
+  ;;
   *)
     case ${${(Mk)opt_args:#cmd?*}[1]#cmd?-} in
+    -a|--show-pause)
+      _arguments '--src=-:source:(aggregate emac pmac)'
+    ;;
     -A|--pause)
       _values -S ' ' -w 'pause parameter' \
         'autoneg[specify if pause autonegotiation is enabled]' \
@@ -177,14 +200,16 @@ if [[ -n $state ]]; then
     -C|--coalesce)
       _wanted settings expl 'coalescing setting' compadd -F line -M 'r:|-=* r:|=*' - \
         adaptive-{r,t}x {r,t}x-{usecs,frames}{,-irq,-high,-low} \
-        stats-block-usecs pkt-rate-{low,high} sample-interval
+        stats-block-usecs pkt-rate-{low,high} sample-interval cqe-mode-{r,t}x \
+        tx-aggr-{max-bytes,max-frames,time-usecs}
     ;;
     -G|--set-ring)
       _values -S ' ' -w 'ring parameter' \
         'rx[change number of ring entries for the RX ring]' \
         'rx-mini[change number of ring entries for the RX Mini ring]' \
         'rx-jumbo[change number of ring entries for the RX Jumbo ring]' \
-        'tx[change number of ring entries for the TX ring]'
+        'tx[change number of ring entries for the TX ring]' \
+        rx-buf-len cqe-size tx-push rx-push tx-push-buf-len
     ;;
     -d|--register-dump)
       _values -S ' ' -w 'option' \
@@ -216,7 +241,9 @@ if [[ -n $state ]]; then
       (( CURRENT = 4 )) && _message -e length 'duration (seconds)'
     ;;
     -S|--statistics)
-      _arguments '(-)--all-groups' '(-)--groups:eth-phy: :eth-mac: :eth-ctrl: :rmon'
+      _arguments '(-)--all-groups' \
+        '(-)--groups:eth-phy: :eth-mac: :eth-ctrl: :rmon' \
+        '--src=-:source:(aggregate emac pmac)' \
     ;;
     -t|--test)
       _values -S ' ' -w 'test mode' \
@@ -318,7 +345,7 @@ if [[ -n $state ]]; then
     ;;
     --[gs]et-tunable)
       _wanted options expl tunable compadd rx-copybreak tx-copybreak \
-          pfc-prevention-tout
+          tx-buf-size pfc-prevention-tout
     ;;
     --reset)
       _wanted components expl component compadd flags dedicated all \
@@ -341,6 +368,13 @@ if [[ -n $state ]]; then
     --cable-test-tdr)
       _wanted options expl 'distance options' compadd first last step pair
     ;;
+    --set-module)
+      _wanted options expl tunable compadd power-mode-policy
+    ;;
+    --set-plca-cfg)
+      _wanted options expl tunable compadd enable node-id node-cnt \
+          to-tmr burst-cnt burst-tmr
+    ;;
     esac
   ;;
   esac
diff --git a/Completion/Linux/Command/_findmnt b/Completion/Linux/Command/_findmnt
index 0c832364d..b29372c39 100644
--- a/Completion/Linux/Command/_findmnt
+++ b/Completion/Linux/Command/_findmnt
@@ -26,6 +26,7 @@ _arguments -s -C \
   '(H -o --output)--output-all[output all available columns]' \
   '(H -p --poll)'{-p+,--poll=}'[monitor changes in /proc/self/mountinfo]::action:(mount umount remount move)' \
   '(H --real)--pseudo[print only pseudo-filesystems]' \
+  '(H)--shadowed[print only filesystems over-mounted by another filesystem]' \
   '(H -R --submounts)'{-R,--submounts}'[print recursively all submounts]' \
   '(H --pseudo)--real[print only real filesystems]' \
   '(H -S --source :)'{-S+,--source=}'[specify the mount source]: :->sources' \
@@ -35,9 +36,11 @@ _arguments -s -C \
   '(H -U --uniq)'{-U,--uniq}'[ignore filesystems with duplicated mount targets]' \
   '(H -u --notruncate)'{-u,--notruncate}'[do not truncate text in columns]' \
   '(H -v --nofsroot)'{-v,--nofsroot}'[do not print \[/dir\] in the SOURCE column]' \
+  '(H -y --shell -n --noheadings)'{-y,--shell}'[use column names usable as shell variable identifiers]' \
   '(H -w --timeout)'{-w+,--timeout}'[specify timeout for --poll]:milliseconds: ' \
   '(H -x --verify)'{-x,--verify}'[check mount table content]' \
   '(H)--verbose[print more information]' \
+  '(H)--vfs-all[print all VFS options]' \
   '(H)1: :->sources_targets' \
   '(H)2:: :->targets' \
   + '(format)' \
diff --git a/Completion/Linux/Command/_free b/Completion/Linux/Command/_free
index 6d74e4a0d..a0da97446 100644
--- a/Completion/Linux/Command/_free
+++ b/Completion/Linux/Command/_free
@@ -3,6 +3,7 @@
 _arguments -s \
   '(-l --lohi)'{-l,--lohi}'[show detailed low and high memory statistics]' \
   '(-t --total)'{-t,--total}'[show total for RAM + swap]' \
+  '(-v --committed)'{-v,--committed}'[show committed memory and commit limit]' \
   '(-w --wide)'{-w,--wide}'[wide mode]' \
   '(-s --seconds)'{-s,--seconds}'[specify the delay between display]:seconds: ' \
   '(-c --count)'{-c+,--count=}'[specify the display count]:count: ' \
diff --git a/Completion/Linux/Command/_fusermount b/Completion/Linux/Command/_fusermount
index d55eca29c..24f9a8018 100644
--- a/Completion/Linux/Command/_fusermount
+++ b/Completion/Linux/Command/_fusermount
@@ -1,4 +1,4 @@
-#compdef fusermount
+#compdef fusermount fusermount3
 
 local expl context state line
 typeset -A opt_args
diff --git a/Completion/Linux/Command/_gpasswd b/Completion/Linux/Command/_gpasswd
index 24fe361b0..d5d16ebba 100644
--- a/Completion/Linux/Command/_gpasswd
+++ b/Completion/Linux/Command/_gpasswd
@@ -5,7 +5,7 @@ _arguments -s \
   '(-d --delete -a --add)'{-d,--delete}'[remove user from group]: : _users' \
   '(-)'{-h,--help}'[display help]' \
   '(-Q --root)'{-Q,--root}'[specify directory to chroot into]: : _files -/' \
-  '(-r --remove-password)'{-r,--remove-password}'[remove the group password]' \
+  '(-r --delete-password)'{-r,--delete-password}'[remove the group password]' \
   '(-R --restrict)'{-R,--restrict}'[restrict access to GROUP to its members]' \
   '(-M --members -A --administrators)'{-M,--members}'[set the list of members of GROUP]: :_sequence _users' \
   '(-A --administrators -M --members)'{-A,--administrators}'[set the list of admins for GROUP]: :_sequence _users' \
diff --git a/Completion/Linux/Command/_ionice b/Completion/Linux/Command/_ionice
index ba403ca56..9989cd6a9 100644
--- a/Completion/Linux/Command/_ionice
+++ b/Completion/Linux/Command/_ionice
@@ -28,7 +28,7 @@ if [[ -n $state ]]; then
   elif (( $+opt_args[args--u] || $+opt_args[args---uid] )); then
     _message -e uids 'user id'
   else
-    _normal && ret=0
+    _normal -p $service && ret=0
   fi
 fi
 
diff --git a/Completion/Linux/Command/_iptables b/Completion/Linux/Command/_iptables
index 27c801da1..892c48710 100644
--- a/Completion/Linux/Command/_iptables
+++ b/Completion/Linux/Command/_iptables
@@ -1,7 +1,7 @@
-#compdef iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore
+#compdef iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore arptables ebtables
 
-local curcontext="$curcontext" state line expl i ret=1
-local -a cmds rcmds ropts rules states prev args
+local curcontext="$curcontext" i ret=1
+local -a state line expl cmds rcmds ropts rules states prev args
 
 case $service in
   iptables-save | ip6tables-save)
@@ -24,12 +24,12 @@ cmds=(
   -P --policy -E --rename-chain -h --help -V --version
 )
 ropts=(
-  -p --protocol -s --src --source -d --dst --destination -j --jump -i
+  -p --proto --protocol -s --src --source -d --dst --destination -j --jump -i
   --in-interface -o --out-interface -f --fragment -c --set-counters
 )
 
 prev=( ${words[1,CURRENT-1]} )
-case ${prev[${prev[(I)-p|--protocol]}+1]}; in
+case ${prev[${prev[(I)-p|--proto|--protocol]}+1]}; in
   tcp)
     args=(
       '--tcp-flags[match based on TCP flags in a packet]: :->tcp-flags: :->tcp-flags'
@@ -92,7 +92,42 @@ while
   (( i=words[(ib.i.)-m|--match]+1 ))
 (( i<CURRENT )); do
   case ${words[i]}; in
-    ah) args+=( '--ahspi[match SPIs in AH header]:*^!:spi' ) ;;
+    addrtype)
+      args+=(
+        '--src-type[match if the source address is of given type]:type:->address-types'
+        '--dst-type[match if the destination address is of given type]:type:->address-types'
