diff --git a/src/computing_security_contexts.md b/src/computing_security_contexts.md
index 5849375..bb946b5 100644
--- a/src/computing_security_contexts.md
+++ b/src/computing_security_contexts.md
@@ -1,5 +1,22 @@
 # Computing Security Contexts
 
+- [Security Context Computation for Kernel Objects](#security-context-computation-for-kernel-objects)
+  - [Process](#process)
+  - [Files](#files)
+  - [File Descriptors](#file-descriptors)
+  - [Filesystems](#filesystems)
+  - [Network File System (nfsv4.2)](#network-file-system-nfsv4.2)
+  - [INET Sockets](#inet-sockets)
+  - [IPC](#ipc)
+  - [Message Queues](#message-queues)
+  - [Semaphores](#semaphores)
+  - [Shared Memory](#shared-memory)
+  - [Keys](#keys)
+- [Using libselinux Functions](#using-libselinux-functions)
+  - [*avc_compute_create* and *security_compute_create*](#avc_compute_create-and-security_compute_create)
+  - [*avc_compute_member* and *security_compute_member*](#avc_compute_member-and-security_compute_member)
+  - [*security_compute_relabel*](#security_compute_relabel)
+
 SELinux uses a number of policy language statements and *libselinux*
 functions to compute a security context via the kernel security server.
 
@@ -15,9 +32,9 @@ components: a source context, a target context and an object class.
 The *libselinux* userspace functions used to compute a security context
 are:
 
--   ***avc_compute_create**(3)* and ***security_compute_create**(3)*
--   ***avc_compute_member**(3)* and ***security_compute_member**(3)*
--   ***security_compute_relabel**(3)*
+- ***avc_compute_create**(3)* and ***security_compute_create**(3)*
+- ***avc_compute_member**(3)* and ***security_compute_member**(3)*
+- ***security_compute_relabel**(3)*
 
 Note that these *libselinux* functions actually call the kernel
 equivalent functions in the security server (see kernel source
@@ -53,24 +70,24 @@ The initial task starts with the kernel security context, but the
 (e.g. *init_t*) when the init binary is executed after the policy has
 been loaded. Some init programs re-exec themselves after loading policy,
 while in other cases the initial policy load is performed by the
-*initrd*/*initramfs* script prior to mounting the real root and
-executing the real init program.
+*initrd*/*initramfs* script prior to mounting the real *root* and
+executing the real *init* program.
 
 Processes inherit their security context as follows:
 
-1.  On fork a process inherits the security context of its
-    creator/parent.
-2.  On *exec*, a process may transition to another security context
-    based on policy statements: *type_transition*, *range_transition*,
-    *role_transition* (policy version 26), *default_user*,
-    *default_role*, *default_range* (policy versions 27) and
-    *default_type* (policy version 28) or if a security-aware process,
-    by calling ***setexeccon**(3)* if permitted by policy prior to
-    invoking exec.
-3.  At any time, a security-aware process may invoke ***setcon**(3)* to
-    switch its security context (if permitted by policy) although this
-    practice is generally discouraged - exec-based transitions are
-    preferred.
+1. On fork a process inherits the security context of its
+   creator/parent.
+2. On *exec*, a process may transition to another security context
+   based on policy statements: *type_transition*, *range_transition*,
+   *role_transition* (policy version 26), *default_user*,
+   *default_role*, *default_range* (policy versions 27) and
+   *default_type* (policy version 28) or if a security-aware process,
+   by calling ***setexeccon**(3)* if permitted by policy prior to
+   invoking exec.
+3. At any time, a security-aware process may invoke ***setcon**(3)* to
+   switch its security context (if permitted by policy) although this
+   practice is generally discouraged - exec-based transitions are
+   preferred.
 
