fix: preserve SELinux label for atomic writes

Author: bcho

go.mod

@@ -9,7 +9,7 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v8 v8.3.0-beta.2
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/hybridcompute/armhybridcompute v1.2.0
 	github.com/Azure/kubelogin v0.2.15
-	github.com/Azure/unbounded v0.1.20-rc.4
+	github.com/Azure/unbounded v0.1.20-rc.4.0.20260707043133-59e1ae4179f5
 	github.com/google/renameio/v2 v2.0.2
 	github.com/google/uuid v1.6.0
 	github.com/spf13/cobra v1.10.2

go.sum

@@ -38,6 +38,8 @@ github.com/Azure/kubelogin v0.2.15 h1:oJqD8Dvput3rO/xZgMTU+hBrcgg0BfQGPCNHJ2dEmy
 github.com/Azure/kubelogin v0.2.15/go.mod h1:RwJS8TzSHTVQhfIZA4HLS79QGfvIp0ocIVLT5oHS/ls=
 github.com/Azure/unbounded v0.1.20-rc.4 h1:ftzpSuL1Zl+hiFyXovC8wr9gTS2JIuUdYeIVlMY7+BQ=
 github.com/Azure/unbounded v0.1.20-rc.4/go.mod h1:WnWLk0Y+Hwnj6MSMGa3YkSXG75y6JS1ek+UyNzAb9d0=
+github.com/Azure/unbounded v0.1.20-rc.4.0.20260707043133-59e1ae4179f5 h1:+X4Yjfr/PFAFmUw7KUvg5fL+X100uI9g6rUZP6PjE6w=
+github.com/Azure/unbounded v0.1.20-rc.4.0.20260707043133-59e1ae4179f5/go.mod h1:WnWLk0Y+Hwnj6MSMGa3YkSXG75y6JS1ek+UyNzAb9d0=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 h1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU=

pkg/utils/utilio/io.go

@@ -24,6 +24,8 @@ func InstallFile(filename string, r io.Reader, perm os.FileMode) error {
 
 // InstallFileWithLimitedSize streams content to local file with limited size and specified permissions.
 // It ensures that the target directory exists and handles the file writing atomically.
+// The temp file is created in the same directory as the destination to preserve the
+// correct SELinux label (avoiding the user_tmp_t label from /tmp).
 //
 // NOTE: we assume the filename is trusted and cleaned without path traversal characters.
 func InstallFileWithLimitedSize(filename string, r io.Reader, perm os.FileMode, maxBytes int64) error {
@@ -34,7 +36,7 @@ func InstallFileWithLimitedSize(filename string, r io.Reader, perm os.FileMode,
 		return err
 	}
 
-	pf, err := renameio.NewPendingFile(filename, renameio.WithPermissions(perm))
+	pf, err := renameio.NewPendingFile(filename, renameio.WithPermissions(perm), renameio.WithTempDir(filepath.Dir(filename)))
 	if err != nil {
 		return err
 	}
@@ -57,12 +59,14 @@ func InstallFileWithLimitedSize(filename string, r io.Reader, perm os.FileMode,
 
 // WriteFile writes the provided content to a local file with specified permissions.
 // It ensures that the target directory exists and handles the file writing atomically.
+// The temp file is created in the same directory as the destination to preserve the
+// correct SELinux label (avoiding the user_tmp_t label from /tmp).
 //
 // NOTE: we assume the filename is trusted and cleaned without path traversal characters.
 func WriteFile(filename string, content []byte, perm os.FileMode) error {
 	if err := os.MkdirAll(filepath.Dir(filename), 0750); err != nil {
 		return err
 	}
 
-	return renameio.WriteFile(filename, content, perm)
+	return renameio.WriteFile(filename, content, perm, renameio.WithTempDir(filepath.Dir(filename)))
 }