+        '(--limit-iface-out)--limit-iface-in[limit to interface the packet is coming in]'
+        '(--limit-iface-in)--limit-iface-out[limit to interface the packet is going out]'
+      )
+    ;;
+    ah)
+      args+=( '--ahspi[match SPIs in AH header]:*^!:spi' )
+      [[ $service = ip6* ]] && args+=(
+        '--ahlen[total length of this header]:length (octets)'
+        '--ahres[match if the reserved field is filled with zero]'
+      )
+    ;;
+    bpf)
+      args+=(
+        '--object-pinned[pass a path to a pinned eBPF object]:path:_files'
+        '--bytecode[pass BPF byte code as generated by nfbpf_compile]:code'
+      )
+    ;;
+    cgroup)
+      args+=(
+        '--path[match cgroup2 membership]:path:_files -W /sys/fs/cgroup'
+        '--cgroup[match cgroup net_cls classid]:classid'
+      )
+    ;;
+    cluster)
+      args+=(
+        '--cluster-total-nodes[set number of total nodes in cluster]:number'
+        '--cluster-local-node[set the local node number ID]:number'
+        '--cluster-local-nodemask[set the local node number ID mask]:mask'
+        '--cluster-hash-seed[set seed value of the Jenkins hash]:value'
+      )
+    ;;
+    comment) args+=( '--comment[add comment to rule]:comment' ) ;;
     conntrack)
       args+=(
         '--ctstate[match packet state]:state:->cfstates'
@@ -160,30 +195,34 @@ _arguments -C -s \
   '(-)'{-V,--version}'[print version information]' \
   '(-h --help -V --version)'{-t,--table}'[specify table]:table:(filter nat mangle raw security)' \
   "($rcmds $cmds)"{-A,--append}'[append rules to end of specified chain]:chain:->chains' \
+  {-C,--check}'[check for the existence of a rule]' \
   "($rcmds $cmds -c --set-counters)"{-D,--delete}'[delete rules from specified chain]:chain:->chains::rule number:->rulenums' \
   "($rcmds $cmds)"{-I,--insert}'[insert rules before specified rule number]:chain:->chains::rule number:->rulenums' \
   "($rcmds $cmds)"{-R,--replace}'[replace a rule]:chain:->chains::rule number:->rulenums' \
-  "($rcmds "${(j. .)cmds:#(-Z|--zero)}" $ropts)"{-L,--list}'[list rules in selected chain]::chain:->chains' \
+  "($rcmds "${(j. .)cmds:#(-Z|--zero)}" $ropts)"{-L,--list}'[list rules in selected chain]::chain:->chains:rule number:->rulenums' \
+  '(-L --list -S --list-rules)'{-S,--list-rules}'[list rules in the form of options to iptables]::chain:->chains::rule number:->rulenums' \
   "($rcmds $cmds $ropts)"{-F,--flush}'[flush specified chain (delete all rules)]::chain:->chains' \
   "($rcmds "${(j. .)cmds:#(-L|--list)}" $ropts)"{-Z,--zero}'[zero the packet and byte counters]::chain:->chains' \
   "($rcmds $cmds)"{-N,--new,--new-chain}'[create a new user-defined chain]:chain name' \
   "($rcmds $cmds)"{-X,--delete-chain}'[delete a user-defined chain]:: :->user-chains' \
   "($rcmds $cmds)"{-P,--policy}'[set the policy for a chain to given target]:chain:->chains:target:->targets' \
   "($rcmds $cmds)"{-E,--rename-chain}'[rename a user-defined chain]:old chain:->user-chains:new chain name' \
-  "($cmds -p --protocol)"{-p,--protocol}'[specify protocol of rule]:*^!:protocol:(! tcp udp icmp all)' \
-  "($cmds -s --src --source)"{-s,--src,--source}'[specify source]:*^!:network:_hosts' \
-  "($cmds -d --dst --destination)"{-d,--dst,--destination}'[specify destination]:*^!:network:_hosts' \
+  "($cmds -p --proto --protocol)"{-p,--proto,--protocol}'[specify protocol of rule]:*^!:protocol:(! tcp udp icmp all)' \
+  "($cmds -s --src --source)"{-s,--src,--source}'[specify source]:*^!:network:_sequence _hosts' \
+  "($cmds -d --dst --destination)"{-d,--dst,--destination}'[specify destination]:*^!:network:_sequence _hosts' \
   "($cmds -j --jump)"{-j,--jump}'[specify rule target]:target:->targets' \
   "($cmds -i --in-interface)"{-i,--in-interface}'[specify interface via which packet is received]:*^!:interface:_net_interfaces' \
   "($cmds -o --out-interface)"{-o,--out-interface}'[specify interface via which packet is to be sent]:*^!:interface:_net_interfaces' \
   "($cmds -f --fragment)"{-f,--fragment}'[match second or further fragments only]' \
   "($cmds -D --delete -c --set-counters)"{-c,--set-counters}'[initialise packet and byte counters]:packets: :bytes' \
   '(-v --verbose)'{-v,--verbose}'[enable verbose output]' \
+  '(-w --wait)'{-w,--wait}'[specify maximum wait to acquire xtables lock before giving up]: :_numbers -u seconds -d 1 wait' \
+  '(-W --wait-interval)'{-W,--wait-interval}'[specify wait time to try to acquire xtables lock]: :_numbers -u usecs -d "1 second" wait' \
   '(-n --numeric)'{-n,--numeric}'[print IP addresses and port numbers in numeric format]' \
   '(-x --exact)'{-x,--exact}'[expand numbers (display exact values)]' \
   '--line-numbers[print line numbers when listing]' \
   '--modprobe=[specify command to load modules with]:command:_command_names -e' \
-  "($cmds)*"{-m,--match}'[extended match (may load extension)]:extension:(ah conntrack dscp esp helper icmp length limit mac mark multiport owner physdev pkttype state tcp tos ttl udp unclean)' \
+  "($cmds)*"{-m,--match}'[extended match (may load extension)]:extension:(addrtype ah bpf cgroup cluster comment connbytes connlabel connlimit connmark conntrack cpu dccp devgroup dscp dsr ecn esp eui64 frag hashlimit hbh helper hl icmp icmp6 iprange ipv6header ipvs length limit mac mark mh multiport nfacct osf owner physdev pkttype policy quota rateest realm recent rpfilter rt sctp set socket state statistic string tcp tcpmss time tos ttl u32 udp unclean)' \
   "$args[@]" && ret=0
 
 case "$state" in
@@ -230,6 +269,11 @@ case "$state" in
     [[ "$state" = cf* ]] && states+=( SNAT DNAT )
     _values -s , 'state' $states && return
   ;;
+  address-types)
+    _wanted address-types expl 'address type' compadd \
+        UNSPEC UNICAST LOCAL BROADCAST ANYCAST MULTICAST \
+        BLACKHOLE UNREACHABLE PROHIBIT THROW NAT XRESOLVE && ret=0
+  ;;
   port-list)
     compset -P '*,'
     if compset -S ',*'; then
diff --git a/Completion/Linux/Command/_lsblk b/Completion/Linux/Command/_lsblk
index 8a9bc18bf..63aac743c 100644
--- a/Completion/Linux/Command/_lsblk
+++ b/Completion/Linux/Command/_lsblk
@@ -6,16 +6,19 @@ local curcontext="$curcontext" state line expl
 typeset -A opt_args
 
 _arguments -C -s -S \
+  '(H -A --noempty)'{-A,--noempty}"[don't print empty devices]" \
   '(H -E --dedup)'{-E+,--dedup=}'[de-duplicate output by specified column]:column:->columns' \
   '(H -a --all)'{-a,--all}'[print all devices]' \
   '(H -b --bytes)'{-b,--bytes}'[print size in bytes rather than in human readable format]' \
   '(H -d --nodeps)'{-d,--nodeps}"[don't print slaves or holders]" \
   '(H -I --include)*'{-e,--exclude}'[exclude devices by major number]:major device number:->majorlist' \
   '(H -e --exclude)*'{-I+,--include=}'[show only devices with specified major numbers]:major device number:->majorlist' \
-  '(H -n --noheadings)'{-n,--noheadings}"[don't print headings]" \
+  '(H -n --noheadings -y --shell)'{-n,--noheadings}"[don't print headings]" \
   '(H -p --paths)'{-p,--paths}'[print complete device path]' \
   '(H -s --inverse)'{-s,--inverse}'[reverse dependency order]' \
+  '(H -w --width)'{-w+,--width=}'[specify output width]:width' \
   '(H -x --sort)'{-x+,--sort=}'[sort output by specified column]:column:->columns' \
+  '(H -y --shell -n --noheadings)'{-y,--shell}'[use column names usable as shell variable identifiers]' \
   '(H)--sysroot=[use specified directory as system root]:directory:_directories' \
   '*:device:_files -g "*(-%b)" -P / -W /' \
   + fields \
@@ -24,6 +27,8 @@ _arguments -C -s -S \
   '(H -f --fs -o --output -O --output-all)'{-f,--fs}'[output info about filesystems]' \
