bus: rework message handlers to always take an error argument

Message handler callbacks can be simplified drastically if the
dispatcher automatically replies to method calls if errors are returned.

Thus: add an sd_bus_error argument to all message handlers. When we
dispatch a message handler and it returns negative or a set sd_bus_error
we send this as message error back to the client. This means errors
returned by handlers by default are given back to clients instead of
rippling all the way up to the event loop, which is desirable to make
things robust.

As a side-effect we can now easily turn the SELinux checks into normal
function calls, since the method call dispatcher will generate the right
error replies automatically now.

Also, make sure we always pass the error structure to all property and
method handlers as last argument to follow the usual style of passing
variables for return values as last argument.

18 files changed, 490 insertions, 425 deletions

diff --git a/src/core/dbus-cgroup.c b/src/core/dbus-cgroup.c
index 4dbb83a769..39865a96da 100644
--- a/src/core/dbus-cgroup.c
+++ b/src/core/dbus-cgroup.c
@@ -33,8 +33,8 @@ static int property_get_blockio_device_weight(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         CGroupContext *c = userdata;
         CGroupBlockIODeviceWeight *w;
@@ -63,8 +63,8 @@ static int property_get_blockio_device_bandwidths(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         CGroupContext *c = userdata;
         CGroupBlockIODeviceBandwidth *b;
@@ -97,8 +97,8 @@ static int property_get_device_allow(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         CGroupContext *c = userdata;
         CGroupDeviceAllow *a;
diff --git a/src/core/dbus-client-track.c b/src/core/dbus-client-track.c
index ce514b577c..4a5bdef040 100644
--- a/src/core/dbus-client-track.c
+++ b/src/core/dbus-client-track.c
@@ -19,6 +19,7 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
+#include "bus-util.h"
 #include "dbus-client-track.h"
 
 static unsigned tracked_client_hash(const void *a) {
@@ -43,7 +44,7 @@ static int tracked_client_compare(const void *a, const void *b) {
         return 0;
 }
 
-static int on_name_owner_changed(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int on_name_owner_changed(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         BusTrackedClient *c = userdata;
         const char *name, *old, *new;
         int r;
@@ -53,8 +54,8 @@ static int on_name_owner_changed(sd_bus *bus, sd_bus_message *message, void *use
 
         r = sd_bus_message_read(message, "sss", &name, &old, &new);
         if (r < 0) {
-                log_debug("Failed to parse NameOwnerChanged message.");
-                return 0;
+                bus_log_parse_error(r);
+                return r;
         }
 
         bus_client_untrack(c->set, bus, name);
diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c
index ca7ee5c10b..90556274d3 100644
--- a/src/core/dbus-execute.c
+++ b/src/core/dbus-execute.c
@@ -40,8 +40,8 @@ static int property_get_environment_files(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         ExecContext *c = userdata;
         char **j;
@@ -72,8 +72,8 @@ static int property_get_rlimit(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         struct rlimit *rl;
         uint64_t u;
@@ -106,8 +106,8 @@ static int property_get_oom_score_adjust(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
 
         ExecContext *c = userdata;
@@ -136,8 +136,8 @@ static int property_get_nice(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
 
         ExecContext *c = userdata;
@@ -165,8 +165,8 @@ static int property_get_ioprio(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
 
         ExecContext *c = userdata;
@@ -193,8 +193,8 @@ static int property_get_cpu_sched_policy(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         ExecContext *c = userdata;
         int32_t n;
@@ -220,8 +220,8 @@ static int property_get_cpu_sched_priority(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         ExecContext *c = userdata;
         int32_t n;
@@ -250,8 +250,8 @@ static int property_get_cpu_affinity(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         ExecContext *c = userdata;
 
@@ -271,8 +271,8 @@ static int property_get_timer_slack_nsec(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         ExecContext *c = userdata;
         uint64_t u;
@@ -295,8 +295,8 @@ static int property_get_capability_bounding_set(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         ExecContext *c = userdata;
 
@@ -315,8 +315,8 @@ static int property_get_capabilities(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         ExecContext *c = userdata;
         char *t = NULL;
@@ -349,8 +349,8 @@ static int property_get_syscall_filter(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         ExecContext *c = userdata;
 
@@ -434,8 +434,8 @@ int bus_property_get_exec_command(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *ret_error) {
 
         ExecCommand *c = *(ExecCommand**) userdata;
         int r;
diff --git a/src/core/dbus-execute.h b/src/core/dbus-execute.h
index 957742beee..1574c309de 100644
--- a/src/core/dbus-execute.h
+++ b/src/core/dbus-execute.h
@@ -36,5 +36,5 @@
 
 extern const sd_bus_vtable bus_exec_vtable[];
 
-int bus_property_get_exec_output(sd_bus *bus, const char *path, const char *interface, const char *property, sd_bus_message *reply, sd_bus_error *error, void *userdata);
-int bus_property_get_exec_command(sd_bus *bus, const char *path, const char *interface, const char *property, sd_bus_message *reply, sd_bus_error *error, void *userdata);
+int bus_property_get_exec_output(sd_bus *bus, const char *path, const char *interface, const char *property, sd_bus_message *reply, void *userdata, sd_bus_error *ret_error);
+int bus_property_get_exec_command(sd_bus *bus, const char *path, const char *interface, const char *property, sd_bus_message *reply, void *userdata, sd_bus_error *ret_error);
diff --git a/src/core/dbus-job.c b/src/core/dbus-job.c
index bdb9096e42..923d545a02 100644
--- a/src/core/dbus-job.c
+++ b/src/core/dbus-job.c
@@ -35,8 +35,8 @@ static int property_get_unit(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         _cleanup_free_ char *p = NULL;
         Job *j = userdata;
@@ -52,14 +52,18 @@ static int property_get_unit(
         return sd_bus_message_append(reply, "(so)", j->unit->id, p);
 }
 
-static int method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Job *j = userdata;
+        int r;
 
         assert(bus);
         assert(message);
         assert(j);
 
-        SELINUX_UNIT_ACCESS_CHECK(j->unit, bus, message, "stop");
+        r = selinux_unit_access_check(j->unit, bus, message, "stop", error);
+        if (r < 0)
+                return r;
+
         job_finish_and_invalidate(j, JOB_CANCELED, true);
 
         return sd_bus_reply_method_return(message, NULL);
diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
index 12b24c123b..d7936fff20 100644
--- a/src/core/dbus-manager.c
+++ b/src/core/dbus-manager.c
@@ -46,8 +46,8 @@ static int property_get_version(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         assert(bus);
         assert(reply);
@@ -61,8 +61,8 @@ static int property_get_features(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         assert(bus);
         assert(reply);
@@ -76,8 +76,8 @@ static int property_get_virtualization(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         const char *id = NULL;
 
@@ -95,10 +95,10 @@ static int property_get_tainted(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
-        char buf[LINE_MAX] = "", *e = buf;
+        char buf[sizeof("split-usr:mtab-not-symlink:cgroups-missing:local-hwclock:")] = "", *e = buf;
         _cleanup_free_ char *p = NULL;
         Manager *m = userdata;
 
@@ -131,8 +131,8 @@ static int property_get_log_target(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         assert(bus);
         assert(reply);
@@ -146,8 +146,8 @@ static int property_set_log_target(
                 const char *interface,
                 const char *property,
                 sd_bus_message *value,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         const char *t;
         int r;
@@ -168,8 +168,8 @@ static int property_get_log_level(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         _cleanup_free_ char *t = NULL;
         int r;
@@ -190,8 +190,8 @@ static int property_set_log_level(
                 const char *interface,
                 const char *property,
                 sd_bus_message *value,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         const char *t;
         int r;
@@ -212,8 +212,8 @@ static int property_get_n_names(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Manager *m = userdata;
 
@@ -230,8 +230,8 @@ static int property_get_n_jobs(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Manager *m = userdata;
 
@@ -248,8 +248,8 @@ static int property_get_progress(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Manager *m = userdata;
         double d;
@@ -272,8 +272,8 @@ static int property_set_runtime_watchdog(
                 const char *interface,
                 const char *property,
                 sd_bus_message *value,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         usec_t *t = userdata;
         int r;
@@ -290,7 +290,7 @@ static int property_set_runtime_watchdog(
         return watchdog_set_timeout(t);
 }
 
