This is not really a selinux-polciy bug, although it will probably require selinux-policy changes.

During my recent work on plymouth (see bug 1945585) it has become clear to me that plymouthd does not run under the system_u:system_r:plymouthd_t:s0 context when it is started from the initrd; and by default Fedora always uses an initrd so that means that when plymouthd is running to display the boot-splash it is never running as
system_u:system_r:plymouthd_t:s0, but instead it is running in the default context.

This is understandable because the selinux-policy is only loaded once the rootfs has been mounted.

plymouth already gets a message from a special service once the rootfs has been mounted read-write, so that it can e.g. start writing debug logs there if debugging is enabled.

I was thinking that given that there is a whole selinux-policy for plymouth, it would be good if plymouth would transition to the system_u:system_r:plymouthd_t:s0 context once the selinux policy has been loaded.

So some questions for the selinux people:

1. Do you agree that doing such a transition would be a good idea ?
2. Are you aware of other daemons doing something similar and can you point me to some example code?