   '(H -m --perms -o --output -O --output-all)'{-m,--perms}'[output info about permissions]' \
   '(H -S --scsi -o --output -O --output-all)'{-S,--scsi}'[output info about SCSI devices]' \
+  '(H -N --nvme -o --output -O --output-all)'{-N,--nvme}'[output info about NVMe devices]' \
+  '(H -v --virtio -o --output -O --output-all)'{-v,--virtio}'[output info about virtio devices]' \
   '(H -t --topology -o --output -O --output-all)'{-t,--topology}'[output info about topology]' \
   '(H fields)'{-o+,--output=}'[specify output columns]:output column:->columnlist' \
   '(H fields)'{-O,--output-all}'[output all columns]' \
diff --git a/Completion/Linux/Command/_networkmanager b/Completion/Linux/Command/_networkmanager
index 1e05252b2..d44c313db 100644
--- a/Completion/Linux/Command/_networkmanager
+++ b/Completion/Linux/Command/_networkmanager
@@ -42,8 +42,24 @@ _nm_fields() {
 }
 
 _nm_general() {
-  _arguments "1:command:(status hostname permissions logging help)"
-  # TODO: provide completions for logging
+  local curcontext="$curcontext" state line
+  _arguments "1:command:(status hostname permissions logging reload help)" \
+    "*::arguments:->args"
+
+  case $line[1] in
+    l*)
+      _values -w -S ' ' values \
+        'level:level' \
+        'domains:domain'
+    ;;
+    r*)
+      _describe -t flags 'flag' '(
+        "conf:NetworkManager.conf configuration"
+        "dns-rc:update DNS configuration"
+        "dns-full:restart the DNS plugin"
+      )'
+    ;;
+  esac
 }
 
 _nm_networking() {
diff --git a/Completion/Linux/Command/_pidof b/Completion/Linux/Command/_pidof
index dd0649ce9..151a0e0f6 100644
--- a/Completion/Linux/Command/_pidof
+++ b/Completion/Linux/Command/_pidof
@@ -3,19 +3,51 @@
 local curcontext="$curcontext" state line expl ret=1
 typeset -A opt_args
 
-local exargs="-h --help -V --version"
-_arguments -C -s -w \
-  '(- *)'{-h,--help}'[display help information]' \
-  '(- *)'{-V,--version}'[print program version]' \
-  "(-s --single-shot $exargs)"{-s,--single-shot}'[return one PID only]' \
-  "(-c --check-root $exargs)"{-c,--check-root}'[omit processes with different root]' \
-  '-q[quiet mode, only set the exit code]' \
-  '(-w --with-workers)'{-w,--with-workers}'[show kernel workers too]' \
-  "(-x $exargs)"-x'[include shells running named scripts]' \
-  "($exargs)"\*{-o+,--omit-pid=}'[omit processes with PIDs]:pids:_sequence -s , _pids' \
-  '(-S --separator)'{-S+,--separator=}'[specify separator put between PIDs]:separator' \
-  '*:process:->procnames' \
-  && return 0
+_pick_variant -r variant procps='--separator' $OSTYPE -h
+
+case $variant in
+  (procps)
+    local exargs="-h --help -V --version"
+    _arguments -C -s -w \
+      '(- *)'{-h,--help}'[display help information]' \
+      '(- *)'{-V,--version}'[print program version]' \
+      "(-s --single-shot $exargs)"{-s,--single-shot}'[return one PID only]' \
+      "(-c --check-root $exargs)"{-c,--check-root}'[omit processes with different root]' \
+      '-q[quiet mode, only set the exit code]' \
+      '(-w --with-workers)'{-w,--with-workers}'[show kernel workers too]' \
+      "(-x $exargs)"-x'[include shells running named scripts]' \
+      "($exargs)"\*{-o+,--omit-pid=}'[omit processes with PIDs]:pids:_sequence -s , _pids' \
+      '(-S --separator)'{-S+,--separator=}'[specify separator put between PIDs]:separator' \
+      '*:process:->procnames' \
+      && return 0
+    ;;
+  (darwin*)
+    # Night Production pidof
+    _arguments -s -w \
+      '(- *)'{-h,-\?}'[display help information]' \
+      '(- *)-v[print out version info on pidof]' \
+      '-l[print output in long format]' \
+      '-k[kill processes by name]' \
+      '*:process:_process_names -a' \
+      && return 0
+    ;;
+  (*)
+    # sysvinit-utils
+    _arguments -C -s -w \
+      '(- *)-h[display help information]' \
+      '-c[return PIDs with the same root directory]' \
+      '-d[use the provided character as output separator]:separator' \
+      '-n[avoid using stat system function on network shares]' \
+      '-o[omit results with a given PID]:pid:_sequence -s , _pids' \
+      '-s[return one PID only]' \
+      '-q[quiet mode. Do not display output]' \
+      '-s[only return one PID]' \
+      '-x[return PIDs of shells running scripts with a matching name]' \
+      '-z[list zombie and I/O waiting processes. May cause pidof to hang]' \
+      '*:process:->procnames' \
+      && return 0
+    ;;
+esac
 
 case $state in
   procnames)
diff --git a/Completion/Linux/Command/_selinux b/Completion/Linux/Command/_selinux
new file mode 100644
index 000000000..a7ba68952
--- /dev/null
+++ b/Completion/Linux/Command/_selinux
@@ -0,0 +1,796 @@
+#compdef audit2allow audit2why avcstat chcon checkmodule checkpolicy fixfiles getpidprevcon getsebool matchpathcon newrole restorecon runcon sealert secon sedta seinfo selinuxconlist selinuxdefcon selinuxexeccon semanage semodule semodule_unpackage sepolgen sepolicy sesearch sestatus setenforce setsebool validatetrans
+
+# encompasses checkpolicy libselinux-utils policycoreutils
+# policycoreutils-devel policycoreutils-python-utils setools-console
+# setools-console-analyses setroubleshoot-server and a few utilities from
+# coreutils
+
+_selinux_attributes() {
+  local -a seattrs expl
+
+  seattrs=( ${(f)"$(_call_program selinux-attributes seinfo --flat -a)"} )
+  _description selinux-attrs expl "selinux attribute"
+  compadd "$@" "$expl[@]" -a seattrs
+}
+
+_selinux_bools() {
+  local -a sebools expl
+
+  sebools=( ${(f)"$(_call_program selinux-bools seinfo --flat -b)"} )
+  _description selinux-bools expl "selinux boolean"
+  compadd "$@" "$expl[@]" -a sebools
+}
+
+_selinux_categories() {
+  local -a secats expl
+
+  secats=( ${(f)"$(_call_program selinux-categories seinfo --flat --category)"} )
+  _description selinux-categories expl "selinux category"
+  compadd "$@" "$expl[@]" -a secats
+}
+
+_selinux_classes() {
+  local -a seclasses expl
+
+  seclasses=( ${(f)"$(_call_program selinux-classes seinfo --flat -c)"} )
+  _description selinux-classes expl "selinux object class"
+  compadd "$@" "$expl[@]" -a seclasses
+}
+
+_selinux_commons() {
+  local -a secommons expl
+
+  secommons=( ${(f)"$(_call_program selinux-commons seinfo --flat --common)"} )
+  _description selinux-commons expl "selinux common permission set"
+  compadd "$@" "$expl[@]" -a secommons
+}
+
+_selinux_interfaces() {
+  local -a seints expl
+
+  seints=( ${(f)"$(_call_program selinux-interfaces sepolicy interface -l)"} )
+  _description selinux-interfaces expl "selinux interface"
+  compadd "$@" "$expl[@]" -a seints
+}
+
+_selinux_permissions() {
+  local -a seperms expl
+
+  seperms=( ${${${${(f)"$(_call_program selinux-permissions seinfo -c --flat -x)"}:#[^[:blank:]]*}#[[:blank:]]}:1} )
+  _description selinux-permissions expl "selinux permission"
+  compadd "$@" "$expl[@]" -a seperms
+}
+
+_selinux_sids() {
+  local -a sesids expl
+
+  sesids=( ${(f)"$(_call_program selinux-sids seinfo --flat --initialsid)"} )
+  _description selinux-sids expl "selinux SID"
+  compadd "$@" "$expl[@]" -a sesids
+}
+
+_selinux_sens() {
+  local -a sens expl
+
+  sesids=( ${(f)"$(_call_program selinux-sens seinfo --flat --initialsid)"} )
+  _description selinux-sensitivities expl "selinux sensitivity"
+  compadd "$@" "$expl[@]" -a sesids
+}
+
+_selinux_modules() {
+  local -a modules expl
+
+  modules=( ${(f)"$(_call_program selinux-modules semodule -l)"} )
+  _description selinux-modules expl "selinux module"
+  compadd "$@" "$expl[@]" -a modules
+}
+
+local curcontext="$curcontext" ret=1
+local -A opt_args
+local -a args sepolgen state state_descr line
+local ign
+(( $#words > 2 )) && ign='!'
