By default, the new grub.conf the grubby creates ends up being marked as boot_t, instead of the boot_runtime_t that it is supposed to be.
Guess that grubby's going to need policy too :/ Should be something simple, though... just need file auto transitioning from boot_t -> boot_runtime_t
We are now just allowing it to run with boot_t so this is not a bug.