clang-tidy: flag direct open(), openat() and creat() calls (#44603)

The tree opens files via the xopenat() family, but nothing stops new
code from calling open() directly, and the repart manifest code already
did so after the migration. Let's port the tests, fuzzers and the two remaining
direct calls in chase and repart to xopenat(), and then add open(), openat()
and creat() to bugprone-unsafe-functions so that clang-tidy reports new
direct calls.

The functions that implement xopenat() and fd_reopen(), the seccomp tests
and the O_EMPTYPATH probe in test-fd-util.c keep calling the syscalls
directly and suppress the check. openat2() can't be covered, since it's a
macro for openat2_shim() and the check ignores calls from macro expansions.

.clang-tidy

@@ -63,6 +63,9 @@ CheckOptions:
     ^ntohs$,be16toh(),is confusing;
     ^strerror$,STRERROR() or printf %m,is not thread-safe;
     ^accept$,accept4(),is not O_CLOEXEC-safe;
+    ^open$,xopenat(),does not set O_CLOEXEC by default;
+    ^openat$,xopenat(),does not set O_CLOEXEC by default;
+    ^creat$,xopenat(),is an obsolete relic that does not set O_CLOEXEC;
     ^dirname$,path_extract_directory(),is icky;
     ^basename$,path_extract_filename(),is icky;
     ^setmntent$,libmount_parse_fstab(),libmount parser should be used instead;

docs/CODING_STYLE.md

@@ -911,6 +911,10 @@ SPDX-License-Identifier: LGPL-2.1-or-later
   `execve()` the `O_CLOEXEC` bit must be cleared explicitly via
   `fd_cloexec(fd, false)` right before the `execve()`.
 
+- Open files with `xopenat()` or one of the other helpers above instead of
+  calling `open()`, `openat()` or `creat()` directly. This also applies to
+  tests. clang-tidy reports direct calls.
+
 - It's a good idea to use `O_NONBLOCK` when opening 'foreign' regular files,
   i.e.  file system objects that are supposed to be regular files whose paths
   were specified by the user and hence might actually refer to other types of

src/basic/chase.c

@@ -107,9 +107,9 @@ static int chase_openat2(int root_fd, int dir_fd, const char *path, ChaseFlags c
                 if (path_is_absolute(path))
                         dir_fd = AT_FDCWD;
                 else {
-                        dir_fd_local = open("/", O_CLOEXEC|O_DIRECTORY|O_PATH);
+                        dir_fd_local = xopenat(AT_FDCWD, "/", O_DIRECTORY|O_PATH);
                         if (dir_fd_local < 0)
-                                return -errno;
+                                return dir_fd_local;
                         dir_fd = dir_fd_local;
                 }
         }

src/basic/fd-util.c

@@ -783,6 +783,8 @@ finish:
         return r;
 }
 
+/* fd_reopen() calls open() and openat() directly. clang-tidy reports direct calls in all other code. */
+/* NOLINTBEGIN(bugprone-unsafe-functions) */
 int fd_reopen(int fd, int flags) {
         assert(wildcard_fd_is_valid(fd));
         assert(!FLAGS_SET(flags, O_CREAT));
@@ -854,6 +856,7 @@ int fd_reopen(int fd, int flags) {
 
         return new_fd;
 }
+/* NOLINTEND(bugprone-unsafe-functions) */
 
 static int fd_reopen_propagate_append_and_position(int fd, int flags) {
         /* Invokes fd_reopen(fd, flags), but propagates O_APPEND if set on original fd, and also tries to

src/basic/fs-util.c

@@ -1081,6 +1081,9 @@ int open_mkdir_at_full_label(int dirfd, const char *path, int flags, XOpenFlags
         return TAKE_FD(fd);
 }
 
+/* openat_report_new() and xopenat_full_label() call open() and openat() directly. clang-tidy reports
+ * direct calls in all other code. */
+/* NOLINTBEGIN(bugprone-unsafe-functions) */
 int openat_report_new(int dirfd, const char *pathname, int flags, mode_t mode, bool *ret_newly_created) {
         int fd, r;
 
@@ -1531,6 +1534,7 @@ error:
 
         return r;
 }
+/* NOLINTEND(bugprone-unsafe-functions) */
 
 int xopenat_lock_full_label(
                 int dir_fd,

src/fuzz/fuzz-decompress.c

@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "compress.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "fuzz.h"
 #include "memfd-util.h"
 #include "memory-util.h"
@@ -126,7 +127,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
                 if (n < 0)
                         return 0;
 
-                null_fd = open("/dev/null", O_WRONLY|O_CLOEXEC|O_NOCTTY);
+                null_fd = xopenat(AT_FDCWD, "/dev/null", O_WRONLY|O_NOCTTY);
                 if (null_fd < 0)
                         return 0;
 

src/import/test-qcow2.c

@@ -3,6 +3,7 @@
 #include <fcntl.h>
 
 #include "fd-util.h"
+#include "fs-util.h"
 #include "log.h"
 #include "qcow2-util.h"
 #include "tests.h"
@@ -18,15 +19,15 @@ int main(int argc, char *argv[]) {
                 return EXIT_FAILURE;
         }
 
-        sfd = open(argv[1], O_RDONLY|O_CLOEXEC|O_NOCTTY);
+        sfd = xopenat(AT_FDCWD, argv[1], O_RDONLY|O_NOCTTY);
         if (sfd < 0) {
-                log_error_errno(errno, "Can't open source file: %m");
+                log_error_errno(sfd, "Can't open source file: %m");
                 return EXIT_FAILURE;
         }
 
-        dfd = open(argv[2], O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY, 0666);
+        dfd = xopenat_full(AT_FDCWD, argv[2], O_WRONLY|O_CREAT|O_NOCTTY, /* xopen_flags= */ 0, 0666);
         if (dfd < 0) {
-                log_error_errno(errno, "Can't open destination file: %m");
+                log_error_errno(dfd, "Can't open destination file: %m");
                 return EXIT_FAILURE;
         }
 

src/import/test-tar.c

@@ -4,6 +4,7 @@
 
 #include "errno-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "libarchive-util.h"
 #include "main-func.h"
 #include "tar-util.h"
@@ -31,7 +32,7 @@ static int run(int argc, char **argv) {
                 return r;
 
         int flags = create ? O_CREAT | O_WRONLY | O_TRUNC : O_RDONLY;
-        _cleanup_close_ int fd1 = RET_NERRNO(open(argv[2], flags | O_CLOEXEC, 0666));
+        _cleanup_close_ int fd1 = xopenat_full(AT_FDCWD, argv[2], flags, /* xopen_flags= */ 0, 0666);
         if (fd1 < 0)
                 return log_error_errno(fd1, "Cannot open %s: %m", argv[2]);
 
@@ -41,7 +42,7 @@ static int run(int argc, char **argv) {
                         return log_error_errno(r, "Failed to mkdir %s: %m", argv[3]);
         }
 
-        _cleanup_close_ int fd2 = RET_NERRNO(open(argv[3], O_DIRECTORY | O_CLOEXEC));
+        _cleanup_close_ int fd2 = xopenat(AT_FDCWD, argv[3], O_DIRECTORY);
         if (fd2 < 0)
                 return log_error_errno(fd2, "Cannot open %s: %m", argv[3]);
 

src/libsystemd/sd-future/test-fiber-io.c

@@ -12,6 +12,7 @@
 
 #include "alloc-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "terminal-util.h"
 #include "tests.h"
 #include "time-util.h"
@@ -433,7 +434,7 @@ TEST(fiber_io_pty) {
         if (master < 0)
                 return (void) log_tests_skipped_errno(master, "Failed to allocate a pty");
 
-        _cleanup_close_ int slave = ASSERT_OK_ERRNO(open(peer, O_RDWR|O_NOCTTY|O_CLOEXEC));
+        _cleanup_close_ int slave = ASSERT_OK(xopenat(AT_FDCWD, peer, O_RDWR|O_NOCTTY));
 
         struct termios t;
         ASSERT_OK_ERRNO(tcgetattr(slave, &t));
@@ -979,8 +980,8 @@ TEST(fiber_io_sendmsg_recvmsg_fd) {
         ASSERT_OK_ERRNO(socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC | SOCK_NONBLOCK, 0, sockfd));
 
         /* Create a test file descriptor to send */
-        _cleanup_close_ int test_fd = open("/dev/null", O_RDONLY | O_CLOEXEC);
-        ASSERT_OK_ERRNO(test_fd);
+        _cleanup_close_ int test_fd = xopenat(AT_FDCWD, "/dev/null", O_RDONLY);
+        ASSERT_OK(test_fd);
 
         _cleanup_(sd_future_unrefp) sd_future *fs = NULL, *fr = NULL;
         int args[2] = { sockfd[0], test_fd };

src/libsystemd/sd-hwdb/test-sd-hwdb.c

@@ -7,6 +7,7 @@
 
 #include "errno-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "hwdb-internal.h"
 #include "nulstr-util.h"
 #include "path-util.h"
@@ -84,7 +85,7 @@ static sd_hwdb* hwdb_new_from_blob(const void *data, size_t size) {
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &tmp));
         _cleanup_free_ char *path = ASSERT_NOT_NULL(path_join(tmp, "hwdb.bin"));
 
-        fd = ASSERT_OK_ERRNO(open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_TRUNC, 0644));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, path, O_WRONLY|O_CREAT|O_TRUNC, /* xopen_flags= */ 0, 0644));
         ASSERT_OK_EQ_ERRNO(write(fd, data, size), (ssize_t) size);
         fd = safe_close(fd);
 

src/libsystemd/sd-journal/test-journal-benchmark.c

@@ -24,6 +24,7 @@
 #include "fileio.h"
 #include "format-table.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "hash-funcs.h"
 #include "hashmap.h"
 #include "io-util.h"
@@ -661,9 +662,9 @@ static int foreach_journal_file(const char *path, file_callback_t callback, void
                 if (!endswith(de->d_name, ".journal"))
                         continue;
 
-                fd = openat(dirfd(d), de->d_name, O_RDONLY|O_CLOEXEC|O_NOFOLLOW);
+                fd = xopenat(dirfd(d), de->d_name, O_RDONLY|O_NOFOLLOW);
                 if (fd < 0)
-                        return log_error_errno(errno, "Failed to open %s/%s: %m", path, de->d_name);
+                        return log_error_errno(fd, "Failed to open %s/%s: %m", path, de->d_name);
 
                 if (fstat(fd, &st) < 0)
                         return log_error_errno(errno, "Failed to stat %s/%s: %m", path, de->d_name);

src/libsystemd/sd-journal/test-journal-flush.c

@@ -10,6 +10,7 @@
 #include "chattr-util.h"
 #include "dirent-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "journal-file-util.h"
 #include "journal-internal.h"
 #include "logs-show.h"
@@ -70,9 +71,9 @@ static int open_archive_file(sd_journal **ret) {
                 if (newest_realtime >= realtime)
                         continue;
 
-                fd = openat(dirfd(d), de->d_name, O_CLOEXEC | O_NONBLOCK | O_RDONLY);
+                fd = xopenat(dirfd(d), de->d_name, O_NONBLOCK | O_RDONLY);
                 if (fd < 0) {
-                        log_info_errno(errno, "Failed to open /var/log/journal/%s, ignoring: %m", de->d_name);
+                        log_info_errno(fd, "Failed to open /var/log/journal/%s, ignoring: %m", de->d_name);
                         continue;
                 }
 

src/libsystemd/sd-journal/test-journal-interleaving.c

@@ -18,6 +18,7 @@
 #include "chattr-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "hashmap.h"
 #include "iovec-util.h"
 #include "journal-file-util.h"
@@ -490,7 +491,7 @@ static void test_remove_unlinked_selected_file_one(bool truncate, bool refresh_s
                 sigbus_install();
 
         /* Keep the file open and mapped while the name goes away, like vacuuming does. */
-        fd = ASSERT_OK_ERRNO(open("two.journal", O_WRONLY|O_CLOEXEC));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "two.journal", O_WRONLY));
         ASSERT_OK_ERRNO(unlink("two.journal"));
 
         if (truncate) {
@@ -567,7 +568,7 @@ TEST(keep_linked_selected_file_error) {
         f = ASSERT_NOT_NULL(ordered_hashmap_get(j->files, strjoina(t, "/two.journal")));
         ASSERT_EQ((int) f->location_type, LOCATION_SEEK);
 
-        fd = ASSERT_OK_ERRNO(open("two.journal", O_WRONLY|O_CLOEXEC));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "two.journal", O_WRONLY));
         ASSERT_OK_EQ_ERRNO(pwrite(fd, &type, sizeof(type), f->current_offset), (ssize_t) sizeof(type));
         ASSERT_OK_ERRNO(fsync(fd));
 
@@ -869,8 +870,8 @@ TEST(open_and_follow_edge_cases) {
         sd_journal_close(j);
         j = NULL;
 
-        directory_fd = open(t, O_RDONLY|O_DIRECTORY|O_CLOEXEC);
-        ASSERT_OK_ERRNO(directory_fd);
+        directory_fd = xopenat(AT_FDCWD, t, O_RDONLY|O_DIRECTORY);
+        ASSERT_OK(directory_fd);
         owned_directory_fd = directory_fd;
         ASSERT_OK(sd_journal_open_directory_fd(
                         &j,
@@ -886,8 +887,8 @@ TEST(open_and_follow_edge_cases) {
         ASSERT_OK_ERRNO(rmdir(t));
         ASSERT_OK_ERRNO(rename(renamed, t));
 
-        failure_fd = open(one, O_RDONLY|O_CLOEXEC|O_NONBLOCK);
-        ASSERT_OK_ERRNO(failure_fd);
+        failure_fd = xopenat(AT_FDCWD, one, O_RDONLY|O_NONBLOCK);
+        ASSERT_OK(failure_fd);
         int failure_fds[] = { failure_fd, -EBADF };
         ASSERT_ERROR(sd_journal_open_files_fd(
                              &j,
@@ -898,11 +899,11 @@ TEST(open_and_follow_edge_cases) {
         ASSERT_OK_ERRNO(fcntl(failure_fd, F_GETFD));
 
         int fds[] = {
-                open(one, O_RDONLY|O_CLOEXEC|O_NONBLOCK),
-                open(two, O_RDONLY|O_CLOEXEC|O_NONBLOCK),
+                xopenat(AT_FDCWD, one, O_RDONLY|O_NONBLOCK),
+                xopenat(AT_FDCWD, two, O_RDONLY|O_NONBLOCK),
         };
-        ASSERT_OK_ERRNO(fds[0]);
-        ASSERT_OK_ERRNO(fds[1]);
+        ASSERT_OK(fds[0]);
+        ASSERT_OK(fds[1]);
         ASSERT_OK_ERRNO(rename(one, moved));
         ASSERT_OK(sd_journal_open_files_fd(&j, fds, ELEMENTSOF(fds), SD_JOURNAL_ASSUME_IMMUTABLE));
         ASSERT_OK_ERRNO(unlink(moved));

src/libsystemd/sd-journal/test-journal-verify.c

@@ -8,6 +8,7 @@
 #include "ansi-color.h"
 #include "chattr-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "iovec-util.h"
 #include "journal-authenticate.h"
 #include "journal-file-util.h"
@@ -26,7 +27,7 @@ static void bit_toggle(const char *fn, uint64_t p) {
         uint8_t b;
         int fd;
 
-        ASSERT_OK_ERRNO(fd = open(fn, O_RDWR|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, fn, O_RDWR));
 
         ASSERT_EQ(pread(fd, &b, 1, p/8), 1);
 
@@ -242,7 +243,7 @@ static void test_hash_chain_cycle(void) {
         /* Point the second data object of the chain back at the head. Looking up the second data object,
          * which verifying the entry that references it does, would then run into the cycle. */
         back = htole64(head);
-        ASSERT_OK_ERRNO(fd = open("test.journal", O_RDWR|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "test.journal", O_RDWR));
         ASSERT_EQ(pwrite(fd, &back, sizeof(back), tail + offsetof(Object, data.next_hash_offset)),
                   (ssize_t) sizeof(back));
         safe_close(fd);
@@ -347,7 +348,7 @@ static void test_entry_reference_one(bool in_data_object) {
         ASSERT_NE(slot, 0u);
         (void) journal_file_offline_close(f);
 
-        ASSERT_OK_ERRNO(fd = open("test.journal", O_RDWR|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "test.journal", O_RDWR));
         if (in_data_object) {
                 /* Give the data object one more reference, to something that is not an entry object. All
                  * existing references stay intact, hence this is only noticed when the entries a data

src/libsystemd/sd-journal/test-journal.c

@@ -8,6 +8,7 @@
 #include "argv-util.h"
 #include "chattr-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "iovec-util.h"
 #include "journal-authenticate.h"
 #include "journal-file-util.h"
@@ -720,7 +721,7 @@ static void test_punch_holes_hash_chain_cycle_one(void) {
 
