The `/var/lib/samba/bind-dns` directory contains files that are hard-linked to files in the `/var/lib/samba/private` directory. All paths for a file must have the same context, or `restorecon` will effectively "toggle" the labels each time it is run.