diff --git a/selinux.org b/selinux.org
index cff9cd0..0184cb7 100644
--- a/selinux.org
+++ b/selinux.org
@@ -1,11 +1,11 @@
 #+TITLE: OpenLMI SELinux Design Document
-#+DATE: <2014-04-17 Thu>
+#+DATE: <2014-04-24 Thu>
 #+Author: Jan Synáček
 #+EMAIL: jsynacek@redhat.com
 #+OPTIONS: ':nil *:t -:t ::t <:t H:3 \n:nil ^:{}  author:t 
 #+OPTIONS: creator:nil  date:nil e:t email:nil f:t inline:t
 #+OPTIONS: num:t tags:t timestamp:t toc:t |:t
-#+CREATOR: Emacs 24.4.50.7 (Org mode 8.2.5h)
+#+CREATOR: Emacs 24.3.90.1 (Org mode 8.2.5h)
 #+DESCRIPTION:
 #+EXCLUDE_TAGS: noexport
 #+KEYWORDS: openlmi selinux
@@ -25,7 +25,7 @@ clear and easier to implement.
 #+BEGIN_SRC plantuml :file selinux.png
   @startuml
 
-  title OpenLMI SELinux Model Draft v2
+  title OpenLMI SELinux Model Draft v3
 
   enum SELinuxState {
       Enforcing
@@ -39,8 +39,8 @@ clear and easier to implement.
   }
 
   enum TargetAction {
-      ListMislabeledFiles
-      RestoreMislabeledFiles
+      Report
+      Restore
   }
 
   class CIM_ComputerSystem
@@ -48,10 +48,6 @@ clear and easier to implement.
 
   class LMI_SELinuxElement <<(C, dodgerblue)>> {
   }
-  class LMI_SELinuxElementWithContext <<(C, dodgerblue)>> {
-      CurrentContext: string
-      ExpectedContext: string  
-  }
 
   class LMI_SELinuxBoolean <<(C, dodgerblue)>> {
       State: boolean
@@ -59,28 +55,23 @@ clear and easier to implement.
   }
 
   class LMI_SELinuxPort <<(C, dodgerblue)>> {
+      SELinuxCurrentContext: string
+      SELinuxExpectedContext: string
       Protocol: SELinuxProtocol
       Ports: string[]
   }
 
-  class LMI_SELinuxFile <<(C, dodgerblue)>> {
-      Name: string
-  }
-
   class LMI_UnixFile
-  class LMI_SELinuxFileIdentity <<(C, dodgerblue)>> {
-      SameElement: ref LMI_UnixFile
-      SystemElement: ref LMI_SELinuxFile
-  }
-  (LMI_UnixFile, LMI_SELinuxFile) . LMI_SELinuxFileIdentity
+  note bottom
+  LMI_UnixFile is part of this draft,
+  because it is passed as an argument
+  to LMI_SELinuxService.RestoreLabels().
+  end note
 
   CIM_ManagedElement <|-- LMI_SELinuxElement
   LMI_SELinuxElement <|-- LMI_SELinuxBoolean
 
-  LMI_SELinuxElement <|-- LMI_SELinuxElementWithContext
-  LMI_SELinuxElementWithContext <|-- LMI_SELinuxPort
-  LMI_SELinuxElementWithContext <|-- LMI_SELinuxFile
-
+  LMI_SELinuxElement <|-- LMI_SELinuxPort
 
   class CIM_Service
   class LMI_SELinuxService <<(C, dodgerblue)>> {
@@ -92,11 +83,11 @@ clear and easier to implement.
       +SetSELinuxState(SELinuxState NewState, boolean MakeDefault): ref LMI_SELinuxJob
       ..
       +SetPortLabel(ref LMI_SELinuxPort Target, string PortRange, boolean Remove): ref LMI_SELinuxJob
-      +SetFileLabel(ref LMI_SELinuxFile Target, string Label): ref LMI_SELinuxJob
+      +SetFileLabel(ref LMI_UnixFile Target, string Label): ref LMI_SELinuxJob
       ..
       +SetBoolean(ref LMI_SELinuxBoolean Target, boolean Value, boolean MakeDefault): ref LMI_SELinuxJob
       ..
-      +ProcessTarget(ref LMI_SELinuxFile Target, TargetAction Action, boolean Recursively) : ref LMI_SELinuxJob
+      +RestoreLabels(ref LMI_UnixFile Target, TargetAction Action, boolean Recursively) : ref LMI_SELinuxJob
   }
   CIM_Service <|-- LMI_SELinuxService
 
