diff --git a/.clang-tidy b/.clang-tidy
index c784c9532b1..ccd2d12069d 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -63,6 +63,9 @@ CheckOptions:
     ^ntohs$,be16toh(),is confusing;
     ^strerror$,STRERROR() or printf %m,is not thread-safe;
     ^accept$,accept4(),is not O_CLOEXEC-safe;
+    ^open$,xopenat(),does not set O_CLOEXEC by default;
+    ^openat$,xopenat(),does not set O_CLOEXEC by default;
+    ^creat$,xopenat(),is an obsolete relic that does not set O_CLOEXEC;
     ^dirname$,path_extract_directory(),is icky;
     ^basename$,path_extract_filename(),is icky;
     ^setmntent$,libmount_parse_fstab(),libmount parser should be used instead;
diff --git a/docs/CODING_STYLE.md b/docs/CODING_STYLE.md
index df3730e493b..378de8248e2 100644
--- a/docs/CODING_STYLE.md
+++ b/docs/CODING_STYLE.md
@@ -911,6 +911,10 @@ SPDX-License-Identifier: LGPL-2.1-or-later
   `execve()` the `O_CLOEXEC` bit must be cleared explicitly via
   `fd_cloexec(fd, false)` right before the `execve()`.
 
+- Open files with `xopenat()` or one of the other helpers above instead of
+  calling `open()`, `openat()` or `creat()` directly. This also applies to
+  tests. clang-tidy reports direct calls.
+
 - It's a good idea to use `O_NONBLOCK` when opening 'foreign' regular files,
   i.e.  file system objects that are supposed to be regular files whose paths
   were specified by the user and hence might actually refer to other types of
diff --git a/src/basic/chase.c b/src/basic/chase.c
index 12884266006..a89d75a7b02 100644
--- a/src/basic/chase.c
+++ b/src/basic/chase.c
@@ -107,9 +107,9 @@ static int chase_openat2(int root_fd, int dir_fd, const char *path, ChaseFlags c
                 if (path_is_absolute(path))
                         dir_fd = AT_FDCWD;
                 else {
-                        dir_fd_local = open("/", O_CLOEXEC|O_DIRECTORY|O_PATH);
+                        dir_fd_local = xopenat(AT_FDCWD, "/", O_DIRECTORY|O_PATH);
                         if (dir_fd_local < 0)
-                                return -errno;
+                                return dir_fd_local;
                         dir_fd = dir_fd_local;
                 }
         }
diff --git a/src/basic/fd-util.c b/src/basic/fd-util.c
index b791d895da6..93a1bd5137f 100644
--- a/src/basic/fd-util.c
+++ b/src/basic/fd-util.c
@@ -783,6 +783,8 @@ finish:
         return r;
 }
 
+/* fd_reopen() calls open() and openat() directly. clang-tidy reports direct calls in all other code. */
+/* NOLINTBEGIN(bugprone-unsafe-functions) */
 int fd_reopen(int fd, int flags) {
         assert(wildcard_fd_is_valid(fd));
         assert(!FLAGS_SET(flags, O_CREAT));
@@ -854,6 +856,7 @@ int fd_reopen(int fd, int flags) {
 
         return new_fd;
 }
+/* NOLINTEND(bugprone-unsafe-functions) */
 
 static int fd_reopen_propagate_append_and_position(int fd, int flags) {
         /* Invokes fd_reopen(fd, flags), but propagates O_APPEND if set on original fd, and also tries to
diff --git a/src/basic/fs-util.c b/src/basic/fs-util.c
index 125079ae8fa..94b340fa9a3 100644
--- a/src/basic/fs-util.c
+++ b/src/basic/fs-util.c
@@ -1081,6 +1081,9 @@ int open_mkdir_at_full_label(int dirfd, const char *path, int flags, XOpenFlags
         return TAKE_FD(fd);
 }
 
+/* openat_report_new() and xopenat_full_label() call open() and openat() directly. clang-tidy reports
+ * direct calls in all other code. */
+/* NOLINTBEGIN(bugprone-unsafe-functions) */
 int openat_report_new(int dirfd, const char *pathname, int flags, mode_t mode, bool *ret_newly_created) {
         int fd, r;
 
@@ -1531,6 +1534,7 @@ error:
 
         return r;
 }
+/* NOLINTEND(bugprone-unsafe-functions) */
 
 int xopenat_lock_full_label(
                 int dir_fd,
diff --git a/src/fuzz/fuzz-decompress.c b/src/fuzz/fuzz-decompress.c
index 545c0a8961f..d385e4ef5f1 100644
--- a/src/fuzz/fuzz-decompress.c
+++ b/src/fuzz/fuzz-decompress.c
@@ -5,6 +5,7 @@
 #include "alloc-util.h"
 #include "compress.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "fuzz.h"
 #include "memfd-util.h"
 #include "memory-util.h"
@@ -126,7 +127,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
                 if (n < 0)
                         return 0;
 
-                null_fd = open("/dev/null", O_WRONLY|O_CLOEXEC|O_NOCTTY);
+                null_fd = xopenat(AT_FDCWD, "/dev/null", O_WRONLY|O_NOCTTY);
                 if (null_fd < 0)
                         return 0;
 
diff --git a/src/import/test-qcow2.c b/src/import/test-qcow2.c
index 26b0685c317..e3a0a12a91c 100644
--- a/src/import/test-qcow2.c
+++ b/src/import/test-qcow2.c
@@ -3,6 +3,7 @@
 #include <fcntl.h>
 
 #include "fd-util.h"
+#include "fs-util.h"
 #include "log.h"
 #include "qcow2-util.h"
 #include "tests.h"
@@ -18,15 +19,15 @@ int main(int argc, char *argv[]) {
                 return EXIT_FAILURE;
         }
 
-        sfd = open(argv[1], O_RDONLY|O_CLOEXEC|O_NOCTTY);
+        sfd = xopenat(AT_FDCWD, argv[1], O_RDONLY|O_NOCTTY);
         if (sfd < 0) {
-                log_error_errno(errno, "Can't open source file: %m");
+                log_error_errno(sfd, "Can't open source file: %m");
                 return EXIT_FAILURE;
         }
 
-        dfd = open(argv[2], O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY, 0666);
+        dfd = xopenat_full(AT_FDCWD, argv[2], O_WRONLY|O_CREAT|O_NOCTTY, /* xopen_flags= */ 0, 0666);
         if (dfd < 0) {
-                log_error_errno(errno, "Can't open destination file: %m");
+                log_error_errno(dfd, "Can't open destination file: %m");
                 return EXIT_FAILURE;
         }
 
diff --git a/src/import/test-tar.c b/src/import/test-tar.c
index c73062e9ed5..1410692547f 100644
--- a/src/import/test-tar.c
+++ b/src/import/test-tar.c
@@ -4,6 +4,7 @@
 
 #include "errno-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "libarchive-util.h"
 #include "main-func.h"
 #include "tar-util.h"
@@ -31,7 +32,7 @@ static int run(int argc, char **argv) {
                 return r;
 
         int flags = create ? O_CREAT | O_WRONLY | O_TRUNC : O_RDONLY;
-        _cleanup_close_ int fd1 = RET_NERRNO(open(argv[2], flags | O_CLOEXEC, 0666));
+        _cleanup_close_ int fd1 = xopenat_full(AT_FDCWD, argv[2], flags, /* xopen_flags= */ 0, 0666);
         if (fd1 < 0)
                 return log_error_errno(fd1, "Cannot open %s: %m", argv[2]);
 
@@ -41,7 +42,7 @@ static int run(int argc, char **argv) {
                         return log_error_errno(r, "Failed to mkdir %s: %m", argv[3]);
         }
 
-        _cleanup_close_ int fd2 = RET_NERRNO(open(argv[3], O_DIRECTORY | O_CLOEXEC));
+        _cleanup_close_ int fd2 = xopenat(AT_FDCWD, argv[3], O_DIRECTORY);
         if (fd2 < 0)
                 return log_error_errno(fd2, "Cannot open %s: %m", argv[3]);
 
diff --git a/src/libsystemd/sd-future/test-fiber-io.c b/src/libsystemd/sd-future/test-fiber-io.c
index 9a8f19eaeb8..bd4c1fa1bcd 100644
--- a/src/libsystemd/sd-future/test-fiber-io.c
+++ b/src/libsystemd/sd-future/test-fiber-io.c
@@ -12,6 +12,7 @@
 
 #include "alloc-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "terminal-util.h"
 #include "tests.h"
 #include "time-util.h"
@@ -433,7 +434,7 @@ TEST(fiber_io_pty) {
         if (master < 0)
                 return (void) log_tests_skipped_errno(master, "Failed to allocate a pty");
 
-        _cleanup_close_ int slave = ASSERT_OK_ERRNO(open(peer, O_RDWR|O_NOCTTY|O_CLOEXEC));
+        _cleanup_close_ int slave = ASSERT_OK(xopenat(AT_FDCWD, peer, O_RDWR|O_NOCTTY));
 
         struct termios t;
         ASSERT_OK_ERRNO(tcgetattr(slave, &t));
@@ -979,8 +980,8 @@ TEST(fiber_io_sendmsg_recvmsg_fd) {
         ASSERT_OK_ERRNO(socketpair(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC | SOCK_NONBLOCK, 0, sockfd));
 
         /* Create a test file descriptor to send */
-        _cleanup_close_ int test_fd = open("/dev/null", O_RDONLY | O_CLOEXEC);
-        ASSERT_OK_ERRNO(test_fd);
+        _cleanup_close_ int test_fd = xopenat(AT_FDCWD, "/dev/null", O_RDONLY);
+        ASSERT_OK(test_fd);
 
         _cleanup_(sd_future_unrefp) sd_future *fs = NULL, *fr = NULL;
         int args[2] = { sockfd[0], test_fd };
diff --git a/src/libsystemd/sd-hwdb/test-sd-hwdb.c b/src/libsystemd/sd-hwdb/test-sd-hwdb.c
index 80bc92d2af6..e58e0a02a71 100644
--- a/src/libsystemd/sd-hwdb/test-sd-hwdb.c
+++ b/src/libsystemd/sd-hwdb/test-sd-hwdb.c
@@ -7,6 +7,7 @@
 
 #include "errno-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "hwdb-internal.h"
 #include "nulstr-util.h"
 #include "path-util.h"
@@ -84,7 +85,7 @@ static sd_hwdb* hwdb_new_from_blob(const void *data, size_t size) {
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &tmp));
         _cleanup_free_ char *path = ASSERT_NOT_NULL(path_join(tmp, "hwdb.bin"));
 
-        fd = ASSERT_OK_ERRNO(open(path, O_WRONLY|O_CREAT|O_CLOEXEC|O_TRUNC, 0644));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, path, O_WRONLY|O_CREAT|O_TRUNC, /* xopen_flags= */ 0, 0644));
         ASSERT_OK_EQ_ERRNO(write(fd, data, size), (ssize_t) size);
         fd = safe_close(fd);
 
diff --git a/src/libsystemd/sd-journal/test-journal-benchmark.c b/src/libsystemd/sd-journal/test-journal-benchmark.c
index 7dd582602bc..adac0505c1f 100644
--- a/src/libsystemd/sd-journal/test-journal-benchmark.c
+++ b/src/libsystemd/sd-journal/test-journal-benchmark.c
@@ -24,6 +24,7 @@
 #include "fileio.h"
 #include "format-table.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "hash-funcs.h"
 #include "hashmap.h"
 #include "io-util.h"
@@ -661,9 +662,9 @@ static int foreach_journal_file(const char *path, file_callback_t callback, void
                 if (!endswith(de->d_name, ".journal"))
                         continue;
 
-                fd = openat(dirfd(d), de->d_name, O_RDONLY|O_CLOEXEC|O_NOFOLLOW);
+                fd = xopenat(dirfd(d), de->d_name, O_RDONLY|O_NOFOLLOW);
                 if (fd < 0)
-                        return log_error_errno(errno, "Failed to open %s/%s: %m", path, de->d_name);
+                        return log_error_errno(fd, "Failed to open %s/%s: %m", path, de->d_name);
 
                 if (fstat(fd, &st) < 0)
                         return log_error_errno(errno, "Failed to stat %s/%s: %m", path, de->d_name);
diff --git a/src/libsystemd/sd-journal/test-journal-flush.c b/src/libsystemd/sd-journal/test-journal-flush.c
index 0ceb999a561..e013d4cb7a8 100644
--- a/src/libsystemd/sd-journal/test-journal-flush.c
+++ b/src/libsystemd/sd-journal/test-journal-flush.c
@@ -10,6 +10,7 @@
 #include "chattr-util.h"
 #include "dirent-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "journal-file-util.h"
 #include "journal-internal.h"
 #include "logs-show.h"
@@ -70,9 +71,9 @@ static int open_archive_file(sd_journal **ret) {
                 if (newest_realtime >= realtime)
                         continue;
 
-                fd = openat(dirfd(d), de->d_name, O_CLOEXEC | O_NONBLOCK | O_RDONLY);
+                fd = xopenat(dirfd(d), de->d_name, O_NONBLOCK | O_RDONLY);
                 if (fd < 0) {
-                        log_info_errno(errno, "Failed to open /var/log/journal/%s, ignoring: %m", de->d_name);
+                        log_info_errno(fd, "Failed to open /var/log/journal/%s, ignoring: %m", de->d_name);
                         continue;
                 }
 
diff --git a/src/libsystemd/sd-journal/test-journal-interleaving.c b/src/libsystemd/sd-journal/test-journal-interleaving.c
index 88a65047824..53519755fa1 100644
--- a/src/libsystemd/sd-journal/test-journal-interleaving.c
+++ b/src/libsystemd/sd-journal/test-journal-interleaving.c
@@ -18,6 +18,7 @@
 #include "chattr-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "hashmap.h"
 #include "iovec-util.h"
 #include "journal-file-util.h"
@@ -490,7 +491,7 @@ static void test_remove_unlinked_selected_file_one(bool truncate, bool refresh_s
                 sigbus_install();
 
