diff --git a/refpolicy/policy/modules/system/selinux.te b/refpolicy/policy/modules/system/selinux.te
index 3bc1093..6a0a865 100644
--- a/refpolicy/policy/modules/system/selinux.te
+++ b/refpolicy/policy/modules/system/selinux.te
@@ -329,10 +329,10 @@ hotplug_use_file_descriptors(restorecon_t)
 ')
 
 # relabeling rules
-files_read_all_directories(restorecon_t)
 kernel_relabel_unlabeled_object(restorecon_t)
 devices_manage_all_devices_labels(restorecon_t)
 files_manage_all_files_labels(restorecon_t)
+files_read_all_directories(restorecon_t)
 # this is to satisfy the assertion:
 authlogin_relabel_to_shadow_passwords(restorecon_t)
 
@@ -399,9 +399,9 @@ logging_send_system_log_message(setfiles_t)
 miscfiles_read_localization(setfiles_t)
 
 # relabeling rules
-files_read_all_directories(setfiles_t)
 kernel_relabel_unlabeled_object(setfiles_t)
 devices_manage_all_devices_labels(setfiles_t)
+files_read_all_directories(setfiles_t)
 files_manage_all_files_labels(setfiles_t)
 # this is to satisfy the assertion:
 authlogin_relabel_to_shadow_passwords(setfiles_t)
diff --git a/refpolicy/policy/modules/system/selinuxutil.te b/refpolicy/policy/modules/system/selinuxutil.te
index 3bc1093..6a0a865 100644
--- a/refpolicy/policy/modules/system/selinuxutil.te
+++ b/refpolicy/policy/modules/system/selinuxutil.te
@@ -329,10 +329,10 @@ hotplug_use_file_descriptors(restorecon_t)
 ')
 
 # relabeling rules
-files_read_all_directories(restorecon_t)
 kernel_relabel_unlabeled_object(restorecon_t)
 devices_manage_all_devices_labels(restorecon_t)
 files_manage_all_files_labels(restorecon_t)
+files_read_all_directories(restorecon_t)
 # this is to satisfy the assertion:
 authlogin_relabel_to_shadow_passwords(restorecon_t)
 
@@ -399,9 +399,9 @@ logging_send_system_log_message(setfiles_t)
 miscfiles_read_localization(setfiles_t)
 
 # relabeling rules
-files_read_all_directories(setfiles_t)
 kernel_relabel_unlabeled_object(setfiles_t)
 devices_manage_all_devices_labels(setfiles_t)
+files_read_all_directories(setfiles_t)
 files_manage_all_files_labels(setfiles_t)
 # this is to satisfy the assertion:
 authlogin_relabel_to_shadow_passwords(setfiles_t)