 ### Files
 
@@ -79,23 +96,23 @@ the following classes: files, symbolic links, directories, socket files,
 fifo's and block/character) upon creation for any filesystem type that
 supports labeling is as follows:
 
-1.  The user component is inherited from the creating process (policy
-    version 27 allows a *default_user* of source or target to be
-    defined for each object class).
-2.  The role component generally defaults to the *object_r* role
-    (policy version 26 allows a *role_transition* and version 27 allows
-    a *default_role* of source or target to be defined for each object
-    class).
-3.  The type component defaults to the type of the parent directory if
-    no matching *type_transition* rule was specified in the policy
-    (policy version 25 allows a filename *type_transition* rule and
-    version 28 allows a *default_type* of source or target to be
-    defined for each object class).
-4.  The *range*/*level* component defaults to the low/current level of
-    the creating process if no matching *range_transition* rule was
-    specified in the policy (policy version 27 allows a *default_range*
-    of source or target with the selected range being low, high or
-    low-high to be defined for each object class).
+1. The user component is inherited from the creating process (policy
+   version 27 allows a *default_user* of source or target to be
+   defined for each object class).
+2. The role component generally defaults to the *object_r* role
+   (policy version 26 allows a *role_transition* and version 27 allows
+   a *default_role* of source or target to be defined for each object
+   class).
+3. The type component defaults to the type of the parent directory if
+   no matching *type_transition* rule was specified in the policy
+   (policy version 25 allows a filename *type_transition* rule and
+   version 28 allows a *default_type* of source or target to be
+   defined for each object class).
+4. The *range*/*level* component defaults to the low/current level of
+   the creating process if no matching *range_transition* rule was
+   specified in the policy (policy version 27 allows a *default_range*
+   of source or target with the selected range being low, high or
+   low-high to be defined for each object class).
 
 Security-aware applications can override this default behavior by
 calling ***setfscreatecon**(3)* prior to creating the file, if permitted
@@ -116,7 +133,7 @@ Inherits the label of its creator/parent.
 ### Filesystems
 
 Filesystems are labeled using the appropriate *fs_use* kernel policy
-language statement as they are mounted, they are based on the filesystem
+language statement as they are mounted, they are based on the *filesystem*
 type name (e.g. *ext4*) and their behaviour (e.g. *xattr*). For example
 if the policy specifies the following:
 
@@ -128,37 +145,37 @@ then as the *pipefs* filesystem is being mounted, the SELinux LSM
 security hook *selinux_set_mnt_opts* will call *security_fs_use*
 that will:
 
--  Look for the filesystem name within the policy (*pipefs*)
--  If present, obtain its behaviour (*fs_use_task*)
--  Then obtain the allocated security context (*system_u:object_r:fs_t:s0*)
+- Look for the filesystem name within the policy (*pipefs*)
+- If present, obtain its behaviour (*fs_use_task*)
+- Then obtain the allocated security context (*system_u:object_r:fs_t:s0*)
 
 Should the behaviour be defined as *fs_use_task*, then the filesystem
 will be labeled as follows:
 
-1.  The user component is inherited from the creating process (policy
-    version 27 allows a *default_user* of source or target to be
-    defined).
-2.  The role component generally defaults to the *object_r* role
-    (policy version 26 allows a *role_transition* and version 27 allows
-    a *default_role* of source or target to be defined).
-3.  The type component defaults to the type of the target type if no
-    matching *type_transition* rule was specified in the policy (policy
-    version 28 allows a *default_type* of source or target to be
-    defined).
-4.  The *range*/*level* component defaults to the low/current level of
-    the creating process if no matching *range_transition* rule was
-    specified in the policy (policy version 27 allows a *default_range*
-    of source or target with the selected range being low, high or
-    low-high to be defined).
+1. The user component is inherited from the creating process (policy
+   version 27 allows a *default_user* of source or target to be
+   defined).
+2. The role component generally defaults to the *object_r* role
+   (policy version 26 allows a *role_transition* and version 27 allows
+   a *default_role* of source or target to be defined).
+3. The type component defaults to the type of the target type if no
+   matching *type_transition* rule was specified in the policy (policy
+   version 28 allows a *default_type* of source or target to be
+   defined).
+4. The *range*/*level* component defaults to the low/current level of
+   the creating process if no matching *range_transition* rule was
+   specified in the policy (policy version 27 allows a *default_range*
+   of source or target with the selected range being *low*, *high* or
+   *low-high* to be defined).
 