@@ -168,17 +159,6 @@ clear and easier to implement.
   };
 
   [ Version("0.0.1"),
-    Description("Common superclass for all SELinux classes which have a context.") ]
-  class LMI_SELinuxElementWithContext : LMI_SELinuxElement
-  {
-    [ Description("Current SELinux context.") ]
-      string CurrentContext;
-
-    [ Description("Expected SELinux context.") ]
-      string ExpectedContext;
-  };
-
-  [ Version("0.0.1"),
     Description("Class representing an SELinux policy boolean.") ]
   class LMI_SELinuxBoolean : LMI_SELinuxElement
   {
@@ -193,8 +173,14 @@ clear and easier to implement.
     Description(
       "Class representing an SELinux port. It can encompass multiple "
       "individual network ports, or even their ranges.") ]
-  class LMI_SELinuxPort : LMI_SELinuxElementWithContext
+  class LMI_SELinuxPort : LMI_SELinuxElement
   {
+    [ Description("Current SELinux context.") ]
+      string SELinuxCurrentContext;
+
+    [ Description("Expected SELinux context.") ]
+      string SELinuxExpectedContext;
+
     [ Description("Protocol type. Only UDP and TCP are supported."),
       ValueMap {"0", "1"},
       Values {"UDP", "TCP"} ]
@@ -210,17 +196,6 @@ clear and easier to implement.
 
   [ Version("0.0.1"),
     Description(
-      "Class representing an SELinux file. Instances of this class "
-      "should be connected with existing LMI_UnixFile instances with "
-      "an identity association class. See LMI_SELinuxFileIdentity.") ]
-  class LMI_SELinuxFile : LMI_SELinuxElementWithContext
-  {
-    [ Description("Full path to the actual file.") ]
-      string Name;
-  };
-
-  [ Version("0.0.1"),
-    Description(
       "SELinux on the managed system.\n"
       "SELinux can be in the following states:\n"
       "   Enforcing - SELinux security policy is enforced.\n"
@@ -290,7 +265,7 @@ clear and easier to implement.
               "In Use"} ]
       uint32 SetFileLabel(
         [ IN, OUT, Description("An SELinux file to change.") ]
-        LMI_SELinuxFile REF Target,
+        LMI_UnixFile REF Target,
 
         [ IN, Description("New label.") ]
         string Label,
@@ -320,21 +295,21 @@ clear and easier to implement.
       );
 
     [ Description(
-      "Take action on an SELinux file.\n"
-      "Possible actions are:\n"
-      " ListMislabeledFiles : List files whose SELinux label is different than the one specified by the policy.\n"
-      " RestoreMislabeledFiles : Restore SELinux label on files to the respective values specified by the policy.\n"),
+      "Restore default SELinux security contexts on files.\n"
+      "There are two actions that can be taken on the specified files:\n"
+      " Report: List files whose SELinux label is different than the one specified by the policy.\n"
+      " Restore: Restore SELinux label on files to the respective values specified by the policy.\n"),
       ValueMap {"0", "1", "2", "3", "4", "5", "6"},
       Values {"Job Completed with No Error", "Not Supported",
               "Unknown", "Timeout", "Failed", "Invalid Parameter",
               "In Use"} ]
-      uint32 ProcessTarget(
+      uint32 RestoreLabels(
         [ IN, OUT, Description("An SELinux file to change.") ]
-        LMI_SELinuxFile REF Target,
+        LMI_UnixFile REF Target,
 
         [ IN, Description(""),
           ValueMap {"0", "1", ".."},
-          Values {"ListMislabeledFiles", "RestoreMislabeledFiles", "OpenLMI Reserved"} ]
+          Values {"Report", "Restore", "OpenLMI Reserved"} ]
         uint16 Action,
 
         [ IN, Description(
@@ -405,19 +380,6 @@ clear and easier to implement.
           DefaultContext = "object_r:object_r:snmp_port_t"
       }
 
