diff --git a/src/basic/chase.c b/src/basic/chase.c
index 373252b645..983901f714 100644
--- a/src/basic/chase.c
+++ b/src/basic/chase.c
@@ -325,7 +325,11 @@ int chaseat(int dir_fd, const char *path, ChaseFlags flags, char **ret_path, int
                                 return r;
 
                         if (FLAGS_SET(flags, CHASE_MKDIR_0755) && !isempty(todo)) {
-                                child = xopenat(fd, first, O_DIRECTORY|O_CREAT|O_EXCL|O_NOFOLLOW|O_CLOEXEC, 0755);
+                                child = xopenat(fd,
+                                                first,
+                                                O_DIRECTORY|O_CREAT|O_EXCL|O_NOFOLLOW|O_CLOEXEC,
+                                                /* xopen_flags = */ 0,
+                                                0755);
                                 if (child < 0)
                                         return child;
                         } else if (FLAGS_SET(flags, CHASE_PARENT) && isempty(todo)) {
@@ -628,6 +632,7 @@ int chase_and_open(const char *path, const char *root, ChaseFlags chase_flags, i
                 /* Shortcut this call if none of the special features of this call are requested */
                 return RET_NERRNO(xopenat(AT_FDCWD, path,
                                           open_flags | (FLAGS_SET(chase_flags, CHASE_NOFOLLOW) ? O_NOFOLLOW : 0),
+                                          /* xopen_flags = */ 0,
                                           mode));
 
         r = chase(path, root, CHASE_PARENT|chase_flags, &p, &path_fd);
@@ -645,7 +650,7 @@ int chase_and_open(const char *path, const char *root, ChaseFlags chase_flags, i
                         return r;
         }
 
-        r = xopenat(path_fd, strempty(fname), open_flags|O_NOFOLLOW, mode);
+        r = xopenat(path_fd, strempty(fname), open_flags|O_NOFOLLOW, /* xopen_flags = */ 0, mode);
         if (r < 0)
                 return r;
 
@@ -834,6 +839,7 @@ int chase_and_openat(int dir_fd, const char *path, ChaseFlags chase_flags, int o
                 /* Shortcut this call if none of the special features of this call are requested */
                 return RET_NERRNO(xopenat(dir_fd, path,
                                           open_flags | (FLAGS_SET(chase_flags, CHASE_NOFOLLOW) ? O_NOFOLLOW : 0),
+                                          /* xopen_flags = */ 0,
                                           mode));
 
         r = chaseat(dir_fd, path, chase_flags|CHASE_PARENT, &p, &path_fd);
@@ -846,7 +852,7 @@ int chase_and_openat(int dir_fd, const char *path, ChaseFlags chase_flags, int o
                         return r;
         }
 
-        r = xopenat(path_fd, strempty(fname), open_flags|O_NOFOLLOW, mode);
+        r = xopenat(path_fd, strempty(fname), open_flags|O_NOFOLLOW, /* xopen_flags = */ 0, mode);
         if (r < 0)
                 return r;
 
diff --git a/src/basic/fs-util.c b/src/basic/fs-util.c
index 1e1413dc80..04a6531dcb 100644
--- a/src/basic/fs-util.c
+++ b/src/basic/fs-util.c
@@ -14,6 +14,7 @@
 #include "fileio.h"
 #include "fs-util.h"
 #include "hostname-util.h"
+#include "label.h"
 #include "lock-util.h"
 #include "log.h"
 #include "macro.h"
@@ -1034,7 +1035,7 @@ int open_mkdir_at(int dirfd, const char *path, int flags, mode_t mode) {
                 path = fname;
         }
 
-        fd = xopenat(dirfd, path, flags|O_CREAT|O_DIRECTORY|O_NOFOLLOW, mode);
+        fd = xopenat(dirfd, path, flags|O_CREAT|O_DIRECTORY|O_NOFOLLOW, /* xopen_flags = */ 0, mode);
         if (IN_SET(fd, -ELOOP, -ENOTDIR))
                 return -EEXIST;
         if (fd < 0)
@@ -1090,7 +1091,7 @@ int openat_report_new(int dirfd, const char *pathname, int flags, mode_t mode, b
         }
 }
 
-int xopenat(int dir_fd, const char *path, int flags, mode_t mode) {
+int xopenat(int dir_fd, const char *path, int open_flags, XOpenFlags xopen_flags, mode_t mode) {
         _cleanup_close_ int fd = -EBADF;
         bool made = false;
         int r;
@@ -1099,14 +1100,20 @@ int xopenat(int dir_fd, const char *path, int flags, mode_t mode) {
         assert(path);
 
         if (isempty(path)) {
-                assert(!FLAGS_SET(flags, O_CREAT|O_EXCL));
-                return fd_reopen(dir_fd, flags & ~O_NOFOLLOW);
+                assert(!FLAGS_SET(open_flags, O_CREAT|O_EXCL));
+                return fd_reopen(dir_fd, open_flags & ~O_NOFOLLOW);
         }
 
