tmpfiles: fix relabel to run restorecon before chown and chmod