really make restorecon run only when necessary