-        if (FLAGS_SET(flags, O_DIRECTORY|O_CREAT)) {
+        if (FLAGS_SET(open_flags, O_CREAT) && FLAGS_SET(xopen_flags, XO_LABEL)) {
+                r = label_ops_pre(dir_fd, path, FLAGS_SET(open_flags, O_DIRECTORY) ? S_IFDIR : S_IFREG);
+                if (r < 0)
+                        return r;
+        }
+
+        if (FLAGS_SET(open_flags, O_DIRECTORY|O_CREAT)) {
                 r = RET_NERRNO(mkdirat(dir_fd, path, mode));
                 if (r == -EEXIST) {
-                        if (FLAGS_SET(flags, O_EXCL))
+                        if (FLAGS_SET(open_flags, O_EXCL))
                                 return -EEXIST;
 
                         made = false;
@@ -1115,10 +1122,17 @@ int xopenat(int dir_fd, const char *path, int flags, mode_t mode) {
                 else
                         made = true;
 
-                flags &= ~(O_EXCL|O_CREAT);
+                if (FLAGS_SET(xopen_flags, XO_LABEL)) {
+                        r = label_ops_post(dir_fd, path);
+                        if (r < 0)
+                                return r;
+                }
+
+                open_flags &= ~(O_EXCL|O_CREAT);
+                xopen_flags &= ~XO_LABEL;
         }
 
-        fd = RET_NERRNO(openat(dir_fd, path, flags, mode));
+        fd = RET_NERRNO(openat(dir_fd, path, open_flags, mode));
         if (fd < 0) {
                 if (IN_SET(fd,
                            /* We got ENOENT? then someone else immediately removed it after we
@@ -1137,10 +1151,24 @@ int xopenat(int dir_fd, const char *path, int flags, mode_t mode) {
                 return fd;
         }
 
+        if (FLAGS_SET(open_flags, O_CREAT) && FLAGS_SET(xopen_flags, XO_LABEL)) {
+                r = label_ops_post(dir_fd, path);
+                if (r < 0)
+                        return r;
+        }
+
         return TAKE_FD(fd);
 }
 
-int xopenat_lock(int dir_fd, const char *path, int flags, mode_t mode, LockType locktype, int operation) {
+int xopenat_lock(
+                int dir_fd,
+                const char *path,
+                int open_flags,
+                XOpenFlags xopen_flags,
+                mode_t mode,
+                LockType locktype,
+                int operation) {
+
         _cleanup_close_ int fd = -EBADF;
         int r;
 
@@ -1150,13 +1178,13 @@ int xopenat_lock(int dir_fd, const char *path, int flags, mode_t mode, LockType
 
         /* POSIX/UNPOSIX locks don't work on directories (errno is set to -EBADF so let's return early with
          * the same error here). */
-        if (FLAGS_SET(flags, O_DIRECTORY) && locktype != LOCK_BSD)
+        if (FLAGS_SET(open_flags, O_DIRECTORY) && locktype != LOCK_BSD)
                 return -EBADF;
 
         for (;;) {
                 struct stat st;
 
-                fd = xopenat(dir_fd, path, flags, mode);
+                fd = xopenat(dir_fd, path, open_flags, xopen_flags, mode);
                 if (fd < 0)
                         return fd;
 
diff --git a/src/basic/fs-util.h b/src/basic/fs-util.h
index cf381dfc26..a19836d138 100644
--- a/src/basic/fs-util.h
+++ b/src/basic/fs-util.h
@@ -132,6 +132,10 @@ int open_mkdir_at(int dirfd, const char *path, int flags, mode_t mode);
 
 int openat_report_new(int dirfd, const char *pathname, int flags, mode_t mode, bool *ret_newly_created);
 
-int xopenat(int dir_fd, const char *path, int flags, mode_t mode);
+typedef enum XOpenFlags {
+        XO_LABEL = 1 << 0,
+} XOpenFlags;
 
-int xopenat_lock(int dir_fd, const char *path, int flags, mode_t mode, LockType locktype, int operation);
+int xopenat(int dir_fd, const char *path, int open_flags, XOpenFlags xopen_flags, mode_t mode);
+
+int xopenat_lock(int dir_fd, const char *path, int open_flags, XOpenFlags xopen_flags, mode_t mode, LockType locktype, int operation);
diff --git a/src/basic/label.c b/src/basic/label.c
new file mode 100644
index 0000000000..f134e77589
--- /dev/null
+++ b/src/basic/label.c
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include <errno.h>
+#include <stddef.h>
+
+#include "label.h"
+
+static const LabelOps *label_ops = NULL;
+
+int label_ops_set(const LabelOps *ops) {
+        if (label_ops)
+                return -EBUSY;
+
+        label_ops = ops;
+        return 0;
+}
+
+int label_ops_pre(int dir_fd, const char *path, mode_t mode) {
+        if (!label_ops || !label_ops->pre)
+                return 0;
+
+        return label_ops->pre(dir_fd, path, mode);
+}
+
+int label_ops_post(int dir_fd, const char *path) {
+        if (!label_ops || !label_ops->post)
+                return 0;
+
+        return label_ops->post(dir_fd, path);
+}
diff --git a/src/basic/label.h b/src/basic/label.h
new file mode 100644
index 0000000000..9644e435a3
--- /dev/null
+++ b/src/basic/label.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include <sys/types.h>
+
+typedef struct LabelOps {
+        int (*pre)(int dir_fd, const char *path, mode_t mode);
+        int (*post)(int dir_fd, const char *path);
+} LabelOps;
+
+int label_ops_set(const LabelOps *label_ops);
+
+int label_ops_pre(int dir_fd, const char *path, mode_t mode);
+int label_ops_post(int dir_fd, const char *path);
diff --git a/src/basic/lock-util.c b/src/basic/lock-util.c
index 8ca30a50f0..3614fbe37c 100644
--- a/src/basic/lock-util.c
+++ b/src/basic/lock-util.c
@@ -37,7 +37,13 @@ int make_lock_file_at(int dir_fd, const char *p, int operation, LockFile *ret) {
         if (!t)
                 return -ENOMEM;
 