         /* Keep the file open and mapped while the name goes away, like vacuuming does. */
-        fd = ASSERT_OK_ERRNO(open("two.journal", O_WRONLY|O_CLOEXEC));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "two.journal", O_WRONLY));
         ASSERT_OK_ERRNO(unlink("two.journal"));
 
         if (truncate) {
@@ -567,7 +568,7 @@ TEST(keep_linked_selected_file_error) {
         f = ASSERT_NOT_NULL(ordered_hashmap_get(j->files, strjoina(t, "/two.journal")));
         ASSERT_EQ((int) f->location_type, LOCATION_SEEK);
 
-        fd = ASSERT_OK_ERRNO(open("two.journal", O_WRONLY|O_CLOEXEC));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "two.journal", O_WRONLY));
         ASSERT_OK_EQ_ERRNO(pwrite(fd, &type, sizeof(type), f->current_offset), (ssize_t) sizeof(type));
         ASSERT_OK_ERRNO(fsync(fd));
 
@@ -869,8 +870,8 @@ TEST(open_and_follow_edge_cases) {
         sd_journal_close(j);
         j = NULL;
 
-        directory_fd = open(t, O_RDONLY|O_DIRECTORY|O_CLOEXEC);
-        ASSERT_OK_ERRNO(directory_fd);
+        directory_fd = xopenat(AT_FDCWD, t, O_RDONLY|O_DIRECTORY);
+        ASSERT_OK(directory_fd);
         owned_directory_fd = directory_fd;
         ASSERT_OK(sd_journal_open_directory_fd(
                         &j,
@@ -886,8 +887,8 @@ TEST(open_and_follow_edge_cases) {
         ASSERT_OK_ERRNO(rmdir(t));
         ASSERT_OK_ERRNO(rename(renamed, t));
 
-        failure_fd = open(one, O_RDONLY|O_CLOEXEC|O_NONBLOCK);
-        ASSERT_OK_ERRNO(failure_fd);
+        failure_fd = xopenat(AT_FDCWD, one, O_RDONLY|O_NONBLOCK);
+        ASSERT_OK(failure_fd);
         int failure_fds[] = { failure_fd, -EBADF };
         ASSERT_ERROR(sd_journal_open_files_fd(
                              &j,
@@ -898,11 +899,11 @@ TEST(open_and_follow_edge_cases) {
         ASSERT_OK_ERRNO(fcntl(failure_fd, F_GETFD));
 
         int fds[] = {
-                open(one, O_RDONLY|O_CLOEXEC|O_NONBLOCK),
-                open(two, O_RDONLY|O_CLOEXEC|O_NONBLOCK),
+                xopenat(AT_FDCWD, one, O_RDONLY|O_NONBLOCK),
+                xopenat(AT_FDCWD, two, O_RDONLY|O_NONBLOCK),
         };
-        ASSERT_OK_ERRNO(fds[0]);
-        ASSERT_OK_ERRNO(fds[1]);
+        ASSERT_OK(fds[0]);
+        ASSERT_OK(fds[1]);
         ASSERT_OK_ERRNO(rename(one, moved));
         ASSERT_OK(sd_journal_open_files_fd(&j, fds, ELEMENTSOF(fds), SD_JOURNAL_ASSUME_IMMUTABLE));
         ASSERT_OK_ERRNO(unlink(moved));
diff --git a/src/libsystemd/sd-journal/test-journal-verify.c b/src/libsystemd/sd-journal/test-journal-verify.c
index aaab1bbe560..8b4691ab1be 100644
--- a/src/libsystemd/sd-journal/test-journal-verify.c
+++ b/src/libsystemd/sd-journal/test-journal-verify.c
@@ -8,6 +8,7 @@
 #include "ansi-color.h"
 #include "chattr-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "iovec-util.h"
 #include "journal-authenticate.h"
 #include "journal-file-util.h"
@@ -26,7 +27,7 @@ static void bit_toggle(const char *fn, uint64_t p) {
         uint8_t b;
         int fd;
 
-        ASSERT_OK_ERRNO(fd = open(fn, O_RDWR|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, fn, O_RDWR));
 
         ASSERT_EQ(pread(fd, &b, 1, p/8), 1);
 
@@ -242,7 +243,7 @@ static void test_hash_chain_cycle(void) {
         /* Point the second data object of the chain back at the head. Looking up the second data object,
          * which verifying the entry that references it does, would then run into the cycle. */
         back = htole64(head);
-        ASSERT_OK_ERRNO(fd = open("test.journal", O_RDWR|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "test.journal", O_RDWR));
         ASSERT_EQ(pwrite(fd, &back, sizeof(back), tail + offsetof(Object, data.next_hash_offset)),
                   (ssize_t) sizeof(back));
         safe_close(fd);
@@ -347,7 +348,7 @@ static void test_entry_reference_one(bool in_data_object) {
         ASSERT_NE(slot, 0u);
         (void) journal_file_offline_close(f);
 
-        ASSERT_OK_ERRNO(fd = open("test.journal", O_RDWR|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "test.journal", O_RDWR));
         if (in_data_object) {
                 /* Give the data object one more reference, to something that is not an entry object. All
                  * existing references stay intact, hence this is only noticed when the entries a data
diff --git a/src/libsystemd/sd-journal/test-journal.c b/src/libsystemd/sd-journal/test-journal.c
index 97f21a3f6fb..13a9148db91 100644
--- a/src/libsystemd/sd-journal/test-journal.c
+++ b/src/libsystemd/sd-journal/test-journal.c
@@ -8,6 +8,7 @@
 #include "argv-util.h"
 #include "chattr-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "iovec-util.h"
 #include "journal-authenticate.h"
 #include "journal-file-util.h"
@@ -720,7 +721,7 @@ static void test_punch_holes_hash_chain_cycle_one(void) {
 
         /* Make the data object its own successor in the hash chain */
         self = htole64(p);
-        ASSERT_OK_ERRNO(fd = open("test.journal", O_RDWR|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "test.journal", O_RDWR));
         ASSERT_EQ(pwrite(fd, &self, sizeof(self), p + offsetof(Object, data.next_hash_offset)),
                   (ssize_t) sizeof(self));
         ASSERT_OK_ERRNO(close(fd));
@@ -782,7 +783,7 @@ static void test_enumerate_fields_hash_chain_cycle_one(void) {
 
         /* Make the field object its own successor in the hash chain */
         self = htole64(p);
-        ASSERT_OK_ERRNO(fd = open("test.journal", O_RDWR|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "test.journal", O_RDWR));
         ASSERT_EQ(pwrite(fd, &self, sizeof(self), p + offsetof(Object, field.next_hash_offset)),
                   (ssize_t) sizeof(self));
         ASSERT_OK_ERRNO(close(fd));
@@ -839,7 +840,7 @@ static void test_enumerate_unique_field_list_cycle_one(void) {
 
         /* Make the data object its own successor in the list of its field */
         self = htole64(p);
-        ASSERT_OK_ERRNO(fd = open("test.journal", O_RDWR|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "test.journal", O_RDWR));
         ASSERT_EQ(pwrite(fd, &self, sizeof(self), p + offsetof(Object, data.next_field_offset)),
                   (ssize_t) sizeof(self));
         ASSERT_OK_ERRNO(close(fd));
diff --git a/src/libsystemd/sd-json/test-json.c b/src/libsystemd/sd-json/test-json.c
index 6e1f75f893b..3d67de20c4c 100644
--- a/src/libsystemd/sd-json/test-json.c
+++ b/src/libsystemd/sd-json/test-json.c
@@ -13,6 +13,7 @@
 #include "fd-util.h"
 #include "format-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "in-addr-util.h"
 #include "io-util.h"
 #include "iovec-util.h"
@@ -1577,7 +1578,7 @@ TEST(fd_info) {
         ASSERT_OK(sd_json_variant_dump(v, SD_JSON_FORMAT_PRETTY_AUTO | SD_JSON_FORMAT_COLOR_AUTO, NULL, /* prefix= */ NULL));
         v = sd_json_variant_unref(v);
 
-        ASSERT_OK_ERRNO(fd = openat(AT_FDCWD, ".", O_CLOEXEC | O_DIRECTORY | O_PATH));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, ".", O_DIRECTORY | O_PATH));
         ASSERT_OK(json_variant_new_fd_info(&v, fd));
         ASSERT_OK(sd_json_variant_dump(v, SD_JSON_FORMAT_PRETTY_AUTO | SD_JSON_FORMAT_COLOR_AUTO, NULL, /* prefix= */ NULL));
         v = sd_json_variant_unref(v);
@@ -1590,7 +1591,7 @@ TEST(fd_info) {
         v = sd_json_variant_unref(v);
         fd = safe_close(fd);
 
-        fd = open("/sys/class/net/lo/uevent", O_CLOEXEC | O_PATH);
+        fd = xopenat(AT_FDCWD, "/sys/class/net/lo/uevent", O_PATH);
         if (fd >= 0) {
                 ASSERT_OK(json_variant_new_fd_info(&v, fd));
                 ASSERT_OK(sd_json_variant_dump(v, SD_JSON_FORMAT_PRETTY_AUTO | SD_JSON_FORMAT_COLOR_AUTO, NULL, /* prefix= */ NULL));
@@ -1599,7 +1600,7 @@ TEST(fd_info) {
         }
 
         /* block device */
-        fd = open("/dev/sda", O_CLOEXEC | O_PATH);
+        fd = xopenat(AT_FDCWD, "/dev/sda", O_PATH);
         if (fd >= 0) {
                 ASSERT_OK(json_variant_new_fd_info(&v, fd));
                 ASSERT_OK(sd_json_variant_dump(v, SD_JSON_FORMAT_PRETTY_AUTO | SD_JSON_FORMAT_COLOR_AUTO, NULL, /* prefix= */ NULL));
diff --git a/src/login/test-session-properties.c b/src/login/test-session-properties.c
index 0372b963718..627d1bc715c 100644
--- a/src/login/test-session-properties.c
+++ b/src/login/test-session-properties.c
@@ -16,6 +16,7 @@
 #include "bus-common-errors.h"
 #include "bus-locator.h"
 #include "device-util.h"
+#include "fs-util.h"
 #include "tests.h"
 #include "time-util.h"
 
@@ -113,7 +114,7 @@ TEST(set_tty) {
         if (!arg_tty)
                 return;
 
-        fd = ASSERT_OK_ERRNO(open(arg_tty, O_RDWR|O_CLOEXEC|O_NOCTTY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, arg_tty, O_RDWR|O_NOCTTY));
 
         ASSERT_OK(sd_bus_open_system(&bus));
 
diff --git a/src/nsresourced/test-userns-restrict.c b/src/nsresourced/test-userns-restrict.c
index ba8674231f1..1e611b546d2 100644
--- a/src/nsresourced/test-userns-restrict.c
+++ b/src/nsresourced/test-userns-restrict.c
@@ -12,6 +12,7 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "namespace-util.h"
 #include "path-util.h"
 #include "pidref.h"
@@ -84,7 +85,7 @@ TEST(userns_restrict) {
          * permission error before we even get to the BPF-LSM. */
         ASSERT_OK_ERRNO(chown(t, CONTAINER_UID_MIN, CONTAINER_UID_MIN));
 
-        host_fd1 = ASSERT_OK_ERRNO(open(t, O_DIRECTORY|O_CLOEXEC));
+        host_fd1 = ASSERT_OK(xopenat(AT_FDCWD, t, O_DIRECTORY));
         host_tmpfs = ASSERT_OK(make_tmpfs_fsmount());
 
         _cleanup_free_ char *idmap = NULL;
@@ -106,18 +107,22 @@ TEST(userns_restrict) {
                 private_tmpfs = make_tmpfs_fsmount();
 
                 /* These two host mounts would record our transient UID on disk, hence are inaccessible */
-                ASSERT_ERROR_ERRNO(openat(host_fd1, "test", O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
-                ASSERT_ERROR_ERRNO(openat(host_tmpfs, "xxx", O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(host_fd1, "test", O_RDWR|O_CREAT,
+                                          /* xopen_flags= */ 0, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(host_tmpfs, "xxx", O_RDWR|O_CREAT,
+                                          /* xopen_flags= */ 0, 0666), EPERM);
                 ASSERT_ERROR_ERRNO(mkdirat(host_fd1, "test2", 0666), EPERM);
                 ASSERT_ERROR_ERRNO(mkdirat(host_tmpfs, "xxx2", 0666), EPERM);
 
                 /* But this mount created locally should be fine */
-                safe_close(ASSERT_OK_ERRNO(openat(private_tmpfs, "yyy", O_RDWR|O_CREAT|O_CLOEXEC, 0666)));
+                safe_close(ASSERT_OK(xopenat_full(private_tmpfs, "yyy", O_RDWR|O_CREAT,
+                                                  /* xopen_flags= */ 0, 0666)));
                 ASSERT_OK_ERRNO(mkdirat(private_tmpfs, "yyy2", 0666));
 