-static int method_get_unit(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_get_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         _cleanup_free_ char *path = NULL;
         Manager *m = userdata;
         const char *name;
@@ -303,22 +303,24 @@ static int method_get_unit(sd_bus *bus, sd_bus_message *message, void *userdata)
 
         r = sd_bus_message_read(message, "s", &name);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         u = manager_get_unit(m, name);
         if (!u)
-                return sd_bus_reply_method_errorf(message, BUS_ERROR_NO_SUCH_UNIT, "Unit %s not loaded.", name);
+                return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s not loaded.", name);
 
-        SELINUX_UNIT_ACCESS_CHECK(u, bus, message, "status");
+        r = selinux_unit_access_check(u, bus, message, "status", error);
+        if (r < 0)
+                return r;
 
         path = unit_dbus_path(u);
         if (!path)
-                return sd_bus_reply_method_errno(message, ENOMEM, NULL);
+                return -ENOMEM;
 
         return sd_bus_reply_method_return(message, "o", path);
 }
 
-static int method_get_unit_by_pid(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_get_unit_by_pid(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         _cleanup_free_ char *path = NULL;
         Manager *m = userdata;
         pid_t pid;
@@ -333,29 +335,30 @@ static int method_get_unit_by_pid(sd_bus *bus, sd_bus_message *message, void *us
 
         r = sd_bus_message_read(message, "u", &pid);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         if (pid == 0) {
                 r = sd_bus_get_owner_pid(bus, sd_bus_message_get_sender(message), &pid);
                 if (r < 0)
-                        return sd_bus_reply_method_errno(message, r, NULL);
+                        return r;
         }
 
         u = manager_get_unit_by_pid(m, pid);
         if (!u)
-                return sd_bus_reply_method_errorf(message, BUS_ERROR_NO_UNIT_FOR_PID, "PID %u does not belong to any loaded unit.", pid);
+                return sd_bus_error_setf(error, BUS_ERROR_NO_UNIT_FOR_PID, "PID %u does not belong to any loaded unit.", pid);
 
-        SELINUX_UNIT_ACCESS_CHECK(u, bus, message, "status");
+        r = selinux_unit_access_check(u, bus, message, "status", error);
+        if (r < 0)
+                return r;
 
         path = unit_dbus_path(u);
         if (!path)
-                return sd_bus_reply_method_errno(message, ENOMEM, NULL);
+                return -ENOMEM;
 
         return sd_bus_reply_method_return(message, "o", path);
 }
 
-static int method_load_unit(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
+static int method_load_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         _cleanup_free_ char *path = NULL;
         Manager *m = userdata;
         const char *name;
@@ -368,23 +371,24 @@ static int method_load_unit(sd_bus *bus, sd_bus_message *message, void *userdata
 
         r = sd_bus_message_read(message, "s", &name);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
-        r = manager_load_unit(m, name, NULL, &error, &u);
+        r = manager_load_unit(m, name, NULL, error, &u);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, &error);
+                return r;
 
-        SELINUX_UNIT_ACCESS_CHECK(u, bus, message, "status");
+        r = selinux_unit_access_check(u, bus, message, "status", error);
+        if (r < 0)
+                return r;
 
         path = unit_dbus_path(u);
         if (!path)
-                return sd_bus_reply_method_errno(message, ENOMEM, NULL);
+                return -ENOMEM;
 
         return sd_bus_reply_method_return(message, "o", path);
 }
 
-static int method_start_unit_generic(sd_bus *bus, sd_bus_message *message, Manager *m, JobType job_type, bool reload_if_possible) {
-        _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
+static int method_start_unit_generic(sd_bus *bus, sd_bus_message *message, Manager *m, JobType job_type, bool reload_if_possible, sd_bus_error *error) {
         const char *name;
         Unit *u;
         int r;
@@ -395,44 +399,44 @@ static int method_start_unit_generic(sd_bus *bus, sd_bus_message *message, Manag
 
         r = sd_bus_message_read(message, "s", &name);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
-        r = manager_load_unit(m, name, NULL, &error, &u);
+        r = manager_load_unit(m, name, NULL, error, &u);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, &error);
+                return r;
 
-        return bus_unit_method_start_generic(bus, message, u, job_type, reload_if_possible);
+        return bus_unit_method_start_generic(bus, message, u, job_type, reload_if_possible, error);
 }
 
-static int method_start_unit(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return method_start_unit_generic(bus, message, userdata, JOB_START, false);
+static int method_start_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return method_start_unit_generic(bus, message, userdata, JOB_START, false, error);
 }
 
-static int method_stop_unit(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return method_start_unit_generic(bus, message, userdata, JOB_STOP, false);
+static int method_stop_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return method_start_unit_generic(bus, message, userdata, JOB_STOP, false, error);
 }
 
-static int method_reload_unit(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return method_start_unit_generic(bus, message, userdata, JOB_RELOAD, false);
+static int method_reload_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return method_start_unit_generic(bus, message, userdata, JOB_RELOAD, false, error);
 }
 
-static int method_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return method_start_unit_generic(bus, message, userdata, JOB_RESTART, false);
+static int method_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return method_start_unit_generic(bus, message, userdata, JOB_RESTART, false, error);
 }
 
-static int method_try_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return method_start_unit_generic(bus, message, userdata, JOB_TRY_RESTART, false);
+static int method_try_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return method_start_unit_generic(bus, message, userdata, JOB_TRY_RESTART, false, error);
 }
 
-static int method_reload_or_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return method_start_unit_generic(bus, message, userdata, JOB_RESTART, true);
+static int method_reload_or_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return method_start_unit_generic(bus, message, userdata, JOB_RESTART, true, error);
 }
 
-static int method_reload_or_try_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return method_start_unit_generic(bus, message, userdata, JOB_TRY_RESTART, true);
+static int method_reload_or_try_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return method_start_unit_generic(bus, message, userdata, JOB_TRY_RESTART, true, error);
 }
 
-static int method_start_unit_replace(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_start_unit_replace(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
         const char *old_name;
         Unit *u;
@@ -444,16 +448,16 @@ static int method_start_unit_replace(sd_bus *bus, sd_bus_message *message, void
 
         r = sd_bus_message_read(message, "s", &old_name);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         u = manager_get_unit(m, old_name);
         if (!u || !u->job || u->job->type != JOB_START)
-                return sd_bus_reply_method_errorf(message, BUS_ERROR_NO_SUCH_JOB, "No job queued for unit %s", old_name);
+                return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_JOB, "No job queued for unit %s", old_name);
 
-        return method_start_unit_generic(bus, message, m, JOB_START, false);
+        return method_start_unit_generic(bus, message, m, JOB_START, false, error);
 }
 
-static int method_kill_unit(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_kill_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
         const char *name;
         Unit *u;
@@ -465,16 +469,16 @@ static int method_kill_unit(sd_bus *bus, sd_bus_message *message, void *userdata
 
         r = sd_bus_message_read(message, "s", &name);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         u = manager_get_unit(m, name);
         if (!u)
-                return sd_bus_reply_method_errorf(message, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not loaded.", name);
+                return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not loaded.", name);
 
-        return bus_unit_method_kill(bus, message, u);
+        return bus_unit_method_kill(bus, message, u, error);
 }
 
-static int method_reset_failed_unit(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_reset_failed_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
         const char *name;
         Unit *u;
@@ -486,16 +490,16 @@ static int method_reset_failed_unit(sd_bus *bus, sd_bus_message *message, void *
 
         r = sd_bus_message_read(message, "s", &name);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         u = manager_get_unit(m, name);
         if (!u)
-                return sd_bus_reply_method_errorf(message, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not loaded.", name);
+                return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not loaded.", name);
 
-        return bus_unit_method_reset_failed(bus, message, u);
+        return bus_unit_method_reset_failed(bus, message, u, error);
 }
 
