This adds support for legacy initscript actions such as
  service iptables save

Packages wishing to provide legacy actions should install programs (probably
scripts, but could be binaries) named
  /usr/libexec/initscripts/legacy-actions/<service>/<action>

It should be emphasized that this feature is meant to be used only in packages
where compatibility of custom actions with previous releases is desired.
Adding of entirely new actions is discouraged. Useful tools should be
shipped by upstreams as programs in /usr/bin, not in distro-specific hacks.

[ Modifications from original : change from /usr/lib to /usr/libexec - notting ]

https://bugzilla.redhat.com/show_bug.cgi?id=796663

Writing /.autorelabel from fedora-autorelabel does not work because the
script is executed only if relabel was already requested.

Create a new unit fedora-autorelabel-mark.service which will be
responsible for creating /.autorelabel if SELinux is disabled.
The unit takes advantage of the new "ConditionSecurity=" support in
systemd.

The old script checked for a read-only filesystem first. The new unit
does not do that. If / is read-only, touch will simply fail. This should
not be considered as a failure of the unit, so "-" is used in ExecStart.

There have been arguments on systemd-devel that the root directory
should not be abused for flag files like /.autorelabel. It has a long
tradition in Fedora though (since 2005). Maybe we can change it
eventually, but let's keep it where it is for now.