 Notes:
 
-1.  Filesystems that support *xattr* extended attributes can be
-    identified via the mount command as there will be a '*seclabel*'
-    keyword present.
-2.  There are mount options for allocating various context types:
-    *context=*, *fscontext=*, *defcontext=* and *rootcontext=*. They are
-    fully described in the ***mount**(8)* man page.
+1. Filesystems that support *xattr* extended attributes can be
+   identified via the mount command as there will be a '*seclabel*'
+   keyword present.
+2. There are mount options for allocating various context types:
+   *context=*, *fscontext=*, *defcontext=* and *rootcontext=*. They are
+   fully described in the ***mount**(8)* man page.
 
 ### Network File System (nfsv4.2)
 
@@ -171,22 +188,22 @@ section.
 If a socket is created by the ***socket**(3)* call they are labeled as
 follows:
 
-1.  The user component is inherited from the creating process (policy
-    version 27 allows a *default_user* of source or target to be
-    defined for each socket object class).
-2.  The role component is inherited from the creating process (policy
-    version 26 allows a *role_transition* and version 27 allows a
-    *default_role* of source or target to be defined for each socket
-    object class).
-3.  The type component is inherited from the creating process if no
-    matching *type_transition* rule was specified in the policy and
-    version 28 allows a *default_type* of source or target to be
-    defined for each socket object class).
-4.  The *range*/*level* component is inherited from the creating process
-    if no matching *range_transition* rule was specified in the policy
-    (policy version 27 allows a *default_range* of source or target
-    with the selected range being low, high or low-high to be defined
-    for each socket object class).
+1. The user component is inherited from the creating process (policy
+   version 27 allows a *default_user* of source or target to be
+   defined for each socket object class).
+2. The role component is inherited from the creating process (policy
+   version 26 allows a *role_transition* and version 27 allows a
+   *default_role* of source or target to be defined for each socket
+   object class).
+3. The type component is inherited from the creating process if no
+   matching *type_transition* rule was specified in the policy and
+   version 28 allows a *default_type* of source or target to be
+   defined for each socket object class).
+4. The *range*/*level* component is inherited from the creating process
+   if no matching *range_transition* rule was specified in the policy
+   (policy version 27 allows a *default_range* of source or target
+   with the selected range being *low*, *high* or *low-high* to be defined
+   for each socket object class).
 
 Security-aware applications may use ***setsockcreatecon**(3)* to
 explicitly label sockets they create if permitted by policy.
@@ -208,22 +225,22 @@ Inherits the label of its sending process. However if sending a message
 that is unlabeled, compute a new label based on the current process and
 the message queue it will be stored in as follows:
 
-1.  The user component is inherited from the sending process (policy
-    version 27 allows a *default_user* of source or target to be
-    defined for the message object class).
-2.  The role component is inherited from the sending process (policy
-    version 26 allows a *role_transition* and version 27 allows a
-    *default_role* of source or target to be defined for the message
-    object class).
-3.  The type component is inherited from the sending process if no
-    matching *type_transition* rule was specified in the policy and
-    version 28 allows a *default_type* of source or target to be
-    defined for the message object class).
-4.  The *range*/*level* component is inherited from the sending process
-    if no matching *range_transition* rule was specified in the policy
-    (policy version 27 allows a *default_range* of source or target
-    with the selected range being low, high or low-high to be defined
-    for the message object class).
+1. The user component is inherited from the sending process (policy
+   version 27 allows a *default_user* of source or target to be
+   defined for the message object class).
+2. The role component is inherited from the sending process (policy
+   version 26 allows a *role_transition* and version 27 allows a
+   *default_role* of source or target to be defined for the message
+   object class).
+3. The type component is inherited from the sending process if no
+   matching *type_transition* rule was specified in the policy and
+   version 28 allows a *default_type* of source or target to be
+   defined for the message object class).
+4. The *range*/*level* component is inherited from the sending process
+   if no matching *range_transition* rule was specified in the policy
+   (policy version 27 allows a *default_range* of source or target
+   with the selected range being *low*, *high* or *low-high* to be defined
+   for the message object class).
 
 ### Semaphores
 
@@ -244,249 +261,262 @@ explicitly label keys they create if permitted by policy.
 