-static int method_set_unit_properties(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_set_unit_properties(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
         const char *name;
         Unit *u;
@@ -507,17 +511,16 @@ static int method_set_unit_properties(sd_bus *bus, sd_bus_message *message, void
 
         r = sd_bus_message_read(message, "s", &name);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         u = manager_get_unit(m, name);
         if (!u)
-                return sd_bus_reply_method_errorf(message, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not loaded.", name);
+                return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not loaded.", name);
 
-        return bus_unit_method_set_properties(bus, message, u);
+        return bus_unit_method_set_properties(bus, message, u, error);
 }
 
-static int method_start_transient_unit(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
+static int method_start_transient_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         const char *name, *smode;
         Manager *m = userdata;
         JobMode mode;
@@ -531,51 +534,53 @@ static int method_start_transient_unit(sd_bus *bus, sd_bus_message *message, voi
 
         r = sd_bus_message_read(message, "ss", &name, &smode);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         t = unit_name_to_type(name);
         if (t < 0)
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_INVALID_ARGS, "Invalid unit type.");
+                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid unit type.");
 
         if (!unit_vtable[t]->can_transient)
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_INVALID_ARGS, "Unit type %s does not support transient units.");
+                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Unit type %s does not support transient units.");
 
         mode = job_mode_from_string(smode);
         if (mode < 0)
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_INVALID_ARGS, "Job mode %s is invalid.", smode);
+                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Job mode %s is invalid.", smode);
 
-        r = manager_load_unit(m, name, NULL, &error, &u);
+        r = manager_load_unit(m, name, NULL, error, &u);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, &error);
+                return r;
 
-        SELINUX_UNIT_ACCESS_CHECK(u, bus, message, "start");
+        r = selinux_unit_access_check(u, bus, message, "start", error);
+        if (r < 0)
+                return r;
 
         if (u->load_state != UNIT_NOT_FOUND || set_size(u->dependencies[UNIT_REFERENCED_BY]) > 0)
-                return sd_bus_reply_method_errorf(message, BUS_ERROR_UNIT_EXISTS, "Unit %s already exists.", name);
+                return sd_bus_error_setf(error, BUS_ERROR_UNIT_EXISTS, "Unit %s already exists.", name);
 
         /* OK, the unit failed to load and is unreferenced, now let's
          * fill in the transient data instead */
         r = unit_make_transient(u);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         /* Set our properties */
-        r = bus_unit_set_properties(u, message, UNIT_RUNTIME, false, &error);
+        r = bus_unit_set_properties(u, message, UNIT_RUNTIME, false, error);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, &error);
+                return r;
 
         /* And load this stub fully */
         r = unit_load(u);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, &error);
+                return r;
 
         manager_dispatch_load_queue(m);
 
         /* Finally, start it */
-        return bus_unit_queue_job(bus, message, u, JOB_START, mode, false);
+        return bus_unit_queue_job(bus, message, u, JOB_START, mode, false, error);
 }
 
-static int method_get_job(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_get_job(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         _cleanup_free_ char *path = NULL;
         Manager *m = userdata;
         uint32_t id;
@@ -588,22 +593,24 @@ static int method_get_job(sd_bus *bus, sd_bus_message *message, void *userdata)
 
         r = sd_bus_message_read(message, "u", &id);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         j = manager_get_job(m, id);
         if (!j)
-                return sd_bus_reply_method_errorf(message, BUS_ERROR_NO_SUCH_JOB, "Job %u does not exist.", (unsigned) id);
+                return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_JOB, "Job %u does not exist.", (unsigned) id);
 
-        SELINUX_UNIT_ACCESS_CHECK(j->unit, bus, message, "status");
+        r = selinux_unit_access_check(j->unit, bus, message, "status", error);
+        if (r < 0)
+                return r;
 
         path = job_dbus_path(j);
         if (!path)
-                return sd_bus_reply_method_errno(message, ENOMEM, NULL);
+                return -ENOMEM;
 
         return sd_bus_reply_method_return(message, "o", path);
 }
 
-static int method_cancel_job(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_cancel_job(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
         uint32_t id;
         Job *j;
@@ -615,46 +622,56 @@ static int method_cancel_job(sd_bus *bus, sd_bus_message *message, void *userdat
 
         r = sd_bus_message_read(message, "u", &id);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         j = manager_get_job(m, id);
         if (!j)
-                return sd_bus_reply_method_errorf(message, BUS_ERROR_NO_SUCH_JOB, "Job %u does not exist.", (unsigned) id);
+                return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_JOB, "Job %u does not exist.", (unsigned) id);
 
-        SELINUX_UNIT_ACCESS_CHECK(j->unit, bus, message, "stop");
+        r = selinux_unit_access_check(j->unit, bus, message, "stop", error);
+        if (r < 0)
+                return r;
 
         job_finish_and_invalidate(j, JOB_CANCELED, true);
 
         return sd_bus_reply_method_return(message, NULL);
 }
 
-static int method_clear_jobs(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_clear_jobs(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
+        int r;
 
         assert(bus);
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "reboot");
+        r = selinux_access_check(bus, message, "reboot", error);
+        if (r < 0)
+                return r;
+
         manager_clear_jobs(m);
 
         return sd_bus_reply_method_return(message, NULL);
 }
 
-static int method_reset_failed(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_reset_failed(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
+        int r;
 
         assert(bus);
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "reload");
+        r = selinux_access_check(bus, message, "reload", error);
+        if (r < 0)
+                return r;
+
         manager_reset_failed(m);
 
         return sd_bus_reply_method_return(message, NULL);
 }
 
-static int method_list_units(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_list_units(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
         Manager *m = userdata;
         const char *k;
@@ -666,15 +683,17 @@ static int method_list_units(sd_bus *bus, sd_bus_message *message, void *userdat
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "status");
+        r = selinux_access_check(bus, message, "status", error);
+        if (r < 0)
+                return r;
 
         r = sd_bus_message_new_method_return(message, &reply);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         r = sd_bus_message_open_container(reply, 'a', "(ssssssouso)");
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         HASHMAP_FOREACH_KEY(u, k, m->units, i) {
                 _cleanup_free_ char *unit_path = NULL, *job_path = NULL;
@@ -687,12 +706,12 @@ static int method_list_units(sd_bus *bus, sd_bus_message *message, void *userdat
 
                 unit_path = unit_dbus_path(u);
                 if (!unit_path)
-                        return sd_bus_reply_method_errno(message, ENOMEM, NULL);
+                        return -ENOMEM;
 
                 if (u->job) {
                         job_path = job_dbus_path(u->job);
                         if (!job_path)
-                                return sd_bus_reply_method_errno(message, ENOMEM, NULL);
+                                return -ENOMEM;
                 }
 
                 r = sd_bus_message_append(
@@ -708,17 +727,17 @@ static int method_list_units(sd_bus *bus, sd_bus_message *message, void *userdat
                                 u->job ? job_type_to_string(u->job->type) : "",
                                 job_path ? job_path : "/");
                 if (r < 0)
-                        return sd_bus_reply_method_errno(message, r, NULL);
+                        return r;
         }
 
         r = sd_bus_message_close_container(reply);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         return sd_bus_send(bus, reply, NULL);
 }
 
-static int method_list_jobs(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_list_jobs(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
         Manager *m = userdata;
         Iterator i;
@@ -729,26 +748,28 @@ static int method_list_jobs(sd_bus *bus, sd_bus_message *message, void *userdata
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "status");
+        r = selinux_access_check(bus, message, "status", error);
+        if (r < 0)
+                return r;
 
         r = sd_bus_message_new_method_return(message, &reply);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         r = sd_bus_message_open_container(reply, 'a', "(usssoo)");
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         HASHMAP_FOREACH(j, m->jobs, i) {
                 _cleanup_free_ char *unit_path = NULL, *job_path = NULL;
 
                 job_path = job_dbus_path(j);
                 if (!job_path)
-                        return sd_bus_reply_method_errno(message, ENOMEM, NULL);
+                        return -ENOMEM;
 
                 unit_path = unit_dbus_path(j->unit);
                 if (!unit_path)
-                        return sd_bus_reply_method_errno(message, ENOMEM, NULL);
+                        return -ENOMEM;
 
                 r = sd_bus_message_append(
                                 reply, "(usssoo)",
@@ -758,17 +779,17 @@ static int method_list_jobs(sd_bus *bus, sd_bus_message *message, void *userdata
                                 job_path,
                                 unit_path);
                 if (r < 0)
-                        return sd_bus_reply_method_errno(message, r, NULL);
+                        return r;
         }
 
         r = sd_bus_message_close_container(reply);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         return sd_bus_send(bus, reply, NULL);
 }
 
