Comment 8 for bug 633646

I may have narrowed this down a bit.
It looks like dev/null with the wrong security context is created when
device-mapper-libs is installed.

Procedure:

mkdir fake_root
cd fake_root

In a new terminal window run:
watch -n 1 'ls --lcontext dev 2>&1'

Start the install:
sudo yum install --installroot=`pwd` --releasever=13 device-mapper-libs

When it completes, dev/null exists:

$ ls --lcontext dev
total 0
-rw-r--r--. 1 unconfined_u:object_r:device_t:s0 root root 0 Aug 13 07:01 null

device-mapper-libs-1.02.44-1.fc13.x86_64