Well I meant permissive on install was better than disabled on install, but certainly if you are using stock packages enforcing on install is the way to go. that said I have run into situatiions where the contextes werent right out of the box on some packages especially when I've done kickstarts from internal repos which include the updates. You are mostly right about fixfiles except if you run "fixfiles -F restore /path" it will do the same thing as "restorecon -R /path". That said I often create custom directories for applications where I dont agree with the default locations and "fixfiles relabel" is a very easy way to make those changes perminent. a common example of this is with PostgreSQL I always create a table space in a subdirectory on a dedicated partition. in this case I set the context on the directory with chcon then do a "fixfiles -F relablel" then every thing is happy :-). essentially the thing I like the most about fixfiles