-static int method_subscribe(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_subscribe(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
         int r;
 
@@ -776,18 +797,20 @@ static int method_subscribe(sd_bus *bus, sd_bus_message *message, void *userdata
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "status");
+        r = selinux_access_check(bus, message, "status", error);
+        if (r < 0)
+                return r;
 
         r = bus_client_track(&m->subscribed, bus, sd_bus_message_get_sender(message));
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
         if (r == 0)
-                return sd_bus_reply_method_errorf(message, BUS_ERROR_ALREADY_SUBSCRIBED, "Client is already subscribed.");
+                return sd_bus_error_setf(error, BUS_ERROR_ALREADY_SUBSCRIBED, "Client is already subscribed.");
 
         return sd_bus_reply_method_return(message, NULL);
 }
 
-static int method_unsubscribe(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_unsubscribe(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
         int r;
 
@@ -795,32 +818,37 @@ static int method_unsubscribe(sd_bus *bus, sd_bus_message *message, void *userda
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "status");
+        r = selinux_access_check(bus, message, "status", error);
+        if (r < 0)
+                return r;
 
         r = bus_client_untrack(m->subscribed, bus, sd_bus_message_get_sender(message));
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
         if (r == 0)
-                return sd_bus_reply_method_errorf(message, BUS_ERROR_NOT_SUBSCRIBED, "Client is not subscribed.");
+                return sd_bus_error_setf(error, BUS_ERROR_NOT_SUBSCRIBED, "Client is not subscribed.");
 
         return sd_bus_reply_method_return(message, NULL);
 }
 
-static int method_dump(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_dump(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         _cleanup_free_ char *dump = NULL;
         _cleanup_fclose_ FILE *f = NULL;
         Manager *m = userdata;
         size_t size;
+        int r;
 
         assert(bus);
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "status");
+        r = selinux_access_check(bus, message, "status", error);
+        if (r < 0)
+                return r;
 
         f = open_memstream(&dump, &size);
         if (!f)
-                return sd_bus_reply_method_errno(message, ENOMEM, NULL);
+                return -ENOMEM;
 
         manager_dump_units(m, f, NULL);
         manager_dump_jobs(m, f, NULL);
@@ -828,13 +856,12 @@ static int method_dump(sd_bus *bus, sd_bus_message *message, void *userdata) {
         fflush(f);
 
         if (ferror(f))
-                return sd_bus_reply_method_errno(message, ENOMEM, NULL);
+                return -ENOMEM;
 
         return sd_bus_reply_method_return(message, "s", dump);
 }
 
-static int method_create_snapshot(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
+static int method_create_snapshot(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         _cleanup_free_ char *path = NULL;
         Manager *m = userdata;
         const char *name;
@@ -846,27 +873,29 @@ static int method_create_snapshot(sd_bus *bus, sd_bus_message *message, void *us
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "start");
+        r = selinux_access_check(bus, message, "start", error);
+        if (r < 0)
+                return r;
 
         r = sd_bus_message_read(message, "sb", &name, &cleanup);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         if (isempty(name))
                 name = NULL;
 
-        r = snapshot_create(m, name, cleanup, &error, &s);
+        r = snapshot_create(m, name, cleanup, error, &s);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, &error);
+                return r;
 
         path = unit_dbus_path(UNIT(s));
         if (!path)
-                return sd_bus_reply_method_errno(message, ENOMEM, NULL);
+                return -ENOMEM;
 
         return sd_bus_reply_method_return(message, "o", path);
 }
 
-static int method_remove_snapshot(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_remove_snapshot(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
         const char *name;
         Unit *u;
@@ -876,23 +905,25 @@ static int method_remove_snapshot(sd_bus *bus, sd_bus_message *message, void *us
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "start");
+        r = selinux_access_check(bus, message, "stop", error);
+        if (r < 0)
+                return r;
 
         r = sd_bus_message_read(message, "s", &name);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         u = manager_get_unit(m, name);
         if (!u)
-                return sd_bus_reply_method_errorf(message, BUS_ERROR_NO_SUCH_UNIT, "Unit %s does not exist.", name);
+                return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s does not exist.", name);
 
         if (u->type != UNIT_SNAPSHOT)
-                return sd_bus_reply_method_errorf(message, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not a snapshot", name);
+                return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not a snapshot", name);
 
-        return bus_snapshot_method_remove(bus, message, u);
+        return bus_snapshot_method_remove(bus, message, u, error);
 }
 
-static int method_reload(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_reload(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
         int r;
 
@@ -900,7 +931,9 @@ static int method_reload(sd_bus *bus, sd_bus_message *message, void *userdata) {
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "reload");
+        r = selinux_access_check(bus, message, "reload", error);
+        if (r < 0)
+                return r;
 
         /* Instead of sending the reply back right away, we just
          * remember that we need to and then send it after the reload
@@ -910,7 +943,7 @@ static int method_reload(sd_bus *bus, sd_bus_message *message, void *userdata) {
         assert(!m->queued_message);
         r = sd_bus_message_new_method_return(message, &m->queued_message);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         m->queued_message_bus = sd_bus_ref(bus);
         m->exit_code = MANAGER_RELOAD;
@@ -918,14 +951,17 @@ static int method_reload(sd_bus *bus, sd_bus_message *message, void *userdata) {
         return 1;
 }
 
-static int method_reexecute(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_reexecute(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
+        int r;
 
         assert(bus);
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "reload");
+        r = selinux_access_check(bus, message, "reload", error);
+        if (r < 0)
+                return r;
 
         /* We don't send a reply back here, the client should
          * just wait for us disconnecting. */
@@ -934,34 +970,40 @@ static int method_reexecute(sd_bus *bus, sd_bus_message *message, void *userdata
         return 1;
 }
 
-static int method_exit(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_exit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
+        int r;
 
         assert(bus);
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "halt");
+        r = selinux_access_check(bus, message, "halt", error);
+        if (r < 0)
+                return r;
 
         if (m->running_as == SYSTEMD_SYSTEM)
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_NOT_SUPPORTED, "Exit is only supported for user service managers.");
+                return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "Exit is only supported for user service managers.");
 
         m->exit_code = MANAGER_EXIT;
 
         return sd_bus_reply_method_return(message, NULL);
 }
 
-static int method_reboot(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_reboot(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
+        int r;
 
         assert(bus);
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "reboot");
+        r = selinux_access_check(bus, message, "reboot", error);
+        if (r < 0)
+                return r;
 
         if (m->running_as != SYSTEMD_SYSTEM)
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_NOT_SUPPORTED, "Reboot is only supported for system managers.");
+                return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "Reboot is only supported for system managers.");
 
         m->exit_code = MANAGER_REBOOT;
 
@@ -969,58 +1011,67 @@ static int method_reboot(sd_bus *bus, sd_bus_message *message, void *userdata) {
 }
 
