On Mon, Jul 04, 2016 at 10:25:36 -0700,
Adam Williamson <adamwill(a)fedoraproject.org> wrote:
Do we actually *need* the second patch if we have the first? I mean, my
suggestion was just to do the first patch; if we do that, do we
actually need to worry about making the relabel happen any earlier than
it currently does?
Can't processes that start before the relabel is complete, get incorrectly
labelled? If so, that can cause a potentially cause a problem with the
labelling of files created by those processes and access from those
processes if the system shifts to enforcing mode later.