                 /* And so should the idmapped host mount: it translates our transient UID to UID 0 before
                  * anything reaches the disk */
-                safe_close(ASSERT_OK_ERRNO(openat(idmapped_tmpfs, "zzz", O_RDWR|O_CREAT|O_CLOEXEC, 0666)));
+                safe_close(ASSERT_OK(xopenat_full(idmapped_tmpfs, "zzz", O_RDWR|O_CREAT,
+                                                  /* xopen_flags= */ 0, 0666)));
                 ASSERT_OK_ERRNO(mkdirat(idmapped_tmpfs, "zzz2", 0666));
 
                 /* chown() is subject to the same policy. Unlike the creation hooks it is handed the ID that
@@ -144,10 +149,12 @@ TEST(userns_restrict) {
                 ASSERT_NOT_NULL(p1 = path_join(t, "newns"));
                 ASSERT_NOT_NULL(p2 = path_join(t, "newns2"));
 
-                ASSERT_ERROR_ERRNO(open(p1, O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(AT_FDCWD, p1, O_RDWR|O_CREAT, /* xopen_flags= */ 0, 0666), EPERM);
                 ASSERT_ERROR_ERRNO(mkdir(p2, 0666), EPERM);
-                ASSERT_ERROR_ERRNO(openat(host_fd1, "newns3", O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
-                ASSERT_ERROR_ERRNO(openat(host_tmpfs, "newns4", O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(host_fd1, "newns3", O_RDWR|O_CREAT,
+                                          /* xopen_flags= */ 0, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(host_tmpfs, "newns4", O_RDWR|O_CREAT,
+                                          /* xopen_flags= */ 0, 0666), EPERM);
 
                 /* And chown() through the clone must stay refused too, not just inode creation. */
                 ASSERT_ERROR_ERRNO(fchownat(AT_FDCWD, t, GID_INVALID, 0, 0), EPERM);
@@ -159,14 +166,18 @@ TEST(userns_restrict) {
                 ASSERT_NOT_NULL(p3 = path_join(t, "newuser"));
                 ASSERT_NOT_NULL(p4 = path_join(t, "newuser2"));
 
-                ASSERT_ERROR_ERRNO(open(p3, O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(AT_FDCWD, p3, O_RDWR|O_CREAT, /* xopen_flags= */ 0, 0666), EPERM);
                 ASSERT_ERROR_ERRNO(mkdir(p4, 0666), EPERM);
-                ASSERT_ERROR_ERRNO(openat(host_fd1, "newuser3", O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
-                ASSERT_ERROR_ERRNO(openat(host_tmpfs, "newuser4", O_RDWR|O_CREAT|O_CLOEXEC, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(host_fd1, "newuser3", O_RDWR|O_CREAT,
+                                          /* xopen_flags= */ 0, 0666), EPERM);
+                ASSERT_ERROR(xopenat_full(host_tmpfs, "newuser4", O_RDWR|O_CREAT,
+                                          /* xopen_flags= */ 0, 0666), EPERM);
 
                 /* …while what was legitimately writable before stays writable */
-                safe_close(ASSERT_OK_ERRNO(openat(private_tmpfs, "aaa", O_RDWR|O_CREAT|O_CLOEXEC, 0666)));
-                safe_close(ASSERT_OK_ERRNO(openat(idmapped_tmpfs, "bbb", O_RDWR|O_CREAT|O_CLOEXEC, 0666)));
+                safe_close(ASSERT_OK(xopenat_full(private_tmpfs, "aaa", O_RDWR|O_CREAT,
+                                                  /* xopen_flags= */ 0, 0666)));
+                safe_close(ASSERT_OK(xopenat_full(idmapped_tmpfs, "bbb", O_RDWR|O_CREAT,
+                                                  /* xopen_flags= */ 0, 0666)));
 
                 _exit(EXIT_SUCCESS);
         }
@@ -295,7 +306,7 @@ TEST(userns_restrict_overlayfs) {
                 _cleanup_free_ char *f = NULL, *uf = NULL;
                 ASSERT_NOT_NULL(f = path_join(merged, "f"));
                 ASSERT_NOT_NULL(uf = path_join(upper, "f"));
-                safe_close(ASSERT_OK_ERRNO(open(f, O_RDWR|O_CREAT|O_CLOEXEC, 0666)));
+                safe_close(ASSERT_OK(xopenat_full(AT_FDCWD, f, O_RDWR|O_CREAT, /* xopen_flags= */ 0, 0666)));
                 ASSERT_OK_ERRNO(access(uf, F_OK));
                 ASSERT_OK_ERRNO(fchownat(AT_FDCWD, f, UID_INVALID, 0, 0));
 
diff --git a/src/repart/repart.c b/src/repart/repart.c
index d28125db58b..3b2588454ba 100644
--- a/src/repart/repart.c
+++ b/src/repart/repart.c
@@ -7601,9 +7601,9 @@ static int partition_manifest_write(Context *context, Partition *p, const char *
 
         log_info("Generating manifest of %s filesystem.", p->format);
 
-        _cleanup_close_ int dir_fd = open(root, O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW);
+        _cleanup_close_ int dir_fd = xopenat(AT_FDCWD, root, O_DIRECTORY|O_NOFOLLOW);
         if (dir_fd < 0)
-                return log_error_errno(errno, "Failed to open populated tree '%s': %m", root);
+                return log_error_errno(dir_fd, "Failed to open populated tree '%s': %m", root);
 
         _cleanup_close_ int dup_fd = fcntl(p->manifest_fd, F_DUPFD_CLOEXEC, 3);
         if (dup_fd < 0)
diff --git a/src/test/test-async.c b/src/test/test-async.c
index 9927e7aa5fd..7dc6340eef9 100644
--- a/src/test/test-async.c
+++ b/src/test/test-async.c
@@ -52,7 +52,7 @@ TEST(asynchronous_close) {
 
                 ASSERT_OK(make_reaper_process(true));
 
-                fd = open("/dev/null", O_RDONLY|O_CLOEXEC);
+                fd = xopenat(AT_FDCWD, "/dev/null", O_RDONLY);
                 ASSERT_OK(fd);
                 asynchronous_close(fd);
                 wait_fd_closed(fd);
diff --git a/src/test/test-bpf-devices.c b/src/test/test-bpf-devices.c
index e4ac5fa6bca..382b0311521 100644
--- a/src/test/test-bpf-devices.c
+++ b/src/test/test-bpf-devices.c
@@ -39,14 +39,14 @@ static void test_policy_closed(const char *cgroup_path, BPFProgram **installed_p
                           "/dev/ptmx") {
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
-                wrong += fd < 0 && errno == EPERM;
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
+                wrong += fd == -EPERM;
                 /* We ignore errors other than EPERM, e.g. ENOENT or ENXIO */
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
-                wrong += fd2 < 0 && errno == EPERM;
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
+                wrong += fd2 == -EPERM;
         }
         ASSERT_EQ(wrong, 0U);
 }
@@ -77,12 +77,12 @@ static void test_policy_strict(const char *cgroup_path, BPFProgram **installed_p
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
                 const char *s = "/dev/null";
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd < 0;
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
                 wrong += fd2 < 0;
         }
 
@@ -90,12 +90,12 @@ static void test_policy_strict(const char *cgroup_path, BPFProgram **installed_p
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
                 const char *s = "/dev/random";
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd < 0;
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
                 wrong += fd2 >= 0;
         }
 
@@ -103,12 +103,12 @@ static void test_policy_strict(const char *cgroup_path, BPFProgram **installed_p
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
                 const char *s = "/dev/zero";
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd >= 0;
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
                 wrong += fd2 < 0;
         }
 
@@ -116,12 +116,12 @@ static void test_policy_strict(const char *cgroup_path, BPFProgram **installed_p
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
                 const char *s = "/dev/full";
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd >= 0;
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
                 wrong += fd2 >= 0;
         }
 
@@ -149,12 +149,12 @@ static void test_policy_allow_list_major(const char *pattern, const char *cgroup
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
                 const char *s = "/dev/null";
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd < 0;
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
                 wrong += fd2 < 0;
         }
 
@@ -162,12 +162,12 @@ static void test_policy_allow_list_major(const char *pattern, const char *cgroup
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
                 const char *s = "/dev/full";
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd < 0;
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
                 wrong += fd2 < 0;
         }
 
@@ -175,12 +175,12 @@ static void test_policy_allow_list_major(const char *pattern, const char *cgroup
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
                 const char *s = "/dev/tty";
 
-                fd = open(s, O_CLOEXEC|O_RDONLY|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDONLY|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd >= 0;
 
-                fd2 = open(s, O_CLOEXEC|O_WRONLY|O_NOCTTY);
-                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(errno) : "-");
+                fd2 = xopenat(AT_FDCWD, s, O_WRONLY|O_NOCTTY);
+                log_debug("open(%s, \"w\") = %d/%s", s, fd2, fd2 < 0 ? ERRNO_NAME(fd2) : "-");
                 wrong += fd2 >= 0;
         }
 
@@ -207,8 +207,8 @@ static void test_policy_allow_list_major_star(char type, const char *cgroup_path
                 _cleanup_close_ int fd = -EBADF;
                 const char *s = "/dev/null";
 
-                fd = open(s, O_CLOEXEC|O_RDWR|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDWR|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 if (type == 'c')
                         wrong += fd < 0;
                 else
@@ -239,8 +239,8 @@ static void test_policy_empty(bool add_mismatched, const char *cgroup_path, BPFP
                 _cleanup_close_ int fd = -EBADF;
                 const char *s = "/dev/null";
 
-                fd = open(s, O_CLOEXEC|O_RDWR|O_NOCTTY);
-                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(errno) : "-");
+                fd = xopenat(AT_FDCWD, s, O_RDWR|O_NOCTTY);
+                log_debug("open(%s, \"r\") = %d/%s", s, fd, fd < 0 ? ERRNO_NAME(fd) : "-");
                 wrong += fd >= 0;
         }
 
diff --git a/src/test/test-bpf-restrict-fsaccess.c b/src/test/test-bpf-restrict-fsaccess.c
index 84606cc1e2c..048009d40ea 100644
--- a/src/test/test-bpf-restrict-fsaccess.c
+++ b/src/test/test-bpf-restrict-fsaccess.c
@@ -49,6 +49,7 @@
 #include "devnum-util.h"
 #include "errno-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "log.h"
 #include "memory-util.h"
 #include "pidref.h"
@@ -85,9 +86,9 @@ static int mmap_probe(const char *path, int prot, const char *what) {
         void *addr;
         int r;
 
-        fd = open(path, O_RDONLY | O_CLOEXEC);
+        fd = xopenat(AT_FDCWD, path, O_RDONLY);
         if (fd < 0) {
-                log_error_errno(errno, "Failed to open %s: %m", path);
+                log_error_errno(fd, "Failed to open %s: %m", path);
                 return PROBE_ERROR;
         }
 
@@ -109,9 +110,9 @@ static int mprotect_probe(const char *path, int prot, bool poke, int new_prot, c
         void *addr;
         int r;
 
-        fd = open(path, O_RDONLY | O_CLOEXEC);
+        fd = xopenat(AT_FDCWD, path, O_RDONLY);
         if (fd < 0) {
-                log_error_errno(errno, "Failed to open %s: %m", path);
+                log_error_errno(fd, "Failed to open %s: %m", path);
                 return PROBE_ERROR;
         }
 
@@ -192,9 +193,9 @@ static int do_procmem_cow(const char *path) {
         ssize_t n;
         int r;
 
-        fd = open(path, O_RDONLY | O_CLOEXEC);
+        fd = xopenat(AT_FDCWD, path, O_RDONLY);
         if (fd < 0) {
-                log_error_errno(errno, "Failed to open %s: %m", path);
+                log_error_errno(fd, "Failed to open %s: %m", path);
                 return PROBE_ERROR;
         }
 
@@ -204,11 +205,10 @@ static int do_procmem_cow(const char *path) {
                 return PROBE_ERROR;
         }
 
-        mem_fd = open("/proc/self/mem", O_RDWR | O_CLOEXEC);
+        mem_fd = xopenat(AT_FDCWD, "/proc/self/mem", O_RDWR);
         if (mem_fd < 0) {
-                r = -errno;
                 munmap_safe(addr, 4096);
-                log_error_errno(r, "Failed to open /proc/self/mem: %m");
+                log_error_errno(mem_fd, "Failed to open /proc/self/mem: %m");
                 return PROBE_ERROR;
         }
 
@@ -232,9 +232,9 @@ static int do_execve_check(const char *path) {
         _cleanup_close_ int fd = -EBADF;
         int r;
 
-        fd = open(path, O_RDONLY | O_CLOEXEC);
+        fd = xopenat(AT_FDCWD, path, O_RDONLY);
         if (fd < 0) {
-                log_error_errno(errno, "Failed to open %s: %m", path);
+                log_error_errno(fd, "Failed to open %s: %m", path);
                 return PROBE_ERROR;
         }
 
diff --git a/src/test/test-bpf-token.c b/src/test/test-bpf-token.c
index f991f926012..9d9c9f6908a 100644
--- a/src/test/test-bpf-token.c
+++ b/src/test/test-bpf-token.c
@@ -4,6 +4,7 @@
 
 #include "bpf-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "main-func.h"
 #include "tests.h"
 
@@ -15,9 +16,9 @@ static int run(int argc, char *argv[]) {
         if (r < 0)
                 return r;
 
-        _cleanup_close_ int bpffs_fd = open("/sys/fs/bpf", O_CLOEXEC|O_RDONLY);
+        _cleanup_close_ int bpffs_fd = xopenat(AT_FDCWD, "/sys/fs/bpf", O_RDONLY);
         if (bpffs_fd < 0)
-                return log_error_errno(errno, "Failed to open '/sys/fs/bpf': %m");
+                return log_error_errno(bpffs_fd, "Failed to open '/sys/fs/bpf': %m");
 
