diff --git a/selinux/setfiles.c b/selinux/setfiles.c
index d567f83..8eb04e6 100644
--- a/selinux/setfiles.c
+++ b/selinux/setfiles.c
@@ -554,7 +554,7 @@
 	if ((applet_name[0] == 's') && (flags & OPT_c)) {
 		FILE *policystream;
 
-		policystream = xfopen(policyfile, "r");
+		policystream = xfopen_for_read(policyfile);
 		if (sepol_set_policydb_from_file(policystream) < 0) {
 			bb_error_msg_and_die("sepol_set_policydb_from_file on %s", policyfile);
 		}
@@ -575,7 +575,7 @@
 	if (flags & OPT_o) {
 		outfile = stdout;
 		if (NOT_LONE_CHAR(out_filename, '-')) {
-			outfile = xfopen(out_filename, "w");
+			outfile = xfopen_for_write(out_filename);
 		}
 	}
 	if (applet_name[0] == 'r') { /* restorecon */
@@ -620,7 +620,7 @@
 		FILE *f = stdin;
 
 		if (NOT_LONE_CHAR(input_filename, '-'))
-			f = xfopen(input_filename, "r");
+			f = xfopen_for_read(input_filename);
 		while ((len = getline(&buf, &buf_len, f)) > 0) {
 			buf[len - 1] = '\0';
 			errors |= process_one(buf);