+
+sepolgen=(
+  "${ign}(-h --help)"{-h,--help}'[display help information]'
+  '(--application --cgi --dbus --inetd --init --admin_user --confined_admin --desktop_user --newtype --sandbox --x_user)'*{-d+,--domain=}'[specify domain to expand]:domain:_selinux_types -a domain'
+  \*{-r+,--role=}'[specify role(s) to which the administrator domain will transition]: :_selinux_roles'
+  \*{-u+,--user=}'[specify SELinux user(s) which will transition to this domain]: :_selinux_users'
+  \*{-a+,--admin=}'[specify domain(s) which this confined admin will administrate]:admin domain:_selinux_types'
+  '(-n --name)'{-n+,--name=}'[specify name of policy to generate]:name'
+  '(--admin_user --confined_admin --desktop_user --newtype --sandbox --x_user)*'{-t+,--type=}'[specify type(s) for which you will generate new definition and rule(s)]:type:_selinux_types'
+  '(-p --path)'{-p+,--path=}'[specify path in which the generated policy files will be stored]:path:_directories'
+  '(--newtype)*'{-w+,--writepath=}'[specify path to which the confined processes will need to write]:path:_directories'
+  '1:command:_files'
+  + '(application)'
+  "(-d)--application[generate 'User Application' policy]"
+  "(-d)--cgi[generate 'Web Application/Script (CGI)' policy]"
+  "(-d)--dbus[generate 'DBUS System Daemon' policy]"
+  "(-d)--inetd[generate 'Internet Services Daemon' policy]"
+  "(-d)--init[generate 'Standard Init Daemon' policy]"
+  "(-d -t 1)--admin_user[generate 'Administrator Login User Role' policy]"
+  "(-d -t 1)--confined_admin[generate 'Confined Root Administrator Role' policy]"
+  "(1)--customize[generate 'Existing Domain Type' policy]"
+  "(-d -t 1)--desktop_user[generate 'Desktop Login User Role' policy]"
+  "(-d -w 1)--newtype[generate 'Module information for a new type' policy]"
+  "(-d -t 1)--sandbox[generate 'Sandbox' policy]"
+  "(-d -t 1)--term_user[generate 'Minimal Terminal Login User Role' policy]"
+  "(-d -t 1)--x_user[generate 'Minimal X Windows Login User Role' policy]"
+)
+
+case $service in
+  check(module|policy))
+    args=(
+      '(-b --binary)'{-b,--binary}'[read an existing binary policy file rather than a source policy.conf file]'
+      '(-C --cil)'{-C,--cil}'[write CIL policy file rather than binary policy file]'
+      '(-E --werror)'{-E,--werror}'[treat warnings as errors]'
+      "${ign}(-h --help)"{-h,--help}'[display help information]'
+      '(-U --handle-unknown)'{-U+,--handle-unknown=}'[specify how the kernel should handle unknown classes or permissions]:action:(deny allow reject)'
+      '(-M --mls)'{-M,--mls}'[enable the MLS policy when checking and compiling the policy]'
+      '(-o --output)'{-o+,--output=}'[write a policy file]:file:_files'
+      '-c+[specify the policy version]:policy version [latest]'
+      ':input file:_files'
+    )
+  ;|
+
+  audit2(allow|why))
+    args=(
+      '(-b --boot -i --input)'{-b,--boot}'[audit messages since last boot]'
+      '(-a --all -i --input -d --dmesg)'{-a,--all}'[read input from audit log]'
+      '(-p --policy)'{-p+,--policy=}'[specify policy file to use for analysis]:file:_files'
+      '(-d --dmesg -a --all -i --input)'{-d,--dmesg}'[read input from dmesg]'
+      '(-i --input -a --all -b --boot)'{-i+,--input=}'[read input from file]:file:_files'
+      '(-l --lastreload)'{-l,--lastreload}'[read input only after the last reload]'
+      '(-r --requires)'{-r,--requires}'[generate require statements for rules]'
+      '(-m --module -M --module-package -r --requires)'{-m+,--module=}'[set the module name]:module name:_selinux_modules'
+      '(-M --module-package -o --output -m --module)'{-M+,--module-package=}'[generate a module package]:module package:_files'
+      '(-o --output -M --module-package)'{-o+,--output=}'[append output to file]:file:_files'
+      '(-D --dontaudit)'{-D,--dontaudit}'[generate policy with dontaudit rules]'
+      '(-R --reference)'{-R,--reference}'[use installed macros in generated policy]'
+      '!(-R --reference -N --noreference)'{-N,--noreference}
+      '(-v --verbose)'{-v,--verbose}'[explain generated output]'
+      '(-e --explain)'{-e,--explain}'[fully explain generated output]'
+      '(-t --type)'{-t+,--type=}'[only process messages with type matching regex]:type'
+      '--perm-map=[specify file name of perm map]:file:_files'
+      '--interface-info=[specify file name of interface information]:file:_files'
+      '(-x --xperms)'{-x,--xperms}'[generate extended permission rules]'
+      '--debug[leave generated modules for -M]'
+      '(-w --why)'{-w,--why}'[translate SELinux audit messages into a description of why the access was denied]'
+      "${ign}(-h --help)"{-h,--help}'[display help information]'
+      "${ign}--version[display version information]"
+    )
+  ;;
+
+  avcstat)
+    args=(
+      '-c[cumulative]'
+      '-f+[specify AVC statistics file]:file [/sys/fs/selinux/avc/cache_stats]:_files'
+      ': :_guard "^-*" "interval (seconds)"'
+    )
+  ;;
+
+  chcon)
+    args=( -S
+      '(-h --no-dereference)--dereference[dereference symlinks]' \
+      '(-h --no-dereference --dereference)'{-h,--no-dereference}'[operate on symlinks themselves]' \
+      '(1 -u --user -r --role  -l --range -t --type)--reference=[copy security context of specified file]:file:_files' \
+      '(1 --reference -u --user)'{-u+,--user=}'[set user in the target security context]: :_selinux_users' \
+      '(1 --reference -r --role)'{-r+,--role=}'[set role in the target security context]: :_selinux_roles' \
+      '(1 --reference -t --type)'{-t+,--type=}'[set type in the target security context]: :_selinux_types' \
+      '(1 --reference -l --range)'{-l+,--range=}'[set range in the target security context]:selinux range' \
+      '(--recursive -R)'{--recursive,-R}'[recurse subdirectories]' \
+      '(-v --verbose)'{-v,--verbose}'[output a diagnostic for every file processed]' \
+      '(-H -L -P)-H[follow symlinks on the command line]' \
+      '(-H -L -P)-L[follow all symlinks]' \
+      "(-H -L -P)-P[don't follow symlinks (default)]" \
+      '!(--preserve-root)--no-preserve-root' \
+      "--preserve-root[fail to operate recursively on '/']" \
+      '(--reference -u --user -r --role  -l --range -t --type)1:security context:_selinux_contexts' \
+      "${ign}--help[display help information]" \
+      "${ign}--version[display version information]" \
+      '*:file:_files'
+    )
+  ;;
+
+  checkmodule)
+    args=(
+      "${ign}(-)"{-V,--version}'[show policy versions created by this program]'
+      '-m[build a policy module instead of a base module]'
+      '-c+[build a policy module targeting a modular policy version]:version (4-21)'
+    )
+  ;;
+
+  checkpolicy)
+    args=(
+      '(-F --conf)'{-F,--conf}'[write policy.conf file rather than binary policy file]'
+      '(-d --debug)'{-d,--debug}'[enter debug mode after loading the policy]'
+      '(-S --sort)'{-S,--sort}'[sort ocontexts before writing out the binary policy]'
+      '(-t --target)'{-t+,--target=}'[specify the target platform]:platform:(selinux xen)'
+      '(-O --optimize)'{-O,--optimize}'[optimize the final kernel policy (remove redundant rules)]'
+      "${ign}(-)"{-V,--version}'[display version information]'
+    )
+  ;;
+
+  fixfiles)
+    args=(
+      '-B[record current date in /.autorelabel to speed later labeling]'
+      '-F[force reset of context to match file_context for customizable files]'
+      '-f[clear /tmp directory without prompt for removal]'
+      '-R+[discover files from specified rpm packages]:package'
+      '-C+[run a diff on the specified file]:file:_files'
+      '-N+[only act on files created after the specified date]:date (YYYY-MM-DD HH\:MM):_dates'
+      '-v[show changes in file labels]'
+      '-T+[specify number of threads to use]:threads'
+      '1::action:(check verify restore relabel onboot)'
+      '*:file:_files'
+    )
+  ;;
+
+  getpidprevcon)
+    _pids
+    return
+  ;;
+
+  getsebool)
+    args=(
+      '(:)-a[show all booleans]'
+      '(-a):boolean:_selinux_bools'
+    )
+  ;;
+
+  matchpathcon)
+    args=(
+      '-m+[force file type for the lookup]:type:(file dir pipe chr_file blk_file lnk_file sock_file)'
+      "-n[don't display path]"
+      "-N[don't use translations]"
+      '-f+[use alternate file_context file]:file:_files'
+      '-p+[use prefix to speed translations]:prefix'
+      '-P+[use alternate policy root path]:path:_directories'
+      '-V[verify file context on disk matches defaults]'
+      '*:file path:_files'
+    )
+  ;;
+
+  newrole)
+    local cmd cpp
+    cmd="$words[1]"
+    cpp='_comp_priv_prefix=( $cmd ${(kv)opt_args[(I)-([rtl]|-role|-type|-level)]} )'
+    args=(