 ### *avc_compute_create* and *security_compute_create*
 
-**Table 1** below shows how the components from the source context
+The table below shows how the components from the source context
 *scon*, target context *tcon* and class *tclass* are used to compute the
 new context *newcon* (referenced by SIDs for
 ***avc_compute_create**(3)*). The following notes also apply:
 
-1.  Any valid policy *role_transition*, *type_transition* and
-    *range_transition* enforcement rules will influence the final
-    outcome as shown.
-2.  For kernels less than 2.6.39 the context generated will depend on
-    whether the class is *process* or any other class.
-3.  For kernels 2.6.39 and above the following also applies:
--   Those classes suffixed by *socket* will also be included in the *process*
+1. Any valid policy [***role_transition***](role_statements.md#role_transition),
+   [***type_transition***](type_statements.md#type_transition) and
+   [***range_transition***](mls_statements.md#range_transition) enforcement
+   rules will influence the final outcome as shown.
+2. For kernels less than 2.6.39 the context generated will depend on
+   whether the class is *process* or any other class.
+3. For kernels 2.6.39 and above the following also applies:
+   - Those classes suffixed by *socket* will also be included in the *process*
     class outcome.
--   If a valid *role_transition* rule for *tclass*, then use that
-    instead of the default *object_r*. Also requires policy version
-    26 or greater - see ***security_policyvers**(3)*.
--   If the *type_transition* rule is classed as the 'file name
-    transition rule' (i.e. it has an *object_name* parameter), then
-    provided the object name in the rule matches the last component of
-    the objects name (in this case a file or directory name), then use
-    the rules *default_type*. Also requires policy version 25 or greater.
-4.  For kernels 3.5 and above with policy version 27 or greater, the
-    *default_user*, *default_role*, *default_range* statements will
-    influence the *user*, *role* and *range* of the computed context for
-    the specified class *tclass*. With policy version 28 or greater the
-    *default_type* statement can also influence the *type* in the
-    computed context.
-
-<table>
-<tbody>
-<tr style="background-color:#D3D3D3;">
-<td><strong>user</strong></td>
-<td><strong>role</strong></td>
-<td><strong>type</strong></td>
-<td><strong>range</strong></td>
-</tr>
-<tr>
-<td><p>If kernel &gt;= 3.5 with a <strong>default_user </strong><em>tclass</em><strong> target</strong> rule then use <em>tcon</em> <em>user</em></p>
-<p>ELSE</p>
-<p>Use <em>scon</em> <em>user</em></p></td>
-<td><p>If kernel &gt;=2.6.39, and there is a valid</p>
-<p>role_transition</p>
-<p> rule then use the rules <em>new_role</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <em><strong>default_role </strong>tclass<strong> source</strong></em> rule then use <em>scon</em> <em>role</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <em><strong>default_role </strong>tclass<strong> target</strong></em> rule then use <em>tcon</em> <em>role</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 2.6.39 and <em>tclass</em> is <em><strong>process</strong></em> or <em>socket</em>, then use <em>scon</em> <em>role</em></p>
-<p>OR</p>
-<p>If kernel &lt;= 2.6.38 and <em>tclass</em> is <em><strong>process</strong></em>, then use <em>scon</em> <em>role</em></p>
-<p>ELSE</p>
-<p>Use <em><strong>object_r</strong></em></p></td>
-<td><p>If there is a valid</p>
-<p>type_transition</p>
-<p>rule then use the rules <em>default_type</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <em><strong>default_type </strong>tclass<strong> source</strong></em> rule then use <em>scon</em> <em>type</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <em><strong>default_type </strong>tclass<strong> target</strong></em> rule then use <em>tcon</em> <em>type</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 2.6.39 and <em>tclass</em> is <em><strong>process</strong></em> or <em>socket</em>, then use <em>scon</em> <em>type</em></p>
-<p>OR</p>
-<p>If kernel &lt;= 2.6.38 and <em>tclass</em> is <em><strong>process</strong></em>, then use <em>scon</em> <em>type</em></p>
-<p>ELSE</p>
-<p>Use <em>tcon</em> <em>type</em></p></td>
-<td><p> If there is a valid</p>
-<p>range_transition</p>