-        fd = xopenat_lock(dfd, p, O_CREAT|O_RDWR|O_NOFOLLOW|O_CLOEXEC|O_NOCTTY, 0600, LOCK_UNPOSIX, operation);
+        fd = xopenat_lock(dfd,
+                          p,
+                          O_CREAT|O_RDWR|O_NOFOLLOW|O_CLOEXEC|O_NOCTTY,
+                          /* xopen_flags = */ 0,
+                          0600,
+                          LOCK_UNPOSIX,
+                          operation);
         if (fd < 0)
                 return fd == -EAGAIN ? -EBUSY : fd;
 
diff --git a/src/basic/meson.build b/src/basic/meson.build
index ee94337140..9358a40001 100644
--- a/src/basic/meson.build
+++ b/src/basic/meson.build
@@ -44,6 +44,7 @@ basic_sources = files(
         'inotify-util.c',
         'io-util.c',
         'ioprio-util.c',
+        'label.c',
         'limits-util.c',
         'locale-util.c',
         'lock-util.c',
diff --git a/src/basic/stat-util.c b/src/basic/stat-util.c
index 843cc025dc..633d9479dd 100644
--- a/src/basic/stat-util.c
+++ b/src/basic/stat-util.c
@@ -464,7 +464,7 @@ int xstatfsat(int dir_fd, const char *path, struct statfs *ret) {
         assert(path);
         assert(ret);
 
-        fd = xopenat(dir_fd, path, O_PATH|O_CLOEXEC|O_NOCTTY, 0);
+        fd = xopenat(dir_fd, path, O_PATH|O_CLOEXEC|O_NOCTTY, /* xopen_flags = */ 0, /* mode = */ 0);
         if (fd < 0)
                 return fd;
 
diff --git a/src/core/automount.c b/src/core/automount.c
index 5df697bf22..3254275d6b 100644
--- a/src/core/automount.c
+++ b/src/core/automount.c
@@ -21,7 +21,7 @@
 #include "format-util.h"
 #include "fstab-util.h"
 #include "io-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "mkdir-label.h"
 #include "mount-util.h"
 #include "mount.h"
diff --git a/src/core/execute.c b/src/core/execute.c
index 5e327465da..b2804e52e9 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -65,7 +65,7 @@
 #include "hexdecoct.h"
 #include "io-util.h"
 #include "ioprio-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "log.h"
 #include "macro.h"
 #include "manager.h"
diff --git a/src/core/main.c b/src/core/main.c
index 08d416bc14..c69f9b9afe 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -2849,8 +2849,8 @@ int main(int argc, char *argv[]) {
                                         goto finish;
                         }
 
-                        if (mac_selinux_init() < 0) {
-                                error_message = "Failed to initialize SELinux support";
+                        if (mac_init() < 0) {
+                                error_message = "Failed to initialize MAC support";
                                 goto finish;
                         }
 
@@ -2922,8 +2922,8 @@ int main(int argc, char *argv[]) {
                  * operate. */
                 capability_ambient_set_apply(0, /* also_inherit= */ false);
 
-                if (mac_selinux_init() < 0) {
-                        error_message = "Failed to initialize SELinux support";
+                if (mac_init() < 0) {
+                        error_message = "Failed to initialize MAC support";
                         goto finish;
                 }
         }
diff --git a/src/core/manager.c b/src/core/manager.c
index f8d469ebf6..78d1a032e6 100644
--- a/src/core/manager.c
+++ b/src/core/manager.c
@@ -54,7 +54,7 @@
 #include "inotify-util.h"
 #include "install.h"
 #include "io-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "load-fragment.h"
 #include "locale-setup.h"
 #include "log.h"
diff --git a/src/core/namespace.c b/src/core/namespace.c
index 1116ece59d..b00f27e08f 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -22,7 +22,7 @@
 #include "fd-util.h"
 #include "format-util.h"
 #include "glyph-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "list.h"
 #include "lock-util.h"
 #include "loop-util.h"
diff --git a/src/core/socket.c b/src/core/socket.c
index a6477de5a0..7c596182c2 100644
--- a/src/core/socket.c
+++ b/src/core/socket.c
@@ -26,7 +26,7 @@
 #include "in-addr-util.h"
 #include "io-util.h"
 #include "ip-protocol-list.h"
-#include "label.h"
+#include "label-util.h"
 #include "log.h"
 #include "mkdir-label.h"
 #include "parse-util.h"
diff --git a/src/core/unit.c b/src/core/unit.c
index 90f87a95f5..55bc926c2f 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -32,7 +32,7 @@
 #include "id128-util.h"
 #include "install.h"
 #include "io-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "load-dropin.h"
 #include "load-fragment.h"
 #include "log.h"
diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
index 36ab0148b9..97b1c61748 100644
--- a/src/hostname/hostnamed.c
+++ b/src/hostname/hostnamed.c
@@ -1524,7 +1524,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 
diff --git a/src/hwdb/hwdb.c b/src/hwdb/hwdb.c
index edc5dfc1f5..4287b1f066 100644
--- a/src/hwdb/hwdb.c
+++ b/src/hwdb/hwdb.c
@@ -124,7 +124,7 @@ static int run(int argc, char *argv[]) {
         if (r <= 0)
                 return r;
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 
diff --git a/src/libsystemd/sd-id128/id128-util.c b/src/libsystemd/sd-id128/id128-util.c
index 76c9d1c051..edadd86eaa 100644
--- a/src/libsystemd/sd-id128/id128-util.c
+++ b/src/libsystemd/sd-id128/id128-util.c
@@ -119,7 +119,7 @@ int id128_read_at(int dir_fd, const char *path, Id128Flag f, sd_id128_t *ret) {
         assert(dir_fd >= 0 || dir_fd == AT_FDCWD);
         assert(path);
 
