Comparisons between SELinux file categories should always translate to the numeric version

SELinux file contexts have a category that is assigned to every file on the system.

If the system is using mcstransd (which most higher security systems will be for user convenience) changes to the system at runtime can cause issues with category translation until mcstransd is restarted.

These conditions cannot be clearly enumerated and may happen at any time. When this occurs, Puppet will try to reset the context on every managed file as well as triggering service restarts based on those files.

This can cause your systems to restart every service each time Puppet runs.

Puppet should, instead, use the output of chcat -L to obtain the list of mappings from the system and translate any categories on files back to their numeric form in all cases.

To do this, simply discard any right hand side values that contain a hyphen (-) and then use the left hand corresponding value for all context comparisons.

Setting a context via either method is equivalent so that code should not need to change.