Busy day today. As is my norm at this point, fixed one thing only to break five others.
Made progress on the SELinux stuff. After adding various bits of debugging, discovered that rpm was only setting up things in rpminstall.c, which is only used for the command line. *sigh* Hacked into rpm-python. Minor policy fixup later and I'm on my way to being happy. And then I start getting journal aborts.
Luckily, sct is in Westford this week, so he's on the case. Hopefully he'll see something obvious 🙂