         _cleanup_close_ int token_fd = sym_bpf_token_create(bpffs_fd, /* opts= */ NULL);
         if (token_fd == -ENOSYS)
diff --git a/src/test/test-btrfs.c b/src/test/test-btrfs.c
index b2dd95eb6af..ebf897214df 100644
--- a/src/test/test-btrfs.c
+++ b/src/test/test-btrfs.c
@@ -224,7 +224,7 @@ TEST(physical_offset) {
                 _exit(EXIT_FAILURE);
         }
 
-        _cleanup_close_ int fd = ASSERT_OK_ERRNO(openat(dir_fd, "swapfile", O_RDONLY|O_CLOEXEC|O_NOCTTY));
+        _cleanup_close_ int fd = ASSERT_OK(xopenat(dir_fd, "swapfile", O_RDONLY|O_NOCTTY));
 
         unsigned attrs;
         ASSERT_OK(read_attr_fd(fd, &attrs));
diff --git a/src/test/test-chase.c b/src/test/test-chase.c
index f92db1869fe..b6383cbce3d 100644
--- a/src/test/test-chase.c
+++ b/src/test/test-chase.c
@@ -541,7 +541,7 @@ TEST(chaseat) {
 
         /* If the file descriptor points to the root directory, the result will be absolute. */
 
-        fd = open("/", O_CLOEXEC | O_DIRECTORY | O_PATH);
+        fd = xopenat(AT_FDCWD, "/", O_DIRECTORY | O_PATH);
         ASSERT_OK(fd);
 
         ASSERT_OK(chaseat(XAT_FDROOT, fd, p, /* flags= */ 0, &result, /* ret_fd= */ NULL));
@@ -627,7 +627,7 @@ TEST(chaseat) {
         fd = safe_close(fd);
 
         /* A plain file (no symlink indirection) should also work. */
-        fd = ASSERT_OK_ERRNO(openat(tfd, "cwd_test", O_CREAT|O_CLOEXEC, 0600));
+        fd = ASSERT_OK(xopenat_full(tfd, "cwd_test", O_CREAT, /* xopen_flags= */ 0, 0600));
         fd = safe_close(fd);
 
         ASSERT_OK(chaseat(XAT_FDROOT, AT_FDCWD, "cwd_test", /* flags= */ 0, &result, &fd));
@@ -658,7 +658,7 @@ TEST(chaseat) {
         /* Test that absolute path or not are the same when resolving relative to a directory file
          * descriptor and that we always get a relative path back. */
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "def", O_CREAT|O_CLOEXEC, 0700));
+        fd = ASSERT_OK(xopenat_full(tfd, "def", O_CREAT, /* xopen_flags= */ 0, 0700));
         fd = safe_close(fd);
         ASSERT_OK_ERRNO(symlinkat("/def", tfd, "qed"));
         ASSERT_OK(chaseat(tfd, tfd, "qed", /* flags= */ 0, &result, /* ret_fd= */ NULL));
@@ -940,12 +940,12 @@ TEST(chaseat_separate_root_and_dir) {
 
         /* Create a file at the root and a subdirectory containing another file. */
         ASSERT_OK_ERRNO(mkdirat(root_fd, "sub", 0755));
-        sub_fd = ASSERT_OK_ERRNO(openat(root_fd, "sub", O_CLOEXEC|O_DIRECTORY|O_PATH));
+        sub_fd = ASSERT_OK(xopenat(root_fd, "sub", O_DIRECTORY|O_PATH));
 
-        fd = ASSERT_OK_ERRNO(openat(root_fd, "outside", O_CREAT|O_CLOEXEC, 0600));
+        fd = ASSERT_OK(xopenat_full(root_fd, "outside", O_CREAT, /* xopen_flags= */ 0, 0600));
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(sub_fd, "inside", O_CREAT|O_CLOEXEC, 0600));
+        fd = ASSERT_OK(xopenat_full(sub_fd, "inside", O_CREAT, /* xopen_flags= */ 0, 0600));
         fd = safe_close(fd);
 
         /* Relative lookup from sub_fd under root_fd finds sub's own files. */
@@ -1106,8 +1106,8 @@ TEST(trailing_dot_dot_below_root) {
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &t));
         _cleanup_free_ char *sub = ASSERT_PTR(path_join(t, "a/b"));
         ASSERT_OK(mkdir_p(sub, 0700));
-        root_fd = ASSERT_OK_ERRNO(open(t, O_PATH|O_DIRECTORY|O_CLOEXEC));
-        a_fd = ASSERT_OK_ERRNO(openat(root_fd, "a", O_PATH|O_DIRECTORY|O_CLOEXEC));
+        root_fd = ASSERT_OK(xopenat(AT_FDCWD, t, O_PATH|O_DIRECTORY));
+        a_fd = ASSERT_OK(xopenat(root_fd, "a", O_PATH|O_DIRECTORY));
         ASSERT_OK_ERRNO(symlinkat("..", root_fd, "a/up"));
 
         /* The parent of the root directory is the root directory itself. */
@@ -1177,7 +1177,7 @@ TEST(chase_mode) {
 
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &t));
         ASSERT_OK_ERRNO(chmod(t, 0755));
-        ASSERT_OK_ERRNO(tfd = open(t, O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(tfd = xopenat(AT_FDCWD, t, O_PATH|O_DIRECTORY));
 
         ASSERT_NOT_NULL(a = path_join(t, "a"));
         ASSERT_NOT_NULL(b = path_join(t, "a/b"));
@@ -1268,8 +1268,8 @@ TEST(chase_mode) {
          * chaseat() doesn't open "a" in that case. */
         WITH_UMASK(0022)
                 ASSERT_OK(mkdir_p(c, 0755));
-        ASSERT_OK_ERRNO(bfd = open(b, O_PATH|O_DIRECTORY|O_CLOEXEC));
-        ASSERT_OK_ERRNO(cfd = open(c, O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(bfd = xopenat(AT_FDCWD, b, O_PATH|O_DIRECTORY));
+        ASSERT_OK(cfd = xopenat(AT_FDCWD, c, O_PATH|O_DIRECTORY));
         ASSERT_OK(chaseat(tfd, cfd, "..", CHASE_PARENT|CHASE_MAX_MODE, /* ret_path= */ NULL, /* ret_fd= */ NULL));
         ASSERT_OK_ERRNO(chmod(a, 0777));
         ASSERT_ERROR(chaseat(tfd, cfd, "..", CHASE_PARENT|CHASE_MAX_MODE, /* ret_path= */ NULL, /* ret_fd= */ NULL), ENOLINK);
diff --git a/src/test/test-compress.c b/src/test/test-compress.c
index 8cceaffd14a..fc2ff9067d6 100644
--- a/src/test/test-compress.c
+++ b/src/test/test-compress.c
@@ -9,6 +9,7 @@
 #include "compress.h"
 #include "copy.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "io-util.h"
 #include "memfd-util.h"
 #include "path-util.h"
@@ -479,7 +480,7 @@ TEST(compress_decompress_stream) {
 
                 log_debug("/* testing %s stream compression */", compression_to_string(c));
 
-                ASSERT_OK(src = open(srcfile, O_RDONLY|O_CLOEXEC));
+                ASSERT_OK(src = xopenat(AT_FDCWD, srcfile, O_RDONLY));
                 ASSERT_OK(dst = mkostemp_safe(pattern));
 
                 ASSERT_OK(compress_stream(c, src, dst, -1, &uncompressed_size));
diff --git a/src/test/test-copy.c b/src/test/test-copy.c
index aa02b40d9fb..3bbb1f731c3 100644
--- a/src/test/test-copy.c
+++ b/src/test/test-copy.c
@@ -314,7 +314,7 @@ TEST(copy_tree_at_symlink) {
         p = mfree(p);
         q = mfree(q);
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "from", O_CLOEXEC | O_PATH | O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(tfd, "from", O_PATH | O_NOFOLLOW));
         ASSERT_OK(copy_tree_at(fd, /* from= */ NULL, tfd, "to_3", UID_INVALID, GID_INVALID, /* copy_flags= */ 0, /* denylist= */ NULL, /* subvolumes= */ NULL));
         ASSERT_OK(readlinkat_malloc(tfd, "to_3", &p));
         ASSERT_STREQ(p, expect);
@@ -338,8 +338,8 @@ TEST(copy_tree_at_fds) {
         ASSERT_OK_ERRNO(mkdirat(tfd, "to", 0755));
 
         /* Both directories handed in as fds, as copy_tree_at_foreign() does */
-        ASSERT_OK_ERRNO(from_fd = openat(tfd, "from", O_RDONLY|O_DIRECTORY|O_CLOEXEC));
-        ASSERT_OK_ERRNO(to_fd = openat(tfd, "to", O_RDONLY|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(from_fd = xopenat(tfd, "from", O_RDONLY|O_DIRECTORY));
+        ASSERT_OK(to_fd = xopenat(tfd, "to", O_RDONLY|O_DIRECTORY));
         ASSERT_OK(copy_tree_at(from_fd, /* from= */ NULL, to_fd, /* to= */ NULL, UID_INVALID, GID_INVALID,
                                COPY_MERGE_EMPTY, /* denylist= */ NULL, /* subvolumes= */ NULL));
         ASSERT_OK(readlinkat_malloc(tfd, "to/link", &p));
@@ -414,11 +414,11 @@ TEST_RET(copy_bytes) {
         _cleanup_close_ int infd = -EBADF;
         char buf[1024], buf2[1024];
 
-        infd = open("/usr/lib/os-release", O_RDONLY|O_CLOEXEC);
+        infd = xopenat(AT_FDCWD, "/usr/lib/os-release", O_RDONLY);
         if (infd < 0)
-                infd = open("/etc/os-release", O_RDONLY|O_CLOEXEC);
+                infd = xopenat(AT_FDCWD, "/etc/os-release", O_RDONLY);
         if (infd < 0)
-                return log_tests_skipped_errno(errno, "Could not open /usr/lib/os-release or /etc/os-release: %m");
+                return log_tests_skipped_errno(infd, "Could not open /usr/lib/os-release or /etc/os-release: %m");
 
         ASSERT_OK_ZERO_ERRNO(pipe2(pipefd, O_CLOEXEC));
 
@@ -450,7 +450,7 @@ static void test_copy_bytes_regular_file_one(const char *src, uint64_t max_bytes
 
         log_info("%s max_bytes=%" PRIu64, __func__, max_bytes);
 
-        fd = ASSERT_OK_ERRNO(open(src, O_CLOEXEC | O_PATH));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, src, O_PATH));
 
         fd2 = ASSERT_OK(mkostemp_safe(fn2));
 
@@ -789,8 +789,8 @@ TEST_RET(copy_holes_with_gaps) {
         int r;
 
         tfd = ASSERT_OK(mkdtemp_open(/* template= */ NULL, /* flags= */ 0, &t));
-        fd = ASSERT_OK_ERRNO(openat(tfd, "src", O_CREAT | O_RDWR, 0600));
-        fd_copy = ASSERT_OK_ERRNO(openat(tfd, "dst", O_CREAT | O_WRONLY, 0600));
+        fd = ASSERT_OK(xopenat_full(tfd, "src", O_CREAT | O_RDWR, /* xopen_flags= */ 0, 0600));
+        fd_copy = ASSERT_OK(xopenat_full(tfd, "dst", O_CREAT | O_WRONLY, /* xopen_flags= */ 0, 0600));
 
         ASSERT_OK_ERRNO(fstat(fd, &st));
         blksz = st.st_blksize;
@@ -891,8 +891,8 @@ TEST(copy_verify_linked) {
 
         ASSERT_OK(write_string_file_at(tfd, "hoge", "bar bar", WRITE_STRING_FILE_CREATE));
 
-        fd_1 = ASSERT_OK_ERRNO(openat(tfd, "hoge", O_CLOEXEC | O_NOCTTY | O_RDONLY));
-        fd_2 = ASSERT_OK_ERRNO(openat(tfd, "hoge", O_CLOEXEC | O_NOCTTY | O_RDONLY));
+        fd_1 = ASSERT_OK(xopenat(tfd, "hoge", O_NOCTTY | O_RDONLY));
+        fd_2 = ASSERT_OK(xopenat(tfd, "hoge", O_NOCTTY | O_RDONLY));
         ASSERT_OK_ERRNO(unlinkat(tfd, "hoge", 0));
 
         ASSERT_OK(copy_file_at(fd_1, /* from= */ NULL, tfd, "to_1", /* open_flags= */ 0, 0644, /* copy_flags= */ 0));
@@ -904,7 +904,7 @@ TEST(copy_verify_linked) {
 
 static bool enable_fsverity(int dirfd, const char *name, int algo, const char *salt, size_t salt_size) {
         _cleanup_close_ int fd = -EBADF;
-        ASSERT_OK_ERRNO(fd = openat(dirfd, name, O_RDONLY | O_CLOEXEC | O_NOCTTY));
+        ASSERT_OK(fd = xopenat(dirfd, name, O_RDONLY | O_NOCTTY));
 
         struct fsverity_enable_arg enable_arg = {
                 .version = 1,
@@ -931,7 +931,7 @@ static struct fsverity_digest* alloc_fsverity_digest(size_t digest_size) {
 
 static bool measure_fsverity(int dirfd, const char *name, struct fsverity_digest *digest) {
         _cleanup_close_ int fd = -EBADF;
-        ASSERT_OK_ERRNO(fd = openat(dirfd, name, O_RDONLY | O_CLOEXEC | O_NOCTTY));
+        ASSERT_OK(fd = xopenat(dirfd, name, O_RDONLY | O_NOCTTY));
         if (ioctl(fd, FS_IOC_MEASURE_VERITY, digest) == 0)
                 return true;
 
diff --git a/src/test/test-coredump-util.c b/src/test/test-coredump-util.c
index 65c22a8b87e..6688588242b 100644
--- a/src/test/test-coredump-util.c
+++ b/src/test/test-coredump-util.c
@@ -7,6 +7,7 @@
 #include "fd-util.h"
 #include "fileio.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "tests.h"
 