-<p> rule then use the rules <em>new_range</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> source low</strong> rule then use <em>scon</em> <em>low</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> source high</strong> rule then use <em>scon</em> <em>high</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> source low_high</strong> rule then use <em>scon</em> <em>range</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> target low</strong> rule then use <em>tcon</em> <em>low</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> target high</strong> rule then use <em>tcon</em> <em>high</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> target low_high</strong> rule then use <em>tcon</em> <em>range</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 2.6.39 and <em>tclass</em> is <em><strong>process</strong></em> or <em>socket</em>, then use <em>scon</em> <em>range</em></p>
-<p>OR</p>
-<p>If kernel &lt;= 2.6.38 and <em>tclass</em> is <em><strong>process</strong></em>, then use <em>scon</em> <em>range</em></p>
-<p>ELSE</p>
-<p>Use <em>scon</em> <em>low</em></p></td>
-</tr>
-</tbody>
-</table>
-
-**Table 1**
+   - If a valid *role_transition* rule for *tclass*, then use that
+     instead of the default *object_r*. Also requires policy version
+     26 or greater - see ***security_policyvers**(3)*.
+   - If the *type_transition* rule is classed as the 'file name
+     transition rule' (i.e. it has an *object_name* parameter), then
+     provided the object name in the rule matches the last component of
+     the objects name (in this case a file or directory name), then use
+     the rules *default_type*. Also requires policy version 25 or greater.
+4. For kernels 3.5 and above with policy version 27 or greater, the
+   *default_user*, *default_role*, *default_range* statements will
+   influence the *user*, *role* and *range* of the computed context for
+   the specified class *tclass*. With policy version 28 or greater the
+   *default_type* statement can also influence the *type* in the
+   computed context.
+
+***Computing avc_compute_create(3) and security_compute_create(3) contexts***:
+
+- ***user***
+  - IF kernel \>= 3.5 with a *default_user tclass target* rule then
+    use *tcon user*
+  - ELSE
+  - Use *scon user*
+- ***role***
+  - IF kernel \>=2.6.39, and there is a valid *role_transition* rule then
+    use the rules [***new_role***](role_statements.md#role_transition)
+  - OR
+  - IF kernel \>= 3.5 with *default_role tclass source* rule then use
+    *scon role*
+  - OR
+  - IF kernel \>= 3.5 with *default_role tclass target* rule then use
+    *tcon role*
+  - OR
+  - IF kernel \>= 2.6.39 and *tclass* is *process* or *\*socket*, then
+    use *scon role*
+  - OR
+  - IF kernel \<= 2.6.38 and *tclass* is *process* then use *scon role*
+  - ELSE
+  - Use *object_r*
+- ***type***
+  - IF there is a valid *type_transition* rule then use the rules
+    [***default_type***](type_statements.md#type_transition)
+  - OR
+  - IF kernel \>= 3.5 with *default_type tclass source* rule then use
+    *scon type*
+  - OR
+  - IF kernel \>= 3.5 with *default_type tclass target* rule then use
+    *tcon type*
+  - OR
+  - IF kernel \>= 2.6.39 and *tclass* is *process* or *\*socket* then
+    use *scon type*
+  - OR
+  - IF kernel \<= 2.6.38 and *tclass* is *process* then use *scon type*
+  - **ELSE**
+  - Use *tcon type*
+- ***range***
+  - IF there is a valid *range_transition* rule then use the rules
+    [***new_range***](mls_statements.md#range_transition)
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass source low* rule then
+    use *scon low*
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass source high* rule then
+    use *scon high*
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass source low_high* rule
+    then use *scon range*
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass target low* rule then
+    use *tcon low*
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass target high* rule then
+    use *tcon high*
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass target low_high* rule
+    then use *tcon range*
+  - OR
+  - IF kernel \>= 2.6.39 and *tclass* is *process* or *\*socket* then
+    use *scon range*
+  - OR
+  - IF kernel \<= 2.6.38 and *tclass* is *process* then use *scon range*
+  - **ELSE**
+  - Use *scon low*
 
