You should not start and stop services directly on SELinux systems as they might end up in a different context compared to when they are started on boot. We seem to have gotten away with this with the targeted policy, but the mls policy is not as forgiving. The proper way is to run them via the run_init helper program. It invokes PAM so that pam_selinux can do a proper context switch first. Unfortunately it seems to be configured to require a password by default, so it could be difficult to automate. This affects at least tl-setup and tlwebadm. Also probably not an issue with systemd as systemctl doesn't directly start the process.
Also, tl-setup currently gives a traceback with the mls policy. A first step could be cleaning that up and giving better user feedback.
This might not be relevant for many systems anymore as these days we use systemctl to start our services. So only systems that use SELinux but not systemd will be affected by this.
We now require systemd, so this bug is no longer relevant.