         /* Make the data object its own successor in the hash chain */
         self = htole64(p);
-        ASSERT_OK_ERRNO(fd = open("test.journal", O_RDWR|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "test.journal", O_RDWR));
         ASSERT_EQ(pwrite(fd, &self, sizeof(self), p + offsetof(Object, data.next_hash_offset)),
                   (ssize_t) sizeof(self));
         ASSERT_OK_ERRNO(close(fd));
@@ -782,7 +783,7 @@ static void test_enumerate_fields_hash_chain_cycle_one(void) {
 
         /* Make the field object its own successor in the hash chain */
         self = htole64(p);
-        ASSERT_OK_ERRNO(fd = open("test.journal", O_RDWR|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "test.journal", O_RDWR));
         ASSERT_EQ(pwrite(fd, &self, sizeof(self), p + offsetof(Object, field.next_hash_offset)),
                   (ssize_t) sizeof(self));
         ASSERT_OK_ERRNO(close(fd));
@@ -839,7 +840,7 @@ static void test_enumerate_unique_field_list_cycle_one(void) {
 
         /* Make the data object its own successor in the list of its field */
         self = htole64(p);
-        ASSERT_OK_ERRNO(fd = open("test.journal", O_RDWR|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "test.journal", O_RDWR));
         ASSERT_EQ(pwrite(fd, &self, sizeof(self), p + offsetof(Object, data.next_field_offset)),
                   (ssize_t) sizeof(self));
         ASSERT_OK_ERRNO(close(fd));

src/libsystemd/sd-json/test-json.c

@@ -13,6 +13,7 @@
 #include "fd-util.h"
 #include "format-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "in-addr-util.h"
 #include "io-util.h"
 #include "iovec-util.h"
@@ -1577,7 +1578,7 @@ TEST(fd_info) {
         ASSERT_OK(sd_json_variant_dump(v, SD_JSON_FORMAT_PRETTY_AUTO | SD_JSON_FORMAT_COLOR_AUTO, NULL, /* prefix= */ NULL));
         v = sd_json_variant_unref(v);
 
-        ASSERT_OK_ERRNO(fd = openat(AT_FDCWD, ".", O_CLOEXEC | O_DIRECTORY | O_PATH));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, ".", O_DIRECTORY | O_PATH));
         ASSERT_OK(json_variant_new_fd_info(&v, fd));
         ASSERT_OK(sd_json_variant_dump(v, SD_JSON_FORMAT_PRETTY_AUTO | SD_JSON_FORMAT_COLOR_AUTO, NULL, /* prefix= */ NULL));
         v = sd_json_variant_unref(v);
@@ -1590,7 +1591,7 @@ TEST(fd_info) {
         v = sd_json_variant_unref(v);
         fd = safe_close(fd);
 
-        fd = open("/sys/class/net/lo/uevent", O_CLOEXEC | O_PATH);
+        fd = xopenat(AT_FDCWD, "/sys/class/net/lo/uevent", O_PATH);
         if (fd >= 0) {
                 ASSERT_OK(json_variant_new_fd_info(&v, fd));
                 ASSERT_OK(sd_json_variant_dump(v, SD_JSON_FORMAT_PRETTY_AUTO | SD_JSON_FORMAT_COLOR_AUTO, NULL, /* prefix= */ NULL));
@@ -1599,7 +1600,7 @@ TEST(fd_info) {
         }
 
         /* block device */
-        fd = open("/dev/sda", O_CLOEXEC | O_PATH);
+        fd = xopenat(AT_FDCWD, "/dev/sda", O_PATH);
         if (fd >= 0) {
                 ASSERT_OK(json_variant_new_fd_info(&v, fd));
                 ASSERT_OK(sd_json_variant_dump(v, SD_JSON_FORMAT_PRETTY_AUTO | SD_JSON_FORMAT_COLOR_AUTO, NULL, /* prefix= */ NULL));

src/login/test-session-properties.c

@@ -16,6 +16,7 @@
 #include "bus-common-errors.h"
 #include "bus-locator.h"
 #include "device-util.h"
+#include "fs-util.h"
 #include "tests.h"
 #include "time-util.h"
 
@@ -113,7 +114,7 @@ TEST(set_tty) {
         if (!arg_tty)
                 return;
 
-        fd = ASSERT_OK_ERRNO(open(arg_tty, O_RDWR|O_CLOEXEC|O_NOCTTY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, arg_tty, O_RDWR|O_NOCTTY));
 
         ASSERT_OK(sd_bus_open_system(&bus));
 

src/nsresourced/test-userns-restrict.c

@@ -12,6 +12,7 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "namespace-util.h"
 #include "path-util.h"
 #include "pidref.h"
@@ -84,7 +85,7 @@ TEST(userns_restrict) {
          * permission error before we even get to the BPF-LSM. */
         ASSERT_OK_ERRNO(chown(t, CONTAINER_UID_MIN, CONTAINER_UID_MIN));
 
-        host_fd1 = ASSERT_OK_ERRNO(open(t, O_DIRECTORY|O_CLOEXEC));
+        host_fd1 = ASSERT_OK(xopenat(AT_FDCWD, t, O_DIRECTORY));
         host_tmpfs = ASSERT_OK(make_tmpfs_fsmount());
 
         _cleanup_free_ char *idmap = NULL;
@@ -106,18 +107,22 @@ TEST(userns_restrict) {
                 private_tmpfs = make_tmpfs_fsmount();
 
                 /* These two host mounts would record our transient UID on disk, hence are inaccessible */
-                ASSERT_ERROR_ERRNO(openat(host_fd1, "test", O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
-                ASSERT_ERROR_ERRNO(openat(host_tmpfs, "xxx", O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(host_fd1, "test", O_RDWR|O_CREAT,
+                                          /* xopen_flags= */ 0, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(host_tmpfs, "xxx", O_RDWR|O_CREAT,
+                                          /* xopen_flags= */ 0, 0666), EPERM);
                 ASSERT_ERROR_ERRNO(mkdirat(host_fd1, "test2", 0666), EPERM);
                 ASSERT_ERROR_ERRNO(mkdirat(host_tmpfs, "xxx2", 0666), EPERM);
 
                 /* But this mount created locally should be fine */
-                safe_close(ASSERT_OK_ERRNO(openat(private_tmpfs, "yyy", O_RDWR|O_CREAT|O_CLOEXEC, 0666)));
+                safe_close(ASSERT_OK(xopenat_full(private_tmpfs, "yyy", O_RDWR|O_CREAT,
+                                                  /* xopen_flags= */ 0, 0666)));
                 ASSERT_OK_ERRNO(mkdirat(private_tmpfs, "yyy2", 0666));
 
                 /* And so should the idmapped host mount: it translates our transient UID to UID 0 before
                  * anything reaches the disk */
-                safe_close(ASSERT_OK_ERRNO(openat(idmapped_tmpfs, "zzz", O_RDWR|O_CREAT|O_CLOEXEC, 0666)));
+                safe_close(ASSERT_OK(xopenat_full(idmapped_tmpfs, "zzz", O_RDWR|O_CREAT,
+                                                  /* xopen_flags= */ 0, 0666)));
                 ASSERT_OK_ERRNO(mkdirat(idmapped_tmpfs, "zzz2", 0666));
 
                 /* chown() is subject to the same policy. Unlike the creation hooks it is handed the ID that
@@ -144,10 +149,12 @@ TEST(userns_restrict) {
                 ASSERT_NOT_NULL(p1 = path_join(t, "newns"));
                 ASSERT_NOT_NULL(p2 = path_join(t, "newns2"));
 
-                ASSERT_ERROR_ERRNO(open(p1, O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(AT_FDCWD, p1, O_RDWR|O_CREAT, /* xopen_flags= */ 0, 0666), EPERM);
                 ASSERT_ERROR_ERRNO(mkdir(p2, 0666), EPERM);
-                ASSERT_ERROR_ERRNO(openat(host_fd1, "newns3", O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
-                ASSERT_ERROR_ERRNO(openat(host_tmpfs, "newns4", O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(host_fd1, "newns3", O_RDWR|O_CREAT,
+                                          /* xopen_flags= */ 0, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(host_tmpfs, "newns4", O_RDWR|O_CREAT,
+                                          /* xopen_flags= */ 0, 0666), EPERM);
 
                 /* And chown() through the clone must stay refused too, not just inode creation. */
                 ASSERT_ERROR_ERRNO(fchownat(AT_FDCWD, t, GID_INVALID, 0, 0), EPERM);
@@ -159,14 +166,18 @@ TEST(userns_restrict) {
                 ASSERT_NOT_NULL(p3 = path_join(t, "newuser"));
                 ASSERT_NOT_NULL(p4 = path_join(t, "newuser2"));
 
-                ASSERT_ERROR_ERRNO(open(p3, O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(AT_FDCWD, p3, O_RDWR|O_CREAT, /* xopen_flags= */ 0, 0666), EPERM);
                 ASSERT_ERROR_ERRNO(mkdir(p4, 0666), EPERM);
-                ASSERT_ERROR_ERRNO(openat(host_fd1, "newuser3", O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
-                ASSERT_ERROR_ERRNO(openat(host_tmpfs, "newuser4", O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(host_fd1, "newuser3", O_RDWR|O_CREAT,
+                                          /* xopen_flags= */ 0, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(host_tmpfs, "newuser4", O_RDWR|O_CREAT,
+                                          /* xopen_flags= */ 0, 0666), EPERM);
 
                 /* …while what was legitimately writable before stays writable */
-                safe_close(ASSERT_OK_ERRNO(openat(private_tmpfs, "aaa", O_RDWR|O_CREAT|O_CLOEXEC, 0666)));
-                safe_close(ASSERT_OK_ERRNO(openat(idmapped_tmpfs, "bbb", O_RDWR|O_CREAT|O_CLOEXEC, 0666)));
+                safe_close(ASSERT_OK(xopenat_full(private_tmpfs, "aaa", O_RDWR|O_CREAT,
+                                                  /* xopen_flags= */ 0, 0666)));
+                safe_close(ASSERT_OK(xopenat_full(idmapped_tmpfs, "bbb", O_RDWR|O_CREAT,
+                                                  /* xopen_flags= */ 0, 0666)));
 
                 _exit(EXIT_SUCCESS);
         }
@@ -295,7 +306,7 @@ TEST(userns_restrict_overlayfs) {
                 _cleanup_free_ char *f = NULL, *uf = NULL;
                 ASSERT_NOT_NULL(f = path_join(merged, "f"));
                 ASSERT_NOT_NULL(uf = path_join(upper, "f"));
-                safe_close(ASSERT_OK_ERRNO(open(f, O_RDWR|O_CREAT|O_CLOEXEC, 0666)));
+                safe_close(ASSERT_OK(xopenat_full(AT_FDCWD, f, O_RDWR|O_CREAT, /* xopen_flags= */ 0, 0666)));
                 ASSERT_OK_ERRNO(access(uf, F_OK));
                 ASSERT_OK_ERRNO(fchownat(AT_FDCWD, f, UID_INVALID, 0, 0));
 

src/repart/repart.c

@@ -7601,9 +7601,9 @@ static int partition_manifest_write(Context *context, Partition *p, const char *
 
         log_info("Generating manifest of %s filesystem.", p->format);
 
-        _cleanup_close_ int dir_fd = open(root, O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW);
+        _cleanup_close_ int dir_fd = xopenat(AT_FDCWD, root, O_DIRECTORY|O_NOFOLLOW);
         if (dir_fd < 0)
-                return log_error_errno(errno, "Failed to open populated tree '%s': %m", root);
+                return log_error_errno(dir_fd, "Failed to open populated tree '%s': %m", root);
 
         _cleanup_close_ int dup_fd = fcntl(p->manifest_fd, F_DUPFD_CLOEXEC, 3);
         if (dup_fd < 0)

src/test/test-async.c

@@ -52,7 +52,7 @@ TEST(asynchronous_close) {
 
                 ASSERT_OK(make_reaper_process(true));
 
-                fd = open("/dev/null", O_RDONLY|O_CLOEXEC);
+                fd = xopenat(AT_FDCWD, "/dev/null", O_RDONLY);
                 ASSERT_OK(fd);
                 asynchronous_close(fd);
                 wait_fd_closed(fd);

src/test/test-bpf-devices.c

@@ -39,14 +39,14 @@ static void test_policy_closed(const char *cgroup_path, BPFProgram **installed_p
                           "/dev/ptmx") {
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
-                wrong += fd < 0 && errno == EPERM;
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
+                wrong += fd == -EPERM;
                 /* We ignore errors other than EPERM, e.g. ENOENT or ENXIO */
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
-                wrong += fd2 < 0 && errno == EPERM;
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
+                wrong += fd2 == -EPERM;
         }
         ASSERT_EQ(wrong, 0U);
 }
@@ -77,12 +77,12 @@ static void test_policy_strict(const char *cgroup_path, BPFProgram **installed_p
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
                 const char *s = "/dev/null";
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd < 0;
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
                 wrong += fd2 < 0;
         }
 
@@ -90,12 +90,12 @@ static void test_policy_strict(const char *cgroup_path, BPFProgram **installed_p
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
                 const char *s = "/dev/random";
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd < 0;
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
                 wrong += fd2 >= 0;
         }
 
@@ -103,12 +103,12 @@ static void test_policy_strict(const char *cgroup_path, BPFProgram **installed_p
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
                 const char *s = "/dev/zero";
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd >= 0;
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
                 wrong += fd2 < 0;
         }
 
@@ -116,12 +116,12 @@ static void test_policy_strict(const char *cgroup_path, BPFProgram **installed_p
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
                 const char *s = "/dev/full";
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd >= 0;
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
                 wrong += fd2 >= 0;
         }
 
@@ -149,12 +149,12 @@ static void test_policy_allow_list_major(const char *pattern, const char *cgroup
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
                 const char *s = "/dev/null";
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd < 0;
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
                 wrong += fd2 < 0;
         }
 
@@ -162,12 +162,12 @@ static void test_policy_allow_list_major(const char *pattern, const char *cgroup
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
                 const char *s = "/dev/full";
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd < 0;
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
                 wrong += fd2 < 0;
         }
 
@@ -175,12 +175,12 @@ static void test_policy_allow_list_major(const char *pattern, const char *cgroup
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
                 const char *s = "/dev/tty";
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd >= 0;
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
                 wrong += fd2 >= 0;
         }
 
@@ -207,8 +207,8 @@ static void test_policy_allow_list_major_star(char type, const char *cgroup_path
                 _cleanup_close_ int fd = -EBADF;
                 const char *s = "/dev/null";
 
-                fd = open(s, O_CLOEXEC|O_RDWR|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDWR|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 if (type == 'c')
                         wrong += fd < 0;
                 else
@@ -239,8 +239,8 @@ static void test_policy_empty(bool add_mismatched, const char *cgroup_path, BPFP
                 _cleanup_close_ int fd = -EBADF;
                 const char *s = "/dev/null";
 
-                fd = open(s, O_CLOEXEC|O_RDWR|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDWR|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd >= 0;
         }
 

src/test/test-bpf-restrict-fsaccess.c

@@ -49,6 +49,7 @@
 #include "devnum-util.h"
 #include "errno-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "log.h"
 #include "memory-util.h"
 #include "pidref.h"
@@ -85,9 +86,9 @@ static int mmap_probe(const char *path, int prot, const char *what) {
         void *addr;
         int r;
 
-        fd = open(path, O_RDONLY | O_CLOEXEC);
+        fd = xopenat(AT_FDCWD, path, O_RDONLY);
         if (fd < 0) {
-                log_error_errno(errno, "Failed to open %s: %m", path);
+                log_error_errno(fd, "Failed to open %s: %m", path);
                 return PROBE_ERROR;
         }
 
@@ -109,9 +110,9 @@ static int mprotect_probe(const char *path, int prot, bool poke, int new_prot, c
         void *addr;
         int r;
 
-        fd = open(path, O_RDONLY | O_CLOEXEC);
+        fd = xopenat(AT_FDCWD, path, O_RDONLY);
         if (fd < 0) {
-                log_error_errno(errno, "Failed to open %s: %m", path);
+                log_error_errno(fd, "Failed to open %s: %m", path);
                 return PROBE_ERROR;
         }
 
@@ -192,9 +193,9 @@ static int do_procmem_cow(const char *path) {
         ssize_t n;
         int r;
 
