honor SELinux labels, when creating and writing config files

Also split out some fileio functions to fileio.c and provide a SELinux
aware pendant in fileio-label.c

see https://bugzilla.redhat.com/show_bug.cgi?id=881577

11 files changed, 13 insertions, 1 deletions

diff --git a/src/core/cgroup-attr.c b/src/core/cgroup-attr.c
index aed4e99d86..1373684bdb 100644
--- a/src/core/cgroup-attr.c
+++ b/src/core/cgroup-attr.c
@@ -22,6 +22,7 @@
 #include "cgroup-attr.h"
 #include "cgroup-util.h"
 #include "list.h"
+#include "fileio.h"
 
 int cgroup_attribute_apply(CGroupAttribute *a, CGroupBonding *b) {
         int r;
diff --git a/src/core/condition.c b/src/core/condition.c
index b3184922b8..30199c10e3 100644
--- a/src/core/condition.c
+++ b/src/core/condition.c
@@ -36,6 +36,7 @@
 #include "condition.h"
 #include "virt.h"
 #include "path-util.h"
+#include "fileio.h"
 
 Condition* condition_new(ConditionType type, const char *parameter, bool trigger, bool negate) {
         Condition *c;
diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c
index e815cb58e4..53394c25f4 100644
--- a/src/core/dbus-execute.c
+++ b/src/core/dbus-execute.c
@@ -29,6 +29,7 @@
 #include "strv.h"
 #include "dbus-common.h"
 #include "syscall-list.h"
+#include "fileio.h"
 
 DEFINE_BUS_PROPERTY_APPEND_ENUM(bus_execute_append_input, exec_input, ExecInput);
 DEFINE_BUS_PROPERTY_APPEND_ENUM(bus_execute_append_output, exec_output, ExecOutput);
diff --git a/src/core/dbus-unit.c b/src/core/dbus-unit.c
index d1de46afd4..4f968c20f2 100644
--- a/src/core/dbus-unit.c
+++ b/src/core/dbus-unit.c
@@ -30,6 +30,7 @@
 #include "cgroup-util.h"
 #include "strv.h"
 #include "path-util.h"
+#include "fileio.h"
 
 const char bus_unit_interface[] _introspect_("Unit") = BUS_UNIT_INTERFACE;
 
diff --git a/src/core/execute.c b/src/core/execute.c
index aa58bc488c..3376adc34a 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -65,6 +65,7 @@
 #include "path-util.h"
 #include "syscall-list.h"
 #include "env-util.h"
+#include "fileio.h"
 
 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
 
diff --git a/src/core/hostname-setup.c b/src/core/hostname-setup.c
index 7894f8a5f2..ac508af122 100644
--- a/src/core/hostname-setup.c
+++ b/src/core/hostname-setup.c
@@ -29,6 +29,7 @@
 #include "macro.h"
 #include "util.h"
 #include "log.h"
+#include "fileio.h"
 
 static int read_and_strip_hostname(const char *path, char **hn) {
         char *s;
diff --git a/src/core/locale-setup.c b/src/core/locale-setup.c
index 48b59bf448..eefb256ac5 100644
--- a/src/core/locale-setup.c
+++ b/src/core/locale-setup.c
@@ -27,6 +27,7 @@
 #include "util.h"
 #include "macro.h"
 #include "virt.h"
+#include "fileio.h"
 
 enum {
         /* We don't list LC_ALL here on purpose. People should be
diff --git a/src/core/machine-id-setup.c b/src/core/machine-id-setup.c
index 7f4c23b130..ca163978f3 100644
--- a/src/core/machine-id-setup.c
+++ b/src/core/machine-id-setup.c
@@ -35,6 +35,7 @@
 #include "mkdir.h"
 #include "log.h"
 #include "virt.h"
+#include "fileio.h"
 
 static int shorten_uuid(char destination[36], const char *source) {
         unsigned i, j;
diff --git a/src/core/main.c b/src/core/main.c
index a2b0a39fd5..71e0a6cf2f 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -66,6 +66,7 @@
 #include "locale-setup.h"
 #include "selinux-setup.h"
 #include "ima-setup.h"
+#include "fileio.h"
 
 static enum {
         ACTION_RUN,
diff --git a/src/core/service.c b/src/core/service.c
index 9c4bc41430..c510736b76 100644
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -43,6 +43,7 @@
 #include "util.h"
 #include "utf8.h"
 #include "env-util.h"
+#include "fileio.h"
 
 #ifdef HAVE_SYSV_COMPAT
 
diff --git a/src/core/unit.c b/src/core/unit.c
index f7d00b6030..86aaa1509a 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -46,6 +46,8 @@
 #include "missing.h"
 #include "cgroup-attr.h"
 #include "mkdir.h"
+#include "label.h"
+#include "fileio-label.h"
 
 const UnitVTable * const unit_vtable[_UNIT_TYPE_MAX] = {
         [UNIT_SERVICE] = &service_vtable,
@@ -2778,7 +2780,7 @@ int unit_write_drop_in(Unit *u, bool runtime, const char *name, const char *data
                 return -ENOMEM;
 
         mkdir_p(p, 0755);
-        return write_one_line_file_atomic(q, data);
+        return write_one_line_file_atomic_label(q, data);
 }
 
 int unit_remove_drop_in(Unit *u, bool runtime, const char *name) {