 TEST(coredump_filter_to_from_string) {
@@ -134,7 +135,7 @@ TEST(parse_auxv) {
         _cleanup_close_ int dir_fd = -EBADF;
 
         ASSERT_OK(get_testdata_dir("auxv", &dir));
-        dir_fd = ASSERT_OK_ERRNO(open(dir, O_RDONLY | O_CLOEXEC | O_DIRECTORY | O_PATH));
+        dir_fd = ASSERT_OK(xopenat(AT_FDCWD, dir, O_RDONLY | O_DIRECTORY | O_PATH));
 
         if (__BYTE_ORDER == __LITTLE_ENDIAN) {
                 test_parse_auxv_one(ELFCLASS32, dir_fd, "resolved.arm32", /* expect_at_secure= */ 0, 193, 193, 193, 193);
diff --git a/src/test/test-data-fd-util.c b/src/test/test-data-fd-util.c
index ba9ade8c7e4..9855c646825 100644
--- a/src/test/test-data-fd-util.c
+++ b/src/test/test-data-fd-util.c
@@ -9,6 +9,7 @@
 #include "data-fd-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "io-util.h"
 #include "memfd-util.h"
 #include "pidref.h"
@@ -42,7 +43,7 @@ TEST(copy_data_fd) {
         _cleanup_(pidref_done_sigkill_wait) PidRef pidref = PIDREF_NULL;
         int r;
 
-        fd1 = open("/etc/fstab", O_RDONLY|O_CLOEXEC);
+        fd1 = xopenat(AT_FDCWD, "/etc/fstab", O_RDONLY);
         if (fd1 >= 0) {
 
                 fd2 = ASSERT_OK(copy_data_fd(fd1));
diff --git a/src/test/test-display-quota.c b/src/test/test-display-quota.c
index c7f0cca5c2a..8669e7e68d6 100644
--- a/src/test/test-display-quota.c
+++ b/src/test/test-display-quota.c
@@ -4,6 +4,7 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "log.h"
 #include "main-func.h"
 #include "quota-util.h"
@@ -14,9 +15,9 @@
 static int show_quota(uid_t uid, const char *path) {
         int r;
 
-        _cleanup_close_ int fd = open(path, O_DIRECTORY|O_CLOEXEC);
+        _cleanup_close_ int fd = xopenat(AT_FDCWD, path, O_DIRECTORY);
         if (fd < 0)
-                return log_error_errno(errno, "Failed to open '%s': %m", path);
+                return log_error_errno(fd, "Failed to open '%s': %m", path);
 
         struct dqblk req;
         r = quotactl_fd_with_fallback(fd, QCMD_FIXED(Q_GETQUOTA, USRQUOTA), uid, &req);
diff --git a/src/test/test-dropin.c b/src/test/test-dropin.c
index 44f48939ff1..095221c483f 100644
--- a/src/test/test-dropin.c
+++ b/src/test/test-dropin.c
@@ -7,6 +7,7 @@
 #include "dropin.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "mkdir.h"
 #include "path-util.h"
 #include "rm-rf.h"
@@ -37,11 +38,11 @@ TEST(unit_file_classify_dependency_entry) {
         _cleanup_close_ int root_fd = -EBADF, wants_fd = -EBADF;
 
         ASSERT_OK(mkdtemp_malloc("/tmp/test-dropin-XXXXXX", &root));
-        ASSERT_OK_ERRNO(root_fd = open(root, O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(root_fd = xopenat(AT_FDCWD, root, O_DIRECTORY));
 
         ASSERT_NOT_NULL(wants = path_join(root, "/etc/systemd/system/multi-user.target.wants"));
         ASSERT_OK(mkdir_p(wants, 0755));
-        ASSERT_OK_ERRNO(wants_fd = open(wants, O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(wants_fd = xopenat(AT_FDCWD, wants, O_DIRECTORY));
 
         ASSERT_OK(write_string_file_at(root_fd, "etc/systemd/system/foo.service", "[Unit]",
                                        WRITE_STRING_FILE_CREATE));
@@ -85,8 +86,8 @@ TEST(unit_file_find_dropin_entry) {
         ASSERT_NOT_NULL(low_wants = path_join(low, "multi-user.target.wants"));
         ASSERT_OK(mkdir_p(high_wants, 0755));
         ASSERT_OK(mkdir_p(low_wants, 0755));
-        ASSERT_OK_ERRNO(high_fd = open(high_wants, O_DIRECTORY|O_CLOEXEC));
-        ASSERT_OK_ERRNO(low_fd = open(low_wants, O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(high_fd = xopenat(AT_FDCWD, high_wants, O_DIRECTORY));
+        ASSERT_OK(low_fd = xopenat(AT_FDCWD, low_wants, O_DIRECTORY));
 
         ASSERT_OK_ERRNO(symlinkat("../foo.service", high_fd, "foo.service"));
         ASSERT_OK_ERRNO(symlinkat("../foo.service", low_fd, "foo.service"));
diff --git a/src/test/test-execve.c b/src/test/test-execve.c
index c16620561d6..70a01fad98c 100644
--- a/src/test/test-execve.c
+++ b/src/test/test-execve.c
@@ -2,6 +2,7 @@
 
 #include "exec-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "log.h"
 #include "main-func.h"
 #include "strv.h"
@@ -26,9 +27,9 @@ static int run(int argc, char **argv) {
 
         char **args = strv_skip(argv, 1) ?: STRV_MAKE("/bin/true");
 
-        _cleanup_close_ int fd = open(args[0], O_RDONLY | O_CLOEXEC);
+        _cleanup_close_ int fd = xopenat(AT_FDCWD, args[0], O_RDONLY);
         if (fd < 0)
-                return log_error_errno(errno, "open(%s) failed: %m", args[0]);
+                return log_error_errno(fd, "open(%s) failed: %m", args[0]);
 
         r = ASSERT_FAIL(fexecve_or_execve(fd, args[0], args, /* envp= */ NULL));
         return log_error_errno(r, "fexecve_or_execve(%s) failed: %m", args[0]);
diff --git a/src/test/test-fanotify-util.c b/src/test/test-fanotify-util.c
index 3f5a1382b72..0d732c14362 100644
--- a/src/test/test-fanotify-util.c
+++ b/src/test/test-fanotify-util.c
@@ -70,7 +70,7 @@ TEST(fanotify) {
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &t));
 
         _cleanup_(context_done) Context c = {
-                .mount_fd = ASSERT_OK_ERRNO(open(t, O_DIRECTORY | O_CLOEXEC)),
+                .mount_fd = ASSERT_OK(xopenat(AT_FDCWD, t, O_DIRECTORY)),
         };
         ASSERT_OK_ERRNO(fstatfs(c.mount_fd, &c.sfs));
 
@@ -114,7 +114,7 @@ TEST(fanotify) {
                 ASSERT_OK(set_ensure_consume(&c.stats, &inode_hash_ops, TAKE_PTR(st)));
 
                 /* Trigger a FAN_CLOSE_WRITE for this file. */
-                safe_close(ASSERT_OK_ERRNO(open(p, O_WRONLY | O_CLOEXEC)));
+                safe_close(ASSERT_OK(xopenat(AT_FDCWD, p, O_WRONLY)));
         }
 
         _cleanup_(sd_event_unrefp) sd_event *event = NULL;
diff --git a/src/test/test-fd-util.c b/src/test/test-fd-util.c
index 196aefafbdb..13625f6e732 100644
--- a/src/test/test-fd-util.c
+++ b/src/test/test-fd-util.c
@@ -7,7 +7,6 @@
 
 #include "alloc-util.h"
 #include "capability-util.h"
-#include "errno-util.h"
 #include "fd-util.h"
 #include "fs-util.h"
 #include "memfd-util.h"
@@ -96,7 +95,7 @@ TEST(fd_validate) {
         ASSERT_ERROR(fd_validate(-EBADF), EBADF);
 
         _cleanup_close_ int b = -EBADF;
-        b = ASSERT_OK_ERRNO(open("/dev/null", O_RDONLY|O_CLOEXEC));
+        b = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
 
         ASSERT_OK_ZERO(fd_validate(b));
         safe_close(b);
@@ -110,9 +109,9 @@ TEST(same_fd) {
 
         ASSERT_OK_ERRNO(pipe2(p, O_CLOEXEC));
         a = ASSERT_OK_ERRNO(fcntl(p[0], F_DUPFD, 3));
-        b = ASSERT_OK_ERRNO(open("/bin/sh", O_RDONLY|O_CLOEXEC));
+        b = ASSERT_OK(xopenat(AT_FDCWD, "/bin/sh", O_RDONLY));
         c = ASSERT_OK_ERRNO(fcntl(a, F_DUPFD, 3));
-        d = ASSERT_OK_ERRNO(open("/bin/sh", O_RDONLY|O_CLOEXEC|O_PATH)); /* O_PATH changes error returns in F_DUPFD_QUERY, let's test explicitly */
+        d = ASSERT_OK(xopenat(AT_FDCWD, "/bin/sh", O_RDONLY|O_PATH)); /* O_PATH changes error returns in F_DUPFD_QUERY, let's test explicitly */
         e = ASSERT_OK_ERRNO(fcntl(d, F_DUPFD, 3));
 
         ASSERT_OK_POSITIVE(same_fd(p[0], p[0]));
@@ -182,7 +181,8 @@ TEST(fd_move_above_stdio) {
         ASSERT_GE(original_stdin, 3);
         ASSERT_OK(close_nointr(/* fd= */ 0));
 
-        new_fd = ASSERT_OK_ZERO_ERRNO(open("/dev/null", O_RDONLY));
+        new_fd = ASSERT_OK_ZERO(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
+        ASSERT_OK(fd_cloexec(new_fd, false));
 
         new_fd = fd_move_above_stdio(new_fd);
         ASSERT_GE(new_fd, 3);
@@ -244,7 +244,7 @@ TEST(rearrange_stdio) {
                 pipe_read_fd = fd_move_above_stdio(/* fd= */ 0);
                 ASSERT_GE(pipe_read_fd, 3);
 
-                ASSERT_OK_ZERO_ERRNO(open("/dev/full", O_WRONLY|O_CLOEXEC));
+                ASSERT_OK_ZERO(xopenat(AT_FDCWD, "/dev/full", O_WRONLY));
                 ASSERT_OK_EQ(memfd_new_and_seal_string("data", "foobar"), 2);
 
                 ASSERT_OK(rearrange_stdio(2, /* original_output_fd= */ 0, 1));
@@ -418,7 +418,7 @@ TEST(fd_reopen) {
         int fl;
 
         /* Test this with a directory */
-        fd1 = ASSERT_OK_ERRNO(open("/proc", O_DIRECTORY|O_PATH|O_CLOEXEC));
+        fd1 = ASSERT_OK(xopenat(AT_FDCWD, "/proc", O_DIRECTORY|O_PATH));
 
         ASSERT_OK_ERRNO(fstat(fd1, &st1));
         ASSERT_TRUE(S_ISDIR(st1.st_mode));
@@ -456,7 +456,7 @@ TEST(fd_reopen) {
         safe_close(fd1);
 
         /* And now, test this with a file. */
-        fd1 = ASSERT_OK_ERRNO(open("/proc/version", O_PATH|O_CLOEXEC));
+        fd1 = ASSERT_OK(xopenat(AT_FDCWD, "/proc/version", O_PATH));
 
         ASSERT_OK_ERRNO(fstat(fd1, &st1));
         ASSERT_TRUE(S_ISREG(st1.st_mode));
@@ -495,7 +495,7 @@ TEST(fd_reopen) {
         fd1 = -EBADF;
 
         /* Validate what happens if we reopen a symlink */
-        fd1 = ASSERT_OK_ERRNO(open("/proc/self", O_PATH|O_CLOEXEC|O_NOFOLLOW));
+        fd1 = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self", O_PATH|O_NOFOLLOW));
         ASSERT_OK_ERRNO(fstat(fd1, &st1));
         ASSERT_TRUE(S_ISLNK(st1.st_mode));
 
@@ -528,7 +528,7 @@ TEST(fd_dup_or_reopen_stdio_nonblock) {
         nfd = safe_close(nfd);
         fd = safe_close(fd);
 
-        ASSERT_OK_ERRNO(fd = open(path, O_WRONLY|O_APPEND|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, path, O_WRONLY|O_APPEND));
         ASSERT_OK(nfd = fd_dup_or_reopen_stdio_nonblock(fd, O_WRONLY));
         ASSERT_OK_ERRNO(fl = fcntl(nfd, F_GETFL));
         ASSERT_TRUE(FLAGS_SET(fl, O_APPEND));
@@ -536,7 +536,7 @@ TEST(fd_dup_or_reopen_stdio_nonblock) {
         fd = safe_close(fd);
 
         /* Reading ahead must not move the offset of the original fd */
-        ASSERT_OK_ERRNO(fd = open(path, O_RDONLY|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, path, O_RDONLY));
         ASSERT_OK_EQ_ERRNO(lseek(fd, 2, SEEK_SET), (off_t) 2);
         ASSERT_OK(nfd = fd_dup_or_reopen_stdio_nonblock(fd, O_RDONLY));
         ASSERT_OK_EQ_ERRNO(read(nfd, buf, sizeof(buf) - 1), (ssize_t) 3);
@@ -569,7 +569,7 @@ TEST(fd_reopen_condition) {
         int fd2, fl;
 