-        fd = xopenat(dir_fd, path, O_RDONLY|O_CLOEXEC|O_NOCTTY, 0);
+        fd = xopenat(dir_fd, path, O_RDONLY|O_CLOEXEC|O_NOCTTY, /* xopen_flags = */ 0, /* mode = */ 0);
         if (fd < 0)
                 return fd;
 
@@ -165,7 +165,7 @@ int id128_write_at(int dir_fd, const char *path, Id128Flag f, sd_id128_t id) {
         assert(dir_fd >= 0 || dir_fd == AT_FDCWD);
         assert(path);
 
-        fd = xopenat(dir_fd, path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY|O_TRUNC, 0444);
+        fd = xopenat(dir_fd, path, O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY|O_TRUNC, /* xopen_flags = */ 0, 0444);
         if (fd < 0)
                 return fd;
 
diff --git a/src/locale/localed.c b/src/locale/localed.c
index 63ff69d7d3..9e5b7b03c0 100644
--- a/src/locale/localed.c
+++ b/src/locale/localed.c
@@ -657,7 +657,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 
diff --git a/src/login/logind-user.c b/src/login/logind-user.c
index 6161af9a74..7a6056086a 100644
--- a/src/login/logind-user.c
+++ b/src/login/logind-user.c
@@ -17,7 +17,7 @@
 #include "format-util.h"
 #include "fs-util.h"
 #include "hashmap.h"
-#include "label.h"
+#include "label-util.h"
 #include "limits-util.h"
 #include "logind-dbus.h"
 #include "logind-user-dbus.h"
diff --git a/src/login/logind.c b/src/login/logind.c
index cfb3ef500c..8323bcc0cb 100644
--- a/src/login/logind.c
+++ b/src/login/logind.c
@@ -1194,7 +1194,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 
diff --git a/src/login/user-runtime-dir.c b/src/login/user-runtime-dir.c
index 5a16d1684d..ed8a80e6ed 100644
--- a/src/login/user-runtime-dir.c
+++ b/src/login/user-runtime-dir.c
@@ -10,7 +10,7 @@
 #include "dev-setup.h"
 #include "format-util.h"
 #include "fs-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "limits-util.h"
 #include "main-func.h"
 #include "mkdir-label.h"
@@ -202,7 +202,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 
diff --git a/src/machine/machinectl.c b/src/machine/machinectl.c
index 197d0cfa1c..8d7d464a4a 100644
--- a/src/machine/machinectl.c
+++ b/src/machine/machinectl.c
@@ -1462,7 +1462,7 @@ static int edit_settings(int argc, char *argv[], void *userdata) {
                 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
                                        "Edit is only supported on the host machine.");
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 
diff --git a/src/nspawn/nspawn-mount.c b/src/nspawn/nspawn-mount.c
index fcf5c710f1..0a85b5d89a 100644
--- a/src/nspawn/nspawn-mount.c
+++ b/src/nspawn/nspawn-mount.c
@@ -9,7 +9,7 @@
 #include "fd-util.h"
 #include "format-util.h"
 #include "fs-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "mkdir-label.h"
 #include "mount-util.h"
 #include "mountpoint-util.h"
diff --git a/src/resolve/resolved-resolv-conf.c b/src/resolve/resolved-resolv-conf.c
index 5749aa1dc3..52e31d2fd3 100644
--- a/src/resolve/resolved-resolv-conf.c
+++ b/src/resolve/resolved-resolv-conf.c
@@ -10,7 +10,7 @@
 #include "fd-util.h"
 #include "fileio.h"
 #include "fs-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "ordered-set.h"
 #include "resolved-conf.h"
 #include "resolved-dns-server.h"
diff --git a/src/resolve/resolved.c b/src/resolve/resolved.c
index f9d3281509..1625c5189d 100644
--- a/src/resolve/resolved.c
+++ b/src/resolve/resolved.c
@@ -38,7 +38,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 
diff --git a/src/shared/btrfs-util.c b/src/shared/btrfs-util.c
index 7909184f2d..16295a5823 100644
--- a/src/shared/btrfs-util.c
+++ b/src/shared/btrfs-util.c
@@ -223,7 +223,7 @@ int btrfs_get_block_device_at(int dir_fd, const char *path, dev_t *ret) {
         assert(path);
         assert(ret);
 
