Selinux disallows read-only loop mount of a file, but only at boot

[David]

I'm exploring new territory: the first time I've ever tried to mount a
loop device (a ro file) at boot using fstab.

My fstab entry works fine from the command line, but it fails at boot
time due to a selinux avc error, I dont understand why but I suspect
it is because the file context is unsuitable.

The file and context are:

[david at kablamm ~]$ ls -lZ
/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso
-r--r-----  root share unconfined_u:object_r:default_t:s0
/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso

The fstab line is:

/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso	/mnt/Fedora-09-i386-DVD	iso9660	loop,ro,gid=share
0 0

The command line that works is:

# mount /mnt/Fedora-09-i386-DVD

The boot-time error messages are:

Mounting local filesystems:
/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso: Permission
denied [FAILED]
Mounting other filesystems:
/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso: Permission
denied [FAILED]

and from dmesg:

type=1400 audit(1241411595.523:4): avc:  denied  { read } for
pid=1335 comm="mount" name="Fedora-09-i386-DVD.iso" dev=sdb2 ino=1922
scontext=system_u:system_r:mount_t:s0
tcontext=unconfined_u:object_r:default_t:s0 tclass=file

and my selinux status is:

[root at kablamm ~]# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 22
Policy from config file:        targeted

QUESTIONS:

I'm guessing that the problem is the file's tcontext .. what should it
be? Is it just a matter of changing it to mount_t, the same as the
error message scontext?

The command
# sesearch --allow -s mount_t -c file -p read
gives 1292 results. How could I decide which one of these to use?

And if anyone can say why it does not matter after boot time, I'd
appreciate understanding that. Possibly something to do with context
transitions?

I've not attempted any trial and error solution, prefer to comprehend
security tools if possible.
Thanks.