Why does restorecon fail? We should at least document why we're ignoring its exit status.