-        fd = open(path, O_RDONLY | O_CLOEXEC);
+        fd = xopenat(AT_FDCWD, path, O_RDONLY);
         if (fd < 0) {
-                log_error_errno(errno, "Failed to open %s: %m", path);
+                log_error_errno(fd, "Failed to open %s: %m", path);
                 return PROBE_ERROR;
         }
 
@@ -204,11 +205,10 @@ static int do_procmem_cow(const char *path) {
                 return PROBE_ERROR;
         }
 
-        mem_fd = open("/proc/self/mem", O_RDWR | O_CLOEXEC);
+        mem_fd = xopenat(AT_FDCWD, "/proc/self/mem", O_RDWR);
         if (mem_fd < 0) {
-                r = -errno;
                 munmap_safe(addr, 4096);
-                log_error_errno(r, "Failed to open /proc/self/mem: %m");
+                log_error_errno(mem_fd, "Failed to open /proc/self/mem: %m");
                 return PROBE_ERROR;
         }
 
@@ -232,9 +232,9 @@ static int do_execve_check(const char *path) {
         _cleanup_close_ int fd = -EBADF;
         int r;
 
-        fd = open(path, O_RDONLY | O_CLOEXEC);
+        fd = xopenat(AT_FDCWD, path, O_RDONLY);
         if (fd < 0) {
-                log_error_errno(errno, "Failed to open %s: %m", path);
+                log_error_errno(fd, "Failed to open %s: %m", path);
                 return PROBE_ERROR;
         }
 

src/test/test-bpf-token.c

@@ -4,6 +4,7 @@
 
 #include "bpf-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "main-func.h"
 #include "tests.h"
 
@@ -15,9 +16,9 @@ static int run(int argc, char *argv[]) {
         if (r < 0)
                 return r;
 
-        _cleanup_close_ int bpffs_fd = open("/sys/fs/bpf", O_CLOEXEC|O_RDONLY);
+        _cleanup_close_ int bpffs_fd = xopenat(AT_FDCWD, "/sys/fs/bpf", O_RDONLY);
         if (bpffs_fd < 0)
-                return log_error_errno(errno, "Failed to open '/sys/fs/bpf': %m");
+                return log_error_errno(bpffs_fd, "Failed to open '/sys/fs/bpf': %m");
 
         _cleanup_close_ int token_fd = sym_bpf_token_create(bpffs_fd, /* opts= */ NULL);
         if (token_fd == -ENOSYS)

src/test/test-btrfs.c

@@ -224,7 +224,7 @@ TEST(physical_offset) {
                 _exit(EXIT_FAILURE);
         }
 
-        _cleanup_close_ int fd = ASSERT_OK_ERRNO(openat(dir_fd, "swapfile", O_RDONLY|O_CLOEXEC|O_NOCTTY));
+        _cleanup_close_ int fd = ASSERT_OK(xopenat(dir_fd, "swapfile", O_RDONLY|O_NOCTTY));
 
         unsigned attrs;
         ASSERT_OK(read_attr_fd(fd, &attrs));

src/test/test-chase.c

@@ -541,7 +541,7 @@ TEST(chaseat) {
 
         /* If the file descriptor points to the root directory, the result will be absolute. */
 
-        fd = open("/", O_CLOEXEC | O_DIRECTORY | O_PATH);
+        fd = xopenat(AT_FDCWD, "/", O_DIRECTORY | O_PATH);
         ASSERT_OK(fd);
 
         ASSERT_OK(chaseat(XAT_FDROOT, fd, p, /* flags= */ 0, &result, /* ret_fd= */ NULL));
@@ -627,7 +627,7 @@ TEST(chaseat) {
         fd = safe_close(fd);
 
         /* A plain file (no symlink indirection) should also work. */
-        fd = ASSERT_OK_ERRNO(openat(tfd, "cwd_test", O_CREAT|O_CLOEXEC, 0600));
+        fd = ASSERT_OK(xopenat_full(tfd, "cwd_test", O_CREAT, /* xopen_flags= */ 0, 0600));
         fd = safe_close(fd);
 
         ASSERT_OK(chaseat(XAT_FDROOT, AT_FDCWD, "cwd_test", /* flags= */ 0, &result, &fd));
@@ -658,7 +658,7 @@ TEST(chaseat) {
         /* Test that absolute path or not are the same when resolving relative to a directory file
          * descriptor and that we always get a relative path back. */
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "def", O_CREAT|O_CLOEXEC, 0700));
+        fd = ASSERT_OK(xopenat_full(tfd, "def", O_CREAT, /* xopen_flags= */ 0, 0700));
         fd = safe_close(fd);
         ASSERT_OK_ERRNO(symlinkat("/def", tfd, "qed"));
         ASSERT_OK(chaseat(tfd, tfd, "qed", /* flags= */ 0, &result, /* ret_fd= */ NULL));
@@ -940,12 +940,12 @@ TEST(chaseat_separate_root_and_dir) {
 
         /* Create a file at the root and a subdirectory containing another file. */
         ASSERT_OK_ERRNO(mkdirat(root_fd, "sub", 0755));
-        sub_fd = ASSERT_OK_ERRNO(openat(root_fd, "sub", O_CLOEXEC|O_DIRECTORY|O_PATH));
+        sub_fd = ASSERT_OK(xopenat(root_fd, "sub", O_DIRECTORY|O_PATH));
 
-        fd = ASSERT_OK_ERRNO(openat(root_fd, "outside", O_CREAT|O_CLOEXEC, 0600));
+        fd = ASSERT_OK(xopenat_full(root_fd, "outside", O_CREAT, /* xopen_flags= */ 0, 0600));
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(sub_fd, "inside", O_CREAT|O_CLOEXEC, 0600));
+        fd = ASSERT_OK(xopenat_full(sub_fd, "inside", O_CREAT, /* xopen_flags= */ 0, 0600));
         fd = safe_close(fd);
 
         /* Relative lookup from sub_fd under root_fd finds sub's own files. */
@@ -1106,8 +1106,8 @@ TEST(trailing_dot_dot_below_root) {
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &t));
         _cleanup_free_ char *sub = ASSERT_PTR(path_join(t, "a/b"));
         ASSERT_OK(mkdir_p(sub, 0700));
-        root_fd = ASSERT_OK_ERRNO(open(t, O_PATH|O_DIRECTORY|O_CLOEXEC));
-        a_fd = ASSERT_OK_ERRNO(openat(root_fd, "a", O_PATH|O_DIRECTORY|O_CLOEXEC));
+        root_fd = ASSERT_OK(xopenat(AT_FDCWD, t, O_PATH|O_DIRECTORY));
+        a_fd = ASSERT_OK(xopenat(root_fd, "a", O_PATH|O_DIRECTORY));
         ASSERT_OK_ERRNO(symlinkat("..", root_fd, "a/up"));
 
         /* The parent of the root directory is the root directory itself. */
@@ -1177,7 +1177,7 @@ TEST(chase_mode) {
 
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &t));
         ASSERT_OK_ERRNO(chmod(t, 0755));
-        ASSERT_OK_ERRNO(tfd = open(t, O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(tfd = xopenat(AT_FDCWD, t, O_PATH|O_DIRECTORY));
 
         ASSERT_NOT_NULL(a = path_join(t, "a"));
         ASSERT_NOT_NULL(b = path_join(t, "a/b"));
@@ -1268,8 +1268,8 @@ TEST(chase_mode) {
          * chaseat() doesn't open "a" in that case. */
         WITH_UMASK(0022)
                 ASSERT_OK(mkdir_p(c, 0755));
-        ASSERT_OK_ERRNO(bfd = open(b, O_PATH|O_DIRECTORY|O_CLOEXEC));
-        ASSERT_OK_ERRNO(cfd = open(c, O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(bfd = xopenat(AT_FDCWD, b, O_PATH|O_DIRECTORY));
+        ASSERT_OK(cfd = xopenat(AT_FDCWD, c, O_PATH|O_DIRECTORY));
         ASSERT_OK(chaseat(tfd, cfd, "..", CHASE_PARENT|CHASE_MAX_MODE, /* ret_path= */ NULL, /* ret_fd= */ NULL));
         ASSERT_OK_ERRNO(chmod(a, 0777));
         ASSERT_ERROR(chaseat(tfd, cfd, "..", CHASE_PARENT|CHASE_MAX_MODE, /* ret_path= */ NULL, /* ret_fd= */ NULL), ENOLINK);

src/test/test-compress.c

@@ -9,6 +9,7 @@
 #include "compress.h"
 #include "copy.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "io-util.h"
 #include "memfd-util.h"
 #include "path-util.h"
@@ -479,7 +480,7 @@ TEST(compress_decompress_stream) {
 
                 log_debug("/* testing %s stream compression */", compression_to_string(c));
 
-                ASSERT_OK(src = open(srcfile, O_RDONLY|O_CLOEXEC));
+                ASSERT_OK(src = xopenat(AT_FDCWD, srcfile, O_RDONLY));
                 ASSERT_OK(dst = mkostemp_safe(pattern));
 
                 ASSERT_OK(compress_stream(c, src, dst, -1, &uncompressed_size));

src/test/test-copy.c

@@ -314,7 +314,7 @@ TEST(copy_tree_at_symlink) {
         p = mfree(p);
         q = mfree(q);
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "from", O_CLOEXEC | O_PATH | O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(tfd, "from", O_PATH | O_NOFOLLOW));
         ASSERT_OK(copy_tree_at(fd, /* from= */ NULL, tfd, "to_3", UID_INVALID, GID_INVALID, /* copy_flags= */ 0, /* denylist= */ NULL, /* subvolumes= */ NULL));
         ASSERT_OK(readlinkat_malloc(tfd, "to_3", &p));
         ASSERT_STREQ(p, expect);
@@ -338,8 +338,8 @@ TEST(copy_tree_at_fds) {
         ASSERT_OK_ERRNO(mkdirat(tfd, "to", 0755));
 
         /* Both directories handed in as fds, as copy_tree_at_foreign() does */
-        ASSERT_OK_ERRNO(from_fd = openat(tfd, "from", O_RDONLY|O_DIRECTORY|O_CLOEXEC));
-        ASSERT_OK_ERRNO(to_fd = openat(tfd, "to", O_RDONLY|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(from_fd = xopenat(tfd, "from", O_RDONLY|O_DIRECTORY));
+        ASSERT_OK(to_fd = xopenat(tfd, "to", O_RDONLY|O_DIRECTORY));
         ASSERT_OK(copy_tree_at(from_fd, /* from= */ NULL, to_fd, /* to= */ NULL, UID_INVALID, GID_INVALID,
                                COPY_MERGE_EMPTY, /* denylist= */ NULL, /* subvolumes= */ NULL));
         ASSERT_OK(readlinkat_malloc(tfd, "to/link", &p));
@@ -414,11 +414,11 @@ TEST_RET(copy_bytes) {
         _cleanup_close_ int infd = -EBADF;
         char buf[1024], buf2[1024];
 
-        infd = open("/usr/lib/os-release", O_RDONLY|O_CLOEXEC);
+        infd = xopenat(AT_FDCWD, "/usr/lib/os-release", O_RDONLY);
         if (infd < 0)
-                infd = open("/etc/os-release", O_RDONLY|O_CLOEXEC);
+                infd = xopenat(AT_FDCWD, "/etc/os-release", O_RDONLY);
         if (infd < 0)
-                return log_tests_skipped_errno(errno, "Could not open /usr/lib/os-release or /etc/os-release: %m");
+                return log_tests_skipped_errno(infd, "Could not open /usr/lib/os-release or /etc/os-release: %m");
 
         ASSERT_OK_ZERO_ERRNO(pipe2(pipefd, O_CLOEXEC));
 
@@ -450,7 +450,7 @@ static void test_copy_bytes_regular_file_one(const char *src, uint64_t max_bytes
 
         log_info("%s max_bytes=%" PRIu64, __func__, max_bytes);
 
-        fd = ASSERT_OK_ERRNO(open(src, O_CLOEXEC | O_PATH));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, src, O_PATH));
 
         fd2 = ASSERT_OK(mkostemp_safe(fn2));
 
@@ -789,8 +789,8 @@ TEST_RET(copy_holes_with_gaps) {
         int r;
 
         tfd = ASSERT_OK(mkdtemp_open(/* template= */ NULL, /* flags= */ 0, &t));
-        fd = ASSERT_OK_ERRNO(openat(tfd, "src", O_CREAT | O_RDWR, 0600));
-        fd_copy = ASSERT_OK_ERRNO(openat(tfd, "dst", O_CREAT | O_WRONLY, 0600));
+        fd = ASSERT_OK(xopenat_full(tfd, "src", O_CREAT | O_RDWR, /* xopen_flags= */ 0, 0600));
+        fd_copy = ASSERT_OK(xopenat_full(tfd, "dst", O_CREAT | O_WRONLY, /* xopen_flags= */ 0, 0600));
 
         ASSERT_OK_ERRNO(fstat(fd, &st));
         blksz = st.st_blksize;
@@ -891,8 +891,8 @@ TEST(copy_verify_linked) {
 
         ASSERT_OK(write_string_file_at(tfd, "hoge", "bar bar", WRITE_STRING_FILE_CREATE));
 
-        fd_1 = ASSERT_OK_ERRNO(openat(tfd, "hoge", O_CLOEXEC | O_NOCTTY | O_RDONLY));
-        fd_2 = ASSERT_OK_ERRNO(openat(tfd, "hoge", O_CLOEXEC | O_NOCTTY | O_RDONLY));
+        fd_1 = ASSERT_OK(xopenat(tfd, "hoge", O_NOCTTY | O_RDONLY));
+        fd_2 = ASSERT_OK(xopenat(tfd, "hoge", O_NOCTTY | O_RDONLY));
         ASSERT_OK_ERRNO(unlinkat(tfd, "hoge", 0));
 
         ASSERT_OK(copy_file_at(fd_1, /* from= */ NULL, tfd, "to_1", /* open_flags= */ 0, 0644, /* copy_flags= */ 0));
@@ -904,7 +904,7 @@ TEST(copy_verify_linked) {
 
 static bool enable_fsverity(int dirfd, const char *name, int algo, const char *salt, size_t salt_size) {
         _cleanup_close_ int fd = -EBADF;
-        ASSERT_OK_ERRNO(fd = openat(dirfd, name, O_RDONLY | O_CLOEXEC | O_NOCTTY));
+        ASSERT_OK(fd = xopenat(dirfd, name, O_RDONLY | O_NOCTTY));
 
         struct fsverity_enable_arg enable_arg = {
                 .version = 1,
@@ -931,7 +931,7 @@ static struct fsverity_digest* alloc_fsverity_digest(size_t digest_size) {
 
 static bool measure_fsverity(int dirfd, const char *name, struct fsverity_digest *digest) {
         _cleanup_close_ int fd = -EBADF;
-        ASSERT_OK_ERRNO(fd = openat(dirfd, name, O_RDONLY | O_CLOEXEC | O_NOCTTY));
+        ASSERT_OK(fd = xopenat(dirfd, name, O_RDONLY | O_NOCTTY));
         if (ioctl(fd, FS_IOC_MEASURE_VERITY, digest) == 0)
                 return true;
 

src/test/test-coredump-util.c

@@ -7,6 +7,7 @@
 #include "fd-util.h"
 #include "fileio.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "tests.h"
 
 TEST(coredump_filter_to_from_string) {
@@ -134,7 +135,7 @@ TEST(parse_auxv) {
         _cleanup_close_ int dir_fd = -EBADF;
 
         ASSERT_OK(get_testdata_dir("auxv", &dir));
-        dir_fd = ASSERT_OK_ERRNO(open(dir, O_RDONLY | O_CLOEXEC | O_DIRECTORY | O_PATH));
+        dir_fd = ASSERT_OK(xopenat(AT_FDCWD, dir, O_RDONLY | O_DIRECTORY | O_PATH));
 
         if (__BYTE_ORDER == __LITTLE_ENDIAN) {
                 test_parse_auxv_one(ELFCLASS32, dir_fd, "resolved.arm32", /* expect_at_secure= */ 0, 193, 193, 193, 193);

src/test/test-data-fd-util.c

@@ -9,6 +9,7 @@
 #include "data-fd-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "io-util.h"
 #include "memfd-util.h"
 #include "pidref.h"
@@ -42,7 +43,7 @@ TEST(copy_data_fd) {
         _cleanup_(pidref_done_sigkill_wait) PidRef pidref = PIDREF_NULL;
         int r;
 
-        fd1 = open("/etc/fstab", O_RDONLY|O_CLOEXEC);
+        fd1 = xopenat(AT_FDCWD, "/etc/fstab", O_RDONLY);
         if (fd1 >= 0) {
 
                 fd2 = ASSERT_OK(copy_data_fd(fd1));

src/test/test-display-quota.c

@@ -4,6 +4,7 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "log.h"
 #include "main-func.h"
 #include "quota-util.h"
@@ -14,9 +15,9 @@
 static int show_quota(uid_t uid, const char *path) {
         int r;
 
