I would like to bring https://bugzilla.redhat.com/show_bug.cgi?id=735877 to your attention, and in particular the fact that restorecon doesn't bring /var/spool/cron to a usable state once it's left it (which it does easily).

I may be missing something, but my expectation is that when I run, say, "restorecon -F -Rv /", I will end up with a system that is as working as the alteration of selinux file contexts can make it.  Discovering that this isn't true, and in an area as essential as the operation of cron, is pretty disturbing.

-Robin