I'm filing this as a tracking bug. We haven't done a whole lot of testing on this configuration but we wanted to provide a workaround and provide a link to this from our documentation.

There is some evidence to suggest that the udev-cache facility (cf openembedded-core/meta/recipes-core/udev/udev/udev-cache) is not generally compatible with SELinux. This may cause at best slower boot times and at worst, additional warnings/errors at boot time and/or failures in enforcing mode (?).

This may cause the udev-cache facility to fail to identify a cachable device configuration, slowing down the boot. 

1) While porting udev-cache changes to meta-selinux, I came across commit c7fc09794c20db9e3b32d326abb627985d2b5b65 [1]: "If, on the other hand, we at least create the cache with selinux and xattrs preserved and restored, we get significantly fewer errors and warnings on boot and we can successfully restore the context further down in init anyway. It still leaves some devices mislabeled, though, and still produces warnings on boot. Previous versions of the initscript removed all use of the dev-cache, if need be, we fall back to that. It is possible to get the middle-ground behaviour by defining use_udev_cache at the top of the udev initscript." This seems to imply that udev-cache has yet to work 100.0% under SELinux.

2) The existing udev-cache selinux implementation included an explicit jump to enforcing mode -- in other words, it's not possible to run udev-cache under permissive mode. It's not clear why this is necessary. I've removed this in our branches.


The workaround is to disable the udev-cache facility entirely by commenting out the DEVCACHE setting in /etc/default/udev-cache.


[1] http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/commit/?id=c7fc09794c20db9e3b32d326abb627985d2b5b65