-        _cleanup_close_ int fd = open(path, O_DIRECTORY|O_CLOEXEC);
+        _cleanup_close_ int fd = xopenat(AT_FDCWD, path, O_DIRECTORY);
         if (fd < 0)
-                return log_error_errno(errno, "Failed to open '%s': %m", path);
+                return log_error_errno(fd, "Failed to open '%s': %m", path);
 
         struct dqblk req;
         r = quotactl_fd_with_fallback(fd, QCMD_FIXED(Q_GETQUOTA, USRQUOTA), uid, &req);

src/test/test-dropin.c

@@ -7,6 +7,7 @@
 #include "dropin.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "mkdir.h"
 #include "path-util.h"
 #include "rm-rf.h"
@@ -37,11 +38,11 @@ TEST(unit_file_classify_dependency_entry) {
         _cleanup_close_ int root_fd = -EBADF, wants_fd = -EBADF;
 
         ASSERT_OK(mkdtemp_malloc("/tmp/test-dropin-XXXXXX", &root));
-        ASSERT_OK_ERRNO(root_fd = open(root, O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(root_fd = xopenat(AT_FDCWD, root, O_DIRECTORY));
 
         ASSERT_NOT_NULL(wants = path_join(root, "/etc/systemd/system/multi-user.target.wants"));
         ASSERT_OK(mkdir_p(wants, 0755));
-        ASSERT_OK_ERRNO(wants_fd = open(wants, O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(wants_fd = xopenat(AT_FDCWD, wants, O_DIRECTORY));
 
         ASSERT_OK(write_string_file_at(root_fd, "etc/systemd/system/foo.service", "[Unit]",
                                        WRITE_STRING_FILE_CREATE));
@@ -85,8 +86,8 @@ TEST(unit_file_find_dropin_entry) {
         ASSERT_NOT_NULL(low_wants = path_join(low, "multi-user.target.wants"));
         ASSERT_OK(mkdir_p(high_wants, 0755));
         ASSERT_OK(mkdir_p(low_wants, 0755));
-        ASSERT_OK_ERRNO(high_fd = open(high_wants, O_DIRECTORY|O_CLOEXEC));
-        ASSERT_OK_ERRNO(low_fd = open(low_wants, O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(high_fd = xopenat(AT_FDCWD, high_wants, O_DIRECTORY));
+        ASSERT_OK(low_fd = xopenat(AT_FDCWD, low_wants, O_DIRECTORY));
 
         ASSERT_OK_ERRNO(symlinkat("../foo.service", high_fd, "foo.service"));
         ASSERT_OK_ERRNO(symlinkat("../foo.service", low_fd, "foo.service"));

src/test/test-execve.c

@@ -2,6 +2,7 @@
 
 #include "exec-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "log.h"
 #include "main-func.h"
 #include "strv.h"
@@ -26,9 +27,9 @@ static int run(int argc, char **argv) {
 
         char **args = strv_skip(argv, 1) ?: STRV_MAKE("/bin/true");
 
-        _cleanup_close_ int fd = open(args[0], O_RDONLY | O_CLOEXEC);
+        _cleanup_close_ int fd = xopenat(AT_FDCWD, args[0], O_RDONLY);
         if (fd < 0)
-                return log_error_errno(errno, "open(%s) failed: %m", args[0]);
+                return log_error_errno(fd, "open(%s) failed: %m", args[0]);
 
         r = ASSERT_FAIL(fexecve_or_execve(fd, args[0], args, /* envp= */ NULL));
         return log_error_errno(r, "fexecve_or_execve(%s) failed: %m", args[0]);

src/test/test-fanotify-util.c

@@ -70,7 +70,7 @@ TEST(fanotify) {
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &t));
 
         _cleanup_(context_done) Context c = {
-                .mount_fd = ASSERT_OK_ERRNO(open(t, O_DIRECTORY | O_CLOEXEC)),
+                .mount_fd = ASSERT_OK(xopenat(AT_FDCWD, t, O_DIRECTORY)),
         };
         ASSERT_OK_ERRNO(fstatfs(c.mount_fd, &c.sfs));
 
@@ -114,7 +114,7 @@ TEST(fanotify) {
                 ASSERT_OK(set_ensure_consume(&c.stats, &inode_hash_ops, TAKE_PTR(st)));
 
                 /* Trigger a FAN_CLOSE_WRITE for this file. */
-                safe_close(ASSERT_OK_ERRNO(open(p, O_WRONLY | O_CLOEXEC)));
+                safe_close(ASSERT_OK(xopenat(AT_FDCWD, p, O_WRONLY)));
         }
 
         _cleanup_(sd_event_unrefp) sd_event *event = NULL;

src/test/test-fd-util.c

@@ -7,7 +7,6 @@
 
 #include "alloc-util.h"
 #include "capability-util.h"
-#include "errno-util.h"
 #include "fd-util.h"
 #include "fs-util.h"
 #include "memfd-util.h"
@@ -96,7 +95,7 @@ TEST(fd_validate) {
         ASSERT_ERROR(fd_validate(-EBADF), EBADF);
 
         _cleanup_close_ int b = -EBADF;
-        b = ASSERT_OK_ERRNO(open("/dev/null", O_RDONLY|O_CLOEXEC));
+        b = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
 
         ASSERT_OK_ZERO(fd_validate(b));
         safe_close(b);
@@ -110,9 +109,9 @@ TEST(same_fd) {
 
         ASSERT_OK_ERRNO(pipe2(p, O_CLOEXEC));
         a = ASSERT_OK_ERRNO(fcntl(p[0], F_DUPFD, 3));
-        b = ASSERT_OK_ERRNO(open("/bin/sh", O_RDONLY|O_CLOEXEC));
+        b = ASSERT_OK(xopenat(AT_FDCWD, "/bin/sh", O_RDONLY));
         c = ASSERT_OK_ERRNO(fcntl(a, F_DUPFD, 3));
-        d = ASSERT_OK_ERRNO(open("/bin/sh", O_RDONLY|O_CLOEXEC|O_PATH)); /* O_PATH changes error returns in F_DUPFD_QUERY, let's test explicitly */
+        d = ASSERT_OK(xopenat(AT_FDCWD, "/bin/sh", O_RDONLY|O_PATH)); /* O_PATH changes error returns in F_DUPFD_QUERY, let's test explicitly */
         e = ASSERT_OK_ERRNO(fcntl(d, F_DUPFD, 3));
 
         ASSERT_OK_POSITIVE(same_fd(p[0], p[0]));
@@ -182,7 +181,8 @@ TEST(fd_move_above_stdio) {
         ASSERT_GE(original_stdin, 3);
         ASSERT_OK(close_nointr(/* fd= */ 0));
 
-        new_fd = ASSERT_OK_ZERO_ERRNO(open("/dev/null", O_RDONLY));
+        new_fd = ASSERT_OK_ZERO(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
+        ASSERT_OK(fd_cloexec(new_fd, false));
 
         new_fd = fd_move_above_stdio(new_fd);
         ASSERT_GE(new_fd, 3);
@@ -244,7 +244,7 @@ TEST(rearrange_stdio) {
                 pipe_read_fd = fd_move_above_stdio(/* fd= */ 0);
                 ASSERT_GE(pipe_read_fd, 3);
 
-                ASSERT_OK_ZERO_ERRNO(open("/dev/full", O_WRONLY|O_CLOEXEC));
+                ASSERT_OK_ZERO(xopenat(AT_FDCWD, "/dev/full", O_WRONLY));
                 ASSERT_OK_EQ(memfd_new_and_seal_string("data", "foobar"), 2);
 
                 ASSERT_OK(rearrange_stdio(2, /* original_output_fd= */ 0, 1));
@@ -418,7 +418,7 @@ TEST(fd_reopen) {
         int fl;
 
         /* Test this with a directory */
-        fd1 = ASSERT_OK_ERRNO(open("/proc", O_DIRECTORY|O_PATH|O_CLOEXEC));
+        fd1 = ASSERT_OK(xopenat(AT_FDCWD, "/proc", O_DIRECTORY|O_PATH));
 
         ASSERT_OK_ERRNO(fstat(fd1, &st1));
         ASSERT_TRUE(S_ISDIR(st1.st_mode));
@@ -456,7 +456,7 @@ TEST(fd_reopen) {
         safe_close(fd1);
 
         /* And now, test this with a file. */
-        fd1 = ASSERT_OK_ERRNO(open("/proc/version", O_PATH|O_CLOEXEC));
+        fd1 = ASSERT_OK(xopenat(AT_FDCWD, "/proc/version", O_PATH));
 
         ASSERT_OK_ERRNO(fstat(fd1, &st1));
         ASSERT_TRUE(S_ISREG(st1.st_mode));
@@ -495,7 +495,7 @@ TEST(fd_reopen) {
         fd1 = -EBADF;
 
         /* Validate what happens if we reopen a symlink */
-        fd1 = ASSERT_OK_ERRNO(open("/proc/self", O_PATH|O_CLOEXEC|O_NOFOLLOW));
+        fd1 = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self", O_PATH|O_NOFOLLOW));
         ASSERT_OK_ERRNO(fstat(fd1, &st1));
         ASSERT_TRUE(S_ISLNK(st1.st_mode));
 
@@ -528,7 +528,7 @@ TEST(fd_dup_or_reopen_stdio_nonblock) {
         nfd = safe_close(nfd);
         fd = safe_close(fd);
 
-        ASSERT_OK_ERRNO(fd = open(path, O_WRONLY|O_APPEND|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, path, O_WRONLY|O_APPEND));
         ASSERT_OK(nfd = fd_dup_or_reopen_stdio_nonblock(fd, O_WRONLY));
         ASSERT_OK_ERRNO(fl = fcntl(nfd, F_GETFL));
         ASSERT_TRUE(FLAGS_SET(fl, O_APPEND));
@@ -536,7 +536,7 @@ TEST(fd_dup_or_reopen_stdio_nonblock) {
         fd = safe_close(fd);
 
         /* Reading ahead must not move the offset of the original fd */
-        ASSERT_OK_ERRNO(fd = open(path, O_RDONLY|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, path, O_RDONLY));
         ASSERT_OK_EQ_ERRNO(lseek(fd, 2, SEEK_SET), (off_t) 2);
         ASSERT_OK(nfd = fd_dup_or_reopen_stdio_nonblock(fd, O_RDONLY));
         ASSERT_OK_EQ_ERRNO(read(nfd, buf, sizeof(buf) - 1), (ssize_t) 3);
@@ -569,7 +569,7 @@ TEST(fd_reopen_condition) {
         int fd2, fl;
 
         /* Open without O_PATH */
-        fd1 = ASSERT_OK_ERRNO(open("/usr/", O_RDONLY|O_DIRECTORY|O_CLOEXEC));
+        fd1 = ASSERT_OK(xopenat(AT_FDCWD, "/usr/", O_RDONLY|O_DIRECTORY));
 
         fl = fcntl(fd1, F_GETFL);
         ASSERT_TRUE(FLAGS_SET(fl, O_DIRECTORY));
@@ -653,13 +653,13 @@ TEST(dir_fd_is_root) {
 
         ASSERT_OK_POSITIVE(dir_fd_is_root_or_cwd(AT_FDCWD));
 
-        fd = ASSERT_OK_ERRNO(open("/", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/", O_PATH|O_DIRECTORY|O_NOFOLLOW));
         ASSERT_OK_POSITIVE(dir_fd_is_root(fd));
         ASSERT_OK_POSITIVE(dir_fd_is_root_or_cwd(fd));
 
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(open("/usr", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/usr", O_PATH|O_DIRECTORY|O_NOFOLLOW));
         ASSERT_OK_EQ(dir_fd_is_root(fd), 0);
         ASSERT_OK_EQ(dir_fd_is_root_or_cwd(fd), 0);
 
@@ -678,19 +678,19 @@ TEST(dir_fd_is_root) {
 
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(open(tmp, O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, tmp, O_PATH|O_DIRECTORY|O_NOFOLLOW));
         ASSERT_OK_EQ(dir_fd_is_root(fd), 0);
         ASSERT_OK_EQ(dir_fd_is_root_or_cwd(fd), 0);
 
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(open(x, O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, x, O_PATH|O_DIRECTORY|O_NOFOLLOW));
         ASSERT_OK_EQ(dir_fd_is_root(fd), 0);
         ASSERT_OK_EQ(dir_fd_is_root_or_cwd(fd), 0);
 
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(open(y, O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, y, O_PATH|O_DIRECTORY|O_NOFOLLOW));
         ASSERT_OK_EQ(dir_fd_is_root(fd), 0);
         ASSERT_OK_EQ(dir_fd_is_root_or_cwd(fd), 0);
 }
@@ -711,7 +711,7 @@ static void test_path_is_root_at_one(bool expected) {
         ASSERT_OK_ZERO(path_is_root("/../../usr"));
 
         _cleanup_close_ int fd = -EBADF;
-        ASSERT_OK_ERRNO(fd = open("/", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "/", O_PATH|O_DIRECTORY|O_NOFOLLOW));
 
         ASSERT_OK_POSITIVE(path_is_root_at(fd, /* path= */ NULL));
         ASSERT_OK_POSITIVE(path_is_root_at(fd, ""));
@@ -736,7 +736,7 @@ static void test_path_is_root_at_one(bool expected) {
         ASSERT_OK_ZERO(path_is_root_at(fd, "/../../usr"));
 
         safe_close(fd);
-        ASSERT_OK_ERRNO(fd = open("/../", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "/../", O_PATH|O_DIRECTORY|O_NOFOLLOW));
 
         ASSERT_OK_EQ(path_is_root_at(fd, /* path= */ NULL), expected);
         ASSERT_OK_EQ(path_is_root_at(fd, ""), expected);
@@ -826,13 +826,13 @@ TEST(path_is_root_at) {
 TEST(fds_inode_and_mount_same) {
         _cleanup_close_ int fd1 = -EBADF, fd2 = -EBADF, fd3 = -EBADF, fd4 = -EBADF;
 
-        fd1 = open("/sys", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW);
-        fd2 = open("/proc", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW);
-        fd3 = open("/proc", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW);
-        fd4 = open("/", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW);
+        fd1 = xopenat(AT_FDCWD, "/sys", O_PATH|O_DIRECTORY|O_NOFOLLOW);
+        fd2 = xopenat(AT_FDCWD, "/proc", O_PATH|O_DIRECTORY|O_NOFOLLOW);
+        fd3 = xopenat(AT_FDCWD, "/proc", O_PATH|O_DIRECTORY|O_NOFOLLOW);
+        fd4 = xopenat(AT_FDCWD, "/", O_PATH|O_DIRECTORY|O_NOFOLLOW);
 
         if (fd1 < 0 || fd2 < 0 || fd3 < 0 || fd4 < 0)
-                return (void) log_tests_skipped_errno(errno, "Failed to open /sys or /proc or /");
+                return (void) log_tests_skipped("Failed to open /sys or /proc or /");
 
         ASSERT_OK_EQ(fds_inode_and_mount_same(fd1, fd2), 0);
         ASSERT_OK_POSITIVE(fds_inode_and_mount_same(fd2, fd3));
@@ -863,21 +863,21 @@ TEST(fd_get_path) {
         ASSERT_OK_ERRNO(symlinkat("../regular", tfd, "subdir/symlink"));
         ASSERT_OK_ERRNO(symlinkat("subdir", tfd, "symdir"));
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "regular", O_CLOEXEC|O_PATH));
+        fd = ASSERT_OK(xopenat(tfd, "regular", O_PATH));
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
 
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(AT_FDCWD, "regular", O_CLOEXEC|O_PATH));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "regular", O_PATH));
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
 
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "subdir/symlink", O_CLOEXEC|O_PATH));
+        fd = ASSERT_OK(xopenat(tfd, "subdir/symlink", O_PATH));
         ASSERT_OK(fd_verify_regular(fd));
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -885,7 +885,7 @@ TEST(fd_get_path) {
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(AT_FDCWD, "subdir/symlink", O_CLOEXEC|O_PATH));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "subdir/symlink", O_PATH));
         ASSERT_OK(fd_verify_regular(fd));
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -893,7 +893,7 @@ TEST(fd_get_path) {
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "symdir//./symlink", O_CLOEXEC|O_PATH));
+        fd = ASSERT_OK(xopenat(tfd, "symdir//./symlink", O_PATH));
         ASSERT_OK(fd_verify_regular(fd));
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -901,7 +901,7 @@ TEST(fd_get_path) {
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(AT_FDCWD, "symdir//./symlink", O_CLOEXEC|O_PATH));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "symdir//./symlink", O_PATH));
         ASSERT_OK(fd_verify_regular(fd));
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -911,7 +911,7 @@ TEST(fd_get_path) {
         fd = safe_close(fd);
 