+      '(-r --role)'{-r+,--role=}'[specify role]: :_selinux_roles'
+      '(-t --type)'{-t+,--type=}'[specify type]: :_selinux_types'
+      '(-l --level)'{-l+,--range=}'[specify level]:level'
+      '(-p --preserve-environment)'{-p,--preserve-environment}"[don't create new minimal environment]"
+      "${ign}(-)"{-V,--version}'[display version information]'
+      "(-)1: :{ $cpp; _command_names -e }" \
+      "*:: :{ $cpp; _normal }"
+    )
+  ;;
+
+  restorecon)
+    args=(
+      '*-e+[exclude a directory]:directory:_directories'
+      '-f+[provide list of files to be processed]:file:_files'
+      '-F[force reset of context to match file_context for customizable files]'
+      "-i[ignore files that don't exist]"
+      '-I[ignore digest to force checking of labels even if SHA256 digest matches]'
+      '-D[set or update any directory SHA256 digests]'
+      '-m[include non-seclabel mounts in relabeling checks]'
+      "-n[don't change any file labels (passive check)]"
+      '(-v)-p[show progress]'
+      '(-R -r)'{-R,-r}'[change file labels recursively]'
+      '(-p)-v[show changes in file labels]'
+      '-W[display warnings about entries that had no matching files]'
+      '-0[expect NUL characters as input filename separators]'
+      "-x[don't cross file system boundaries]"
+      '-T+[specify number of threads to use]:threads'
+      "${ign}(-)"{-h,-\?}'[display help information]'
+      '*:file path:_files'
+    )
+  ;;
+
+  runcon)
+    args=(
+      '(1 -c --compute)'{-c,--compute}'[compute process transition context before modifying]'
+      '(1 -t --type)'{-t+,--type=}'[specify type]: :_selinux_types'
+      '(1 -u --user)'{-u+,--user=}'[specify user identity]: :_selinux_users'
+      '(1 -r --role)'{-r+,--role=}'[specify role]: :_selinux_roles'
+      '(1 -l --range)'{-l+,--range=}'[specify level range]:range'
+      '(-)1:security context:_selinux_contexts'
+      '*:::args:_normal'
+    )
+  ;;
+
+  sealert)
+    args=(
+      '(-b --browser)'{-b,--browser}'[launch the browser]'
+      '(-s --service -S --noservice)'{-s,--service}'[start sealert as a dbus service]'
+      '(-S --noservice -s --service)'{-S,--noservice}'[start sealert without dbus service as standalone app]'
+      '(-l --lookupid)'{-l+,--lookupid=}'[lookup alert by id, id may be wildcard * to lookup all alerts]:id'
+      '(-a --analyze)'{-a+,--analyze=}'[scan a log file, analyze its AVCs]:log file:_files'
+      '(-u --user)'{-u+,--user=}'[logon user name]:username'
+      '(-p --password)'{-p+,--password=}'[logon user password]:password'
+      '(-P --plugin)'{-P+,--plugin=}'[specify plugin name, required for -f]:plugin name'
+      '(-f --fix)'{-f+,--fix=}'[fix avc with the given uuid, requires plugin]:uuid'
+      "${ign}(-)"{-h,--help}'[display help information]'
+    )
+  ;;
+
+  secon)
+    args=(
+      "${ign}(-)"{-h,--help}'[display help information]'
+      "${ign}(-)--version[display version information]"
+      '(-P --prompt)'{-P,--prompt}'[output in a format good for a prompt]'
+      '(-u --user)'{-u,--user}'[show user of the context]'
+      '(-r --role)'{-r,--role}'[show role of the context]'
+      '(-t --type)'{-t,--type}'[show type of the context]'
+      '(-s --sensitivity)'{-s,--sensitivity}'[show sensitivity level of the context]'
+      '(-c --clearance)'{-c,--clearance}'[show clearance level of the context]'
+      '(-m --mls-range)'{-m,--mls-range}'[show sensitivity to clearance range of]'
+      '(-R --raw)'{-R,--raw}'[output context in "raw" format]'
+      '(-C --color)'{-C,--color}'[output using ANSI color codes (requires -P)]'
+      + '(context)'
+      {--self,--current}'[get context for the current process]'
+      {--self-exec,--current-exec}'[get exec context for the current process]'
+      {--self-fs,--current-fs}'[get fs context for the current process]'
+      {--self-key,--current-key}'[get key context for the current process]'
+      '--parent[get context for the parent process]'
+      '--parent-exec[get exec context for the parent process]'
+      '--parent-fs[get fs context for the parent process]'
+      '--parent-key[get key context for the parent process]'
+      {-p+,--pid=}'[context from the specified pid]:pid:_pids'
+      '--pid-exec[use exec context from the specified pid]:pid:_pids'
+      '--pid-fs[use fs context from the specified pid]:pid:_pids'
+      '--pid-key[use key context from the specified pid]:pid:_pids'
+      {-f+,--file=}'[use context from the specified file]:file:_files'
+      {-L+,--link=}"[use context from the specified file, doesn't follow symlinks]:file:_files"
+      ':context:_selinux_contexts'
+    )
+  ;;
+
+  sedta)
+    args=(
+      '(-p --policy)'{-p+,--policy=}'[specify path to SELinux policy to analyze]:policy:_files'
+      '(-s --source)'{-s+,--source=}'[specify source type of the analysis]:source:_selinux_types -a domain'
+      '(-t --target)'{-t+,--target=}'[specify target type of the analysis]:target:_selinux_types -a domain'
+      '--full[print rule lists for transitions]'
+      '--stats[display statistics at the end of the analysis]'
+      '(-v --verbose)'{-v,--verbose}'[extra informational messages]'
+      '--debug[enable debugging]'
+      '(-S --shortest_path)'{-S,--shortest_path}'[calculate all shortest paths]'
+      '(-A --all_paths)'{-A+,--all_paths=}'[calculate all paths]:max steps'
+      '(-r --reverse)'{-r,--reverse}'[perform a reverse DTA]'
+      '(-l --limit_trans)'{-l+,--limit_trans=}'[limit to the specified number of transitions]:limit'
+      '*:excluded domain:_selinux_types -a domain'
+      "${ign}(- *)"{-h,--help}'[display help information]'
+      "${ign}(-)--version[display version information]"
+    )
+  ;;
+
+  seinfo)
+    args=(
+      '(-a --attribute)'{-a,--attribute}'[list attributes or print named attribute]:: :_selinux_attributes'
+      '(-b --bool)'{-b,--bool}'[list booleans or print named boolean]:: :_selinux_bools'
+      '(-c --class)'{-c,--class}'[list object classes or print named object class]:: :_selinux_classes'
+      '(-r --role)'{-r,--role}'[list roles or print named role]:: :_selinux_roles'
+      '(-t --type)'{-t,--type}'[list types or print named type]:: :_selinux_types'
+      '(-u --user)'{-u,--user}'[list users or print named user]:: :_selinux_users'
+      '--category[list categories or print named category]:: :_selinux_categories'
+      '--common[list common permission sets or print named common]:: :_selinux_commons'
+      '--constrain[list constraints or print constraints for named object class]:: :_selinux_classes'
+      '--default[list default_* statements or print statements for named object class]:: :_selinux_classes'
+      '--fs_use[list fs_use_* statements or print statements for named filesystem type]:: :_file_systems'
+      '--genfscon[list genfscon statements or print statements for named filesystem type]:: :_file_systems'
+      '--initialsid[list initial SIDs or print named SID]:: : _selinux_sids'
+      '--netifcon[list netif contexts or print for named interface]:: : _net_interfaces'
+      '--nodecon[list node contexts or print statement for node with specified address]::address'
+      '--permissive[list permissive types or print named statement]::type'
+      '--polcap[list policy capabilities or print named statement]::type'
+      '--portcon[list port contexts or print statements for port range]::port range'
+      '--sensitivity[list sensitivities or print named sensitivity]:: :_selinux_sens'
+      '--typebounds[list type bounds or print named bound type]:: :_selinux_typebounds'
+      '--validatetrans[list validatetrans rules or print constraints for named object class]:: :_selinux_classes'
+      '--all[list all components]'
+      '(-x --expand)'{-x,--expand}'[print additional details]'
+      '--flat[exclude headers and indentation in output]'
+      '(-v --verbose)'{-v,--verbose}'[print additional informational messages]'
+      '--debug[enable debugging output]'
+      "${ign}--help[display help information]"
+      "${ign}--version[display version information]"
+      ':policy:_files'
+    )
+  ;;
+
+  selinuxconlist)
+    args=(
+      '-l+[specify mcs/mls level]:level'
+      ':user:_selinux_users'
+      ':context:_selinux_contexts'
+    )
+  ;;
+
+  selinuxdefcon)
+    args=(
+      '-l+[specify mcs/mls level]:level'
+      ':user:_users'
+      ':context:_selinux_contexts'
+    )
+  ;;
+
+  selinuxexeccon)
+    args=(
+      '1:command:_files -g "*(-*)"'
+      '2:from context:_selinux_contexts'
+    )
+  ;;
+
+  semanage)
+    _arguments -C \
+      {-h,--help}'[display help information]' \
+      ': :->command' \
+      '*::: := ->option-or-argument' && ret=0
