mjhjmtu

I am trying to mount ecryptfs on a system that uses SELinux (e.g. Cent-OS), and I want to preserve the security tag of all individual underlying files. Using mount -o command I can set the security tag of all files, e.g.

mount -t ecryptfs /var/lib/mysql /var/lib/mysql -o context="system_u:object_r:mysqld_db_t:s0" 

which is not what I want. As far as I know, ecryptfs supports extended attributes, and functions such as ecryptfs_setxattr and ecryptfs_getxattr are defined in the file inode.c of ecryptfs kernel module.
In addition, from man mount the option fscontext seems to do exactly what I want:

The fscontext= option works for all filesystems, regardless of their xattr support. The fscontext option sets the overarching filesystem label to a specific security context. This filesystem label is separate from the individual labels on the files. It represents the entire filesystem for certain kinds of permission checks, such as during mount or file creation. Individual file labels are still obtained from the xattrs on the files themselves. The context option actually sets the aggregate context that fscontext provides, in addition to supplying the same label for individual files.

Still the following command

mount -t ecryptfs /var/lib/mysql /var/lib/mysql -o fscontext="system_u:object_r:mysqld_db_t:s0"

changes the SELinux tag of all files to system_u:object_r:mysqld_db_t:s0, even for the file /var/lib/mysql/mysql.sock with the original tag system_u:object_r:mysqld_var_run_t:so.

My questions:

1) How can I mount ecryptfs on a directory and preserve the security tags (i.e. SELinux tags) of each file?

2) Why doesn't mount -o fscontext work for ecryptfs as it suppose to?

Note: I am using mysql directory just as an example, I was able to add policy modules to SELinux and make mysqld work when ecryptfs is mounted on top. Here, I am asking for a general solution to make ecryptfs transparent to SELinux.