         ASSERT_NOT_NULL(q = path_join(t, "subdir/symlink"));
-        fd = ASSERT_OK_ERRNO(openat(tfd, "subdir/symlink", O_CLOEXEC|O_PATH|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(tfd, "subdir/symlink", O_PATH|O_NOFOLLOW));
         ASSERT_ERROR(fd_verify_regular(fd), ELOOP);
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -919,7 +919,7 @@ TEST(fd_get_path) {
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(AT_FDCWD, "subdir/symlink", O_CLOEXEC|O_PATH|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "subdir/symlink", O_PATH|O_NOFOLLOW));
         ASSERT_ERROR(fd_verify_regular(fd), ELOOP);
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -927,7 +927,7 @@ TEST(fd_get_path) {
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "symdir//./symlink", O_CLOEXEC|O_PATH|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(tfd, "symdir//./symlink", O_PATH|O_NOFOLLOW));
         ASSERT_ERROR(fd_verify_regular(fd), ELOOP);
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -935,7 +935,7 @@ TEST(fd_get_path) {
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(AT_FDCWD, "symdir//./symlink", O_CLOEXEC|O_PATH|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "symdir//./symlink", O_PATH|O_NOFOLLOW));
         ASSERT_ERROR(fd_verify_regular(fd), ELOOP);
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -952,17 +952,17 @@ TEST(fd_vet_accmode) {
         ASSERT_OK_ZERO(fd_vet_accmode(fd_rw, O_WRONLY));
         ASSERT_OK_POSITIVE(fd_vet_accmode(fd_rw, O_RDWR));
 
-        ASSERT_OK_ERRNO(fd_ro = open(name, O_RDONLY | O_CLOEXEC));
+        ASSERT_OK(fd_ro = xopenat(AT_FDCWD, name, O_RDONLY));
         ASSERT_OK_POSITIVE(fd_vet_accmode(fd_ro, O_RDONLY));
         ASSERT_ERROR(fd_vet_accmode(fd_ro, O_WRONLY), EPROTOTYPE);
         ASSERT_ERROR(fd_vet_accmode(fd_ro, O_RDWR), EPROTOTYPE);
 
-        ASSERT_OK_ERRNO(fd_wo = open(name, O_WRONLY | O_CLOEXEC));
+        ASSERT_OK(fd_wo = xopenat(AT_FDCWD, name, O_WRONLY));
         ASSERT_ERROR(fd_vet_accmode(fd_wo, O_RDONLY), EPROTOTYPE);
         ASSERT_OK_POSITIVE(fd_vet_accmode(fd_wo, O_WRONLY));
         ASSERT_ERROR(fd_vet_accmode(fd_wo, O_RDWR), EPROTOTYPE);
 
-        ASSERT_OK_ERRNO(fd_opath = open(name, O_PATH | O_CLOEXEC));
+        ASSERT_OK(fd_opath = xopenat(AT_FDCWD, name, O_PATH));
         ASSERT_ERROR(fd_vet_accmode(fd_opath, O_RDONLY), EBADFD);
         ASSERT_ERROR(fd_vet_accmode(fd_opath, O_WRONLY), EBADFD);
         ASSERT_ERROR(fd_vet_accmode(fd_opath, O_RDWR), EBADFD);
@@ -975,13 +975,13 @@ TEST(fd_is_writable) {
         ASSERT_OK(fd_rw = mkostemp_safe(name));
         ASSERT_OK_POSITIVE(fd_is_writable(fd_rw));
 
-        ASSERT_OK(fd_ro = open(name, O_RDONLY | O_CLOEXEC));
+        ASSERT_OK(fd_ro = xopenat(AT_FDCWD, name, O_RDONLY));
         ASSERT_OK_ZERO(fd_is_writable(fd_ro));
 
-        ASSERT_OK(fd_wo = open(name, O_WRONLY | O_CLOEXEC));
+        ASSERT_OK(fd_wo = xopenat(AT_FDCWD, name, O_WRONLY));
         ASSERT_OK_POSITIVE(fd_is_writable(fd_wo));
 
-        ASSERT_OK(fd_path = open(name, O_PATH | O_CLOEXEC));
+        ASSERT_OK(fd_path = xopenat(AT_FDCWD, name, O_PATH));
         ASSERT_OK_ZERO(fd_is_writable(fd_path));
 
         ASSERT_SIGNAL(fd_is_writable(-1), SIGABRT);
@@ -997,8 +997,9 @@ TEST(fd_reopen_emptypath) {
 
         ASSERT_OK(tfd = mkdtemp_open(/* template= */ NULL, /* flags= */ 0, &t));
 
-        /* Older kernels ignore the flag and miss the empty path */
-        fd = openat(tfd, "", O_PATH|O_CLOEXEC|O_EMPTYPATH);
+        /* Older kernels ignore the flag and miss the empty path. xopenat() returns -ENOENT for an empty path
+         * without calling openat(), so the probe calls openat() directly. */
+        fd = openat(tfd, "", O_PATH|O_CLOEXEC|O_EMPTYPATH); /* NOLINT(bugprone-unsafe-functions) */
         if (fd < 0 && errno == ENOENT)
                 return (void) log_tests_skipped("kernel lacks O_EMPTYPATH");
         ASSERT_OK_ERRNO(fd);
@@ -1009,8 +1010,8 @@ TEST(fd_reopen_emptypath) {
 
         /* A directory we may read but not search: "." cannot be looked up in it, O_EMPTYPATH needs no lookup */
         ASSERT_OK_ERRNO(mkdirat(tfd, "noexec", 0400));
-        ASSERT_OK_ERRNO(dfd = openat(tfd, "noexec", O_PATH|O_DIRECTORY|O_CLOEXEC));
-        ASSERT_ERROR(RET_NERRNO(openat(dfd, ".", O_RDONLY|O_DIRECTORY|O_CLOEXEC)), EACCES);
+        ASSERT_OK(dfd = xopenat(tfd, "noexec", O_PATH|O_DIRECTORY));
+        ASSERT_ERROR(xopenat(dfd, ".", O_RDONLY|O_DIRECTORY), EACCES);
 
         ASSERT_OK(fd = fd_reopen(dfd, O_RDONLY|O_DIRECTORY));
         ASSERT_OK_POSITIVE(inode_same_at(dfd, /* filea= */ NULL, fd, /* fileb= */ NULL, AT_EMPTY_PATH));
@@ -1020,7 +1021,7 @@ TEST(fd_reopen_cloexec) {
         _cleanup_close_ int fd = -EBADF, reopened = -EBADF;
         int fl;
 
-        ASSERT_OK_ERRNO(fd = open("/proc", O_DIRECTORY|O_PATH|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "/proc", O_DIRECTORY|O_PATH));
 
         /* O_CLOEXEC is implied, whether requested or not */
         ASSERT_OK(reopened = fd_reopen(fd, O_RDONLY|O_DIRECTORY));

src/test/test-fdset.c

@@ -4,6 +4,7 @@
 
 #include "fd-util.h"
 #include "fdset.h"
+#include "fs-util.h"
 #include "tests.h"
 #include "tmpfile-util.h"
 
@@ -14,14 +15,14 @@ TEST(fdset_new_fill) {
         log_close();
         log_set_open_when_needed(true);
 
-        fd = ASSERT_OK_ERRNO(open("/dev/null", O_CLOEXEC|O_RDONLY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
 
         ASSERT_OK(fdset_new_fill(/* filter_cloexec= */ -1, &fdset));
         ASSERT_TRUE(fdset_contains(fdset, fd));
         fdset = fdset_free(fdset);
         ASSERT_ERROR(fd_validate(fd), EBADF);
 
-        fd = ASSERT_OK_ERRNO(open("/dev/null", O_CLOEXEC|O_RDONLY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
 
         ASSERT_OK(fdset_new_fill(/* filter_cloexec= */ 0, &fdset));
         ASSERT_FALSE(fdset_contains(fdset, fd));
@@ -33,7 +34,8 @@ TEST(fdset_new_fill) {
         fdset = fdset_free(fdset);
         ASSERT_ERROR(fd_validate(fd), EBADF);
 
-        fd = ASSERT_OK_ERRNO(open("/dev/null", O_RDONLY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
+        ASSERT_OK(fd_cloexec(fd, false));
 
         ASSERT_OK(fdset_new_fill(/* filter_cloexec= */ 1, &fdset));
         ASSERT_FALSE(fdset_contains(fdset, fd));

src/test/test-fiemap.c

@@ -7,6 +7,7 @@
 
 #include "argv-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "hibernate-util.h"
 #include "log.h"
 #include "tests.h"
@@ -18,9 +19,9 @@ static int test_fiemap_one(const char *path) {
 
         log_info("/* %s */", __func__);
 
-        fd = open(path, O_RDONLY | O_CLOEXEC | O_NONBLOCK);
+        fd = xopenat(AT_FDCWD, path, O_RDONLY | O_NONBLOCK);
         if (fd < 0)
-                return log_error_errno(errno, "failed to open %s: %m", path);
+                return log_error_errno(fd, "failed to open %s: %m", path);
         r = read_fiemap(fd, &fiemap);
         if (r == -EOPNOTSUPP)
                 exit(log_tests_skipped("Not supported"));

src/test/test-fileio.c

@@ -610,7 +610,7 @@ TEST(read_full_file_full) {
 
         /* A NULL filename reads the file the fd refers to */
         _cleanup_close_ int fd = -EBADF;
-        ASSERT_OK_ERRNO(fd = open(fn, O_RDONLY|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, fn, O_RDONLY));
         ASSERT_OK(read_full_file_at(fd, /* filename= */ NULL, &rbuf, &rbuf_size));
         ASSERT_EQ(rbuf_size, sizeof(buf));
         ASSERT_EQ(memcmp(buf, rbuf, rbuf_size), 0);
@@ -624,7 +624,7 @@ TEST(xfopenat_empty_path) {
 
         ASSERT_OK(tfd = mkdtemp_open(NULL, 0, &t));
         ASSERT_OK(write_string_file_at(tfd, "file", "hello", WRITE_STRING_FILE_CREATE));
-        ASSERT_OK_ERRNO(fd = openat(tfd, "file", O_RDONLY|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(tfd, "file", O_RDONLY));
 
         /* A NULL or empty path reopens the fd for reading... */
         ASSERT_OK(xfopenat(fd, /* path= */ NULL, "re", 0, &f));
@@ -920,7 +920,7 @@ TEST(read_boolean_file) {
         ASSERT_OK_ERRNO(chdir(cwd));
 
         /* Also test the dir_fd >= 0 path using an actual fd for /tmp. */
-        ASSERT_OK(dfd = open("/tmp", O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(dfd = xopenat(AT_FDCWD, "/tmp", O_DIRECTORY));
         ASSERT_OK(write_string_file(fn, "1", WRITE_STRING_FILE_TRUNCATE));
         _cleanup_free_ char *bn = NULL;
         ASSERT_OK(path_extract_filename(fn, &bn));

src/test/test-fs-util.c

@@ -146,7 +146,7 @@ TEST(access_fd) {
         a = strjoina(arg_test_dir ?: "/tmp", "/access-fd.XXXXXX");
         ASSERT_OK(mkdtemp_malloc(a, &p));
 
-        fd = ASSERT_OK_ERRNO(open(p, O_RDONLY|O_DIRECTORY|O_CLOEXEC));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, p, O_RDONLY|O_DIRECTORY));
 
         ASSERT_OK(access_fd(fd, R_OK));
         ASSERT_OK(access_fd(fd, F_OK));
@@ -269,7 +269,7 @@ TEST(unlinkat_deallocate) {
 
         ASSERT_OK(tempfn_random_child(arg_test_dir, "unlink-deallocation", &p));
 
-        fd = ASSERT_OK_ERRNO(open(p, O_WRONLY|O_CLOEXEC|O_CREAT|O_EXCL, 0600));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, p, O_WRONLY|O_CREAT|O_EXCL, /* xopen_flags= */ 0, 0600));
 
         ASSERT_OK_EQ_ERRNO(write(fd, "hallo\n", 6), 6);
 
@@ -404,7 +404,7 @@ TEST(chmod_and_chown) {
 static void create_binary_file(const char *p, const void *data, size_t l) {
         _cleanup_close_ int fd = -EBADF;
 
-        fd = ASSERT_OK_ERRNO(open(p, O_CREAT|O_WRONLY|O_EXCL|O_CLOEXEC, 0600));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, p, O_CREAT|O_WRONLY|O_EXCL, /* xopen_flags= */ 0, 0600));
         ASSERT_OK_EQ_ERRNO(write(fd, data, l), (ssize_t) l);
 }
 
@@ -881,7 +881,7 @@ TEST(xopenat_socket) {
         ASSERT_OK_ERRNO(mkdirat(tfd, "dir", 0755));
         ASSERT_ERROR(xopenat_full(tfd, "dir", O_PATH, XO_SOCKET, /* mode= */ 0), EISDIR);
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "reg", O_CREAT|O_CLOEXEC, 0600));
+        fd = ASSERT_OK(xopenat_full(tfd, "reg", O_CREAT, /* xopen_flags= */ 0, 0600));
         fd = safe_close(fd);
         ASSERT_ERROR(xopenat_full(tfd, "reg", O_PATH, XO_SOCKET, /* mode= */ 0), ENOTSOCK);
 
@@ -957,7 +957,7 @@ TEST(xopenat_auto_rw_ro) {
          * this when running as root, or as a user with CAP_DAC_OVERRIDE. */
 
         if (have_effective_cap(CAP_DAC_OVERRIDE) <= 0) {
-                fd = ASSERT_OK_ERRNO(openat(tfd, "ro", O_CREAT|O_EXCL|O_WRONLY|O_CLOEXEC, 0444));
+                fd = ASSERT_OK(xopenat_full(tfd, "ro", O_CREAT|O_EXCL|O_WRONLY, /* xopen_flags= */ 0, 0444));
                 fd = safe_close(fd);
                 ASSERT_OK_ERRNO(fchmodat(tfd, "ro", 0444, 0));
 
@@ -1037,23 +1037,23 @@ TEST(linkat_replace) {
 
         tfd = ASSERT_OK(mkdtemp_open(/* template= */ NULL, /* flags= */ 0, &t));
 
-        _cleanup_close_ int fd1 = ASSERT_OK_ERRNO(openat(tfd, "foo", O_CREAT|O_RDWR|O_CLOEXEC, 0600));
+        _cleanup_close_ int fd1 = ASSERT_OK(xopenat_full(tfd, "foo", O_CREAT|O_RDWR, /* xopen_flags= */ 0, 0600));
 
         ASSERT_OK(linkat_replace(tfd, "foo", tfd, "bar"));
         ASSERT_OK(linkat_replace(tfd, "foo", tfd, "bar"));
 
-        _cleanup_close_ int fd1_check = ASSERT_OK_ERRNO(openat(tfd, "bar", O_RDWR|O_CLOEXEC));
+        _cleanup_close_ int fd1_check = ASSERT_OK(xopenat(tfd, "bar", O_RDWR));
 
         ASSERT_OK_POSITIVE(inode_same_at(fd1, /* filea= */ NULL, fd1_check, /* fileb= */ NULL,
                                          AT_EMPTY_PATH));
 
-        _cleanup_close_ int fd2 = ASSERT_OK_ERRNO(openat(tfd, "baz", O_CREAT|O_RDWR|O_CLOEXEC, 0600));
+        _cleanup_close_ int fd2 = ASSERT_OK(xopenat_full(tfd, "baz", O_CREAT|O_RDWR, /* xopen_flags= */ 0, 0600));
 
         ASSERT_OK_EQ(inode_same_at(fd1, /* filea= */ NULL, fd2, /* fileb= */ NULL, AT_EMPTY_PATH), 0);
 
         ASSERT_OK(linkat_replace(tfd, "foo", tfd, "baz"));
 
-        _cleanup_close_ int fd2_check = openat(tfd, "baz", O_RDWR|O_CLOEXEC);
+        _cleanup_close_ int fd2_check = xopenat(tfd, "baz", O_RDWR);
 