 
-static int method_poweroff(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_poweroff(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
+        int r;
 
         assert(bus);
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "halt");
+        r = selinux_access_check(bus, message, "halt", error);
+        if (r < 0)
+                return r;
 
         if (m->running_as != SYSTEMD_SYSTEM)
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_NOT_SUPPORTED, "Powering off is only supported for system managers.");
+                return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "Powering off is only supported for system managers.");
 
         m->exit_code = MANAGER_POWEROFF;
 
         return sd_bus_reply_method_return(message, NULL);
 }
 
-static int method_halt(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_halt(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
+        int r;
 
         assert(bus);
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "halt");
+        r = selinux_access_check(bus, message, "halt", error);
+        if (r < 0)
+                return r;
 
         if (m->running_as != SYSTEMD_SYSTEM)
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_NOT_SUPPORTED, "Halt is only supported for system managers.");
+                return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "Halt is only supported for system managers.");
 
         m->exit_code = MANAGER_HALT;
 
         return sd_bus_reply_method_return(message, NULL);
 }
 
-static int method_kexec(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_kexec(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
+        int r;
 
         assert(bus);
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "reboot");
+        r = selinux_access_check(bus, message, "reboot", error);
+        if (r < 0)
+                return r;
 
         if (m->running_as != SYSTEMD_SYSTEM)
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_NOT_SUPPORTED, "KExec is only supported for system managers.");
+                return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "KExec is only supported for system managers.");
 
         m->exit_code = MANAGER_KEXEC;
 
         return sd_bus_reply_method_return(message, NULL);
 }
 
-static int method_switch_root(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_switch_root(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         char *ri = NULL, *rt = NULL;
         const char *root, *init;
         Manager *m = userdata;
@@ -1030,45 +1081,47 @@ static int method_switch_root(sd_bus *bus, sd_bus_message *message, void *userda
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "reboot");
+        r = selinux_access_check(bus, message, "reboot", error);
+        if (r < 0)
+                return r;
 
         if (m->running_as != SYSTEMD_SYSTEM)
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_NOT_SUPPORTED, "KExec is only supported for system managers.");
+                return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "KExec is only supported for system managers.");
 
         r = sd_bus_message_read(message, "ss", &root, &init);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         if (path_equal(root, "/") || !path_is_absolute(root))
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_INVALID_ARGS, "Invalid switch root path %s", root);
+                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid switch root path %s", root);
 
         /* Safety check */
         if (isempty(init)) {
                 if (! path_is_os_tree(root))
-                        return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_INVALID_ARGS, "Specified switch root path %s does not seem to be an OS tree. /etc/os-release is missing.", root);
+                        return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Specified switch root path %s does not seem to be an OS tree. /etc/os-release is missing.", root);
         } else {
                 _cleanup_free_ char *p = NULL;
 
                 if (!path_is_absolute(init))
-                        return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_INVALID_ARGS, "Invalid init path %s", init);
+                        return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid init path %s", init);
 
                 p = strappend(root, init);
                 if (!p)
-                        return sd_bus_reply_method_errno(message, ENOMEM, NULL);
+                        return -ENOMEM;
 
                 if (access(p, X_OK) < 0)
-                        return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_INVALID_ARGS, "Specified init binary %s does not exist.", p);
+                        return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Specified init binary %s does not exist.", p);
         }
 
         rt = strdup(root);
         if (!rt)
-                return sd_bus_reply_method_errno(message, ENOMEM, NULL);
+                return -ENOMEM;
 
         if (!isempty(init)) {
                 ri = strdup(init);
                 if (!ri) {
                         free(ri);
-                        return sd_bus_reply_method_errno(message, ENOMEM, NULL);
+                        return -ENOMEM;
                 }
         }
 
@@ -1081,7 +1134,7 @@ static int method_switch_root(sd_bus *bus, sd_bus_message *message, void *userda
         return sd_bus_reply_method_return(message, NULL);
 }
 
-static int method_set_environment(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_set_environment(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         _cleanup_strv_free_ char **plus = NULL;
         Manager *m = userdata;
         int r;
@@ -1090,22 +1143,24 @@ static int method_set_environment(sd_bus *bus, sd_bus_message *message, void *us
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "reload");
+        r = selinux_access_check(bus, message, "reload", error);
+        if (r < 0)
+                return r;
 
         r = sd_bus_message_read_strv(message, &plus);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
         if (!strv_env_is_valid(plus))
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment assignments");
+                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment assignments");
 
         r = manager_environment_add(m, NULL, plus);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         return sd_bus_reply_method_return(message, NULL);
 }
 
-static int method_unset_environment(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_unset_environment(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         _cleanup_strv_free_ char **minus = NULL;
         Manager *m = userdata;
         int r;
@@ -1114,23 +1169,25 @@ static int method_unset_environment(sd_bus *bus, sd_bus_message *message, void *
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "reload");
+        r = selinux_access_check(bus, message, "reload", error);
+        if (r < 0)
+                return r;
 
         r = sd_bus_message_read_strv(message, &minus);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         if (!strv_env_name_or_assignment_is_valid(minus))
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment variable names or assignments");
+                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment variable names or assignments");
 
         r = manager_environment_add(m, minus, NULL);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         return sd_bus_reply_method_return(message, NULL);
 }
 
-static int method_unset_and_set_environment(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_unset_and_set_environment(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         _cleanup_strv_free_ char **minus = NULL, **plus = NULL;
         Manager *m = userdata;
         int r;
@@ -1139,29 +1196,31 @@ static int method_unset_and_set_environment(sd_bus *bus, sd_bus_message *message
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "reload");
+        r = selinux_access_check(bus, message, "reload", error);
+        if (r < 0)
+                return r;
 
         r = sd_bus_message_read_strv(message, &plus);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         r = sd_bus_message_read_strv(message, &minus);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         if (!strv_env_is_valid(plus))
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment assignments");
+                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment assignments");
         if (!strv_env_name_or_assignment_is_valid(minus))
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment variable names or assignments");
+                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment variable names or assignments");
 
         r = manager_environment_add(m, minus, plus);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         return sd_bus_reply_method_return(message, NULL);
 }
 
-static int method_list_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_list_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
         Manager *m = userdata;
         UnitFileList *item;
@@ -1173,42 +1232,38 @@ static int method_list_unit_files(sd_bus *bus, sd_bus_message *message, void *us
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "status");
+        r = selinux_access_check(bus, message, "status", error);
+        if (r < 0)
+                return r;
 
         r = sd_bus_message_new_method_return(message, &reply);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         h = hashmap_new(string_hash_func, string_compare_func);
         if (!h)
-                return sd_bus_reply_method_errno(message, ENOMEM, NULL);
+                return -ENOMEM;
 
         r = unit_file_get_list(m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER, NULL, h);
-        if (r < 0) {
-                r = sd_bus_reply_method_errno(message, r, NULL);
+        if (r < 0)
                 goto fail;
-        }
 
         r = sd_bus_message_open_container(reply, 'a', "(ss)");
-        if (r < 0) {
-                r = sd_bus_reply_method_errno(message, r, NULL);
+        if (r < 0)
                 goto fail;
-        }
 
         HASHMAP_FOREACH(item, h, i) {
 
                 r = sd_bus_message_append(reply, "(ss)", item->path, unit_file_state_to_string(item->state));
-                if (r < 0) {
-                        r = sd_bus_reply_method_errno(message, r, NULL);
+                if (r < 0)
                         goto fail;
-                }
         }
 
         unit_file_list_free(h);
 
         r = sd_bus_message_close_container(reply);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         return sd_bus_send(bus, reply, NULL);
 
@@ -1217,7 +1272,7 @@ fail:
         return r;
 }
 
-static int method_get_unit_file_state(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_get_unit_file_state(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
         const char *name;
         UnitFileState state;
@@ -1228,22 +1283,24 @@ static int method_get_unit_file_state(sd_bus *bus, sd_bus_message *message, void
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "status");
+        r = selinux_access_check(bus, message, "status", error);
+        if (r < 0)
+                return r;
 
         r = sd_bus_message_read(message, "s", &name);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER;
 
         state = unit_file_get_state(scope, NULL, name);
         if (state < 0)
-                return sd_bus_reply_method_errno(message, state, NULL);
+                return state;
 
         return sd_bus_reply_method_return(message, "s", unit_file_state_to_string(state));
 }
 
-static int method_get_default_target(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_get_default_target(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         _cleanup_free_ char *default_target = NULL;
         Manager *m = userdata;
         UnitFileScope scope;
@@ -1253,13 +1310,15 @@ static int method_get_default_target(sd_bus *bus, sd_bus_message *message, void
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "status");
+        r = selinux_access_check(bus, message, "status", error);
+        if (r < 0)
+                return r;
 
         scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER;
 
         r = unit_file_get_default(scope, NULL, &default_target);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         return sd_bus_reply_method_return(message, "s", default_target);
 }
@@ -1324,7 +1383,7 @@ static int reply_unit_file_changes_and_free(
 
 fail:
         unit_file_changes_free(changes, n_changes);
-        return sd_bus_reply_method_errno(message, r, NULL);
+        return r;
 }
 
 static int method_enable_unit_files_generic(
@@ -1333,7 +1392,8 @@ static int method_enable_unit_files_generic(
                 Manager *m, const
                 char *verb,
                 int (*call)(UnitFileScope scope, bool runtime, const char *root_dir, char *files[], bool force, UnitFileChange **changes, unsigned *n_changes),
-                bool carries_install_info) {
+                bool carries_install_info,
+                sd_bus_error *error) {
 