-        fd = xopenat(dir_fd, path, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY, 0);
+        fd = xopenat(dir_fd, path, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY, /* xopen_flags = */ 0, /* mode = */ 0);
         if (fd < 0)
                 return fd;
 
diff --git a/src/shared/dev-setup.c b/src/shared/dev-setup.c
index e0db777c96..7dca6ad7d4 100644
--- a/src/shared/dev-setup.c
+++ b/src/shared/dev-setup.c
@@ -6,7 +6,7 @@
 
 #include "alloc-util.h"
 #include "dev-setup.h"
-#include "label.h"
+#include "label-util.h"
 #include "log.h"
 #include "mkdir-label.h"
 #include "nulstr-util.h"
diff --git a/src/shared/hwdb-util.c b/src/shared/hwdb-util.c
index 785611f8c4..a2fbcd7078 100644
--- a/src/shared/hwdb-util.c
+++ b/src/shared/hwdb-util.c
@@ -11,7 +11,7 @@
 #include "fs-util.h"
 #include "hwdb-internal.h"
 #include "hwdb-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "mkdir-label.h"
 #include "nulstr-util.h"
 #include "path-util.h"
diff --git a/src/shared/label.c b/src/shared/label-util.c
similarity index 92%
rename from src/shared/label.c
rename to src/shared/label-util.c
index 66fcc0a31f..3316c9ed37 100644
--- a/src/shared/label.c
+++ b/src/shared/label-util.c
@@ -7,6 +7,7 @@
 #include "btrfs-util.h"
 #include "fs-util.h"
 #include "label.h"
+#include "label-util.h"
 #include "macro.h"
 #include "selinux-util.h"
 #include "smack-util.h"
@@ -115,3 +116,15 @@ int btrfs_subvol_make_label(const char *path) {
 
         return mac_smack_fix(path, 0);
 }
+
+int mac_init(void) {
+        int r;
+
+        assert(!(mac_selinux_use() && mac_smack_use()));
+
+        r = mac_selinux_init();
+        if (r < 0)
+                return r;
+
+        return mac_smack_init();
+}
diff --git a/src/shared/label.h b/src/shared/label-util.h
similarity index 97%
rename from src/shared/label.h
rename to src/shared/label-util.h
index 2f899e2bdd..2f8c539618 100644
--- a/src/shared/label.h
+++ b/src/shared/label-util.h
@@ -24,3 +24,5 @@ static inline int symlink_atomic_label(const char *from, const char *to) {
 int mknod_label(const char *pathname, mode_t mode, dev_t dev);
 
 int btrfs_subvol_make_label(const char *path);
+
+int mac_init(void);
diff --git a/src/shared/loop-util.c b/src/shared/loop-util.c
index a70c5509d5..3e51c93ede 100644
--- a/src/shared/loop-util.c
+++ b/src/shared/loop-util.c
@@ -677,9 +677,9 @@ int loop_device_make_by_path_at(
         direct_flags = FLAGS_SET(loop_flags, LO_FLAGS_DIRECT_IO) ? O_DIRECT : 0;
         rdwr_flags = open_flags >= 0 ? open_flags : O_RDWR;
 
-        fd = xopenat(dir_fd, path, basic_flags|direct_flags|rdwr_flags, 0);
+        fd = xopenat(dir_fd, path, basic_flags|direct_flags|rdwr_flags, /* xopen_flags = */ 0, /* mode = */ 0);
         if (fd < 0 && direct_flags != 0) /* If we had O_DIRECT on, and things failed with that, let's immediately try again without */
-                fd = xopenat(dir_fd, path, basic_flags|rdwr_flags, 0);
+                fd = xopenat(dir_fd, path, basic_flags|rdwr_flags, /* xopen_flags = */ 0, /* mode = */ 0);
         else
                 direct = direct_flags != 0;
         if (fd < 0) {
@@ -689,9 +689,9 @@ int loop_device_make_by_path_at(
                 if (open_flags >= 0 || !(ERRNO_IS_PRIVILEGE(r) || r == -EROFS))
                         return r;
 
-                fd = xopenat(dir_fd, path, basic_flags|direct_flags|O_RDONLY, 0);
+                fd = xopenat(dir_fd, path, basic_flags|direct_flags|O_RDONLY, /* xopen_flags = */ 0, /* mode = */ 0);
                 if (fd < 0 && direct_flags != 0) /* as above */
-                        fd = xopenat(dir_fd, path, basic_flags|O_RDONLY, 0);
+                        fd = xopenat(dir_fd, path, basic_flags|O_RDONLY, /* xopen_flags = */ 0, /* mode = */ 0);
                 else
                         direct = direct_flags != 0;
                 if (fd < 0)
diff --git a/src/shared/machine-pool.c b/src/shared/machine-pool.c
index fb0b2f5adc..b372de40a3 100644
--- a/src/shared/machine-pool.c
+++ b/src/shared/machine-pool.c
@@ -3,7 +3,7 @@
 #include <errno.h>
 