         ASSERT_OK_EQ(inode_same_at(fd2, /* filea= */ NULL, fd2_check, /* fileb= */ NULL, AT_EMPTY_PATH), 0);
         ASSERT_OK_POSITIVE(inode_same_at(fd1, /* filea= */ NULL, fd2_check, /* fileb= */ NULL,
@@ -1074,7 +1074,7 @@ TEST(readlinkat_malloc) {
         ASSERT_STREQ(p, expect);
         p = mfree(p);
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "linkname", O_PATH | O_NOFOLLOW | O_CLOEXEC));
+        fd = ASSERT_OK(xopenat(tfd, "linkname", O_PATH | O_NOFOLLOW));
         ASSERT_OK(readlinkat_malloc(fd, NULL, &p));
         ASSERT_STREQ(p, expect);
         p = mfree(p);

src/test/test-journal-importer.c

@@ -3,6 +3,7 @@
 #include <fcntl.h>
 
 #include "alloc-util.h"
+#include "fs-util.h"
 #include "journal-importer.h"
 #include "tests.h"
 
@@ -21,7 +22,7 @@ TEST(basic_parsing) {
         int r;
 
         ASSERT_OK(get_testdata_dir("journal-data/journal-1.txt", &journal_data_path));
-        imp.fd = ASSERT_OK_ERRNO(open(journal_data_path, O_RDONLY|O_CLOEXEC));
+        imp.fd = ASSERT_OK(xopenat(AT_FDCWD, journal_data_path, O_RDONLY));
 
         do
                 r = journal_importer_process_data(&imp);
@@ -50,7 +51,7 @@ TEST(bad_input) {
         int r;
 
         ASSERT_OK(get_testdata_dir("journal-data/journal-1.txt", &journal_data_path));
-        imp.fd = ASSERT_OK_ERRNO(open(journal_data_path, O_RDONLY|O_CLOEXEC));
+        imp.fd = ASSERT_OK(xopenat(AT_FDCWD, journal_data_path, O_RDONLY));
 
         do
                 r = journal_importer_process_data(&imp);

src/test/test-kernel-image.c

@@ -8,6 +8,7 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "glob-util.h"
 #include "kernel-image.h"
 #include "memfd-util.h"
@@ -213,12 +214,12 @@ TEST(installed_kernels) {
                 ASSERT_OK(path_extract_directory(*path, &dir));
                 ASSERT_OK(path_extract_filename(dir, &version));
 
-                _cleanup_close_ int fd = open(*path, O_RDONLY|O_CLOEXEC);
-                if (fd < 0 && ERRNO_IS_PRIVILEGE(errno)) {
-                        log_notice_errno(errno, "Cannot open %s, skipping: %m", *path);
+                _cleanup_close_ int fd = xopenat(AT_FDCWD, *path, O_RDONLY);
+                if (ERRNO_IS_NEG_PRIVILEGE(fd)) {
+                        log_notice_errno(fd, "Cannot open %s, skipping: %m", *path);
                         continue;
                 }
-                ASSERT_OK_ERRNO(fd);
+                ASSERT_OK(fd);
 
                 _cleanup_close_ int decompressed_fd = -EBADF;
                 r = kernel_decompress(fd, &decompressed_fd);

src/test/test-kexec.c

@@ -7,6 +7,7 @@
 #include "alloc-util.h"
 #include "compress.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "io-util.h"
 #include "reboot-util.h"
 #include "string-util.h"
@@ -214,9 +215,9 @@ TEST(system_kernel) {
 
         log_info("Found kernel image: %s", path);
 
-        fd = open(path, O_RDONLY|O_CLOEXEC);
+        fd = xopenat(AT_FDCWD, path, O_RDONLY);
         if (fd < 0) {
-                log_tests_skipped_errno(errno, "Cannot open kernel image '%s'", path);
+                log_tests_skipped_errno(fd, "Cannot open kernel image '%s'", path);
                 return;
         }
 

src/test/test-keyring-util.c

@@ -6,6 +6,7 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "iovec-util.h"
 #include "keyring-util.h"
 #include "rm-rf.h"
@@ -178,11 +179,11 @@ TEST(keyring_find_by_name_at) {
 
         /* Below a root without /proc there is no /proc/keys to look at */
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &tmp));
-        ASSERT_OK_ERRNO(empty_fd = open(tmp, O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(empty_fd = xopenat(AT_FDCWD, tmp, O_PATH|O_DIRECTORY));
         ASSERT_ERROR(keyring_find_by_name_at(empty_fd, "anything", getuid(), &serial), ENOENT);
 
         /* The host root behaves like keyring_find_by_name() */
-        ASSERT_OK_ERRNO(root_fd = open("/", O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(root_fd = xopenat(AT_FDCWD, "/", O_PATH|O_DIRECTORY));
         r = keyring_find_by_name_at(root_fd, ".this-keyring-does-not-exist", getuid(), &serial);
         if (ERRNO_IS_NEG_PRIVILEGE(r) || IN_SET(r, -ERFKILL, -ENOENT)) {
                 log_tests_skipped_errno(r, "/proc/keys not available");

src/test/test-label.c

@@ -82,7 +82,7 @@ static int labelling_op(int dir_fd, const char *text, const char *path, mode_t m
                 return log_error_errno(r, "Error in pathname =>: %m");
 
         /* Open the file within the directory for writing */
-        write_fd = RET_NERRNO(openat(dir_fd, path, O_CLOEXEC|O_WRONLY|O_TRUNC|O_CREAT, 0644));
+        write_fd = xopenat_full(dir_fd, path, O_WRONLY|O_TRUNC|O_CREAT, /* xopen_flags= */ 0, 0644);
         if (write_fd < 0)
                 return log_error_errno(write_fd, "Error in opening directory for writing =>: %m");
 

src/test/test-loop-util.c

@@ -13,6 +13,7 @@
 #include "capability-util.h"
 #include "dissect-image.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "gpt.h"
 #include "loop-util.h"
 #include "mkfs-util.h"
@@ -193,7 +194,8 @@ TEST(loop_block) {
         _cleanup_close_ int fd = -EBADF;
 
         ASSERT_OK(tempfn_random_child("/var/tmp", "sfdisk", &p));
-        fd = ASSERT_OK_ERRNO(open(p, O_CREAT|O_EXCL|O_RDWR|O_CLOEXEC|O_NOFOLLOW, 0666));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, p, O_CREAT|O_EXCL|O_RDWR|O_NOFOLLOW,
+                                    /* xopen_flags= */ 0, 0666));
         ASSERT_OK_ERRNO(ftruncate(fd, 256*1024*1024));
 
         cmd = ASSERT_NOT_NULL(strjoin("sfdisk ", p));
@@ -416,7 +418,8 @@ static int make_test_image(int *ret_fd) {
         _cleanup_pclose_ FILE *sfdisk = NULL;
 
         ASSERT_OK(tempfn_random_child("/var/tmp", "sfdisk", &p));
-        int fd = ASSERT_OK_ERRNO(open(p, O_CREAT|O_EXCL|O_RDWR|O_CLOEXEC|O_NOFOLLOW, 0666));
+        int fd = ASSERT_OK(xopenat_full(AT_FDCWD, p, O_CREAT|O_EXCL|O_RDWR|O_NOFOLLOW,
+                                        /* xopen_flags= */ 0, 0666));
         ASSERT_OK_ERRNO(ftruncate(fd, 256*1024*1024));
 
         cmd = ASSERT_NOT_NULL(strjoin("sfdisk ", p));
@@ -655,7 +658,8 @@ TEST(partscan_not_needed_without_partition_table) {
          * to expose a nested partition table though, so any device without one — here simply an empty device —
          * must take the shortcut. */
         ASSERT_OK(tempfn_random_child("/var/tmp", "loop-util", &p));
-        fd = ASSERT_OK_ERRNO(open(p, O_CREAT|O_EXCL|O_RDWR|O_CLOEXEC|O_NOFOLLOW, 0666));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, p, O_CREAT|O_EXCL|O_RDWR|O_NOFOLLOW,
+                                    /* xopen_flags= */ 0, 0666));
         ASSERT_OK_ERRNO(ftruncate(fd, 256*1024*1024));
         (void) unlink(p);
 
@@ -702,7 +706,8 @@ static void test_nested_partition_table_one(const char *nested_table) {
 
         /* Build an image with a single root partition spanning the whole disk. */
         ASSERT_OK(tempfn_random_child("/var/tmp", "sfdisk", &p));
-        fd = ASSERT_OK_ERRNO(open(p, O_CREAT|O_EXCL|O_RDWR|O_CLOEXEC|O_NOFOLLOW, 0666));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, p, O_CREAT|O_EXCL|O_RDWR|O_NOFOLLOW,
+                                    /* xopen_flags= */ 0, 0666));
         ASSERT_OK_ERRNO(ftruncate(fd, 256*1024*1024));
 
         cmd = ASSERT_NOT_NULL(strjoin("sfdisk ", p));
@@ -747,7 +752,7 @@ static void test_nested_partition_table_one(const char *nested_table) {
         /* The partition has partition scanning disabled but now carries a partition table, so the shortcut
          * must be refused and a real loop device with partition scanning allocated (even without
          * LOOP_DEVICE_MAY_POPULATE_PARTITION_TABLE, since there genuinely is a table to scan). */
-        part_fd = ASSERT_OK_ERRNO(open(node, O_RDWR|O_CLOEXEC|O_NOCTTY));
+        part_fd = ASSERT_OK(xopenat(AT_FDCWD, node, O_RDWR|O_NOCTTY));
         ASSERT_OK(loop_device_make(part_fd, O_RDWR, /* offset= */ 0, UINT64_MAX, /* sector_size= */ 0, LO_FLAGS_PARTSCAN, LOCK_SH, &loop));
         ASSERT_TRUE(loop->created);
 #else

src/test/test-manifest-util.c

@@ -15,6 +15,7 @@
 #include "fd-util.h"
 #include "fileio.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "hexdecoct.h"
 #include "io-util.h"
 #include "iovec-util.h"
@@ -722,12 +723,12 @@ TEST(manifest_omitted) {
          * make of that */
         ASSERT_OK_ERRNO(fchmodat(tfd, "regular.txt", 0000, 0));
         ASSERT_OK_ERRNO(fchmodat(tfd, "subdir", 0000, 0));
-        _cleanup_close_ int probe_fd = openat(tfd, "regular.txt", O_RDONLY|O_CLOEXEC);
+        _cleanup_close_ int probe_fd = xopenat(tfd, "regular.txt", O_RDONLY);
         if (probe_fd >= 0) {
                 ASSERT_OK_ERRNO(fchmodat(tfd, "subdir", 0755, 0));
                 return (void) log_tests_skipped("Privileged enough to read inaccessible files");
         }
-        ASSERT_EQ(errno, EACCES);
+        ASSERT_ERROR(probe_fd, EACCES);
 
         static const struct {
                 ManifestFormat format;

src/test/test-mount-util.c

@@ -450,7 +450,7 @@ TEST(umount_recursive_busy) {
                 ASSERT_OK(mount_nofollow_verbose(LOG_INFO, "tmpfs", older, "tmpfs", 0, NULL));
                 ASSERT_OK(mount_nofollow_verbose(LOG_INFO, "tmpfs", busy, "tmpfs", 0, NULL));
 
-                _unused_ _cleanup_close_ int fd = ASSERT_OK_ERRNO(open(busy, O_DIRECTORY|O_CLOEXEC));
+                _unused_ _cleanup_close_ int fd = ASSERT_OK(xopenat(AT_FDCWD, busy, O_DIRECTORY));
 
                 ASSERT_OK_EQ(umount_recursive(prefix, 0), 1);
 
@@ -478,14 +478,14 @@ TEST(fd_make_mount_point) {
         if (r == 0) {
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
 
-                fd = ASSERT_OK_ERRNO(open(s, O_PATH|O_CLOEXEC));
+                fd = ASSERT_OK(xopenat(AT_FDCWD, s, O_PATH));
 
                 ASSERT_OK_EQ(is_mount_point_at(fd, /* path= */ NULL, AT_SYMLINK_FOLLOW), 0);
 
                 ASSERT_OK_POSITIVE(fd_make_mount_point(fd));
 
                 /* Reopen the inode so that we end up on the new mount */
-                fd2 = open(s, O_PATH|O_CLOEXEC);
+                fd2 = xopenat(AT_FDCWD, s, O_PATH);
 
                 ASSERT_OK_POSITIVE(is_mount_point_at(fd2, /* path= */ NULL, AT_SYMLINK_FOLLOW));
 
@@ -624,7 +624,7 @@ TEST(path_is_network_fs_harder) {
         _cleanup_close_ int dir_fd = -EBADF;
         int r;
 
-        ASSERT_OK(dir_fd = open("/", O_PATH | O_CLOEXEC));
+        ASSERT_OK(dir_fd = xopenat(AT_FDCWD, "/", O_PATH));
         FOREACH_STRING(s,
                        "/", "/dev/", "/proc/", "/run/", "/sys/", "/tmp/", "/usr/", "/var/tmp/",
                        "", ".", "../../../", "/this/path/should/not/exist/for/test-mount-util/") {

src/test/test-mountpoint-util.c

@@ -159,9 +159,9 @@ TEST(path_is_mount_point) {
         ASSERT_NOT_NULL(mkdtemp(tmp_dir));
         file1 = ASSERT_NOT_NULL(path_join(tmp_dir, "file1"));
         file2 = ASSERT_NOT_NULL(path_join(tmp_dir, "file2"));
-        fd = ASSERT_OK_ERRNO(open(file1, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0664));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, file1, O_WRONLY|O_CREAT|O_EXCL, /* xopen_flags= */ 0, 0664));
         close(fd);
-        fd = ASSERT_OK_ERRNO(open(file2, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0664));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, file2, O_WRONLY|O_CREAT|O_EXCL, /* xopen_flags= */ 0, 0664));
         close(fd);
         link1 = ASSERT_NOT_NULL(path_join(tmp_dir, "link1"));
         ASSERT_OK_ZERO_ERRNO(symlink("file1", link1));
@@ -190,7 +190,7 @@ TEST(path_is_mount_point) {
 
         /* file in subdirectory mountpoints */
         dir1file = ASSERT_NOT_NULL(path_join(dir1, "file"));
-        fd = ASSERT_OK_ERRNO(open(dir1file, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0664));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, dir1file, O_WRONLY|O_CREAT|O_EXCL, /* xopen_flags= */ 0, 0664));
         close(fd);
 
         ASSERT_OK_EQ(path_is_mount_point_full(dir1file, /* root= */ NULL, AT_SYMLINK_FOLLOW), 0);
@@ -229,7 +229,7 @@ TEST(path_is_mount_point) {
 
                 /* dirs */
                 dir2file = ASSERT_NOT_NULL(path_join(dir2, "file"));
-                fd = ASSERT_OK_ERRNO(open(dir2file, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0664));
+                fd = ASSERT_OK(xopenat_full(AT_FDCWD, dir2file, O_WRONLY|O_CREAT|O_EXCL, /* xopen_flags= */ 0, 0664));
                 close(fd);
 
                 ASSERT_OK_ERRNO(mount(dir2, dir1, /* filesystemtype= */ NULL, MS_BIND, /* data= */ NULL));
@@ -266,7 +266,7 @@ TEST(is_mount_point_at) {
         _cleanup_close_ int fd = -EBADF;
         int r;
 
-        fd = ASSERT_OK_ERRNO(open("/", O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/", O_RDONLY|O_DIRECTORY|O_NOCTTY));
 
         ASSERT_OK_POSITIVE(is_mount_point_at(fd, "/", /* flags= */ 0));
         ASSERT_OK_POSITIVE(is_mount_point_at(fd, "..", /* flags= */ 0));
@@ -280,7 +280,7 @@ TEST(is_mount_point_at) {
         ASSERT_OK_ZERO(is_mount_point_at(fd, "usr/lib", /* flags= */ 0));
 
         safe_close(fd);
-        fd = ASSERT_OK_ERRNO(open("/tmp", O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/tmp", O_RDONLY|O_DIRECTORY|O_NOCTTY));
 
         ASSERT_OK(mkdtemp_malloc("/tmp/not-mounted-XXXXXX", &tmpdir));
         ASSERT_OK(path_extract_filename(tmpdir, &tmpdir_basename));
@@ -288,7 +288,7 @@ TEST(is_mount_point_at) {
         ASSERT_OK_ZERO(is_mount_point_at(fd, strjoina(tmpdir_basename, "/"), /* flags= */ 0));
 
         safe_close(fd);
-        fd = ASSERT_OK_ERRNO(open("/proc", O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc", O_RDONLY|O_DIRECTORY|O_NOCTTY));
 