 ### *avc_compute_member* and *security_compute_member*
 
-**Table 2** shows how the components from the source context,
+The table below shows how the components from the source context,
 *scon* target context, *tcon* and class, *tclass* are used to compute
 the new context *newcon* (referenced by SIDs for
 ***avc_compute_member**(3)*). The following notes also apply:
 
-1.  Any valid policy *type_member* enforcement rules will influence the
-    final outcome as shown.
-2.  For kernels less than 2.6.39 the context generated will depend on
-    whether the class is *process* or any other class.
-3.  For kernels 2.6.39 and above, those classes suffixed by *socket* are
-    also included in the *process* class outcome.
-4.  For kernels 3.5 and above with policy version 28 or greater, the
-    *default_role*, *default_range* statements will influence the
-    *role* and *range* of the computed context for the specified class
-    *tclass*. With policy version 28 or greater the *default_type*
-    statement can also influence the *type* in the computed context.
-
-<table>
-<tbody>
-<tr style="background-color:#D3D3D3;">
-<td><strong>user</strong></td>
-<td><strong>role</strong></td>
-<td><strong>type</strong></td>
-<td><strong>range</strong></td>
-</tr>
-<tr>
-<td>Always uses <em>tcon</em> <em>user</em></td>
-<td><p>If kernel &gt;= 3.5 with <strong>default_role </strong><em>tclass</em><strong> source</strong> rule then use <em>scon</em> <em>role</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_role </strong><em>tclass</em><strong> target</strong> rule then use <em>tcon</em> <em>role</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 2.6.39 and <em>tclass</em> is <strong>process</strong> or <em>socket</em>, then use <em>scon</em> <em>role</em></p>
-<p>OR</p>
-<p>If kernel &lt;= 2.6.38 and <em>tclass</em> is <strong>process</strong>, then use <em>scon</em> <em>role</em></p>
-<p>ELSE</p>
-<p>Use <strong>object_r</strong></p></td>
-<td><p>If there is a valid</p>
-<p>type_member</p>
-<p>rule then use the rules <em>member_type</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_type </strong><em>tclass</em><strong> source</strong> rule then use <em>scon</em> <em>type</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_type </strong><em>tclass</em><strong> target</strong> rule then use <em>tcon</em> <em>type</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 2.6.39 and <em>tclass</em> is <em><strong>process</strong></em> or <em>socket</em>, then use <em>scon</em> <em>type</em></p>
-<p>OR</p>
-<p>If kernel &lt;= 2.6.38 and <em>tclass</em> is <strong>process</strong>, then use <em>scon</em> <em>type</em></p>
-<p>ELSE</p>
-<p>Use <em>tcon</em> <em>type</em></p></td>
-<td><p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> source low</strong> rule then use <em>scon</em> <em>low</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> source high</strong> rule then use <em>scon</em> <em>high</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> source low_high</strong> rule then use <em>scon</em> <em>range</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> target low</strong> rule then use <em>tcon</em> <em>low</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> target high</strong> rule then use <em>tcon</em> <em>high</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> target low_high</strong> rule then use <em>tcon</em> <em>range</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 2.6.39 and <em>tclass</em> is <strong>process</strong> or <em>socket</em>, then use <em>scon</em> <em>range</em></p>
-<p>OR</p>
-<p>If kernel &lt;= 2.6.38 and <em>tclass</em> is <strong>process</strong>, then use <em>scon</em> <em>range</em></p>
-<p>ELSE</p>
-<p>Use <em>scon</em> <em>low</em></p></td>
-</tr>
-</tbody>
-</table>
-
-**Table 2**
+1. Any valid policy [***type_member***](type_statements.md#type_member)
+   enforcement rules will influence the final outcome as shown.
+2. For kernels less than 2.6.39 the context generated will depend on
+   whether the class is *process* or any other class.
+3. For kernels 2.6.39 and above, those classes suffixed by *socket* are
+   also included in the *process* class outcome.
+4. For kernels 3.5 and above with policy version 28 or greater, the
+   *default_role*, *default_range* statements will influence the
+   *role* and *range* of the computed context for the specified class
+   *tclass*. With policy version 28 or greater the *default_type*
+   statement can also influence the *type* in the computed context.
+
+***Computing avc_compute_member(3) and security_compute_member(3) contexts:***
+
+- ***user***
+  - Always uses *tcon user*
+- ***role***
+  - IF kernel \>= 3.5 with *default_role tclass source* rule then use
+    *scon role*
+  - OR
+  - IF kernel \>= 3.5 with *default_role tclass target* rule then use
+    *tcon role*
+  - OR
+  - IF kernel \>= 2.6.39 and *tclass* is *process* or *\*socket* then
+    use *scon role*
+  - OR
+  - IF kernel \<= 2.6.38 and *tclass* is *process* then use *scon role*
+  - ELSE
+  - Use *object_r*
+- ***type***
+  - IF there is a valid *type_member* rule then use the rules
+    [***member_type***](type_statements.md#type_member)
+  - OR
+  - IF kernel \>= 3.5 with *default_type tclass source* rule then use
+    *scon type*
+  - OR
+  - IF kernel \>= 3.5 with *default_type tclass target* rule then use
+    *tcon type*
+  - OR
+  - IF kernel \>= 2.6.39 and *tclass* is *process* or *\*socket* then
+    use *scon type*
+  - OR
+  - IF kernel \<= 2.6.38 and *tclass* is *process* then use *scon type*
+  - ELSE
+  - Use *tcon type*
+- ***range***
+  - IF kernel \>= 3.5 with *default_range tclass source low* rule then
+    use *scon low*
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass source high* rule then
+    use *scon high*
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass source low_high* rule
+    then use *scon range*
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass target low* rule then
+      use *tcon low*
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass target high* rule then
+    use *tcon high*
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass target low_high* rule
+    then use *tcon range*
+  - OR
+  - IF kernel \>= 2.6.39 and *tclass* is *process* or *\*socket* then
+    use *scon range*
+  - OR
+  - IF kernel \<= 2.6.38 and *tclass* is *process* then use *scon range*
+  - ELSE
+  - Use *scon low*
 
