When fs.protected_regular=1 root cannot open temp files that are owned by other users read-write. So move os.chown after write. Refactoring suggested by Christian Heimes. Fixes: https://pagure.io/freeipa/issue/7906 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>