+
+    case $state in
+      command)
+        local -a subcmds
+
+        subcmds=(
+          import:'import local customizations'
+          export:'output local customizations'
+          login:'manage login mappings between linux users and SELinux confined users'
+          user:'manage SELinux confined users (Roles and levels for an SELinux user)'
+          port:'manage network port type definitions'
+          interface:'manage network interface type definitions'
+          module:'manage SELinux policy modules'
+          node:'manage network node type definitions'
+          fcontext:'manage file context mapping definitions'
+          boolean:'manage booleans to selectively enable functionality'
+          permissive:'manage process type enforcement mode'
+          dontaudit:'disable/enable dontaudit rules in policy'
+          ibpkey:'manage infiniband pkey type definitions'
+          ibendport:'manage infiniband end port type definitions'
+        )
+
+        _describe -t commands command subcmds
+        return
+      ;;
+      option-or-argument)
+        (( $#words > 2 )) && ign='!' || ign=''
+        curcontext=${curcontext%:*}-$line[1]:
+        args=(
+          "${ign}(-)"{-h,--help}'[display help information]'
+          '(-S --store)'{-S+,--store=}'[select an alternate SELinux Policy Store to manage]:store:_files'
+        )
+
+        case $line[1] in
+          ^export)
+            args+=( '(-N --noreload)'{-N,--noreload}"[don't reload policy after commit]" )
+          ;|
+          boolean|fcontext|ibendport|ibpkey|interface|login|module|node|port|user)
+            args+=( '(-C --locallist)'{-C,--locallist}'[list local customizations]' )
+          ;|
+          boolean|fcontext|ibendport|ibpkey|interface|login|module|node|permissive|port|user)
+            args+=(
+              '(-n --noheading)'{-n,--noheading}"[don't print list heading]"
+              '(-l --list)'{-l,--list}'[list records]'
+              '(-E --extract)'{-E,--extract}'[extract customizable commands, for use within a transaction]'
+            )
+          ;|
+          fcontext|ibendport|ibpkey|interface|login|module|node|permissive|port|user)
+            args+=( '(-a --add)'{-a,--add}'[add a record]' )
+          ;|
+          boolean|fcontext|ibendport|ibpkey|interface|login|node|permissive|port|user)
+            args+=(
+              '(-d --delete)'{-d,--delete}'[delete a record]'
+              '(-D --deleteall)'{-D,--deleteall}'[remove all local customizations]'
+            )
+          ;|
+          boolean|fcontext|ibendport|ibpkey|interface|login|node|port|user)
+            args+=( '(-m --modify)'{-m,--modify}'[modify a record]' )
+          ;|
+          fcontext|login)
+            args+=( '(-s --seuser)'{-s+,--seuser=}'[SELinux user name]:seuser:_selinux_users' )
+          ;|
+          fcontext|ibendport|ibpkey|interface|node|port)
+            args+=( '(-t --type)'{-t+,--type=}'[SELinux Type for the object]:type:_selinux_contexts -a file_type' )
+          ;|
+          fcontext|ibendport|ibpkey|interface|login|node|port|user)
+            args+=( '(-r --range)'{-r+,--range=}'[specify MLS/MCS Security Range]:range' )
+          ;|
+
+          import)
+            args+=( '(-f --input_file)'{-f+,--input_file=}'[specify input file]:input file:_files' )
+          ;;
+          export)
+            args+=( '(-f --output_file)'{-f+,--output_file=}'[specify output file]:output_file' )
+          ;;
+          login)
+            args+=( '(-l --list)1: :{ compset -P % && _groups || _users }' )
+          ;;
+          user)
+            args+=(
+              '(-L --level)'{-L,--level}'[default SELinux Level for SELinux user, s0 Default. (MLS/MCS Systems only)]:level'
+              \*{-R,--roles}'[specify SELinux Roles]:roles:_selinux_roles'
+              ': :_selinux_users'
+            )
+          ;;
+          port)
+            args+=(
+              '(-p --proto)'{-p+,--proto=}'[specify protocol for the specified port]:protocol:(tcp udp dccp sctp)'
+              ': :_ports'
+            )
+          ;|
+          interface)
+            args+=( ': :_selinux_interfaces' )
+          ;;
+          module)
+            args+=(
+              '(-P --priority)'{-P+,--priority=}'[select a priority for module operations]:priority [400]'
+              '(-E --extract)'{-E,--extract}'[extract customizable commands, for use within a transaction]'
+              '(-a --add)'{-a,--add}'[add a module]:module name:_selinux_modules'
+              '(-r --remove)'{-r,--remove}'[remove a module]:module name:_selinux_modules'
+              '(-d --disable)'{-d,--disable}'[disable a module]:module name:_selinux_modules'
+              '(-e --enable)'{-e,--enable}'[enable a module]:module name:_selinux_modules'
+            )
+          ;;
+          node)
+            args+=(
+              '(-p --proto)'{-p+,--proto=}'[specify protocol for the specified node]:protocol:(ipv4 ipv6)'
+              '(-M --netmask)'{-M+,--netmask=}'[specify network mask]:netmask'
+              ':node:'
+            )
+          ;;
+          fcontext)
+            args+=(
+              '(-e --equal)'{-e+,--equal=}'[substitute target path with sourcepath when generating default label]:equal'
+              '(-f --ftype)'{-f+,--ftype=}'[specify file type]:file type:((
+                f\:regular\ file
+                d\:directory
+                c\:character\ device
+                b\:block device
+                s\:socket
+                l\:symbolic\ link
+                p\:named\ pipe))'
+              ':file spec (regex):_files'
+            )
+          ;;
+          boolean)
+            args+=(
+              '(-)'{-1,--on}'[enable]'
+              '(-)'{-0,--off}'[disable]'
+              ':boolean:_selinux_bools'
+            )
+          ;;
+          permissive)
+            args+=( '1:type:_selinux_types' )
+          ;;
+          dontaudit)
+            args+=( '1:value:(on off)' )
+          ;;
+          ibpkey)
+            args+=(
+              '(-x --subnet_prefix)'{-x,--subnet_prefix}'[specify subnet prefix for the specified infiniband ibpkey]:subnet prefix'
+              ':pkey:'
+            )
+          ;;
+          ibendport)
+            args+=(
+              '(-z --ibdev_name)'{-z+,--ibdev_name=}'[specify name for the specified infiniband end port]:ibdev name'
+            )
+          ;;
+        esac
+      ;;
+    esac
+  ;;
+
+  semodule)
+    args=(
+      \*{-R,--reload}'[force a reload of policy]'
+      \*{-B,--build}'[build and reload policy]'
+      \*'--refresh[like --build but reuse existing linked policy if module files unchanged]'
+      \*{-D,--disable_dontaudit}'[remove dontaudits from policy]'
+      \*{-i+,--install=}'[install a new module]:module package:_files -g "*.(pp|cil)(-.)"'
+      \!{-b,--base,-u,--upgrade}':module package:_files -g "*.(pp|cil)(-.)"'
+      \*{-r+,--remove=}'[remove existing module at desired priority]:module name:_selinux_modules'
+      \*{-l+,--list-modules=-}'[display list of installed modules]::kind:((
+        standard\:highest\ priority,\ enabled\ modules
+        full\:list\ all\ modules
+      ))'
+      \*{-X+,--priority=}'[set priority for following operations]:priority (1-999)'
+      \*{-e,--enable=}'[enable module]:module name:_selinux_modules'
+      \*{-d,--disable=}'[disable module]:module name:_selinux_modules'
+      \*{-E,--extract=}'[extract module]:module name:_selinux_modules'
+      '(-s --store)'{-s+,--store=}'[name of the store to operate on]:store'
+      '(-N -n --noreload)'{-N,-n,--noreload}"[don't reload policy after commit]"
+      '(-v --verbose)'{-v,--verbose}'[be verbose]'
+      '(-P --preserve_tunables)'{-P,--preserve_tunables}'[preserve tunables in policy]'
+      '(-C --ignore-module-cache)'{-C,--ignore-module-cache}'[rebuild CIL modules compiled from HLL files]'
+      '(-p --path)'{-p,--path}'[use an alternate path for the policy root]'
+      '(-S --store-path)'{-S+,--store-path=}'[use an alternate path for the policy store root]:path:_directories'
+      '(-c --cil)'{-c,--cil}'[extract module as cil; only affects module extraction]'
+      '(-H --hll)'{-H,--hll}'[extract module as hll; only affects module extraction]'
+      '(-m --checksum)'{-m,--checksum}'[add SHA256 checksum of modules to the list output]'
+      '!(--refresh)--rebuild-if-modules-changed'
+      "${ign}(-)"{-h,--help}'[display help information]'
+    )
+  ;;
+
+  semodule_unpackage)
+    args=(
+      ':pp file:_files -g "*.pp(-.)"'
+      ':mod file:_files -g "*.mod(-.)"'
+      ':fc file:_files -g "*.fc(-.)"'