 ### *security_compute_relabel*
 
-**Table 3** below shows how the components from the source context,
+The table below shows how the components from the source context,
 *scon* target context, *tcon* and class, *tclass* are used to compute
 the new context *newcon* for ***security_compute_relabel**(3)*. The
 following notes also apply:
 
-1.  Any valid policy *type_change* enforcement rules will influence the
-    final outcome shown in the table.
-2.  For kernels less than 2.6.39 the context generated will depend on
-    whether the class is *process* or any other class.
-3.  For kernels 2.6.39 and above, those classes suffixed by *socket*
-    are also included in the *process* class outcome.
-4.  For kernels 3.5 and above with policy version 28 or greater, the
-    *default_user*, *default_role*, *default_range* statements will
-    influence the *user*, *role* and *range* of the computed context for
-    the specified class *tclass*. With policy version 28 or greater the
-    *default_type* statement can also influence the *type* in the
-    computed context.
-
-<table>
-<tbody>
-<tr style="background-color:#D3D3D3;">
-<td><strong>user</strong></td>
-<td><strong>role</strong></td>
-<td><strong>type</strong></td>
-<td><strong>range</strong></td>
-</tr>
-<tr>
-<td><p>If kernel &gt;= 3.5 with a <strong>default_user </strong><em>tclass</em><strong> target</strong> rule then use <em>tcon</em> <em>user</em></p>
-<p>ELSE</p>
-<p>Use <em>scon</em> <em>user</em></p></td>
-<td><p>If kernel &gt;= 3.5 with <strong>default_role </strong><em>tclass</em><strong> source</strong> rule then use <em>scon</em> <em>role</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_role </strong><em>tclass</em><strong> target</strong> rule then use <em>tcon</em> <em>role</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 2.6.39 and <em>tclass</em> is <strong>process</strong> or <em>socket</em>, then use <em>scon</em> <em>role</em></p>
-<p>OR</p>
-<p>If kernel &lt;= 2.6.38 and <em>tclass</em> is <strong>process</strong>, then use <em>scon</em> <em>role</em></p>
-<p>ELSE</p>
-<p>Use <strong>object_r</strong></p></td>
-<td><p>If there is a valid</p>
-<p>type_change</p>
-<p>rule then use the rules <em>change_type</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_type </strong><em>tclass</em><strong> source</strong> rule then use <em>scon</em> <em>type</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_type </strong><em>tclass</em><strong> target</strong> rule then use <em>tcon</em> <em>type</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 2.6.39 and <em>tclass</em> is <em><strong>process</strong></em> or <em>socket</em>, then use <em>scon</em> <em>type</em></p>
-<p>OR</p>
-<p>If kernel &lt;= 2.6.38 and <em>tclass</em> is <strong>process</strong>, then use <em>scon</em> <em>type</em></p>
-<p>ELSE</p>
-<p>Use <em>tcon</em> <em>type</em></p></td>
-<td><p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> source low</strong> rule then use <em>scon</em> <em>low</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> source high</strong> rule then use <em>scon</em> <em>high</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> source low_high</strong> rule then use <em>scon</em> <em>range</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> target low</strong> rule then use <em>tcon</em> <em>low</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> target high</strong> rule then use <em>tcon</em> <em>high</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 3.5 with <strong>default_range </strong><em>tclass</em><strong> target low_high</strong> rule then use <em>tcon</em> <em>range</em></p>