-      object SELinuxFile_1 {
-          InstanceID = "/etc"
-          Name = "/etc"
-          CurrentContext = "system_u:object_r:etc_t:s0"
-          DefaultContext = "system_u:object_r:etc_t:s0"
-      }
-      object SELinuxFile_2 {
-          InstanceID = "/root"
-          Name = /root
-          CurrentContext = "system_u:object_r:sysfs_t_t:s0"
-          DefaultContext = "system_u:object_r:admin_home_t:s0"
-      }
-
       object SELinuxService_Global {
           InstanceID = "LMI:SELinuxService:Global"
           State =  Permissive
@@ -430,15 +392,11 @@ clear and easier to implement.
       object SELinuxServiceHasElement_2
       object SELinuxServiceHasElement_3
       object SELinuxServiceHasElement_4
-      object SELinuxServiceHasElement_5
-      object SELinuxServiceHasElement_6
 
       (SELinuxService_Global, SELinuxBoolean_1) . SELinuxServiceHasElement_1
       (SELinuxService_Global, SELinuxBoolean_2) . SELinuxServiceHasElement_2
       (SELinuxService_Global, SELinuxPort_1) . SELinuxServiceHasElement_3
       (SELinuxService_Global, SELinuxPort_2) . SELinuxServiceHasElement_4
-      (SELinuxService_Global, SELinuxFile_1) . SELinuxServiceHasElement_5
-      (SELinuxService_Global, SELinuxFile_2) . SELinuxServiceHasElement_6
   @enduml
 #+END_SRC
 
@@ -453,12 +411,12 @@ actual LMIShell looks like.
 ** Booleans
 
 *** get selinux boolean
-#+BEGIN_EXAMPLE
+#+BEGIN_SRC python
 LMI_SELinuxBoolean.first_instance({"InstanceID":"LMI:SELinuxBoolean:use_nfs_home_dirs"})
-#+END_EXAMPLE
+#+END_SRC
 
 *** set selinux boolean
-#+BEGIN_EXAMPLE
+#+BEGIN_SRC python
 s = LMI_SELinuxService.first_instance()
 i = LMI_SELinuxBoolean.first_instance({"InstanceID":"LMI:SELinuxBoolean:use_nfs_home_dirs"})
 
@@ -467,96 +425,92 @@ s.SetBoolean(ref i, True, False)
 
 # set boolean permanently
 s.SetBoolean(ref i, True, True)
-#+END_EXAMPLE
+#+END_SRC
 
 ** Ports
 
 *** show local ports and their labels
-#+BEGIN_EXAMPLE
+#+BEGIN_SRC python
 LMI_SELinuxPort.EnumerateInstance()
-#+END_EXAMPLE
+#+END_SRC
 
 *** set label on a port
-#+BEGIN_EXAMPLE
+#+BEGIN_SRC python
 s = LMI_SELinuxService.first_instance()
 i = LMI_SELinuxPort.first_instance({"InstanceID":"LMI:SELinuxPort:TCP:virt_port_t"})
 
 s.SetPortLabel(ref i, "new_label_t")
-#+END_EXAMPLE
+#+END_SRC
 
 ** Service
 For all upcoming operations, the service instance is needed.
 
-#+BEGIN_EXAMPLE
+#+BEGIN_SRC python
 s = LMI_SELinuxService.first_instance()
-#+END_EXAMPLE
+#+END_SRC
 
 Also, all service methods return job instances with affected elements associated to them.
 
 *** get selinux state
-#+BEGIN_EXAMPLE
+#+BEGIN_SRC python
 # getenforce
 s.State
 
 # get persistent state (/etc/sysconfig/selinux)
 s.DefaultState
-#+END_EXAMPLE
+#+END_SRC
 
 *** set selinux state
-#+BEGIN_EXAMPLE
+#+BEGIN_SRC python
 # setenforce
 s.SetSELinuxState(Permissive)
 
 # set persistent state (/etc/sysconfig/selinux)
 s.SetSELinuxState(Enforcing, True)
-#+END_EXAMPLE
+#+END_SRC
 
 *** show policy version
-#+BEGIN_EXAMPLE
+#+BEGIN_SRC python
 s.PolicyVersion
-#+END_EXAMPLE
+#+END_SRC
 
 *** show current mode (enforcing/permissive)
-#+BEGIN_EXAMPLE
+#+BEGIN_SRC python
 s.SELinuxState
-#+END_EXAMPLE
+#+END_SRC
 
 *** show default mode (from /etc/sysconfig/selinux; enforcing/permissive/disabled)
-#+BEGIN_EXAMPLE
+#+BEGIN_SRC python
 s.SELinuxDefaultState
-#+END_EXAMPLE
+#+END_SRC
 
