Comment 10 for bug 651503

(In reply to comment #7)
> This is not an SELinux bug but a packaging bug. You need to make sure the
> selinux policy package is installed first

We might consider doing that with Spacewalk/Satellite packages in the future.

> Or run the restorecon on all files
> covered by the context when the package gets installed.

Well, the trouble is, matchpathcon_init() seems to be called at the beginning of the rpm transaction and matchpathcon_fini() at the end, so the newly loaded module (or semanage fcontext, I assume) is not seen by rpm. External restorecon fixes that, yes.

Still, shouldn't rpm detect that the state of SELinux has changed while the package was installed, and rerun that matchpathcon_init() ? Obviously, this bugzilla should probably be aligned to rpm/rpmlib.