 #include "btrfs-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "machine-pool.h"
 #include "missing_magic.h"
 #include "stat-util.h"
diff --git a/src/shared/meson.build b/src/shared/meson.build
index 021ba517f8..31241bc08d 100644
--- a/src/shared/meson.build
+++ b/src/shared/meson.build
@@ -96,7 +96,7 @@ shared_sources = files(
         'kernel-image.c',
         'keyring-util.c',
         'killall.c',
-        'label.c',
+        'label-util.c',
         'libcrypt-util.c',
         'libfido2-util.c',
         'libmount-util.c',
diff --git a/src/shared/mount-setup.c b/src/shared/mount-setup.c
index 6162a58d9a..fd14cd8598 100644
--- a/src/shared/mount-setup.c
+++ b/src/shared/mount-setup.c
@@ -17,7 +17,7 @@
 #include "fd-util.h"
 #include "fileio.h"
 #include "fs-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "log.h"
 #include "macro.h"
 #include "mkdir-label.h"
diff --git a/src/shared/mount-util.c b/src/shared/mount-util.c
index 7a06cc75ae..81b681afa7 100644
--- a/src/shared/mount-util.c
+++ b/src/shared/mount-util.c
@@ -22,7 +22,7 @@
 #include "glyph-util.h"
 #include "hashmap.h"
 #include "initrd-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "libmount-util.h"
 #include "missing_mount.h"
 #include "missing_syscall.h"
diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c
index cc00a85952..a38a56f434 100644
--- a/src/shared/selinux-util.c
+++ b/src/shared/selinux-util.c
@@ -20,6 +20,7 @@
 #include "alloc-util.h"
 #include "errno-util.h"
 #include "fd-util.h"
+#include "label.h"
 #include "log.h"
 #include "macro.h"
 #include "mallinfo-util.h"
@@ -54,6 +55,15 @@ static bool have_status_page = false;
                         : -ERRNO_VALUE(_e);                             \
                 _enforcing ? _r : 0;                                    \
         })
+
+static int mac_selinux_label_pre(int dir_fd, const char *path, mode_t mode) {
+        return mac_selinux_create_file_prepare_at(dir_fd, path, mode);
+}
+
+static int mac_selinux_label_post(int dir_fd, const char *path) {
+        mac_selinux_create_file_clear();
+        return 0;
+}
 #endif
 
 bool mac_selinux_use(void) {
@@ -128,6 +138,10 @@ static int open_label_db(void) {
 
 int mac_selinux_init(void) {
 #if HAVE_SELINUX
+        static const LabelOps label_ops = {
+                .pre = mac_selinux_label_pre,
+                .post = mac_selinux_label_post,
+        };
         int r;
 
         if (initialized)
@@ -152,6 +166,10 @@ int mac_selinux_init(void) {
                 return r;
         }
 
+        r = label_ops_set(&label_ops);
+        if (r < 0)
+                return r;
+
         /* Save the current policyload sequence number, so mac_selinux_maybe_reload() does not trigger on
          * first call without any actual change. */
         last_policyload = selinux_status_policyload();
diff --git a/src/shared/selinux-util.h b/src/shared/selinux-util.h
index e9771a28fe..238550ef52 100644
--- a/src/shared/selinux-util.h
+++ b/src/shared/selinux-util.h
@@ -7,7 +7,7 @@
 #include <sys/types.h>
 
 #include "macro.h"
-#include "label.h"
+#include "label-util.h"
 
 #if HAVE_SELINUX
 #include <selinux/selinux.h>
diff --git a/src/shared/smack-util.c b/src/shared/smack-util.c
index 8c28dd91d7..1f88e724d0 100644
--- a/src/shared/smack-util.c
+++ b/src/shared/smack-util.c
@@ -15,6 +15,7 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "label.h"
 #include "log.h"
 #include "macro.h"
 #include "path-util.h"
@@ -288,3 +289,23 @@ int renameat_and_apply_smack_floor_label(int fdf, const char *from, int fdt, con
         return 0;
 #endif
 }
+
+static int mac_smack_label_pre(int dir_fd, const char *path, mode_t mode) {
+        return 0;
+}
+
+static int mac_smack_label_post(int dir_fd, const char *path) {
+        return mac_smack_fix_full(dir_fd, path, NULL, 0);
+}
+
+int mac_smack_init(void) {
+        static const LabelOps label_ops = {
+                .pre = mac_smack_label_pre,
+                .post = mac_smack_label_post,
+        };
+
+        if (!mac_smack_use())
+                return 0;
+
+        return label_ops_set(&label_ops);
+}
diff --git a/src/shared/smack-util.h b/src/shared/smack-util.h
index 17b31c6c25..f6ed2ece38 100644
--- a/src/shared/smack-util.h
+++ b/src/shared/smack-util.h
@@ -10,7 +10,7 @@
 #include <stdbool.h>
 #include <sys/types.h>
 
-#include "label.h"
+#include "label-util.h"
 #include "macro.h"
 