         ASSERT_OK_POSITIVE(is_mount_point_at(fd, /* path= */ NULL, /* flags= */ 0));
         ASSERT_OK_POSITIVE(is_mount_point_at(fd, "", /* flags= */ 0));
@@ -306,7 +306,7 @@ TEST(is_mount_point_at) {
         ASSERT_OK_ERRNO(chdir(pwd));
 
         safe_close(fd);
-        fd = ASSERT_OK_ERRNO(open("/proc/version", O_RDONLY|O_CLOEXEC|O_NOCTTY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/version", O_RDONLY|O_NOCTTY));
 
         r = is_mount_point_at(fd, /* path= */ NULL, /* flags= */ 0);
         ASSERT_TRUE(IN_SET(r, 0, -ENOTDIR)); /* on old kernels we can't determine if regular files are mount points if we have no directory fd */
@@ -320,7 +320,7 @@ TEST(is_mount_point_at) {
         struct stat st;
 
         safe_close(fd);
-        ASSERT_OK_ERRNO(fd = open(tmpdir, O_DIRECTORY|O_PATH|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, tmpdir, O_DIRECTORY|O_PATH));
 
         ASSERT_OK_ERRNO(symlinkat("/usr", fd, "symlink"));
 
@@ -329,7 +329,7 @@ TEST(is_mount_point_at) {
                 return;
         ASSERT_OK_ERRNO(mfd);
 
-        ASSERT_OK_ERRNO(rfd = openat(fd, "regular", O_CLOEXEC|O_CREAT|O_EXCL, 0644));
+        ASSERT_OK(rfd = xopenat_full(fd, "regular", O_CREAT|O_EXCL, /* xopen_flags= */ 0, 0644));
 
         ASSERT_OK_ERRNO(move_mount(mfd, "", rfd, "", MOVE_MOUNT_F_EMPTY_PATH|MOVE_MOUNT_T_EMPTY_PATH));
 
@@ -393,7 +393,7 @@ TEST(path_get_mnt_id_at_null) {
         ASSERT_EQ(id1, id2);
         id2 = -1;
 
-        root_fd = ASSERT_OK_ERRNO(open("/", O_DIRECTORY|O_CLOEXEC));
+        root_fd = ASSERT_OK(xopenat(AT_FDCWD, "/", O_DIRECTORY));
 
         ASSERT_OK(path_get_mnt_id_at(root_fd, "/run/", &id2));
         ASSERT_EQ(id1, id2);
@@ -411,7 +411,7 @@ TEST(path_get_mnt_id_at_null) {
         ASSERT_EQ(id1, id2);
         id2 = -1;
 
-        run_fd = ASSERT_OK_ERRNO(openat(root_fd, "run", O_DIRECTORY|O_CLOEXEC));
+        run_fd = ASSERT_OK(xopenat(root_fd, "run", O_DIRECTORY));
 
         id2 = -1;
         ASSERT_OK(path_get_mnt_id_at(run_fd, "", &id2));

src/test/test-mstack.c

@@ -24,8 +24,8 @@ static bool overlayfs_set_fd_lowerdir_plus_supported(void) {
                 return false;
         ASSERT_OK_ERRNO(sb_fd);
 
-        _cleanup_close_ int layer_fd = open("/", O_DIRECTORY|O_CLOEXEC);
-        ASSERT_OK_ERRNO(layer_fd);
+        _cleanup_close_ int layer_fd = xopenat(AT_FDCWD, "/", O_DIRECTORY);
+        ASSERT_OK(layer_fd);
 
         r = RET_NERRNO(fsconfig(sb_fd, FSCONFIG_SET_FD, "lowerdir+", /* value= */ NULL, layer_fd));
         if (r < 0 && (ERRNO_IS_NEG_NOT_SUPPORTED(r) || r == -EINVAL))
@@ -107,8 +107,8 @@ TEST(mstack) {
                         _cleanup_close_ int rfd = -EBADF;
                         ASSERT_OK(mstack_bind_mounts(mstack, w, /* where_fd= */ -EBADF, flags, &rfd));
 
-                        _cleanup_close_ int ofd = open(w, O_PATH|O_CLOEXEC);
-                        ASSERT_OK_ERRNO(ofd);
+                        _cleanup_close_ int ofd = xopenat(AT_FDCWD, w, O_PATH);
+                        ASSERT_OK(ofd);
 
                         ASSERT_OK_ERRNO(faccessat(ofd, "check1", F_OK, AT_SYMLINK_NOFOLLOW));
                         ASSERT_OK_ERRNO(faccessat(ofd, "check2/", F_OK, AT_SYMLINK_NOFOLLOW));

src/test/test-namespace-util.c

@@ -8,6 +8,7 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "namespace-util.h"
 #include "pidref.h"
 #include "process-util.h"
@@ -15,7 +16,7 @@
 #include "tests.h"
 
 TEST(fd_is_namespace) {
-        _cleanup_close_ int fd = ASSERT_OK_ERRNO(open("/dev/null", O_RDONLY|O_CLOEXEC));
+        _cleanup_close_ int fd = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
 
         ASSERT_OK_ZERO(fd_is_namespace(fd, _NAMESPACE_TYPE_INVALID));
         ASSERT_OK_ZERO(fd_is_namespace(fd, NAMESPACE_USER));
@@ -35,9 +36,9 @@ TEST(fd_is_namespace) {
 }
 
 TEST(is_our_namespace) {
-        _cleanup_close_ int userns_fd = ASSERT_OK_ERRNO(open("/proc/self/ns/user", O_RDONLY|O_CLOEXEC));
-        _cleanup_close_ int mntns_fd = ASSERT_OK_ERRNO(open("/proc/self/ns/mnt", O_RDONLY|O_CLOEXEC));
-        _cleanup_close_ int fd = ASSERT_OK_ERRNO(open("/dev/null", O_RDONLY|O_CLOEXEC));
+        _cleanup_close_ int userns_fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self/ns/user", O_RDONLY));
+        _cleanup_close_ int mntns_fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self/ns/mnt", O_RDONLY));
+        _cleanup_close_ int fd = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
 
         ASSERT_OK_POSITIVE(is_our_namespace(userns_fd, NAMESPACE_USER));
         ASSERT_OK_POSITIVE(is_our_namespace(mntns_fd, NAMESPACE_MOUNT));
@@ -115,12 +116,12 @@ TEST(namespace_enter_nothing) {
 
                 ASSERT_OK(namespace_enter(-EBADF, -EBADF, -EBADF, -EBADF, -EBADF));
 
-                _cleanup_close_ int userns_fd = ASSERT_OK_ERRNO(open("/proc/self/ns/user", O_RDONLY|O_CLOEXEC));
+                _cleanup_close_ int userns_fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self/ns/user", O_RDONLY));
                 ASSERT_OK(namespace_enter(-EBADF, -EBADF, -EBADF, userns_fd, -EBADF));
 
-                _cleanup_close_ int mntns_fd = ASSERT_OK_ERRNO(open("/proc/self/ns/mnt", O_RDONLY|O_CLOEXEC));
-                _cleanup_close_ int pidns_fd = ASSERT_OK_ERRNO(open("/proc/self/ns/pid", O_RDONLY|O_CLOEXEC));
-                _cleanup_close_ int netns_fd = ASSERT_OK_ERRNO(open("/proc/self/ns/net", O_RDONLY|O_CLOEXEC));
+                _cleanup_close_ int mntns_fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self/ns/mnt", O_RDONLY));
+                _cleanup_close_ int pidns_fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self/ns/pid", O_RDONLY));
+                _cleanup_close_ int netns_fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY));
                 ASSERT_OK(namespace_enter(pidns_fd, mntns_fd, netns_fd, userns_fd, -EBADF));
 
                 _exit(EXIT_SUCCESS);

src/test/test-namespace.c

@@ -16,6 +16,7 @@
 #include "alloc-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "libmount-util.h"
 #include "namespace-util.h"
 #include "namespace.h"
@@ -227,12 +228,12 @@ TEST(protect_kernel_logs) {
         if (r == 0) {
                 _cleanup_close_ int fd = -EBADF;
 
-                ASSERT_OK_ERRNO(fd = open("/dev/kmsg", O_RDONLY | O_CLOEXEC));
+                ASSERT_OK(fd = xopenat(AT_FDCWD, "/dev/kmsg", O_RDONLY));
 
                 ASSERT_OK_ZERO(setup_namespace(&p, /* reterr_path= */ NULL));
 
                 ASSERT_OK_ERRNO(setresuid(UID_NOBODY, UID_NOBODY, UID_NOBODY));
-                ASSERT_ERROR_ERRNO(open("/dev/kmsg", O_RDONLY | O_CLOEXEC), EACCES);
+                ASSERT_ERROR(xopenat(AT_FDCWD, "/dev/kmsg", O_RDONLY), EACCES);
 
                 _exit(EXIT_SUCCESS);
         }
@@ -288,7 +289,7 @@ TEST(userns_get_base_uid) {
 
 TEST(namespace_open_by_id) {
         /* Try our own user namespace first to see if the kernel exposes ns_id at all. */
-        _cleanup_close_ int userns_fd = ASSERT_OK_ERRNO(open("/proc/self/ns/user", O_RDONLY|O_CLOEXEC));
+        _cleanup_close_ int userns_fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self/ns/user", O_RDONLY));
 
         uint64_t ns_id;
         int r = RET_NERRNO(ioctl(userns_fd, NS_GET_ID, &ns_id));

src/test/test-notify-recv.c

@@ -8,6 +8,7 @@
 #include "event-util.h"
 #include "fd-util.h"
 #include "fdset.h"
+#include "fs-util.h"
 #include "notify-recv.h"
 #include "pidref.h"
 #include "process-util.h"
@@ -98,10 +99,10 @@ TEST(notify_socket_prepare) {
                 ASSERT_OK_ERRNO(setenv("NOTIFY_SOCKET", path, /* overwrite= */ true));
                 ASSERT_OK_POSITIVE(sd_notify(/* unset_environment= */ false, "FIRST_MESSAGE=1"));
 
-                _cleanup_close_ int fd1 = open("/tmp", O_RDONLY|O_CLOEXEC|O_DIRECTORY);
-                ASSERT_OK_ERRNO(fd1);
-                _cleanup_close_ int fd2 = open("/dev/null", O_RDONLY|O_CLOEXEC);
-                ASSERT_OK_ERRNO(fd2);
+                _cleanup_close_ int fd1 = xopenat(AT_FDCWD, "/tmp", O_RDONLY|O_DIRECTORY);
+                ASSERT_OK(fd1);
+                _cleanup_close_ int fd2 = xopenat(AT_FDCWD, "/dev/null", O_RDONLY);
+                ASSERT_OK(fd2);
 
                 ASSERT_OK_POSITIVE(
                         sd_pid_notify_with_fds(

src/test/test-ns.c

@@ -4,6 +4,7 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+#include "fs-util.h"
 #include "log.h"
 #include "namespace.h"
 #include "tests.h"
@@ -81,7 +82,7 @@ int main(int argc, char *argv[]) {
         _cleanup_(pinned_resource_done) PinnedResource pr = PINNED_RESOURCE_NULL;
 
         if (root_directory) {
-                pr.directory_fd = ASSERT_OK_ERRNO(open(root_directory, O_PATH|O_CLOEXEC|O_DIRECTORY));
+                pr.directory_fd = ASSERT_OK(xopenat(AT_FDCWD, root_directory, O_PATH|O_DIRECTORY));
                 pr.directory = ASSERT_NOT_NULL(strdup(root_directory));
         }
 

src/test/test-pressure.c

@@ -17,6 +17,7 @@
 #include "event-util.h"
 #include "fd-util.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "hashmap.h"
 #include "path-util.h"
 #include "pidref.h"
@@ -119,8 +120,8 @@ static void test_fake_pressure(
 
         _cleanup_free_ char *j = ASSERT_NOT_NULL(path_join(tmp, "fifo"));
         ASSERT_OK_ERRNO(mkfifo(j, 0600));
-        fifo_fd = open(j, O_CLOEXEC|O_RDWR|O_NONBLOCK);
-        ASSERT_OK_ERRNO(fifo_fd);
+        fifo_fd = xopenat(AT_FDCWD, j, O_RDWR|O_NONBLOCK);
+        ASSERT_OK(fifo_fd);
 
         _cleanup_free_ char *k = ASSERT_NOT_NULL(path_join(tmp, "sock"));
         socket_fd = socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC, 0);
@@ -544,7 +545,8 @@ _noreturn_ static void real_pressure_eat_io(int pipe_fd) {
         for (;;) {
                 _cleanup_close_ int fd = -EBADF;
 
-                fd = open("/var/tmp/.io-pressure-test", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0600);
+                fd = xopenat_full(AT_FDCWD, "/var/tmp/.io-pressure-test", O_WRONLY|O_CREAT|O_TRUNC,
+                                  /* xopen_flags= */ 0, 0600);
                 if (fd < 0)
                         continue;
 

src/test/test-recurse-dir.c

@@ -5,6 +5,7 @@
 #include <sys/stat.h>
 
 #include "fd-util.h"
+#include "fs-util.h"
 #include "log.h"
 #include "recurse-dir.h"
 #include "rm-rf.h"
@@ -168,7 +169,7 @@ static void test_must_be_flags(void) {
         ASSERT_OK(tfd = mkdtemp_open(/* template= */ NULL, O_DIRECTORY, &t));
 
         ASSERT_OK_ERRNO(mkdirat(tfd, "dir", 0777));
-        ASSERT_OK_ERRNO(reg_fd = openat(tfd, "reg", O_CREAT|O_EXCL|O_WRONLY|O_CLOEXEC, 0666));
+        ASSERT_OK(reg_fd = xopenat_full(tfd, "reg", O_CREAT|O_EXCL|O_WRONLY, /* xopen_flags= */ 0, 0666));
         reg_fd = safe_close(reg_fd);
         ASSERT_OK_ERRNO(symlinkat("reg", tfd, "lnk"));
         ASSERT_OK_ERRNO(mknodat(tfd, "sock", S_IFSOCK|0666, 0));
@@ -203,10 +204,10 @@ int main(int argc, char *argv[]) {
         else
                 p = "/usr/share/man"; /* something hopefully reasonably stable while we run (and limited in size) */
 
-        fd = open(p, O_DIRECTORY|O_CLOEXEC);
-        if (fd < 0 && errno == ENOENT)
-                return log_tests_skipped_errno(errno, "Couldn't open directory %s", p);
-        ASSERT_OK_ERRNO(fd);
+        fd = xopenat(AT_FDCWD, p, O_DIRECTORY);
+        if (fd == -ENOENT)
+                return log_tests_skipped_errno(fd, "Couldn't open directory %s", p);
+        ASSERT_OK(fd);
 
         /* If the test directory is on an overlayfs then files and their directory may return different
          * st_dev in stat results, which confuses nftw into thinking they're on different filesystems and

src/test/test-reread-partition-table-manual.c

@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "fd-util.h"
+#include "fs-util.h"
 #include "log.h"
 #include "main-func.h"
 #include "reread-partition-table.h"
@@ -14,9 +15,9 @@ static int run(int argc, char *argv[]) {
         if (argc != 2)
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Expected single parameter, the device node to open.");
 
-        _cleanup_close_ int fd = open(argv[1], O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
+        _cleanup_close_ int fd = xopenat(AT_FDCWD, argv[1], O_RDONLY|O_NONBLOCK|O_NOCTTY);
         if (fd < 0)
-                return log_error_errno(errno, "Failed to open '%s': %m", argv[1]);
+                return log_error_errno(fd, "Failed to open '%s': %m", argv[1]);
 
         r = reread_partition_table_fd(fd, REREADPT_BSD_LOCK|REREADPT_FORCE_UEVENT, /* args= */ NULL);
         if (r < 0)

src/test/test-reread-partition-table.c

@@ -7,6 +7,7 @@
 #include "capability-util.h"
 #include "errno-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "loop-util.h"
 #include "memfd-util.h"
 #include "path-util.h"
@@ -98,7 +99,7 @@ TEST(rereadpt) {
         ASSERT_OK_ZERO_ERRNO(access(p, F_OK));
 
         _cleanup_close_ int pfd = -EBADF;
-        ASSERT_OK_ERRNO(pfd = open(p, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY));
+        ASSERT_OK(pfd = xopenat(AT_FDCWD, p, O_RDONLY|O_NONBLOCK|O_NOCTTY));
         uint64_t size;
         ASSERT_OK(blockdev_get_device_size(pfd, &size));
         ASSERT_EQ(size, 20U*1024U*1024U);
@@ -123,14 +124,14 @@ TEST(rereadpt) {
         ASSERT_OK(reread_partition_table_fd(loop->fd, /* flags= */ 0, /* args= */ NULL));
         ASSERT_OK_ZERO_ERRNO(access(p, F_OK));
 
-        ASSERT_OK_ERRNO(pfd = open(p, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY));
+        ASSERT_OK(pfd = xopenat(AT_FDCWD, p, O_RDONLY|O_NONBLOCK|O_NOCTTY));
         ASSERT_OK(blockdev_get_device_size(pfd, &size));
         ASSERT_EQ(size, 30U*1024U*1024U);
         pfd = safe_close(pfd);
 