         /* Open without O_PATH */
-        fd1 = ASSERT_OK_ERRNO(open("/usr/", O_RDONLY|O_DIRECTORY|O_CLOEXEC));
+        fd1 = ASSERT_OK(xopenat(AT_FDCWD, "/usr/", O_RDONLY|O_DIRECTORY));
 
         fl = fcntl(fd1, F_GETFL);
         ASSERT_TRUE(FLAGS_SET(fl, O_DIRECTORY));
@@ -653,13 +653,13 @@ TEST(dir_fd_is_root) {
 
         ASSERT_OK_POSITIVE(dir_fd_is_root_or_cwd(AT_FDCWD));
 
-        fd = ASSERT_OK_ERRNO(open("/", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/", O_PATH|O_DIRECTORY|O_NOFOLLOW));
         ASSERT_OK_POSITIVE(dir_fd_is_root(fd));
         ASSERT_OK_POSITIVE(dir_fd_is_root_or_cwd(fd));
 
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(open("/usr", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/usr", O_PATH|O_DIRECTORY|O_NOFOLLOW));
         ASSERT_OK_EQ(dir_fd_is_root(fd), 0);
         ASSERT_OK_EQ(dir_fd_is_root_or_cwd(fd), 0);
 
@@ -678,19 +678,19 @@ TEST(dir_fd_is_root) {
 
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(open(tmp, O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, tmp, O_PATH|O_DIRECTORY|O_NOFOLLOW));
         ASSERT_OK_EQ(dir_fd_is_root(fd), 0);
         ASSERT_OK_EQ(dir_fd_is_root_or_cwd(fd), 0);
 
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(open(x, O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, x, O_PATH|O_DIRECTORY|O_NOFOLLOW));
         ASSERT_OK_EQ(dir_fd_is_root(fd), 0);
         ASSERT_OK_EQ(dir_fd_is_root_or_cwd(fd), 0);
 
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(open(y, O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, y, O_PATH|O_DIRECTORY|O_NOFOLLOW));
         ASSERT_OK_EQ(dir_fd_is_root(fd), 0);
         ASSERT_OK_EQ(dir_fd_is_root_or_cwd(fd), 0);
 }
@@ -711,7 +711,7 @@ static void test_path_is_root_at_one(bool expected) {
         ASSERT_OK_ZERO(path_is_root("/../../usr"));
 
         _cleanup_close_ int fd = -EBADF;
-        ASSERT_OK_ERRNO(fd = open("/", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "/", O_PATH|O_DIRECTORY|O_NOFOLLOW));
 
         ASSERT_OK_POSITIVE(path_is_root_at(fd, /* path= */ NULL));
         ASSERT_OK_POSITIVE(path_is_root_at(fd, ""));
@@ -736,7 +736,7 @@ static void test_path_is_root_at_one(bool expected) {
         ASSERT_OK_ZERO(path_is_root_at(fd, "/../../usr"));
 
         safe_close(fd);
-        ASSERT_OK_ERRNO(fd = open("/../", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "/../", O_PATH|O_DIRECTORY|O_NOFOLLOW));
 
         ASSERT_OK_EQ(path_is_root_at(fd, /* path= */ NULL), expected);
         ASSERT_OK_EQ(path_is_root_at(fd, ""), expected);
@@ -826,13 +826,13 @@ TEST(path_is_root_at) {
 TEST(fds_inode_and_mount_same) {
         _cleanup_close_ int fd1 = -EBADF, fd2 = -EBADF, fd3 = -EBADF, fd4 = -EBADF;
 
-        fd1 = open("/sys", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW);
-        fd2 = open("/proc", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW);
-        fd3 = open("/proc", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW);
-        fd4 = open("/", O_CLOEXEC|O_PATH|O_DIRECTORY|O_NOFOLLOW);
+        fd1 = xopenat(AT_FDCWD, "/sys", O_PATH|O_DIRECTORY|O_NOFOLLOW);
+        fd2 = xopenat(AT_FDCWD, "/proc", O_PATH|O_DIRECTORY|O_NOFOLLOW);
+        fd3 = xopenat(AT_FDCWD, "/proc", O_PATH|O_DIRECTORY|O_NOFOLLOW);
+        fd4 = xopenat(AT_FDCWD, "/", O_PATH|O_DIRECTORY|O_NOFOLLOW);
 
         if (fd1 < 0 || fd2 < 0 || fd3 < 0 || fd4 < 0)
-                return (void) log_tests_skipped_errno(errno, "Failed to open /sys or /proc or /");
+                return (void) log_tests_skipped("Failed to open /sys or /proc or /");
 
         ASSERT_OK_EQ(fds_inode_and_mount_same(fd1, fd2), 0);
         ASSERT_OK_POSITIVE(fds_inode_and_mount_same(fd2, fd3));
@@ -863,21 +863,21 @@ TEST(fd_get_path) {
         ASSERT_OK_ERRNO(symlinkat("../regular", tfd, "subdir/symlink"));
         ASSERT_OK_ERRNO(symlinkat("subdir", tfd, "symdir"));
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "regular", O_CLOEXEC|O_PATH));
+        fd = ASSERT_OK(xopenat(tfd, "regular", O_PATH));
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
 
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(AT_FDCWD, "regular", O_CLOEXEC|O_PATH));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "regular", O_PATH));
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
 
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "subdir/symlink", O_CLOEXEC|O_PATH));
+        fd = ASSERT_OK(xopenat(tfd, "subdir/symlink", O_PATH));
         ASSERT_OK(fd_verify_regular(fd));
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -885,7 +885,7 @@ TEST(fd_get_path) {
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(AT_FDCWD, "subdir/symlink", O_CLOEXEC|O_PATH));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "subdir/symlink", O_PATH));
         ASSERT_OK(fd_verify_regular(fd));
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -893,7 +893,7 @@ TEST(fd_get_path) {
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "symdir//./symlink", O_CLOEXEC|O_PATH));
+        fd = ASSERT_OK(xopenat(tfd, "symdir//./symlink", O_PATH));
         ASSERT_OK(fd_verify_regular(fd));
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -901,7 +901,7 @@ TEST(fd_get_path) {
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(AT_FDCWD, "symdir//./symlink", O_CLOEXEC|O_PATH));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "symdir//./symlink", O_PATH));
         ASSERT_OK(fd_verify_regular(fd));
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -911,7 +911,7 @@ TEST(fd_get_path) {
         fd = safe_close(fd);
 
         ASSERT_NOT_NULL(q = path_join(t, "subdir/symlink"));
-        fd = ASSERT_OK_ERRNO(openat(tfd, "subdir/symlink", O_CLOEXEC|O_PATH|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(tfd, "subdir/symlink", O_PATH|O_NOFOLLOW));
         ASSERT_ERROR(fd_verify_regular(fd), ELOOP);
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -919,7 +919,7 @@ TEST(fd_get_path) {
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(AT_FDCWD, "subdir/symlink", O_CLOEXEC|O_PATH|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "subdir/symlink", O_PATH|O_NOFOLLOW));
         ASSERT_ERROR(fd_verify_regular(fd), ELOOP);
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -927,7 +927,7 @@ TEST(fd_get_path) {
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "symdir//./symlink", O_CLOEXEC|O_PATH|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(tfd, "symdir//./symlink", O_PATH|O_NOFOLLOW));
         ASSERT_ERROR(fd_verify_regular(fd), ELOOP);
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -935,7 +935,7 @@ TEST(fd_get_path) {
         p = mfree(p);
         fd = safe_close(fd);
 
-        fd = ASSERT_OK_ERRNO(openat(AT_FDCWD, "symdir//./symlink", O_CLOEXEC|O_PATH|O_NOFOLLOW));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "symdir//./symlink", O_PATH|O_NOFOLLOW));
         ASSERT_ERROR(fd_verify_regular(fd), ELOOP);
         ASSERT_OK(fd_get_path(fd, &p));
         ASSERT_STREQ(p, q);
@@ -952,17 +952,17 @@ TEST(fd_vet_accmode) {
         ASSERT_OK_ZERO(fd_vet_accmode(fd_rw, O_WRONLY));
         ASSERT_OK_POSITIVE(fd_vet_accmode(fd_rw, O_RDWR));
 
-        ASSERT_OK_ERRNO(fd_ro = open(name, O_RDONLY | O_CLOEXEC));
+        ASSERT_OK(fd_ro = xopenat(AT_FDCWD, name, O_RDONLY));
         ASSERT_OK_POSITIVE(fd_vet_accmode(fd_ro, O_RDONLY));
         ASSERT_ERROR(fd_vet_accmode(fd_ro, O_WRONLY), EPROTOTYPE);
         ASSERT_ERROR(fd_vet_accmode(fd_ro, O_RDWR), EPROTOTYPE);
 
-        ASSERT_OK_ERRNO(fd_wo = open(name, O_WRONLY | O_CLOEXEC));
+        ASSERT_OK(fd_wo = xopenat(AT_FDCWD, name, O_WRONLY));
         ASSERT_ERROR(fd_vet_accmode(fd_wo, O_RDONLY), EPROTOTYPE);
         ASSERT_OK_POSITIVE(fd_vet_accmode(fd_wo, O_WRONLY));
         ASSERT_ERROR(fd_vet_accmode(fd_wo, O_RDWR), EPROTOTYPE);
 
-        ASSERT_OK_ERRNO(fd_opath = open(name, O_PATH | O_CLOEXEC));
+        ASSERT_OK(fd_opath = xopenat(AT_FDCWD, name, O_PATH));
         ASSERT_ERROR(fd_vet_accmode(fd_opath, O_RDONLY), EBADFD);
         ASSERT_ERROR(fd_vet_accmode(fd_opath, O_WRONLY), EBADFD);
         ASSERT_ERROR(fd_vet_accmode(fd_opath, O_RDWR), EBADFD);
@@ -975,13 +975,13 @@ TEST(fd_is_writable) {
         ASSERT_OK(fd_rw = mkostemp_safe(name));
         ASSERT_OK_POSITIVE(fd_is_writable(fd_rw));
 
-        ASSERT_OK(fd_ro = open(name, O_RDONLY | O_CLOEXEC));
+        ASSERT_OK(fd_ro = xopenat(AT_FDCWD, name, O_RDONLY));
         ASSERT_OK_ZERO(fd_is_writable(fd_ro));
 
-        ASSERT_OK(fd_wo = open(name, O_WRONLY | O_CLOEXEC));
+        ASSERT_OK(fd_wo = xopenat(AT_FDCWD, name, O_WRONLY));
         ASSERT_OK_POSITIVE(fd_is_writable(fd_wo));
 
-        ASSERT_OK(fd_path = open(name, O_PATH | O_CLOEXEC));
+        ASSERT_OK(fd_path = xopenat(AT_FDCWD, name, O_PATH));
         ASSERT_OK_ZERO(fd_is_writable(fd_path));
 
         ASSERT_SIGNAL(fd_is_writable(-1), SIGABRT);
@@ -997,8 +997,9 @@ TEST(fd_reopen_emptypath) {
 
         ASSERT_OK(tfd = mkdtemp_open(/* template= */ NULL, /* flags= */ 0, &t));
 
-        /* Older kernels ignore the flag and miss the empty path */
-        fd = openat(tfd, "", O_PATH|O_CLOEXEC|O_EMPTYPATH);
+        /* Older kernels ignore the flag and miss the empty path. xopenat() returns -ENOENT for an empty path
+         * without calling openat(), so the probe calls openat() directly. */
+        fd = openat(tfd, "", O_PATH|O_CLOEXEC|O_EMPTYPATH); /* NOLINT(bugprone-unsafe-functions) */
         if (fd < 0 && errno == ENOENT)
                 return (void) log_tests_skipped("kernel lacks O_EMPTYPATH");
         ASSERT_OK_ERRNO(fd);
@@ -1009,8 +1010,8 @@ TEST(fd_reopen_emptypath) {
 
         /* A directory we may read but not search: "." cannot be looked up in it, O_EMPTYPATH needs no lookup */
         ASSERT_OK_ERRNO(mkdirat(tfd, "noexec", 0400));
-        ASSERT_OK_ERRNO(dfd = openat(tfd, "noexec", O_PATH|O_DIRECTORY|O_CLOEXEC));
-        ASSERT_ERROR(RET_NERRNO(openat(dfd, ".", O_RDONLY|O_DIRECTORY|O_CLOEXEC)), EACCES);
+        ASSERT_OK(dfd = xopenat(tfd, "noexec", O_PATH|O_DIRECTORY));
+        ASSERT_ERROR(xopenat(dfd, ".", O_RDONLY|O_DIRECTORY), EACCES);
 
         ASSERT_OK(fd = fd_reopen(dfd, O_RDONLY|O_DIRECTORY));
         ASSERT_OK_POSITIVE(inode_same_at(dfd, /* filea= */ NULL, fd, /* fileb= */ NULL, AT_EMPTY_PATH));
@@ -1020,7 +1021,7 @@ TEST(fd_reopen_cloexec) {
         _cleanup_close_ int fd = -EBADF, reopened = -EBADF;
         int fl;
 
-        ASSERT_OK_ERRNO(fd = open("/proc", O_DIRECTORY|O_PATH|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "/proc", O_DIRECTORY|O_PATH));
 