 #define SMACK_FLOOR_LABEL "_"
@@ -28,6 +28,7 @@ typedef enum SmackAttr {
 } SmackAttr;
 
 bool mac_smack_use(void);
+int mac_smack_init(void);
 
 int mac_smack_fix_full(int atfd, const char *inode_path, const char *label_path, LabelFixFlags flags);
 static inline int mac_smack_fix(const char *path, LabelFixFlags flags) {
diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c
index 561b01a67a..aff823d773 100644
--- a/src/systemctl/systemctl-edit.c
+++ b/src/systemctl/systemctl-edit.c
@@ -333,7 +333,7 @@ int verb_edit(int argc, char *argv[], void *userdata) {
         if (r < 0)
                 return r;
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 
diff --git a/src/sysusers/sysusers.c b/src/sysusers/sysusers.c
index 12adad516e..cfa4823df7 100644
--- a/src/sysusers/sysusers.c
+++ b/src/sysusers/sysusers.c
@@ -2178,7 +2178,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 
diff --git a/src/test/test-fs-util.c b/src/test/test-fs-util.c
index fa33b807b2..873052e24d 100644
--- a/src/test/test-fs-util.c
+++ b/src/test/test-fs-util.c
@@ -680,26 +680,26 @@ TEST(xopenat) {
 
         /* Test that xopenat() creates directories if O_DIRECTORY is specified. */
 
-        assert_se((fd = xopenat(tfd, "abc", O_DIRECTORY|O_CREAT|O_EXCL|O_CLOEXEC, 0755)) >= 0);
+        assert_se((fd = xopenat(tfd, "abc", O_DIRECTORY|O_CREAT|O_EXCL|O_CLOEXEC, 0, 0755)) >= 0);
         assert_se((fd_verify_directory(fd) >= 0));
         fd = safe_close(fd);
 
-        assert_se(xopenat(tfd, "abc", O_DIRECTORY|O_CREAT|O_EXCL|O_CLOEXEC, 0755) == -EEXIST);
+        assert_se(xopenat(tfd, "abc", O_DIRECTORY|O_CREAT|O_EXCL|O_CLOEXEC, 0, 0755) == -EEXIST);
 
-        assert_se((fd = xopenat(tfd, "abc", O_DIRECTORY|O_CREAT|O_CLOEXEC, 0755)) >= 0);
+        assert_se((fd = xopenat(tfd, "abc", O_DIRECTORY|O_CREAT|O_CLOEXEC, 0, 0755)) >= 0);
         assert_se((fd_verify_directory(fd) >= 0));
         fd = safe_close(fd);
 
         /* Test that xopenat() creates regular files if O_DIRECTORY is not specified. */
 
-        assert_se((fd = xopenat(tfd, "def", O_CREAT|O_EXCL|O_CLOEXEC, 0644)) >= 0);
+        assert_se((fd = xopenat(tfd, "def", O_CREAT|O_EXCL|O_CLOEXEC, 0, 0644)) >= 0);
         assert_se(fd_verify_regular(fd) >= 0);
         fd = safe_close(fd);
 
         /* Test that we can reopen an existing fd with xopenat() by specifying an empty path. */
 
-        assert_se((fd = xopenat(tfd, "def", O_PATH|O_CLOEXEC, 0)) >= 0);
-        assert_se((fd2 = xopenat(fd, "", O_RDWR|O_CLOEXEC, 0644)) >= 0);
+        assert_se((fd = xopenat(tfd, "def", O_PATH|O_CLOEXEC, 0, 0)) >= 0);
+        assert_se((fd2 = xopenat(fd, "", O_RDWR|O_CLOEXEC, 0, 0644)) >= 0);
 }
 
 TEST(xopenat_lock) {
@@ -713,11 +713,11 @@ TEST(xopenat_lock) {
          * and close the file descriptor and still properly create the directory and acquire the lock in
          * another process.  */
 
-        fd = xopenat_lock(tfd, "abc", O_CREAT|O_DIRECTORY|O_CLOEXEC, 0755, LOCK_BSD, LOCK_EX);
+        fd = xopenat_lock(tfd, "abc", O_CREAT|O_DIRECTORY|O_CLOEXEC, 0, 0755, LOCK_BSD, LOCK_EX);
         assert_se(fd >= 0);
         assert_se(faccessat(tfd, "abc", F_OK, 0) >= 0);
         assert_se(fd_verify_directory(fd) >= 0);
-        assert_se(xopenat_lock(tfd, "abc", O_DIRECTORY|O_CLOEXEC, 0755, LOCK_BSD, LOCK_EX|LOCK_NB) == -EAGAIN);
+        assert_se(xopenat_lock(tfd, "abc", O_DIRECTORY|O_CLOEXEC, 0, 0755, LOCK_BSD, LOCK_EX|LOCK_NB) == -EAGAIN);
 
         pid_t pid = fork();
         assert_se(pid >= 0);
@@ -725,11 +725,11 @@ TEST(xopenat_lock) {
         if (pid == 0) {
                 safe_close(fd);
 
