add chcon cmd to prevent selinux denials