engine: Fix up some send/recv corner cases

Initially I wasn't 100% clear or decided on the send/recv semantics.
After some experimenting, I think this is much closer to what we want.
Nothing should break or regress here, this only enables more
possibilities.

engine/util/util.go

@@ -37,6 +37,7 @@ import (
 	"encoding/base64"
 	"encoding/gob"
 	"fmt"
+	"io"
 	"os"
 	"os/user"
 	"reflect"
@@ -387,6 +388,83 @@ func GetGID(group string) (int, error) {
 	return -1, errwrap.Wrapf(err, "group lookup error (%s)", group)
 }
 
+// GetUIDGID is a small helper function to return the current uid and gid of the
+// user running this program. If invoked under `sudo` it works as expected to
+// return the root uid and gid.
+func GetUIDGID() (int, int, error) {
+	currentUser, err := user.Current()
+	if err != nil {
+		return -1, -1, err
+	}
+
+	uid, err := strconv.Atoi(currentUser.Uid)
+	if err != nil {
+		return -1, -1, err
+	}
+
+	gid, err := strconv.Atoi(currentUser.Gid)
+	if err != nil {
+		return -1, -1, err
+	}
+
+	return uid, gid, nil
+}
+
+// ReadData is a helper to read data, usually from our vardir directory. If the
+// data is nil, this means the file didn't exist.
+func ReadData(p string) (*string, error) {
+	file, err := os.Open(p) // open a handle to read the file
+	if os.IsNotExist(err) {
+		return nil, nil // no file
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+	data, err := io.ReadAll(file)
+	if err != nil {
+		return nil, err
+	}
+	s := string(data)
+	return &s, nil
+}
+
+// WriteData is a helper to write data, usually into our vardir directory. If
+// the data is nil, this counts as a request to delete the file.
+func WriteData(p string, data *string) (int, error) {
+	if data == nil {
+		err := os.Remove(p)
+		if os.IsNotExist(err) {
+			return 0, nil // no file
+		}
+		return -1, err
+	}
+
+	uid, gid, err := GetUIDGID()
+	if err != nil {
+		return -1, err
+	}
+
+	// Chmod it before we write the secret data.
+	file, err := os.OpenFile(p, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	//file, err := os.Create(p) // open a handle to create the file
+	if err != nil {
+		return -1, err
+	}
+	defer file.Close()
+
+	// Chown it before we write the secret data.
+	if err := file.Chown(uid, gid); err != nil {
+		return -1, err
+	}
+
+	c, err := file.Write([]byte(*data))
+	if err != nil {
+		return c, errwrap.Wrapf(err, "can't write file")
+	}
+	return c, file.Sync()
+}
+
 // RestartUnit restarts the given dbus unit and waits for it to finish starting.
 func RestartUnit(ctx context.Context, conn *dbus.Conn, unit string) error {
 	return unitStateAction(ctx, conn, unit, DBusRestartUnit)