         /* No change */
         ASSERT_OK(reread_partition_table_fd(loop->fd, /* flags= */ 0, /* args= */ NULL));
-        ASSERT_OK_ERRNO(pfd = open(p, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY));
+        ASSERT_OK(pfd = xopenat(AT_FDCWD, p, O_RDONLY|O_NONBLOCK|O_NOCTTY));
 
         /* Move */
         log_notice("MOVING BY 50M");
@@ -146,14 +147,14 @@ TEST(rereadpt) {
         ASSERT_OK_ZERO_ERRNO(access(p, F_OK));
         ASSERT_OK(reread_partition_table_fd(loop->fd, /* flags= */ 0, /* args= */ NULL));
 
-        pfd = ASSERT_OK_ERRNO(open(p, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY));
+        pfd = ASSERT_OK(xopenat(AT_FDCWD, p, O_RDONLY|O_NONBLOCK|O_NOCTTY));
         ASSERT_OK(blockdev_get_device_size(pfd, &size));
         ASSERT_EQ(size, 15U*1024U*1024U);
         pfd = safe_close(pfd);
 
         /* No change */
         ASSERT_OK(reread_partition_table_fd(loop->fd, /* flags= */ 0, /* args= */ NULL));
-        pfd = ASSERT_OK_ERRNO(open(p, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY));
+        pfd = ASSERT_OK(xopenat(AT_FDCWD, p, O_RDONLY|O_NONBLOCK|O_NOCTTY));
 
         /* Remove */
         log_notice("REMOVING");

src/test/test-rm-rf.c

@@ -147,7 +147,7 @@ TEST(rm_rf_children_rewind) {
         _cleanup_close_ int fd = -EBADF;
 
         ASSERT_OK(mkdtemp_malloc("/tmp/test-rm-rf-rewind.XXXXXXX", &d));
-        fd = ASSERT_OK_ERRNO(open(d, O_RDONLY|O_DIRECTORY|O_CLOEXEC));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, d, O_RDONLY|O_DIRECTORY));
 
         /* Exclude the directory from automatic aging by systemd-tmpfiles, as per
          * https://systemd.io/TEMPORARY_DIRECTORIES */

src/test/test-seccomp.c

@@ -1013,7 +1013,7 @@ static int real_open(const char *path, int flags, mode_t mode) {
 #if defined __NR_open && __NR_open >= 0
         return (int) syscall(__NR_open, path, flags, mode);
 #else
-        return open(path, flags, mode);
+        return open(path, flags, mode); /* NOLINT(bugprone-unsafe-functions) */
 #endif
 }
 
@@ -1035,6 +1035,9 @@ static int try_fchmodat2(int dirfd, const char *path, mode_t mode, int flags) {
         return RET_NERRNO(fchmodat(dirfd, path, mode, flags));
 }
 
+/* restrict_suid_sgid tests the seccomp filter on the creat() and openat() syscalls. The test has to call
+ * creat() and openat() directly. */
+/* NOLINTBEGIN(bugprone-unsafe-functions) */
 TEST(restrict_suid_sgid) {
         int r;
 
@@ -1228,7 +1231,11 @@ TEST(restrict_suid_sgid) {
                 _exit(EXIT_SUCCESS);
         }
 }
+/* NOLINTEND(bugprone-unsafe-functions) */
 
+/* After seccomp_suppress_sync(), the open() syscall fails with EINVAL when O_SYNC is set. The test calls
+ * open() directly to check that. */
+/* NOLINTBEGIN(bugprone-unsafe-functions) */
 static void test_seccomp_suppress_sync_child(void) {
         _cleanup_(unlink_and_freep) char *path = NULL;
         _cleanup_close_ int fd = -EBADF;
@@ -1260,6 +1267,7 @@ static void test_seccomp_suppress_sync_child(void) {
         ASSERT_ERROR_ERRNO(fsync(-1), EBADF);
         ASSERT_ERROR_ERRNO(syncfs(-1), EBADF);
 }
+/* NOLINTEND(bugprone-unsafe-functions) */
 
 TEST(seccomp_suppress_sync) {
         int r;

src/test/test-socket-util.c

@@ -230,7 +230,7 @@ TEST(passfd_read) {
                 char tmpfile[] = "/tmp/test-socket-util-passfd-read-XXXXXX";
                 ASSERT_OK_ZERO(write_tmpfile(tmpfile, file_contents));
 
-                _cleanup_close_ int tmpfd = ASSERT_OK_ERRNO(open(tmpfile, O_RDONLY));
+                _cleanup_close_ int tmpfd = ASSERT_OK(xopenat(AT_FDCWD, tmpfile, O_RDONLY));
                 ASSERT_OK_ERRNO(unlink(tmpfile));
 
                 ASSERT_OK_ZERO(send_one_fd(pair[1], tmpfd, MSG_DONTWAIT));
@@ -296,7 +296,7 @@ TEST(passfd_contents_read) {
 
                 ASSERT_OK_ZERO(write_tmpfile(tmpfile, file_contents));
 
-                _cleanup_close_ int tmpfd = ASSERT_OK_ERRNO(open(tmpfile, O_RDONLY));
+                _cleanup_close_ int tmpfd = ASSERT_OK(xopenat(AT_FDCWD, tmpfile, O_RDONLY));
                 ASSERT_OK_ERRNO(unlink(tmpfile));
 
                 ASSERT_OK_POSITIVE(send_one_fd_iov(pair[1], tmpfd, &iov, 1, MSG_DONTWAIT));
@@ -505,7 +505,7 @@ TEST(sockaddr_un_set_path) {
         free(j);
         ASSERT_NOT_NULL(j = path_join(t, "sock"));
 
-        ASSERT_OK_ERRNO(fd3 = open(j, O_CLOEXEC|O_PATH|O_NOFOLLOW));
+        ASSERT_OK(fd3 = xopenat(AT_FDCWD, j, O_PATH|O_NOFOLLOW));
         ASSERT_OK(sockaddr_un_set_path(&sa.un, FORMAT_PROC_FD_PATH(fd3))); /* connect via O_PATH instead, circumventing 108ch limit */
 
         ASSERT_OK_ERRNO(connect(fd2, &sa.sa, sockaddr_len(&sa)));

src/test/test-stat-util.c

@@ -119,8 +119,8 @@ TEST(inode_same) {
         ASSERT_OK_POSITIVE(inode_same("/proc", "/proc", /* flags= */ 0));
         ASSERT_OK_POSITIVE(inode_same("/proc", "/proc", AT_SYMLINK_NOFOLLOW));
 
-        _cleanup_close_ int fd1 = ASSERT_OK_ERRNO(open("/dev/null", O_CLOEXEC|O_RDONLY)),
-                fd2 = ASSERT_OK_ERRNO(open("/dev/null", O_CLOEXEC|O_RDONLY));
+        _cleanup_close_ int fd1 = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY)),
+                fd2 = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
 
         ASSERT_OK_POSITIVE(inode_same_at(fd1, /* filea= */ NULL, fd2, /* fileb= */ NULL, AT_EMPTY_PATH));
         ASSERT_OK_POSITIVE(inode_same_at(fd2, /* filea= */ NULL, fd1, /* fileb= */ NULL, AT_EMPTY_PATH));
@@ -130,7 +130,7 @@ TEST(inode_same) {
         ASSERT_OK_POSITIVE(inode_same_at(fd2, /* filea= */ NULL, fd2, /* fileb= */ NULL, AT_EMPTY_PATH|AT_SYMLINK_NOFOLLOW));
 
         safe_close(fd2);
-        fd2 = ASSERT_OK_ERRNO(open("/dev/urandom", O_CLOEXEC|O_RDONLY));
+        fd2 = ASSERT_OK(xopenat(AT_FDCWD, "/dev/urandom", O_RDONLY));
 
         ASSERT_OK_EQ(inode_same_at(fd1, /* filea= */ NULL, fd2, /* fileb= */ NULL, AT_EMPTY_PATH), 0);
         ASSERT_OK_EQ(inode_same_at(fd2, /* filea= */ NULL, fd1, /* fileb= */ NULL, AT_EMPTY_PATH), 0);
@@ -173,7 +173,7 @@ TEST(is_symlink_at) {
         _cleanup_close_ int tfd = -EBADF, fd = -EBADF;
 
         ASSERT_OK(tfd = mkdtemp_open(/* template= */ NULL, /* flags= */ 0, &t));
-        ASSERT_OK_ERRNO(fd = openat(tfd, "file", O_CREAT|O_EXCL|O_WRONLY|O_CLOEXEC, 0600));
+        ASSERT_OK(fd = xopenat_full(tfd, "file", O_CREAT|O_EXCL|O_WRONLY, /* xopen_flags= */ 0, 0600));
         fd = safe_close(fd);
         ASSERT_OK_ERRNO(symlinkat("missing", tfd, "dangling"));
 
@@ -182,7 +182,7 @@ TEST(is_symlink_at) {
         ASSERT_ERROR(is_symlink_at(tfd, "missing"), ENOENT);
         ASSERT_OK_ZERO(is_symlink_at(tfd, /* path= */ NULL));
 
-        ASSERT_OK_ERRNO(fd = openat(tfd, "dangling", O_PATH|O_NOFOLLOW|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(tfd, "dangling", O_PATH|O_NOFOLLOW));
         ASSERT_OK_POSITIVE(is_symlink_at(fd, /* path= */ NULL));
         ASSERT_OK_POSITIVE(is_symlink_at(fd, ""));
         ASSERT_ERROR(is_symlink_at(fd, "file"), ENOTDIR);
@@ -270,7 +270,7 @@ TEST(dir_is_empty) {
 
         /* A NULL path checks the directory the fd refers to */
         _cleanup_close_ int fd = -EBADF;
-        ASSERT_OK_ERRNO(fd = open(empty_dir, O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, empty_dir, O_DIRECTORY));
         ASSERT_OK_POSITIVE(dir_is_empty_at(fd, /* path= */ NULL, /* ignore_hidden_or_backup= */ false));
         ASSERT_OK(touch(j));
         ASSERT_OK_ZERO(dir_is_empty_at(fd, /* path= */ NULL, /* ignore_hidden_or_backup= */ false));
@@ -315,7 +315,7 @@ TEST(fd_verify_linked) {
         ASSERT_NOT_NULL(p = path_join(t, "hoge"));
         ASSERT_OK(touch(p));
 
-        fd = ASSERT_OK_ERRNO(open(p, O_CLOEXEC | O_PATH));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, p, O_PATH));
 
         ASSERT_OK(fd_verify_linked(fd));
         ASSERT_OK_ERRNO(unlinkat(tfd, "hoge", 0));

src/test/test-terminal-util.c

@@ -13,6 +13,7 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "memfd-util.h"
 #include "path-util.h"
 #include "process-util.h"
@@ -224,9 +225,9 @@ TEST(terminal_fix_size_vc) {
         /* On a virtual console terminal_fix_size() must not query the terminal at all: it should report
          * success without touching the dimensions the kernel gave us. */
 
-        _cleanup_close_ int fd = open("/dev/tty1", O_RDWR|O_NOCTTY|O_CLOEXEC);
+        _cleanup_close_ int fd = xopenat(AT_FDCWD, "/dev/tty1", O_RDWR|O_NOCTTY);
         if (fd < 0)
-                return (void) log_notice_errno(errno, "Can't open /dev/tty1, skipping: %m");
+                return (void) log_notice_errno(fd, "Can't open /dev/tty1, skipping: %m");
 
         _cleanup_free_ char *name = NULL;
         r = getttyname_harder(fd, &name);
@@ -325,7 +326,7 @@ TEST(terminal_is_pty_fd) {
         fd1 = safe_close(fd1);
         fd2 = safe_close(fd2);
 
-        fd1 = ASSERT_OK_ERRNO(open("/dev/null", O_RDONLY|O_CLOEXEC));
+        fd1 = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
         ASSERT_OK_ZERO(terminal_is_pty_fd(fd1));
 
         /* In container managers real tty devices might be weird, avoid them. */

src/test/test-voa-util.c

@@ -8,6 +8,7 @@
 #include "conf-files.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "mkdir.h"
 #include "path-util.h"
 #include "rm-rf.h"
@@ -64,7 +65,7 @@ TEST(voa_os_identifiers) {
         _cleanup_close_ int root_fd = -EBADF;
 
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &root));
-        ASSERT_OK_ERRNO(root_fd = open(root, O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(root_fd = xopenat(AT_FDCWD, root, O_PATH|O_DIRECTORY));
 
         /* No os-release at all yields the documented default */
         ASSERT_OK_ZERO(voa_os_identifiers(root_fd, &l));
@@ -173,7 +174,7 @@ TEST(voa_list_verifiers) {
         };
 
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &root));
-        ASSERT_OK_ERRNO(root_fd = open(root, O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(root_fd = xopenat(AT_FDCWD, root, O_PATH|O_DIRECTORY));
 
         /* Every copy counts */
         add_file(root, "/usr/share/voa/testos" X509_DIR "a-certificate.pem");
@@ -316,7 +317,7 @@ TEST(voa_list_verifiers_symlinked_load_path_parent) {
         };
 
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &root));
-        ASSERT_OK_ERRNO(root_fd = open(root, O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(root_fd = xopenat(AT_FDCWD, root, O_PATH|O_DIRECTORY));
 
         /* rpm-ostree layout: /usr/local is a symlink to ../var/usrlocal */
         add_dir(root, "/usr");
@@ -356,7 +357,7 @@ TEST(voa_list_verifiers_mode) {
         };
 
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &root));
-        ASSERT_OK_ERRNO(root_fd = open(root, O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(root_fd = xopenat(AT_FDCWD, root, O_PATH|O_DIRECTORY));
 
         add_file(root, "/etc/voa/testos" X509_DIR "a-certificate.pem");
         add_file(root, "/run/voa/testos" X509_DIR "b-certificate.pem");

src/test/test-xattr-util.c

@@ -42,7 +42,7 @@ TEST(getxattr_at_malloc) {
         value = mfree(value);
 
         safe_close(fd);
-        ASSERT_OK_ERRNO(fd = open("/", O_RDONLY|O_DIRECTORY|O_CLOEXEC|O_NOCTTY));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "/", O_RDONLY|O_DIRECTORY|O_NOCTTY));
         r = getxattr_at_malloc(fd, "usr", "user.idontexist", /* at_flags= */ 0, &value, /* ret_size= */ NULL);
         ASSERT_TRUE(ERRNO_IS_NEG_XATTR_ABSENT(r));
 
@@ -57,7 +57,7 @@ TEST(getxattr_at_malloc) {
         ASSERT_TRUE(ERRNO_IS_NEG_XATTR_ABSENT(r));
 
         safe_close(fd);
-        ASSERT_OK_ERRNO(fd = open(x, O_PATH|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, x, O_PATH));
         ASSERT_OK(getxattr_at_malloc(fd, /* path= */ NULL, "user.foo", /* at_flags= */ 0, &value, /* ret_size= */ NULL));
         ASSERT_STREQ(value, "bar");
         value = mfree(value);
@@ -164,7 +164,7 @@ TEST(xsetxattr) {
         verify_xattr(dfd, "");
 
         /* by fd (O_PATH) */
-        ASSERT_OK_ERRNO(fd = openat(dfd, "test", O_PATH|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(dfd, "test", O_PATH));
 
         ASSERT_OK(xremovexattr(fd, "", /* at_flags= */ 0, "user.foo"));
 
@@ -176,7 +176,7 @@ TEST(xsetxattr) {
 
         fd = safe_close(fd);
 
-        fd = openat(dfd, "test", O_RDONLY|O_CLOEXEC);
+        fd = xopenat(dfd, "test", O_RDONLY);
 
         ASSERT_OK(xsetxattr_full(fd, /* path= */ NULL, /* at_flags= */ 0, "user.foo", "fd_regular", SIZE_MAX, XATTR_REPLACE));
         verify_xattr(dfd, "fd_regular");
@@ -188,7 +188,7 @@ TEST(xsetxattr) {
 
         /* user.* xattrs are not supported on symlinks. Use trusted.* which requires privilege. */
         ASSERT_OK_ERRNO(symlinkat("empty", dfd, "symlink"));
-        ASSERT_OK_ERRNO(fd = openat(dfd, "symlink", O_NOFOLLOW|O_PATH|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(dfd, "symlink", O_NOFOLLOW|O_PATH));
 
         ASSERT_ERROR(xsetxattr(dfd, "symlink", AT_SYMLINK_FOLLOW, "trusted.test", "bogus"), ENOENT);