comment updates
add some selinux config tunables
don't hardcode restorecon command