         /* O_CLOEXEC is implied, whether requested or not */
         ASSERT_OK(reopened = fd_reopen(fd, O_RDONLY|O_DIRECTORY));
diff --git a/src/test/test-fdset.c b/src/test/test-fdset.c
index d3c494598ee..8bdffb485e8 100644
--- a/src/test/test-fdset.c
+++ b/src/test/test-fdset.c
@@ -4,6 +4,7 @@
 
 #include "fd-util.h"
 #include "fdset.h"
+#include "fs-util.h"
 #include "tests.h"
 #include "tmpfile-util.h"
 
@@ -14,14 +15,14 @@ TEST(fdset_new_fill) {
         log_close();
         log_set_open_when_needed(true);
 
-        fd = ASSERT_OK_ERRNO(open("/dev/null", O_CLOEXEC|O_RDONLY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
 
         ASSERT_OK(fdset_new_fill(/* filter_cloexec= */ -1, &fdset));
         ASSERT_TRUE(fdset_contains(fdset, fd));
         fdset = fdset_free(fdset);
         ASSERT_ERROR(fd_validate(fd), EBADF);
 
-        fd = ASSERT_OK_ERRNO(open("/dev/null", O_CLOEXEC|O_RDONLY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
 
         ASSERT_OK(fdset_new_fill(/* filter_cloexec= */ 0, &fdset));
         ASSERT_FALSE(fdset_contains(fdset, fd));
@@ -33,7 +34,8 @@ TEST(fdset_new_fill) {
         fdset = fdset_free(fdset);
         ASSERT_ERROR(fd_validate(fd), EBADF);
 
-        fd = ASSERT_OK_ERRNO(open("/dev/null", O_RDONLY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
+        ASSERT_OK(fd_cloexec(fd, false));
 
         ASSERT_OK(fdset_new_fill(/* filter_cloexec= */ 1, &fdset));
         ASSERT_FALSE(fdset_contains(fdset, fd));
diff --git a/src/test/test-fiemap.c b/src/test/test-fiemap.c
index c7abc8bbc14..7e9e301d016 100644
--- a/src/test/test-fiemap.c
+++ b/src/test/test-fiemap.c
@@ -7,6 +7,7 @@
 
 #include "argv-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "hibernate-util.h"
 #include "log.h"
 #include "tests.h"
@@ -18,9 +19,9 @@ static int test_fiemap_one(const char *path) {
 
         log_info("/* %s */", __func__);
 
-        fd = open(path, O_RDONLY | O_CLOEXEC | O_NONBLOCK);
+        fd = xopenat(AT_FDCWD, path, O_RDONLY | O_NONBLOCK);
         if (fd < 0)
-                return log_error_errno(errno, "failed to open %s: %m", path);
+                return log_error_errno(fd, "failed to open %s: %m", path);
         r = read_fiemap(fd, &fiemap);
         if (r == -EOPNOTSUPP)
                 exit(log_tests_skipped("Not supported"));
diff --git a/src/test/test-fileio.c b/src/test/test-fileio.c
index 71a375a0013..337a9be32e2 100644
--- a/src/test/test-fileio.c
+++ b/src/test/test-fileio.c
@@ -610,7 +610,7 @@ TEST(read_full_file_full) {
 
         /* A NULL filename reads the file the fd refers to */
         _cleanup_close_ int fd = -EBADF;
-        ASSERT_OK_ERRNO(fd = open(fn, O_RDONLY|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, fn, O_RDONLY));
         ASSERT_OK(read_full_file_at(fd, /* filename= */ NULL, &rbuf, &rbuf_size));
         ASSERT_EQ(rbuf_size, sizeof(buf));
         ASSERT_EQ(memcmp(buf, rbuf, rbuf_size), 0);
@@ -624,7 +624,7 @@ TEST(xfopenat_empty_path) {
 
         ASSERT_OK(tfd = mkdtemp_open(NULL, 0, &t));
         ASSERT_OK(write_string_file_at(tfd, "file", "hello", WRITE_STRING_FILE_CREATE));
-        ASSERT_OK_ERRNO(fd = openat(tfd, "file", O_RDONLY|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(tfd, "file", O_RDONLY));
 
         /* A NULL or empty path reopens the fd for reading... */
         ASSERT_OK(xfopenat(fd, /* path= */ NULL, "re", 0, &f));
@@ -920,7 +920,7 @@ TEST(read_boolean_file) {
         ASSERT_OK_ERRNO(chdir(cwd));
 
         /* Also test the dir_fd >= 0 path using an actual fd for /tmp. */
-        ASSERT_OK(dfd = open("/tmp", O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(dfd = xopenat(AT_FDCWD, "/tmp", O_DIRECTORY));
         ASSERT_OK(write_string_file(fn, "1", WRITE_STRING_FILE_TRUNCATE));
         _cleanup_free_ char *bn = NULL;
         ASSERT_OK(path_extract_filename(fn, &bn));
diff --git a/src/test/test-fs-util.c b/src/test/test-fs-util.c
index b35ba3a3f9b..b48f905025e 100644
--- a/src/test/test-fs-util.c
+++ b/src/test/test-fs-util.c
@@ -146,7 +146,7 @@ TEST(access_fd) {
         a = strjoina(arg_test_dir ?: "/tmp", "/access-fd.XXXXXX");
         ASSERT_OK(mkdtemp_malloc(a, &p));
 
-        fd = ASSERT_OK_ERRNO(open(p, O_RDONLY|O_DIRECTORY|O_CLOEXEC));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, p, O_RDONLY|O_DIRECTORY));
 
         ASSERT_OK(access_fd(fd, R_OK));
         ASSERT_OK(access_fd(fd, F_OK));
@@ -269,7 +269,7 @@ TEST(unlinkat_deallocate) {
 
         ASSERT_OK(tempfn_random_child(arg_test_dir, "unlink-deallocation", &p));
 
-        fd = ASSERT_OK_ERRNO(open(p, O_WRONLY|O_CLOEXEC|O_CREAT|O_EXCL, 0600));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, p, O_WRONLY|O_CREAT|O_EXCL, /* xopen_flags= */ 0, 0600));
 
         ASSERT_OK_EQ_ERRNO(write(fd, "hallo\n", 6), 6);
 
@@ -404,7 +404,7 @@ TEST(chmod_and_chown) {
 static void create_binary_file(const char *p, const void *data, size_t l) {
         _cleanup_close_ int fd = -EBADF;
 
-        fd = ASSERT_OK_ERRNO(open(p, O_CREAT|O_WRONLY|O_EXCL|O_CLOEXEC, 0600));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, p, O_CREAT|O_WRONLY|O_EXCL, /* xopen_flags= */ 0, 0600));
         ASSERT_OK_EQ_ERRNO(write(fd, data, l), (ssize_t) l);
 }
 
@@ -881,7 +881,7 @@ TEST(xopenat_socket) {
         ASSERT_OK_ERRNO(mkdirat(tfd, "dir", 0755));
         ASSERT_ERROR(xopenat_full(tfd, "dir", O_PATH, XO_SOCKET, /* mode= */ 0), EISDIR);
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "reg", O_CREAT|O_CLOEXEC, 0600));
+        fd = ASSERT_OK(xopenat_full(tfd, "reg", O_CREAT, /* xopen_flags= */ 0, 0600));
         fd = safe_close(fd);
         ASSERT_ERROR(xopenat_full(tfd, "reg", O_PATH, XO_SOCKET, /* mode= */ 0), ENOTSOCK);
 
@@ -957,7 +957,7 @@ TEST(xopenat_auto_rw_ro) {
          * this when running as root, or as a user with CAP_DAC_OVERRIDE. */
 
         if (have_effective_cap(CAP_DAC_OVERRIDE) <= 0) {
-                fd = ASSERT_OK_ERRNO(openat(tfd, "ro", O_CREAT|O_EXCL|O_WRONLY|O_CLOEXEC, 0444));
+                fd = ASSERT_OK(xopenat_full(tfd, "ro", O_CREAT|O_EXCL|O_WRONLY, /* xopen_flags= */ 0, 0444));
                 fd = safe_close(fd);
                 ASSERT_OK_ERRNO(fchmodat(tfd, "ro", 0444, 0));
 
@@ -1037,23 +1037,23 @@ TEST(linkat_replace) {
 
         tfd = ASSERT_OK(mkdtemp_open(/* template= */ NULL, /* flags= */ 0, &t));
 
-        _cleanup_close_ int fd1 = ASSERT_OK_ERRNO(openat(tfd, "foo", O_CREAT|O_RDWR|O_CLOEXEC, 0600));
+        _cleanup_close_ int fd1 = ASSERT_OK(xopenat_full(tfd, "foo", O_CREAT|O_RDWR, /* xopen_flags= */ 0, 0600));
 
         ASSERT_OK(linkat_replace(tfd, "foo", tfd, "bar"));
         ASSERT_OK(linkat_replace(tfd, "foo", tfd, "bar"));
 
-        _cleanup_close_ int fd1_check = ASSERT_OK_ERRNO(openat(tfd, "bar", O_RDWR|O_CLOEXEC));
+        _cleanup_close_ int fd1_check = ASSERT_OK(xopenat(tfd, "bar", O_RDWR));
 
         ASSERT_OK_POSITIVE(inode_same_at(fd1, /* filea= */ NULL, fd1_check, /* fileb= */ NULL,
                                          AT_EMPTY_PATH));
 
-        _cleanup_close_ int fd2 = ASSERT_OK_ERRNO(openat(tfd, "baz", O_CREAT|O_RDWR|O_CLOEXEC, 0600));
+        _cleanup_close_ int fd2 = ASSERT_OK(xopenat_full(tfd, "baz", O_CREAT|O_RDWR, /* xopen_flags= */ 0, 0600));
 
         ASSERT_OK_EQ(inode_same_at(fd1, /* filea= */ NULL, fd2, /* fileb= */ NULL, AT_EMPTY_PATH), 0);
 
         ASSERT_OK(linkat_replace(tfd, "foo", tfd, "baz"));
 
-        _cleanup_close_ int fd2_check = openat(tfd, "baz", O_RDWR|O_CLOEXEC);
+        _cleanup_close_ int fd2_check = xopenat(tfd, "baz", O_RDWR);
 
         ASSERT_OK_EQ(inode_same_at(fd2, /* filea= */ NULL, fd2_check, /* fileb= */ NULL, AT_EMPTY_PATH), 0);
         ASSERT_OK_POSITIVE(inode_same_at(fd1, /* filea= */ NULL, fd2_check, /* fileb= */ NULL,
@@ -1074,7 +1074,7 @@ TEST(readlinkat_malloc) {
         ASSERT_STREQ(p, expect);
         p = mfree(p);
 
-        fd = ASSERT_OK_ERRNO(openat(tfd, "linkname", O_PATH | O_NOFOLLOW | O_CLOEXEC));
+        fd = ASSERT_OK(xopenat(tfd, "linkname", O_PATH | O_NOFOLLOW));
         ASSERT_OK(readlinkat_malloc(fd, NULL, &p));
         ASSERT_STREQ(p, expect);
         p = mfree(p);
diff --git a/src/test/test-journal-importer.c b/src/test/test-journal-importer.c
index baf4c7eb5ea..b7c275b05f9 100644
--- a/src/test/test-journal-importer.c
+++ b/src/test/test-journal-importer.c
@@ -3,6 +3,7 @@
 #include <fcntl.h>
 
 #include "alloc-util.h"
+#include "fs-util.h"
 #include "journal-importer.h"
 #include "tests.h"
 
@@ -21,7 +22,7 @@ TEST(basic_parsing) {
         int r;
 
         ASSERT_OK(get_testdata_dir("journal-data/journal-1.txt", &journal_data_path));
-        imp.fd = ASSERT_OK_ERRNO(open(journal_data_path, O_RDONLY|O_CLOEXEC));
+        imp.fd = ASSERT_OK(xopenat(AT_FDCWD, journal_data_path, O_RDONLY));
 
         do
                 r = journal_importer_process_data(&imp);
@@ -50,7 +51,7 @@ TEST(bad_input) {
         int r;
 
         ASSERT_OK(get_testdata_dir("journal-data/journal-1.txt", &journal_data_path));
-        imp.fd = ASSERT_OK_ERRNO(open(journal_data_path, O_RDONLY|O_CLOEXEC));
+        imp.fd = ASSERT_OK(xopenat(AT_FDCWD, journal_data_path, O_RDONLY));
 
         do
                 r = journal_importer_process_data(&imp);
diff --git a/src/test/test-kernel-image.c b/src/test/test-kernel-image.c
index 6fcee9e4ffd..11cc219cbde 100644
--- a/src/test/test-kernel-image.c
+++ b/src/test/test-kernel-image.c
@@ -8,6 +8,7 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "glob-util.h"
 #include "kernel-image.h"
 #include "memfd-util.h"
@@ -213,12 +214,12 @@ TEST(installed_kernels) {
                 ASSERT_OK(path_extract_directory(*path, &dir));
                 ASSERT_OK(path_extract_filename(dir, &version));
 
-                _cleanup_close_ int fd = open(*path, O_RDONLY|O_CLOEXEC);
-                if (fd < 0 && ERRNO_IS_PRIVILEGE(errno)) {
-                        log_notice_errno(errno, "Cannot open %s, skipping: %m", *path);
+                _cleanup_close_ int fd = xopenat(AT_FDCWD, *path, O_RDONLY);
+                if (ERRNO_IS_NEG_PRIVILEGE(fd)) {
+                        log_notice_errno(fd, "Cannot open %s, skipping: %m", *path);
                         continue;
                 }
-                ASSERT_OK_ERRNO(fd);
+                ASSERT_OK(fd);
 