 *** restore a file label (optionally with subdirectories)
-#+BEGIN_EXAMPLE
+#+BEGIN_SRC python
 
 # restore label on a file
 # the 'Recursively' argument has no effect on non-directories
-i = LMI_SELinuxFile.get_instance({"InstanceID":"LMI:SELinuxFile:/home/jsynacek/.bashrc"})
-s.ProcessTarget(ref i, 1<"RestoreMislabeledFiles">)
+i = LMI_UnixFile.get_instance({"Name":"/home/jsynacek/.bashrc"})
+s.RestoreLabels(ref i, 1<"Restore">)
 
 # restore labels in  /etc recursively
 # this may potentially take a while
-i = LMI_SELinuxFile.get_instance({"InstanceID":"LMI:SELinuxFile:/etc"})
-s.ProcessTarget(ref i, 1<"RestoreMislabeledFiles">, True)
+i = LMI_UnixFile.get_instance({"Name":"/etc"})
+s.RestoreLabels(ref i, 1<"Restore">, True)
 
-#+END_EXAMPLE
+#+END_SRC
 
 *** scan a directory and report mislabelled files
-#+BEGIN_EXAMPLE
+#+BEGIN_SRC python
 # get mislabeled files in /var
-i = LMI_SELinuxFile.get_instance({"InstanceID":"LMI:SELinuxFile:/var"})
-s.ProcessTarget(ref i, 0<"ListMislabeledFiles">, False)
+i = LMI_UnixFile.get_instance({"Name":"/var"})
+s.RestoreLabels(ref i, 0<"Report">, False)
 
 # get mislabeled files in /var recursively
 # this may potentially take a while
-s.ProcessTarget(ref i, 0<"ListMislabeledFiles">, True)
+s.RestoreLabels(ref i, 0<"Report">, True)
 
-#+END_EXAMPLE
+#+END_SRC
 
-*** TODO send indication when file gets mislabelled
-#+BEGIN_EXAMPLE
-TBD
-#+END_EXAMPLE
 
 * Additional use cases
 If there are any, they will be documented here.
@@ -687,12 +641,16 @@ timestamp and version of this document, in which they were made.
    As a bonus, if there is no SELinux on the managed machine, no SELinux* classes
    will be present and everything will fit.
 
+   <2014-04-17 Thu>
+
 ** D: LMI_SELinuxService will use a string for its policy type property.              :v2:
    Although there are some common names for policy types, like Targeted, Strict,
    MLS, it is probably better to use simple string, instead of an enumeration
    type. It isn't clear whether the common names may change or custom names can
    be used.
 
+   <2014-04-17 Thu>
+
 ** Q: Why not make LMI_SElinuxService.SetSELinuxState() take NewState and NewDefaultState instead? :v2:
    *A*: It may appear as a better solution, but if the method is called with
     both set, and for some reason, setting of only one of them fails, it is not
@@ -703,8 +661,30 @@ timestamp and version of this document, in which they were made.
     It is more simple to just call the current method twice and have the
     operation "atomic".
 
+   <2014-04-17 Thu>
+
+** D: The method for restoring/listing mislabeled files shall be called RestoreLabels :v3:
+   Since it functionally resembles the 'restorecon' command.
+
+   <2014-04-24 Thu>
+
+** D: LMI_SELinuxFile will be removed from the model                                  :v3:
+   There is already LMI_UnixFile. Although it is a bit of an outlier, it is special anyway, because it can't be
+   enumerated.
+
+   <2014-04-24 Thu>
+
+** Q: Shouldn't LMI_SELinuxService.RestoreLabels() be somehow restrained, so it doesn't DoS the server :v3:
+   A: No. Anybody with ssh access to the server may run 'restorecon' on his, possibly huge, directory structure as well.
+
+   <2014-04-24 Thu>
+
 * Older versions
 ** v1
 #+BEGIN_HTML
 <a href="v1/selinux.org" type="text/plain">org</a> / <a href="v1/selinux.html">html</a> (<a href="v1/v1-v2.patch" type="text/plain">diff</a>)
 #+END_HTML
+** v2
+#+BEGIN_HTML
+<a href="v2/selinux.org" type="text/plain">org</a> / <a href="v2/selinux.html">html</a> (<a href="v2/v2-v3.patch" type="text/plain">diff</a>)
+#+END_HTML
