And lvm2 will now set file contexts when it creates device nodes (and its symlinks). I fell back to the hack I don't really like in the end, but it at least appears to work. This should really probably get pushed down into device-mapper instead, but that can wait a few days until I make sure it's really what we want/need.