Two identical files; Apache says one is forbidden

I've got this one file, favicon.ico. It's actually a large group of nested files, but purely for example, just this one.

If I do cp favicon.ico favicon2.ico, Apache can read the second one just fine.

If I do mv favicon.ico favicon3.ico, Apache throws a 403 on favicon3.ico.

If I su apache, I can read the file as apache.

stat says both files are identical, except for the inode number.

Is there some hidden flag somewhere or something that I'm missing? I've never seen anything like this.

error_log says (13)Permission denied: access to /favicon3.ico denied

SELinux is denying you access to the file, since you moved instead of copied it from somewhere else on the filesystem into its final location. Thus it kept its original security context, which didn't allow Apache to access it.

To resolve the issue, relabel the file (and probably all the rest of your files).

For example:

restorecon -r -v /var/www/html

To avoid the problem in future, copy files (and delete the original if necessary).