Use destination dir for atomic temp files

Author: Copilot

pkg/utils/utilio/io.go

@@ -24,6 +24,8 @@ func InstallFile(filename string, r io.Reader, perm os.FileMode) error {
 
 // InstallFileWithLimitedSize streams content to local file with limited size and specified permissions.
 // It ensures that the target directory exists and handles the file writing atomically.
+// The temp file is created in the same directory as the destination to preserve
+// the correct SELinux label.
 //
 // NOTE: we assume the filename is trusted and cleaned without path traversal characters.
 func InstallFileWithLimitedSize(filename string, r io.Reader, perm os.FileMode, maxBytes int64) error {
@@ -34,7 +36,7 @@ func InstallFileWithLimitedSize(filename string, r io.Reader, perm os.FileMode,
 		return err
 	}
 
-	pf, err := renameio.NewPendingFile(filename, renameio.WithPermissions(perm))
+	pf, err := renameio.NewPendingFile(filename, renameio.WithPermissions(perm), renameio.WithTempDir(filepath.Dir(filename)))
 	if err != nil {
 		return err
 	}
@@ -57,12 +59,14 @@ func InstallFileWithLimitedSize(filename string, r io.Reader, perm os.FileMode,
 
 // WriteFile writes the provided content to a local file with specified permissions.
 // It ensures that the target directory exists and handles the file writing atomically.
+// The temp file is created in the same directory as the destination to preserve
+// the correct SELinux label.
 //
 // NOTE: we assume the filename is trusted and cleaned without path traversal characters.
 func WriteFile(filename string, content []byte, perm os.FileMode) error {
 	if err := os.MkdirAll(filepath.Dir(filename), 0750); err != nil {
 		return err
 	}
 
-	return renameio.WriteFile(filename, content, perm)
+	return renameio.WriteFile(filename, content, perm, renameio.WithTempDir(filepath.Dir(filename)))
 }

pkg/utils/utilio/io_test.go

@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 )
 
 func TestWriteFile(t *testing.T) {
@@ -159,6 +160,36 @@ func TestInstallFile(t *testing.T) {
 	}
 }
 
+func TestInstallFileWithLimitedSizeCreatesTempFileInTargetDir(t *testing.T) {
+	targetDir := t.TempDir()
+	tmpDir := t.TempDir()
+	t.Setenv("TMPDIR", tmpDir)
+
+	filename := filepath.Join(targetDir, "target.txt")
+	reader := &blockingReader{
+		started: make(chan struct{}),
+		unblock: make(chan struct{}),
+	}
+	errCh := make(chan error, 1)
+	go func() {
+		errCh <- InstallFileWithLimitedSize(filename, reader, 0o644, 1024)
+	}()
+
+	<-reader.started
+
+	if !waitForTempFile(t, targetDir, filepath.Base(filename)) {
+		t.Fatalf("expected pending temp file in target directory %q", targetDir)
+	}
+	if hasTempFile(t, tmpDir, filepath.Base(filename)) {
+		t.Fatalf("expected no pending temp file in TMPDIR %q", tmpDir)
+	}
+
+	close(reader.unblock)
+	if err := <-errCh; err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
 func TestInstallFileWithLimitedSize(t *testing.T) {
 	tests := []struct {
 		name      string
@@ -391,3 +422,44 @@ type errReader struct {
 func (e *errReader) Read(_ []byte) (int, error) {
 	return 0, e.err
 }
+
+type blockingReader struct {
+	started chan struct{}
+	unblock chan struct{}
+	sent    bool
+}
+
+func (r *blockingReader) Read(p []byte) (int, error) {
+	if !r.sent {
+		r.sent = true
+		p[0] = 'x'
+		close(r.started)
+		return 1, nil
+	}
+
+	<-r.unblock
+	return 0, io.EOF
+}
+
+func waitForTempFile(t *testing.T, dir, targetBase string) bool {
+	t.Helper()
+
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		if hasTempFile(t, dir, targetBase) {
+			return true
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	return false
+}
+
+func hasTempFile(t *testing.T, dir, targetBase string) bool {
+	t.Helper()
+
+	matches, err := filepath.Glob(filepath.Join(dir, "."+targetBase+"*"))
+	if err != nil {
+		t.Fatalf("glob temp files: %v", err)
+	}
+	return len(matches) > 0
+}