         _cleanup_strv_free_ char **l = NULL;
         UnitFileChange *changes = NULL;
@@ -1345,43 +1405,45 @@ static int method_enable_unit_files_generic(
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, verb);
+        r = selinux_access_check(bus, message, verb, error);
+        if (r < 0)
+                return r;
 
         r = sd_bus_message_read_strv(message, &l);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         r = sd_bus_message_read(message, "bb", &runtime, &force);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER;
 
         r = call(scope, runtime, NULL, l, force, &changes, &n_changes);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         return reply_unit_file_changes_and_free(m, bus, message, carries_install_info ? r : -1, changes, n_changes);
 }
 
-static int method_enable_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_enable, true);
+static int method_enable_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_enable, true, error);
 }
 
-static int method_reenable_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_reenable, true);
+static int method_reenable_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_reenable, true, error);
 }
 
-static int method_link_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_link, false);
+static int method_link_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_link, false, error);
 }
 
-static int method_preset_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_preset, true);
+static int method_preset_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_preset, true, error);
 }
 
-static int method_mask_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return method_enable_unit_files_generic(bus, message, userdata, "disable", unit_file_mask, false);
+static int method_mask_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return method_enable_unit_files_generic(bus, message, userdata, "disable", unit_file_mask, false, error);
 }
 
 static int method_disable_unit_files_generic(
@@ -1389,7 +1451,8 @@ static int method_disable_unit_files_generic(
                 sd_bus_message *message,
                 Manager *m, const
                 char *verb,
-                int (*call)(UnitFileScope scope, bool runtime, const char *root_dir, char *files[], UnitFileChange **changes, unsigned *n_changes)) {
+                int (*call)(UnitFileScope scope, bool runtime, const char *root_dir, char *files[], UnitFileChange **changes, unsigned *n_changes),
+                sd_bus_error *error) {
 
         _cleanup_strv_free_ char **l = NULL;
         UnitFileChange *changes = NULL;
@@ -1401,34 +1464,36 @@ static int method_disable_unit_files_generic(
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, verb);
+        r = selinux_access_check(bus, message, verb, error);
+        if (r < 0)
+                return r;
 
         r = sd_bus_message_read_strv(message, &l);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         r = sd_bus_message_read(message, "b", &runtime);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER;
 
         r = call(scope, runtime, NULL, l, &changes, &n_changes);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         return reply_unit_file_changes_and_free(m, bus, message, -1, changes, n_changes);
 }
 
-static int method_disable_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return method_disable_unit_files_generic(bus, message, userdata, "disable", unit_file_disable);
+static int method_disable_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return method_disable_unit_files_generic(bus, message, userdata, "disable", unit_file_disable, error);
 }
 
-static int method_unmask_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return method_disable_unit_files_generic(bus, message, userdata, "enable", unit_file_unmask);
+static int method_unmask_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return method_disable_unit_files_generic(bus, message, userdata, "enable", unit_file_unmask, error);
 }
 
-static int method_set_default_target(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int method_set_default_target(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         UnitFileChange *changes = NULL;
         unsigned n_changes = 0;
         Manager *m = userdata;
@@ -1440,17 +1505,19 @@ static int method_set_default_target(sd_bus *bus, sd_bus_message *message, void
         assert(message);
         assert(m);
 
-        SELINUX_ACCESS_CHECK(bus, message, "enable");
+        r = selinux_access_check(bus, message, "enable", error);
+        if (r < 0)
+                return r;
 
         r = sd_bus_message_read(message, "sb", &name, &force);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER;
 
         r = unit_file_set_default(scope, NULL, name, force, &changes, &n_changes);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         return reply_unit_file_changes_and_free(m, bus, message, -1, changes, n_changes);
 }
diff --git a/src/core/dbus-mount.c b/src/core/dbus-mount.c
index 2056eab11e..eb3c0387cd 100644
--- a/src/core/dbus-mount.c
+++ b/src/core/dbus-mount.c
@@ -34,8 +34,8 @@ static int property_get_what(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Mount *m = userdata;
         const char *d;
@@ -60,8 +60,8 @@ static int property_get_options(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Mount *m = userdata;
         const char *d;
@@ -86,8 +86,8 @@ static int property_get_type(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Mount *m = userdata;
         const char *d;
diff --git a/src/core/dbus-path.c b/src/core/dbus-path.c
index a206f49020..cf1de44d85 100644
--- a/src/core/dbus-path.c
+++ b/src/core/dbus-path.c
@@ -33,8 +33,8 @@ static int property_get_paths(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Path *p = userdata;
         PathSpec *k;
@@ -63,8 +63,8 @@ static int property_get_unit(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Unit *p = userdata, *trigger;
 
diff --git a/src/core/dbus-snapshot.c b/src/core/dbus-snapshot.c
index 1e53fefc66..a54dc8cf89 100644
--- a/src/core/dbus-snapshot.c
+++ b/src/core/dbus-snapshot.c
@@ -25,14 +25,17 @@
 #include "dbus-unit.h"
 #include "dbus-snapshot.h"
 
-int bus_snapshot_method_remove(sd_bus *bus, sd_bus_message *message, void *userdata) {
+int bus_snapshot_method_remove(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Snapshot *s = userdata;
+        int r;
 
         assert(bus);
         assert(message);
         assert(s);
 
-        SELINUX_UNIT_ACCESS_CHECK(UNIT(s), bus, message, "stop");
+        r = selinux_unit_access_check(UNIT(s), bus, message, "stop", error);
+        if (r < 0)
+                return r;
 
         snapshot_remove(s);
 
diff --git a/src/core/dbus-snapshot.h b/src/core/dbus-snapshot.h
index f6f432240d..d7551cbcdc 100644
--- a/src/core/dbus-snapshot.h
+++ b/src/core/dbus-snapshot.h
@@ -25,4 +25,4 @@
 
 extern const sd_bus_vtable bus_snapshot_vtable[];
 
-int bus_snapshot_method_remove(sd_bus *bus, sd_bus_message *message, void *userdata);
+int bus_snapshot_method_remove(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error);
diff --git a/src/core/dbus-socket.c b/src/core/dbus-socket.c
index e9fa24d1a3..19a44849a3 100644
--- a/src/core/dbus-socket.c
+++ b/src/core/dbus-socket.c
@@ -37,8 +37,8 @@ static int property_get_listen(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
 
         Socket *s = SOCKET(userdata);
diff --git a/src/core/dbus-swap.c b/src/core/dbus-swap.c
index 15292cd192..09c00b3f90 100644
--- a/src/core/dbus-swap.c
+++ b/src/core/dbus-swap.c
@@ -35,8 +35,8 @@ static int property_get_priority(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Swap *s = SWAP(userdata);
         int p;
diff --git a/src/core/dbus-timer.c b/src/core/dbus-timer.c
index 113c63faa0..9e4070a1a3 100644
--- a/src/core/dbus-timer.c
+++ b/src/core/dbus-timer.c
@@ -33,8 +33,8 @@ static int property_get_monotonic_timers(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Timer *t = userdata;
         TimerValue *v;
@@ -82,8 +82,8 @@ static int property_get_calendar_timers(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Timer *t = userdata;
         TimerValue *v;
@@ -121,8 +121,8 @@ static int property_get_unit(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Unit *u = userdata, *trigger;
 
diff --git a/src/core/dbus-unit.c b/src/core/dbus-unit.c
index 759fc4a869..5fca7653e0 100644
--- a/src/core/dbus-unit.c
+++ b/src/core/dbus-unit.c
@@ -39,8 +39,8 @@ static int property_get_names(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Unit *u = userdata;
         Iterator i;
@@ -70,8 +70,8 @@ static int property_get_following(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Unit *u = userdata, *f;
 