-                fd = xopenat_lock(tfd, "abc", O_CREAT|O_DIRECTORY|O_CLOEXEC, 0755, LOCK_BSD, LOCK_EX);
+                fd = xopenat_lock(tfd, "abc", O_CREAT|O_DIRECTORY|O_CLOEXEC, 0, 0755, LOCK_BSD, LOCK_EX);
                 assert_se(fd >= 0);
                 assert_se(faccessat(tfd, "abc", F_OK, 0) >= 0);
                 assert_se(fd_verify_directory(fd) >= 0);
-                assert_se(xopenat_lock(tfd, "abc", O_DIRECTORY|O_CLOEXEC, 0755, LOCK_BSD, LOCK_EX|LOCK_NB) == -EAGAIN);
+                assert_se(xopenat_lock(tfd, "abc", O_DIRECTORY|O_CLOEXEC, 0, 0755, LOCK_BSD, LOCK_EX|LOCK_NB) == -EAGAIN);
 
                 _exit(EXIT_SUCCESS);
         }
@@ -748,8 +748,8 @@ TEST(xopenat_lock) {
         assert_se(wait_for_terminate(pid, &si) >= 0);
         assert_se(si.si_code == CLD_EXITED);
 
-        assert_se(xopenat_lock(tfd, "abc", 0, 0755, LOCK_POSIX, LOCK_EX) == -EBADF);
-        assert_se(xopenat_lock(tfd, "def", O_DIRECTORY, 0755, LOCK_POSIX, LOCK_EX) == -EBADF);
+        assert_se(xopenat_lock(tfd, "abc", 0, 0, 0755, LOCK_POSIX, LOCK_EX) == -EBADF);
+        assert_se(xopenat_lock(tfd, "def", O_DIRECTORY, 0, 0755, LOCK_POSIX, LOCK_EX) == -EBADF);
 }
 
 static int intro(void) {
diff --git a/src/test/udev-rule-runner.c b/src/test/udev-rule-runner.c
index 0b5938802a..f7ba143325 100644
--- a/src/test/udev-rule-runner.c
+++ b/src/test/udev-rule-runner.c
@@ -117,7 +117,7 @@ static int run(int argc, char *argv[]) {
 
         log_debug("version %s", GIT_VERSION);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 
diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
index ad483301ef..ad1d492d6b 100644
--- a/src/timedate/timedated.c
+++ b/src/timedate/timedated.c
@@ -392,7 +392,7 @@ static int context_write_data_local_rtc(Context *c) {
                 }
         }
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 
diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
index e16f26d8d5..1cb8f06b3e 100644
--- a/src/tmpfiles/tmpfiles.c
+++ b/src/tmpfiles/tmpfiles.c
@@ -41,7 +41,7 @@
 #include "glob-util.h"
 #include "hexdecoct.h"
 #include "io-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "log.h"
 #include "macro.h"
 #include "main-func.h"
@@ -800,7 +800,11 @@ static int dir_cleanup(
                                            cutoff_nsec, sub_path, age_by_file, false))
                                 continue;
 
-                        fd = xopenat(dirfd(d), de->d_name, O_RDONLY|O_CLOEXEC|O_NOFOLLOW|O_NOATIME, 0);
+                        fd = xopenat(dirfd(d),
+                                     de->d_name,
+                                     O_RDONLY|O_CLOEXEC|O_NOFOLLOW|O_NOATIME,
+                                     /* xopen_flags = */ 0,
+                                     /* mode = */ 0);
                         if (fd < 0 && fd != -ENOENT)
                                 log_warning_errno(fd, "Opening file \"%s\" failed, ignoring: %m", sub_path);
                         if (fd >= 0 && flock(fd, LOCK_EX|LOCK_NB) < 0 && errno == EAGAIN) {
@@ -4326,7 +4330,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 
diff --git a/src/udev/udev-node.c b/src/udev/udev-node.c
index e49e959cd8..098e8ed0cc 100644
--- a/src/udev/udev-node.c
+++ b/src/udev/udev-node.c
@@ -15,7 +15,7 @@
 #include "format-util.h"
 #include "fs-util.h"
 #include "hexdecoct.h"
-#include "label.h"
+#include "label-util.h"
 #include "mkdir-label.h"
 #include "parse-util.h"
 #include "path-util.h"
diff --git a/src/udev/udevadm.c b/src/udev/udevadm.c
index b803f7bb0f..51dc041a29 100644
--- a/src/udev/udevadm.c
+++ b/src/udev/udevadm.c
@@ -130,7 +130,7 @@ static int run(int argc, char *argv[]) {
         if (r <= 0)
                 return r;
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 
diff --git a/src/udev/udevd.c b/src/udev/udevd.c
index b3aabcaa1f..cf00576cfb 100644
--- a/src/udev/udevd.c
+++ b/src/udev/udevd.c
@@ -2019,7 +2019,7 @@ int run_udevd(int argc, char *argv[]) {
         /* set umask before creating any file/directory */
         umask(022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 
diff --git a/src/update-done/update-done.c b/src/update-done/update-done.c
index 6518830717..f448b3b1d1 100644
--- a/src/update-done/update-done.c
+++ b/src/update-done/update-done.c
@@ -48,7 +48,7 @@ int main(int argc, char *argv[]) {
                 return EXIT_FAILURE;
         }
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return EXIT_FAILURE;
 
diff --git a/src/user-sessions/user-sessions.c b/src/user-sessions/user-sessions.c
index 37867ee3ed..58054f89fb 100644
--- a/src/user-sessions/user-sessions.c
+++ b/src/user-sessions/user-sessions.c
@@ -25,7 +25,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;