Shouldn't restorecond be allowed to relabel anything?