+    )
+  ;;
+
+  sepolgen)
+    args=( $sepolgen )
+  ;;
+  sepolicy)
+    _arguments -C \
+      '-P+[specify policy to examine]' \
+      "${ign}(- 1)-h[display help information]" \
+      '1:command:((
+          booleans\:"get description of booleans"
+          communicate\:"query if domains can communicate with each other"
+          generate\:"generate policy module template"
+          gui\:"graphical user interface for policies"
+          interface\:"list policy interfaces"
+          manpage\:"generate man pages for policies"
+          network\:"query policy network information"
+          transition\:"query policy to see how a source process domain can transition to the target process domain"))' \
+      '*::: := ->option-or-argument' && ret=0
+    case $state in
+      option-or-argument)
+        curcontext=${curcontext%:*}-$line[1]:
+        args=( '(-)'{-h,--help}'[display help information]' )
+        case $line[1] in
+          transition|communicate)
+            args+=(
+              '(-s --source)'{-s+,--source=}'[specify source domain]:source:_selinux_types -a domain'
+              '(-t --target)'{-t+,--target=}'[specify target domain]:target:_selinux_types -a domain'
+            )
+          ;|
+          manpage|network)
+            args+=(
+              {-d,--domain}'[specify domain]:*: :_selinux_types -a domain'
+              '!*'{-d-,--domain=-}': :_selinux_types -a domain'
+            )
+          ;|
+          booleans)
+            args+=(
+              '(-)'{-a,--all}'[get all booleans descriptions]'
+              \*{-b,--boolean}'[specify boolean to show description]:*:boolean:_selinux_bools'
+              '!(-a --all -h --help)*'{-b-,--boolean=}': :_selinux_bools'
+            )
+          ;;
+          communicate)
+            args+=(
+              '(-c --class)'{-c+,--class=}'[specify class to use for communications]:tclass [file]:_selinux_classes'
+              '(-S --sourceaccess)'{-S+,--sourceaccess=}'[specify permissions for the source type to use]:source access [open,write]'
+              '(-T --targetaccess)'{-T+,--targetaccess=}'[specify permissions for the target type to use]:target access [open,read]'
+            )
+          ;;
+          generate)
+            args=( $sepolgen )
+          ;;
+          interface)
+            args+=(
+              '(-c --compile)'{-c,--compile}'[run compile test for selected interface]'
+              '(-v --verbose)'{-v,--verbose}'[show verbose information]'
+              '(-f --file)'{-f+,--file=}'[specify interface file]:interface file:_files'
+              '(-a --list_admin)'{-a,--list_admin}'[list all domains with admin interface - DOMAIN_admin()]'
+              '(-u --list_user)'{-u,--list_user}'[list all domains with SELinux user role interface - DOMAIN_role()]'
+              '(-l --list)'{-l,--list}'[list all interfaces]'
+              {-i,--interfaces}'[specify interface names]:*:interface:_selinux_interfaces'
+              '!*'{-i-,--interfaces=-}':interface:_selinux_interfaces'
+            )
+          ;;
+          manpage)
+            args+=(
+              '(-p --path)'{-p+,--path=}'[specify path in which the generated selinux man pages will be stored]:path:_directories'
+              '(-o --os)'{-o+,--os=}'[specify name of the OS for man pages]:OS'
+              '(-w --web)'(-w,--web)'[generate HTML man pages structure]'
+              '(-r --root)'{-r+,--root=}'[specify alternate root directory]:root [/]:_directories'
+              '--source_files[alternative root path needs to include file context files and policy.xml file]'
+              '(-a --all -d --domain)'{-a,--all}'[all domains]'
+            )
+          ;;
+          network)
+            args+=(
+              '(-l --list)'{-l,--list}'[list all SELinux port types]'
+              {-p,--port}'[specify type related to the port]:*:port number'
+              '!*'{-p-,--port=-}':port number'
+              {-t,--type}'[show ports defined for this SELinux type]:*:port type:_selinux_types -a port_type'
+              '!*'{-t-,--type=-}':port type:_selinux_types -a port_type'
+              {-d,--domain}'[specify domain]:*:domain:_selinux_types -a domain'
+              '!*'{-d-,--domain=-}':domain:_selinux_types -a domain'
+              {-a,--application}'[show ports to which this application can bind and/or connect]:*:application:_selinux_types -a application_domain_type'
+              '!*'{-a-,--application=-}':domain:_selinux_types -a application_domain_type' # am not sure this is what is meant by applications
+            )
+          ;;
+        esac
+      ;;
+    esac
+  ;;
+
+  sesearch)
+    args=(
+      "${ign}(-h --help)"{-h,--help}'[display help information]'
+      "${ign}--version[display version information]"
+      '(-v --verbose)'{-v,--verbose}'[print extra informational messages]'
+      '--debug[enable debugging]'
+      '-A[search allow and allowxperm rules]'
+      '--allow[search allow rules]'
+      '--allowxperm[search allowxperm rules]'
+      '--auditallow[search auditallow rules]'
+      '--auditallowxperm[search auditallowxperm rules]'
+      '--dontaudit[search dontaudit rules]'
+      '--dontauditxperm[search dontauditxperm rules]'
+      '--neverallow[search neverallow rules]'
+      '--neverallowxperm[search neverallowxperm rules]'
+      '(-T --type_trans)'{-T,--type_trans}'[search type_transition rules]'
+      '--type_change[search type_change rules]'
+      '--type_member[search type_member rules]'
+      '--role_allow[find role allow rules]'
+      '--role_trans[find range_transition rules]'
+      '--range_trans[search range_transition rules]'
+      '(-s --source)'{-s+,--source=}'[source type/role of the TE/RBAC rule]: : _alternative
+        "types\:type\:_selinux_types"
+        "roles\:role\:_selinux_attributes"'
+      '(-t --target)'{-t+,--target=}'[target type/role of the TE/RBAC rule]: : _alternative
+        "types\:type\:_selinux_types"
+        "roles\:role\:_selinux_attributes"'
+      '(-c --class)'{-c+,--class=}'[comma separated list of object classes]:class:_sequence _selinux_classes'
+      '(-p --perms)'{-p+,--perms=}'[comma separated list of permissions]: :_sequence _selinux_permissions'
+      '(-x --xperms)'{-x+,--xperms=}'[comma separated list of extended permissions]:xperms'
+      '(-D --default)'{-D+,--default=}'[default of the rule. (type/role/range transition rules]:default'
+      '(-b --bool)'{-b+,--bool=}'[comma separated list of Booleans in the conditional expression]:bool '
+      '-eb[match Boolean list exactly instead of matching any listed boolean]'
+      '-ep[match permission set exactly instead of matching any listed permission]'
+      '-ex[match extended permission set exactly instead of matching any listed permission]'
+      '-Sp[match rules where the listed permissions are a subset of the rule permissions]'
+      '-ds[match source attributes directly instead of matching member types/roles]'
+      '-dt[match target attributes directly instead of matching member types/roles]'
+      '-rs[use regular expression matching for the source type/role]'
+      '-rt[use regular expression matching for the target type/role]'
+      '-rc[use regular expression matching for the object class]'
+      '-rd[use regular expression matching for the default type/role]'
+      '-rb[use regular expression matching for booleans]'
+      ':policy:_files'
+    )
+  ;;
+
+  sestatus)
+    args=( '-b[booleans]' '-v[contexts of files and processes listed in the /etc/sestatus.conf]' )
+  ;;
+
+  setenforce)
+    _alternative \
+      'enable-args:enable:(Enforcing 1)' \
+      'disable-args:disable:(Permissive 0)'
+    return
+  ;;
+
+  setsebool)
+    args=(
+      '-P[make changes persistent by writing pending values to disk]'
+      "-N[don't reload policy from disk]"
+      '-V[print verbose error messages]'
+      ':boolean:_selinux_bools'
+      ': : _values value
+              {1,on}"[enable]"
+              {0,off}"[disable]"'
+    )
+  ;;
+
+  validatetrans)
+    args=(
+      ':source context:_selinux_contexts'
+      ':target context:_selinux_contexts'
+      ':class:_selinux_classes'
+      ':new context:_selinux_contexts'
+    )
+  ;;
+esac
+
+_arguments -s $args
diff --git a/Completion/Linux/Command/_setpriv b/Completion/Linux/Command/_setpriv
index 196f2f627..8b8d99785 100644
--- a/Completion/Linux/Command/_setpriv
+++ b/Completion/Linux/Command/_setpriv
@@ -93,10 +93,10 @@ _arguments -C -S -s \
   '--reuid[set real and effective UNIX user id]:UNIX user:_users' \
   '--securebits[set "process securebits"]: : _sequence __setpriv_prctl_securebits_set_elements' \
   '--pdeathsig[keep, clear, or set parent death signal]: : __setpriv_death_signals' \
-  '--selinux-label[request a selinux label]:SELinux labels: ' \
+  '--selinux-label[request a selinux label]:SELinux label:_selinux_contexts' \
   '--apparmor-profile[request an apparmor profile]:AppArmor profiles: ' \
   '--reset-env[set environment as for a classic login shell]' \
-  '*:::command:_normal' \
+  '*:::command: _normal -p $service' \
   && return 0
 
 case $state in
diff --git a/Completion/Linux/Command/_strace b/Completion/Linux/Command/_strace
index b3b6f5096..37e14b6d6 100644
--- a/Completion/Linux/Command/_strace
+++ b/Completion/Linux/Command/_strace
@@ -11,11 +11,13 @@ _arguments -C -s \
   \*{-E+,--env=}'[set or remove exported environment variable]:variable:->envars' \
   '(:)*'{-p+,--attach=}'[attach to the process with specified process ID and begin tracing]:process ID:_pids' \
   "${root}(-u --user)"{-u+,--user=}'[run as specified user]:user:_users' \
+  '--argv0=[set argv0 for program]:name' \