@@ -89,8 +89,8 @@ static int property_get_dependencies(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Set *s = *(Set**) userdata;
         Iterator j;
@@ -119,8 +119,8 @@ static int property_get_description(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Unit *u = userdata;
 
@@ -137,8 +137,8 @@ static int property_get_active_state(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Unit *u = userdata;
 
@@ -155,8 +155,8 @@ static int property_get_sub_state(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Unit *u = userdata;
 
@@ -173,8 +173,8 @@ static int property_get_unit_file_state(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Unit *u = userdata;
 
@@ -191,8 +191,8 @@ static int property_get_can_start(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Unit *u = userdata;
 
@@ -209,8 +209,8 @@ static int property_get_can_stop(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Unit *u = userdata;
 
@@ -230,8 +230,8 @@ static int property_get_can_reload(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Unit *u = userdata;
 
@@ -248,8 +248,8 @@ static int property_get_can_isolate(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Unit *u = userdata;
 
@@ -266,8 +266,8 @@ static int property_get_job(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         _cleanup_free_ char *p = NULL;
         Unit *u = userdata;
@@ -292,8 +292,8 @@ static int property_get_need_daemon_reload(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Unit *u = userdata;
 
@@ -310,8 +310,8 @@ static int property_get_conditions(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Unit *u = userdata;
         Condition *c;
@@ -341,8 +341,8 @@ static int property_get_load_error(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         _cleanup_bus_error_free_ sd_bus_error e = SD_BUS_ERROR_NULL;
         Unit *u = userdata;
@@ -357,7 +357,7 @@ static int property_get_load_error(
         return sd_bus_message_append(reply, "(ss)", e.name, e.message);
 }
 
-int bus_unit_method_start_generic(sd_bus *bus, sd_bus_message *message, Unit *u, JobType job_type, bool reload_if_possible) {
+int bus_unit_method_start_generic(sd_bus *bus, sd_bus_message *message, Unit *u, JobType job_type, bool reload_if_possible, sd_bus_error *error) {
         const char *smode;
         JobMode mode;
         int r;
@@ -369,45 +369,44 @@ int bus_unit_method_start_generic(sd_bus *bus, sd_bus_message *message, Unit *u,
 
         r = sd_bus_message_read(message, "s", &smode);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         mode = job_mode_from_string(smode);
         if (mode < 0)
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_INVALID_ARGS, "Job mode %s invalid", smode);
+                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Job mode %s invalid", smode);
 
-        return bus_unit_queue_job(bus, message, u, job_type, mode, reload_if_possible);
+        return bus_unit_queue_job(bus, message, u, job_type, mode, reload_if_possible, error);
 }
 
-static int method_start(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return bus_unit_method_start_generic(bus, message, userdata, JOB_START, false);
+static int method_start(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return bus_unit_method_start_generic(bus, message, userdata, JOB_START, false, error);
 }
 
-static int method_stop(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return bus_unit_method_start_generic(bus, message, userdata, JOB_STOP, false);
+static int method_stop(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return bus_unit_method_start_generic(bus, message, userdata, JOB_STOP, false, error);
 }
 
-static int method_reload(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return bus_unit_method_start_generic(bus, message, userdata, JOB_RELOAD, false);
+static int method_reload(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return bus_unit_method_start_generic(bus, message, userdata, JOB_RELOAD, false, error);
 }
 
-static int method_restart(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return bus_unit_method_start_generic(bus, message, userdata, JOB_RESTART, false);
+static int method_restart(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return bus_unit_method_start_generic(bus, message, userdata, JOB_RESTART, false, error);
 }
 
-static int method_try_restart(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return bus_unit_method_start_generic(bus, message, userdata, JOB_TRY_RESTART, false);
+static int method_try_restart(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return bus_unit_method_start_generic(bus, message, userdata, JOB_TRY_RESTART, false, error);
 }
 
-static int method_reload_or_restart(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return bus_unit_method_start_generic(bus, message, userdata, JOB_RESTART, true);
+static int method_reload_or_restart(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return bus_unit_method_start_generic(bus, message, userdata, JOB_RESTART, true, error);
 }
 
-static int method_reload_or_try_restart(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        return bus_unit_method_start_generic(bus, message, userdata, JOB_TRY_RESTART, true);
+static int method_reload_or_try_restart(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        return bus_unit_method_start_generic(bus, message, userdata, JOB_TRY_RESTART, true, error);
 }
 
-int bus_unit_method_kill(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
+int bus_unit_method_kill(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Unit *u = userdata;
         const char *swho;
         int32_t signo;
@@ -420,44 +419,48 @@ int bus_unit_method_kill(sd_bus *bus, sd_bus_message *message, void *userdata) {
 
         r = sd_bus_message_read(message, "si", &swho, &signo);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         if (isempty(swho))
                 who = KILL_ALL;
         else {
                 who = kill_who_from_string(swho);
                 if (who < 0)
-                        return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_INVALID_ARGS, "Invalid who argument %s", swho);
+                        return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid who argument %s", swho);
         }
 
         if (signo <= 0 || signo >= _NSIG)
-                return sd_bus_reply_method_errorf(message, SD_BUS_ERROR_INVALID_ARGS, "Signal number out of range.");
+                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Signal number out of range.");
 
-        SELINUX_UNIT_ACCESS_CHECK(u, bus, message, "stop");
+        r = selinux_unit_access_check(u, bus, message, "stop", error);
+        if (r < 0)
+                return r;
 
-        r = unit_kill(u, who, signo, &error);
+        r = unit_kill(u, who, signo, error);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, &error);
+                return r;
 
         return sd_bus_reply_method_return(message, NULL);
 }
 
-int bus_unit_method_reset_failed(sd_bus *bus, sd_bus_message *message, void *userdata) {
+int bus_unit_method_reset_failed(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Unit *u = userdata;
+        int r;
 
         assert(bus);
         assert(message);
         assert(u);
 
-        SELINUX_UNIT_ACCESS_CHECK(u, bus, message, "reload");
+        r = selinux_unit_access_check(u, bus, message, "reload", error);
+        if (r < 0)
+                return r;
 
         unit_reset_failed(u);
 
         return sd_bus_reply_method_return(message, NULL);
 }
 
-int bus_unit_method_set_properties(sd_bus *bus, sd_bus_message *message, void *userdata) {
-        _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
+int bus_unit_method_set_properties(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Unit *u = userdata;
         int runtime, r;
 
@@ -467,21 +470,23 @@ int bus_unit_method_set_properties(sd_bus *bus, sd_bus_message *message, void *u
 
         r = sd_bus_message_read(message, "b", &runtime);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
-        SELINUX_UNIT_ACCESS_CHECK(u, bus, message, "start");
+        r = selinux_unit_access_check(u, bus, message, "start", error);
+        if (r < 0)
+                return r;
 
         r = sd_bus_message_enter_container(message, 'a', "(sv)");
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
-        r = bus_unit_set_properties(u, message, runtime ? UNIT_RUNTIME : UNIT_PERSISTENT, true, &error);
+        r = bus_unit_set_properties(u, message, runtime ? UNIT_RUNTIME : UNIT_PERSISTENT, true, error);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, &error);
+                return r;
 
         r = sd_bus_message_exit_container(message);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         return sd_bus_reply_method_return(message, NULL);
 }
@@ -568,8 +573,8 @@ static int property_get_slice(
                 const char *interface,
                 const char *property,
                 sd_bus_message *reply,
-                sd_bus_error *error,
-                void *userdata) {
+                void *userdata,
+                sd_bus_error *error) {
 
         Unit *u = userdata;
 
@@ -728,9 +733,9 @@ int bus_unit_queue_job(
                 Unit *u,
                 JobType type,
                 JobMode mode,
-                bool reload_if_possible) {
+                bool reload_if_possible,
+                sd_bus_error *error) {
 
-        _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
         _cleanup_free_ char *path = NULL;
         Job *j;
         int r;
@@ -748,31 +753,34 @@ int bus_unit_queue_job(
                         type = JOB_RELOAD;
         }
 