-<p>OR</p>
-<p>If kernel &gt;= 2.6.39 and <em>tclass</em> is <strong>process</strong> or <em>socket</em>, then use <em>scon</em> <em>range</em></p>
-<p>OR</p>
-<p>If kernel &lt;= 2.6.38 and <em>tclass</em> is <strong>process</strong>, then use <em>scon</em> <em>range</em></p>
-<p>ELSE</p>
-<p>Use <em>scon</em> <em>low</em></p></td>
-</tr>
-</tbody>
-</table>
-
-**Table 3**
+1. Any valid policy [***type_change***](type_statements.md#type_change)
+   enforcement rules will influence the final outcome shown in the table.
+2. For kernels less than 2.6.39 the context generated will depend on
+   whether the class is *process* or any other class.
+3. For kernels 2.6.39 and above, those classes suffixed by *socket*
+   are also included in the *process* class outcome.
+4. For kernels 3.5 and above with policy version 28 or greater, the
+   *default_user*, *default_role*, *default_range* statements will
+   influence the *user*, *role* and *range* of the computed context for
+   the specified class *tclass*. With policy version 28 or greater the
+   *default_type* statement can also influence the *type* in the
+   computed context.
+
+***Computing security_compute_relabel(3) contexts:***
+
+- ***user***
+  - If kernel \>= 3.5 with a *default_user tclass target* rule then use
+    *tcon user*
+  - ELSE
+  - Use *scon user*
+- ***role***
+  - IF kernel \>= 3.5 with *default_role tclass source* rule then use
+    *scon role*
+  - OR
+  - IF kernel \>= 3.5 with *default_role tclass target* rule then use
+    *tcon role*
+  - OR
+  - IF kernel \>= 2.6.39 and *tclass* is *process* or *\*socket* then use
+    *scon role*
+  - OR
+  - IF kernel \<= 2.6.38 and *tclass* is *process* then use *scon role*
+  - ELSE
+  - Use *object_r*
+- ***type***
+  - IF there is a valid *type_change* rule then use the rules
+    [***change_type***](type_statements.md#type_change)
+  - OR
+  - IF kernel \>= 3.5 with *default_type tclass source* rule then use
+    *scon type*
+  - OR
+  - IF kernel \>= 3.5 with *default_type tclass target* rule then use
+    *tcon type*
+  - OR
+  - IF kernel \>= 2.6.39 and *tclass* is *process* or *\*socket* then use
+    *scon type*
+  - OR
+  - IF kernel \<= 2.6.38 and *tclass* is *process* then use *scon type*
+  - ELSE
+  - Use *tcon type*
+- ***range***
+  - IF kernel \>= 3.5 with *default_range tclass source low* rule then use
+    *scon low*
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass source high* rule then use
+    *scon high*
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass source low_high* rule then
+    use *scon range*
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass target low* rule then use
+    *tcon low*
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass target high* rule then use
+    *tcon high*
+  - OR
+  - IF kernel \>= 3.5 with *default_range tclass target low_high* rule then
+    use *tcon range*
+  - OR
+  - IF kernel \>= 2.6.39 and *tclass* is *process* or *\*socket* then use
+    *scon range*
+  - OR
+  - IF kernel \<= 2.6.38 and *tclass* is *process* then use *scon range*
+  - ELSE
+  - Use *scon low*
 
 <!-- %CUTHERE% -->
 