   '(-b --detach-on)'{-b+,--detach-on=}'[detach from process on specified syscall]:syscall:(execve)' \
   '(--daemonize)-D[run tracer as detached grandchild, keeping traced process as direct child of calling process]' \
   '(-D)--daemonize=-[specify how to run tracer process]::method:(grandchild pgroup session)' \
   '(-f --follow-forks)'{-f,--follow-forks}'[trace child processes as they are created by currently traced processes]' \
   '(-I --interruptible)'{-I+,--interruptible=}'[specify when strace can be interrupted by signals]:interruptible:((1\:"no signals are blocked" 2\:"fatal signals are blocked while decoding syscall (default)" 3\:"fatal signals are always blocked (default with -o)" 4\:"fatal signals and SIGTSTP are always blocked"))' \
+  '--kill-on-exit[kill all tracees if strace is killed]' \
   \*{-e+,--trace=}'[select events to trace or how to trace]:system call:->expressions' \
   \*{-P+,--path=}'[trace only system calls accessing given path]:path:_files' \
   '(-z -Z --successful-only --failed-only)'{-z,--successful-only}'[trace only system calls that return success]' \
@@ -45,11 +47,14 @@ _arguments -C -s \
   '(-v --no-abbrev)'{-v,--no-abbrev}'[print unabbreviated versions of environment, stat, termios, etc. calls]' \
   '(-xx --strings-in-hex)-x[print all non-ASCII strings in hexadecimal string format]' \
   '(-x --strings-in-hex)-xx[print all strings in hexadecimal string format]' \
-  '(-x -xx)--strings-in-hex=[specify strings to print in hexadecimal format]:string type:(all non-ascii)' \
+  '(-x -xx)--strings-in-hex=[specify strings to print in hexadecimal format]:string type:(all non-ascii non-ascii-chars)' \
   '(-X --const-print-style)'{-X+,--const-print-style=}'[set the format for printing of named constants and flags]:format:(raw abbrev verbose)' \
   '(-c --summary-only -yy --decode-fds)-y[print paths associated with file descriptor arguments]' \
   '(-c --summary-only -y --decode-fds)-yy[print protocol specific information associated with socket file descriptors]' \
-  '(-c --summary-only -y -yy)--decode-fds=-[print information associated with file descriptors]::information [none]:_sequence compadd - none all path socket dev pidfd' \
+  '(-c --summary-only -y -yy)--decode-fds=-[print information associated with file descriptors]::information [none]:_sequence compadd - none all path socket dev pidfd signalfd' \
+  '(-c --summary-only -Y)--decode-pids=[print information associated with process IDs]:information [none]:_sequence compadd - none comm pidns' \
+  '!(-c --summary-only -Y --decode-pids)--pidns-translation' \
+  '(-c --summary-only --decode-pids)-Y[print command names for PIDs]' \
   '(-c --summary-only -C --summary -i --instruction-pointer -k --stack-traces -r --relative-timestamps -ff -t -tt -ttt --absolute-timestamps -T --syscall-times -y -yy --decode-fds)'{-c,--summary-only}'[count time, calls, and errors for each system call and report a summary]' \
   '(-c --summary-only -C --summary)'{-C,--summary}'[count time, calls, and errors for each system call and report a summary in addition to regular output]' \
   '(-O --summary-syscall-overhead)'{-O+,--summary-syscall-overhead=}'[specify overhead for tracing system calls]:overhead (microseconds)' \
@@ -57,9 +62,11 @@ _arguments -C -s \
   '(-U --summary-columns)'{-U+,--summary-columns=}'[show specific columns in the summary report]:column:_sequence compadd - time-percent total-time min-time max-time avg-time calls errors name' \
   '(-w --summary-wall-clock)'{-w,--summary-wall-clock}'[summarise syscall latency]' \
   '(-c --summary-only -C)-ff[write each process trace to <filename>.<pid> (when using -o <filename>]' \
+  '--syscall-limit=[detach all tracees after tracing given number of syscalls]:limit' \
   '(-d --debug)'{-d,--debug}'[show debug output of strace itself on standard error]' \
   '(- 1 *)'{-h,--help}'[display help information]' \
   '--seccomp-bpf[enable seccomp-bpf filtering]' \
+  '--tips=-[show strace tips, tricks, and tweaks before exit]:tip [id\:random,format\:compact]' \
   '(- 1 *)'{-V,--version}'[display version information]' \
   '(-):command name: _command_names -e' \
   '*::arguments:_normal' && ret=0
@@ -72,6 +79,7 @@ case $state in
       'verbose[dereference structures for the specified set of system calls]:system call:_sequence _sys_calls -a -n' \
       'raw[print raw, undecoded arguments for the specified set of system calls]:system call:_sequence _sys_calls -a -n' \
       'signal[trace only the specified subset of signals]:signal:_sequence _signals -s -M "B\:!="' \
+      'trace-fds[trace operations on listed file descriptors]:file descriptor:_sequence _file_descriptors' \
       'read[perform a full hex and ASCII dump of all the data read from listed file descriptors]:file descriptor:_sequence _file_descriptors' \
       'write[perform a full hex and ASCII dump of all the data written to listed file descriptors]:file descriptor:_sequence _file_descriptors' \
       'fault[perform syscall fault injection]:system call:_sys_calls -a -n' \
@@ -79,7 +87,8 @@ case $state in
       'status[trace system calls with given return status]:status:->status' \
       'quiet[suppress various information messages]:message [none]:_sequence compadd - none attach exit path-resolution personality thread-execve superseded' \
       'kvm[print the exit reason of kvm vcpu]: :(vcpu)' \
-      'decode-fds[print information associated with file descriptors]:information [none]:_sequence compadd - none all path socket dev pidfd' && ret=0
+      'decode-fds[print information associated with file descriptors]:information [none]:_sequence compadd - none all path socket dev pidfd signalfd' \
+      'decode-pids[print information associated with process IDs]:information [none]:_sequence compadd - none comm pidns' && ret=0
     if [[ $state = status ]]; then
       _values -s , 'return status [all]' \
         all successful failed \
diff --git a/Completion/Linux/Command/_sysstat b/Completion/Linux/Command/_sysstat
index 5620da73d..59a2f5da9 100644
--- a/Completion/Linux/Command/_sysstat
+++ b/Completion/Linux/Command/_sysstat
@@ -56,6 +56,7 @@ _sadf() {
       '--dev=-[specify block devices for which statistics are to be displayed]:block device:_files -g "*(-%)"' \
       '--fs=-[specify filesystems for which statistics are to be displayed]:file system:_dir_list -s ,' \
       '--iface=-[specify network interfaces for which statistics are to be displayed]:network interface:_sequence _net_interfaces' \
+      '--int=-[specify interrupts for which statistics are to be displayed]: : _values -s "," interrupt 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15' \
       '-s[set starting time of report]:starting time (HH\:MM\:SS)"' \
       '(-t -U)-T[display timestamp in local time]' \
       '(-T -U)-t[display timestamp in file\''s original localtime]' \
@@ -99,9 +100,10 @@ _sar() {
     '(--human -p)-h[make output easier to read: implies --human and -p]' \
     '(- 1 2)--help[display usage information]' \
     '--human[print sizes in human readable format]' \
-    '*-I[report statistics for interrupts]: : _values -s "," interrupt 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 SUM ALL XALL' \
+    '-I[report statistics for interrupts]:interrupt:(SUM ALL)' \
     '-i[select records as close as possible to interval]:interval' \
     '--iface=-[specify network interfaces for which statistics are to be displayed]:network interface:_sequence _net_interfaces' \
+    '--int=-[specify interrupts for which statistics are to be displayed]: : _values -s "," interrupt 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15' \
     '-j[display persistent device names]:type:(ID LABEL PATH UUID)' \
     '-m[report power management statistics]:keyword:_sequence compadd - CPU FAN FREQ IN TEMP USB ALL' \
     '-n[report network statistics]:keyword:_sequence compadd - DEV EDEV NFS NFSD SOCK IP EIP ICMP EICMP TCP ETCP UDP SOCK6 IP6 EIP6 ICMP6 EICMP6 UDP6 FC SOFT ALL' \
@@ -130,7 +132,7 @@ _pidstat() {
   _arguments -s : \
     '-C[filter tasks by string]:task filter' \
     '-d[report I/O statistics]' \
-    '-e[execute specified program and monitor it with pidstat]:*::command: _normal' \
+    '-e[execute specified program and monitor it with pidstat]:*::command: _normal -p $service' \
     '-H[display timestamp in seconds since the epoch]' \
     '-h[display horizontally]' \
     '-I[divide CPU usage by number of processors]' \
diff --git a/Completion/Linux/Command/_valgrind b/Completion/Linux/Command/_valgrind
index b4bb3248e..5eaaea338 100644
--- a/Completion/Linux/Command/_valgrind
+++ b/Completion/Linux/Command/_valgrind
@@ -165,7 +165,7 @@ args_massif=(
   "--time-unit=-[specify time unit]:unit [i]:((
     i\:instructions\ executed
     ms\:milliseconds
-    b\:heap\ bytes\ alloc\'d/dealloc\'d
+    B\:heap\ bytes\ alloc\'d/dealloc\'d
   ))"
   '--detailed-freq=-[every Nth snapshot should be detailed]:snapshot interval [10]'
   '--max-snapshots=-[specofy maximum number of snapshots recorded]:maximum [100]'
@@ -216,7 +216,7 @@ _arguments -C ${(P)args} $cmd \
   '--vgdb=-[activate gdbserver]:enable [yes]:(yes no full)' \
   '--vgdb-error=-[invoke gdbserver after specified number of errors]:errors [999999999]:errors' \
   '--vgdb-stop-at=-[invoke gdbserver for given events]:event:_sequence compadd - startup exit valgrindabexit all none' \
-  '--track-fds=-[track open file descriptors]:enable:(yes no)' \
+  '--track-fds=-[track open file descriptors]:enable [no]:(yes no all)' \
   '--time-stamp=-[add timestamps to log messages]:enable:(yes no)' \
   '--log-fd=-[log messages to specified file descriptor]:file descriptor:_file_descriptors' \
   '--log-file=-[log messages to specified file with pid appended]:file:_files' \