-        SELINUX_UNIT_ACCESS_CHECK(u, bus, message,
-                                  (type == JOB_START || type == JOB_RESTART || type == JOB_TRY_RESTART) ? "start" :
-                                  type == JOB_STOP ? "stop" : "reload");
+        r = selinux_unit_access_check(
+                        u, bus, message,
+                        (type == JOB_START || type == JOB_RESTART || type == JOB_TRY_RESTART) ? "start" :
+                        type == JOB_STOP ? "stop" : "reload", error);
+        if (r < 0)
+                return r;
 
         if (type == JOB_STOP &&
             (u->load_state == UNIT_NOT_FOUND || u->load_state == UNIT_ERROR) &&
             unit_active_state(u) == UNIT_INACTIVE)
-                return sd_bus_reply_method_errorf(message, BUS_ERROR_NO_SUCH_UNIT, "Unit %s not loaded.", u->id);
+                return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s not loaded.", u->id);
 
         if ((type == JOB_START && u->refuse_manual_start) ||
             (type == JOB_STOP && u->refuse_manual_stop) ||
             ((type == JOB_RESTART || type == JOB_TRY_RESTART) && (u->refuse_manual_start || u->refuse_manual_stop)))
-                return sd_bus_reply_method_errorf(message, BUS_ERROR_ONLY_BY_DEPENDENCY, "Operation refused, unit %s may be requested by dependency only.", u->id);
+                return sd_bus_error_setf(error, BUS_ERROR_ONLY_BY_DEPENDENCY, "Operation refused, unit %s may be requested by dependency only.", u->id);
 
-        r = manager_add_job(u->manager, type, u, mode, true, &error, &j);
+        r = manager_add_job(u->manager, type, u, mode, true, error, &j);
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, &error);
+                return r;
 
         r = bus_client_track(&j->subscribed, bus, sd_bus_message_get_sender(message));
         if (r < 0)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         path = job_dbus_path(j);
         if (!path)
-                return sd_bus_reply_method_errno(message, r, NULL);
+                return r;
 
         return sd_bus_reply_method_return(message, "o", path);
 }
diff --git a/src/core/dbus-unit.h b/src/core/dbus-unit.h
index 859de102b6..57a5e19744 100644
--- a/src/core/dbus-unit.h
+++ b/src/core/dbus-unit.h
@@ -30,10 +30,10 @@ extern const sd_bus_vtable bus_unit_cgroup_vtable[];
 void bus_unit_send_change_signal(Unit *u);
 void bus_unit_send_removed_signal(Unit *u);
 
-int bus_unit_method_start_generic(sd_bus *bus, sd_bus_message *message, Unit *u, JobType job_type, bool reload_if_possible);
-int bus_unit_method_kill(sd_bus *bus, sd_bus_message *message, void *userdata);
-int bus_unit_method_reset_failed(sd_bus *bus, sd_bus_message *message, void *userdata);
+int bus_unit_method_start_generic(sd_bus *bus, sd_bus_message *message, Unit *u, JobType job_type, bool reload_if_possible, sd_bus_error *error);
+int bus_unit_method_kill(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error);
+int bus_unit_method_reset_failed(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error);
 
-int bus_unit_queue_job(sd_bus *bus, sd_bus_message *message, Unit *u, JobType type, JobMode mode, bool reload_if_possible);
+int bus_unit_queue_job(sd_bus *bus, sd_bus_message *message, Unit *u, JobType type, JobMode mode, bool reload_if_possible, sd_bus_error *error);
 int bus_unit_set_properties(Unit *u, sd_bus_message *message, UnitSetPropertiesMode mode, bool commit, sd_bus_error *error);
-int bus_unit_method_set_properties(sd_bus *bus, sd_bus_message *message, void *userdata);
+int bus_unit_method_set_properties(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error);
diff --git a/src/core/dbus.c b/src/core/dbus.c
index b6124b3b22..3d8da1e6ad 100644
--- a/src/core/dbus.c
+++ b/src/core/dbus.c
@@ -71,7 +71,7 @@ int bus_send_queued_message(Manager *m) {
         return 0;
 }
 
-static int signal_agent_released(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int signal_agent_released(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
         const char *cgroup;
         int r;
@@ -100,7 +100,7 @@ static int signal_agent_released(sd_bus *bus, sd_bus_message *message, void *use
         return 0;
 }
 
-static int signal_disconnected(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int signal_disconnected(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Manager *m = userdata;
 
         assert(bus);
@@ -119,7 +119,7 @@ static int signal_disconnected(sd_bus *bus, sd_bus_message *message, void *userd
         return 0;
 }
 
-static int signal_name_owner_changed(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int signal_name_owner_changed(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         const char *name, *old_owner, *new_owner;
         Manager *m = userdata;
         int r;
@@ -142,7 +142,7 @@ static int signal_name_owner_changed(sd_bus *bus, sd_bus_message *message, void
         return 0;
 }
 
-static int signal_activation_request(sd_bus *bus, sd_bus_message *message, void *userdata) {
+static int signal_activation_request(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *ret_error) {
         _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
         _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
         Manager *m = userdata;
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
index 282cfd21ee..cca3df652a 100644
--- a/src/core/selinux-access.c
+++ b/src/core/selinux-access.c
@@ -314,7 +314,7 @@ static int get_calling_context(
    If the machine is in permissive mode it will return ok.  Audit messages will
    still be generated if the access would be denied in enforcing mode.
 */
-int selinux_access_check(
+int selinux_generic_access_check(
                 sd_bus *bus,
                 sd_bus_message *message,
                 const char *path,
@@ -391,7 +391,7 @@ finish:
 
 #else
 
-int selinux_access_check(
+int selinux_generic_access_check(
                 sd_bus *bus,
                 sd_bus_message *message,
                 const char *path,
diff --git a/src/core/selinux-access.h b/src/core/selinux-access.h
index 3404f62166..9e89064819 100644
--- a/src/core/selinux-access.h
+++ b/src/core/selinux-access.h
@@ -27,36 +27,18 @@
 
 void selinux_access_free(void);
 
-int selinux_access_check(sd_bus *bus, sd_bus_message *message, const char *path, const char *permission, sd_bus_error *error);
+int selinux_generic_access_check(sd_bus *bus, sd_bus_message *message, const char *path, const char *permission, sd_bus_error *error);
 
 #ifdef HAVE_SELINUX
 
-#define SELINUX_ACCESS_CHECK(bus, message, permission)                  \
-        do {                                                            \
-                _cleanup_bus_error_free_ sd_bus_error _error = SD_BUS_ERROR_NULL; \
-                sd_bus_message *_m = (message);                         \
-                sd_bus *_b = (bus);                                     \
-                int _r;                                                 \
-                _r = selinux_access_check(_b, _m, NULL, (permission), &_error); \
-                if (_r < 0)                                             \
-                        return sd_bus_reply_method_errno(_m, _r, &_error); \
-        } while (false)
-
-#define SELINUX_UNIT_ACCESS_CHECK(unit, bus, message, permission)       \
-        do {                                                            \
-                _cleanup_bus_error_free_ sd_bus_error _error = SD_BUS_ERROR_NULL; \
-                sd_bus_message *_m = (message);                         \
-                sd_bus *_b = (bus);                                     \
-                Unit *_u = (unit);                                      \
-                int _r;                                                 \
-                _r = selinux_access_check(_b, _m, _u->source_path ?: _u->fragment_path, (permission), &_error); \
-                if (_r < 0)                                             \
-                        return sd_bus_reply_method_errno(_m, _r, &_error); \
-        } while (false)
+#define selinux_access_check(bus, message, permission, error) \
+        selinux_generic_access_check(bus, message, NULL, permission, error)
+#define selinux_unit_access_check(unit, bus, message, permission, error) \
+        ({ Unit *_unit = (unit); selinux_generic_access_check(bus, message, _unit->fragment_path ?: _unit->fragment_path, permission, error); })
 
 #else
 
-#define SELINUX_ACCESS_CHECK(bus, message, permission) do { } while (false)
-#define SELINUX_UNIT_ACCESS_CHECK(unit, bus, message, permission) do { } while (false)
+#define selinux_access_check(bus, message, permission, error) 0
+#define selinux_unit_access_check(unit, bus, message, permission, error) 0
 
 #endif