                 _cleanup_close_ int decompressed_fd = -EBADF;
                 r = kernel_decompress(fd, &decompressed_fd);
diff --git a/src/test/test-kexec.c b/src/test/test-kexec.c
index 380e7ba2d01..13fd8c8487c 100644
--- a/src/test/test-kexec.c
+++ b/src/test/test-kexec.c
@@ -7,6 +7,7 @@
 #include "alloc-util.h"
 #include "compress.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "io-util.h"
 #include "reboot-util.h"
 #include "string-util.h"
@@ -214,9 +215,9 @@ TEST(system_kernel) {
 
         log_info("Found kernel image: %s", path);
 
-        fd = open(path, O_RDONLY|O_CLOEXEC);
+        fd = xopenat(AT_FDCWD, path, O_RDONLY);
         if (fd < 0) {
-                log_tests_skipped_errno(errno, "Cannot open kernel image '%s'", path);
+                log_tests_skipped_errno(fd, "Cannot open kernel image '%s'", path);
                 return;
         }
 
diff --git a/src/test/test-keyring-util.c b/src/test/test-keyring-util.c
index 91f52a66efc..95ed3e259dc 100644
--- a/src/test/test-keyring-util.c
+++ b/src/test/test-keyring-util.c
@@ -6,6 +6,7 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "iovec-util.h"
 #include "keyring-util.h"
 #include "rm-rf.h"
@@ -178,11 +179,11 @@ TEST(keyring_find_by_name_at) {
 
         /* Below a root without /proc there is no /proc/keys to look at */
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &tmp));
-        ASSERT_OK_ERRNO(empty_fd = open(tmp, O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(empty_fd = xopenat(AT_FDCWD, tmp, O_PATH|O_DIRECTORY));
         ASSERT_ERROR(keyring_find_by_name_at(empty_fd, "anything", getuid(), &serial), ENOENT);
 
         /* The host root behaves like keyring_find_by_name() */
-        ASSERT_OK_ERRNO(root_fd = open("/", O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(root_fd = xopenat(AT_FDCWD, "/", O_PATH|O_DIRECTORY));
         r = keyring_find_by_name_at(root_fd, ".this-keyring-does-not-exist", getuid(), &serial);
         if (ERRNO_IS_NEG_PRIVILEGE(r) || IN_SET(r, -ERFKILL, -ENOENT)) {
                 log_tests_skipped_errno(r, "/proc/keys not available");
diff --git a/src/test/test-label.c b/src/test/test-label.c
index 173bb5140ca..eae851ca4e2 100644
--- a/src/test/test-label.c
+++ b/src/test/test-label.c
@@ -82,7 +82,7 @@ static int labelling_op(int dir_fd, const char *text, const char *path, mode_t m
                 return log_error_errno(r, "Error in pathname =>: %m");
 
         /* Open the file within the directory for writing */
-        write_fd = RET_NERRNO(openat(dir_fd, path, O_CLOEXEC|O_WRONLY|O_TRUNC|O_CREAT, 0644));
+        write_fd = xopenat_full(dir_fd, path, O_WRONLY|O_TRUNC|O_CREAT, /* xopen_flags= */ 0, 0644);
         if (write_fd < 0)
                 return log_error_errno(write_fd, "Error in opening directory for writing =>: %m");
 
diff --git a/src/test/test-loop-util.c b/src/test/test-loop-util.c
index 2c0a8899ad9..f3f77d211a6 100644
--- a/src/test/test-loop-util.c
+++ b/src/test/test-loop-util.c
@@ -13,6 +13,7 @@
 #include "capability-util.h"
 #include "dissect-image.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "gpt.h"
 #include "loop-util.h"
 #include "mkfs-util.h"
@@ -193,7 +194,8 @@ TEST(loop_block) {
         _cleanup_close_ int fd = -EBADF;
 
         ASSERT_OK(tempfn_random_child("/var/tmp", "sfdisk", &p));
-        fd = ASSERT_OK_ERRNO(open(p, O_CREAT|O_EXCL|O_RDWR|O_CLOEXEC|O_NOFOLLOW, 0666));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, p, O_CREAT|O_EXCL|O_RDWR|O_NOFOLLOW,
+                                    /* xopen_flags= */ 0, 0666));
         ASSERT_OK_ERRNO(ftruncate(fd, 256*1024*1024));
 
         cmd = ASSERT_NOT_NULL(strjoin("sfdisk ", p));
@@ -416,7 +418,8 @@ static int make_test_image(int *ret_fd) {
         _cleanup_pclose_ FILE *sfdisk = NULL;
 
         ASSERT_OK(tempfn_random_child("/var/tmp", "sfdisk", &p));
-        int fd = ASSERT_OK_ERRNO(open(p, O_CREAT|O_EXCL|O_RDWR|O_CLOEXEC|O_NOFOLLOW, 0666));
+        int fd = ASSERT_OK(xopenat_full(AT_FDCWD, p, O_CREAT|O_EXCL|O_RDWR|O_NOFOLLOW,
+                                        /* xopen_flags= */ 0, 0666));
         ASSERT_OK_ERRNO(ftruncate(fd, 256*1024*1024));
 
         cmd = ASSERT_NOT_NULL(strjoin("sfdisk ", p));
@@ -655,7 +658,8 @@ TEST(partscan_not_needed_without_partition_table) {
          * to expose a nested partition table though, so any device without one — here simply an empty device —
          * must take the shortcut. */
         ASSERT_OK(tempfn_random_child("/var/tmp", "loop-util", &p));
-        fd = ASSERT_OK_ERRNO(open(p, O_CREAT|O_EXCL|O_RDWR|O_CLOEXEC|O_NOFOLLOW, 0666));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, p, O_CREAT|O_EXCL|O_RDWR|O_NOFOLLOW,
+                                    /* xopen_flags= */ 0, 0666));
         ASSERT_OK_ERRNO(ftruncate(fd, 256*1024*1024));
         (void) unlink(p);
 
@@ -702,7 +706,8 @@ static void test_nested_partition_table_one(const char *nested_table) {
 
         /* Build an image with a single root partition spanning the whole disk. */
         ASSERT_OK(tempfn_random_child("/var/tmp", "sfdisk", &p));
-        fd = ASSERT_OK_ERRNO(open(p, O_CREAT|O_EXCL|O_RDWR|O_CLOEXEC|O_NOFOLLOW, 0666));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, p, O_CREAT|O_EXCL|O_RDWR|O_NOFOLLOW,
+                                    /* xopen_flags= */ 0, 0666));
         ASSERT_OK_ERRNO(ftruncate(fd, 256*1024*1024));
 
         cmd = ASSERT_NOT_NULL(strjoin("sfdisk ", p));
@@ -747,7 +752,7 @@ static void test_nested_partition_table_one(const char *nested_table) {
         /* The partition has partition scanning disabled but now carries a partition table, so the shortcut
          * must be refused and a real loop device with partition scanning allocated (even without
          * LOOP_DEVICE_MAY_POPULATE_PARTITION_TABLE, since there genuinely is a table to scan). */
-        part_fd = ASSERT_OK_ERRNO(open(node, O_RDWR|O_CLOEXEC|O_NOCTTY));
+        part_fd = ASSERT_OK(xopenat(AT_FDCWD, node, O_RDWR|O_NOCTTY));
         ASSERT_OK(loop_device_make(part_fd, O_RDWR, /* offset= */ 0, UINT64_MAX, /* sector_size= */ 0, LO_FLAGS_PARTSCAN, LOCK_SH, &loop));
         ASSERT_TRUE(loop->created);
 #else
diff --git a/src/test/test-manifest-util.c b/src/test/test-manifest-util.c
index b43ff85d0b7..53ce61788a2 100644
--- a/src/test/test-manifest-util.c
+++ b/src/test/test-manifest-util.c
@@ -15,6 +15,7 @@
 #include "fd-util.h"
 #include "fileio.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "hexdecoct.h"
 #include "io-util.h"
 #include "iovec-util.h"
@@ -722,12 +723,12 @@ TEST(manifest_omitted) {
          * make of that */
         ASSERT_OK_ERRNO(fchmodat(tfd, "regular.txt", 0000, 0));
         ASSERT_OK_ERRNO(fchmodat(tfd, "subdir", 0000, 0));
-        _cleanup_close_ int probe_fd = openat(tfd, "regular.txt", O_RDONLY|O_CLOEXEC);
+        _cleanup_close_ int probe_fd = xopenat(tfd, "regular.txt", O_RDONLY);
         if (probe_fd >= 0) {
                 ASSERT_OK_ERRNO(fchmodat(tfd, "subdir", 0755, 0));
                 return (void) log_tests_skipped("Privileged enough to read inaccessible files");
         }
-        ASSERT_EQ(errno, EACCES);
+        ASSERT_ERROR(probe_fd, EACCES);
 
         static const struct {
                 ManifestFormat format;
diff --git a/src/test/test-mount-util.c b/src/test/test-mount-util.c
index 2c1c6984516..67ea614ed80 100644
--- a/src/test/test-mount-util.c
+++ b/src/test/test-mount-util.c
@@ -450,7 +450,7 @@ TEST(umount_recursive_busy) {
                 ASSERT_OK(mount_nofollow_verbose(LOG_INFO, "tmpfs", older, "tmpfs", 0, NULL));
                 ASSERT_OK(mount_nofollow_verbose(LOG_INFO, "tmpfs", busy, "tmpfs", 0, NULL));
 
-                _unused_ _cleanup_close_ int fd = ASSERT_OK_ERRNO(open(busy, O_DIRECTORY|O_CLOEXEC));
+                _unused_ _cleanup_close_ int fd = ASSERT_OK(xopenat(AT_FDCWD, busy, O_DIRECTORY));
 
                 ASSERT_OK_EQ(umount_recursive(prefix, 0), 1);
 
@@ -478,14 +478,14 @@ TEST(fd_make_mount_point) {
         if (r == 0) {
                 _cleanup_close_ int fd = -EBADF, fd2 = -EBADF;
 
-                fd = ASSERT_OK_ERRNO(open(s, O_PATH|O_CLOEXEC));
+                fd = ASSERT_OK(xopenat(AT_FDCWD, s, O_PATH));
 
                 ASSERT_OK_EQ(is_mount_point_at(fd, /* path= */ NULL, AT_SYMLINK_FOLLOW), 0);
 
                 ASSERT_OK_POSITIVE(fd_make_mount_point(fd));
 
                 /* Reopen the inode so that we end up on the new mount */
-                fd2 = open(s, O_PATH|O_CLOEXEC);
+                fd2 = xopenat(AT_FDCWD, s, O_PATH);
 
                 ASSERT_OK_POSITIVE(is_mount_point_at(fd2, /* path= */ NULL, AT_SYMLINK_FOLLOW));
 
@@ -624,7 +624,7 @@ TEST(path_is_network_fs_harder) {
         _cleanup_close_ int dir_fd = -EBADF;
         int r;
 
-        ASSERT_OK(dir_fd = open("/", O_PATH | O_CLOEXEC));
+        ASSERT_OK(dir_fd = xopenat(AT_FDCWD, "/", O_PATH));
         FOREACH_STRING(s,
                        "/", "/dev/", "/proc/", "/run/", "/sys/", "/tmp/", "/usr/", "/var/tmp/",
                        "", ".", "../../../", "/this/path/should/not/exist/for/test-mount-util/") {
diff --git a/src/test/test-mountpoint-util.c b/src/test/test-mountpoint-util.c
index c6a783fa9c4..da0ff928f4e 100644
--- a/src/test/test-mountpoint-util.c
+++ b/src/test/test-mountpoint-util.c
@@ -159,9 +159,9 @@ TEST(path_is_mount_point) {
         ASSERT_NOT_NULL(mkdtemp(tmp_dir));
         file1 = ASSERT_NOT_NULL(path_join(tmp_dir, "file1"));
         file2 = ASSERT_NOT_NULL(path_join(tmp_dir, "file2"));
-        fd = ASSERT_OK_ERRNO(open(file1, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0664));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, file1, O_WRONLY|O_CREAT|O_EXCL, /* xopen_flags= */ 0, 0664));
         close(fd);
-        fd = ASSERT_OK_ERRNO(open(file2, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0664));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, file2, O_WRONLY|O_CREAT|O_EXCL, /* xopen_flags= */ 0, 0664));
         close(fd);
         link1 = ASSERT_NOT_NULL(path_join(tmp_dir, "link1"));
         ASSERT_OK_ZERO_ERRNO(symlink("file1", link1));
@@ -190,7 +190,7 @@ TEST(path_is_mount_point) {
 
         /* file in subdirectory mountpoints */
         dir1file = ASSERT_NOT_NULL(path_join(dir1, "file"));
-        fd = ASSERT_OK_ERRNO(open(dir1file, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0664));
+        fd = ASSERT_OK(xopenat_full(AT_FDCWD, dir1file, O_WRONLY|O_CREAT|O_EXCL, /* xopen_flags= */ 0, 0664));
         close(fd);
 
         ASSERT_OK_EQ(path_is_mount_point_full(dir1file, /* root= */ NULL, AT_SYMLINK_FOLLOW), 0);
@@ -229,7 +229,7 @@ TEST(path_is_mount_point) {
 
                 /* dirs */
                 dir2file = ASSERT_NOT_NULL(path_join(dir2, "file"));
-                fd = ASSERT_OK_ERRNO(open(dir2file, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0664));
+                fd = ASSERT_OK(xopenat_full(AT_FDCWD, dir2file, O_WRONLY|O_CREAT|O_EXCL, /* xopen_flags= */ 0, 0664));
                 close(fd);
 
                 ASSERT_OK_ERRNO(mount(dir2, dir1, /* filesystemtype= */ NULL, MS_BIND, /* data= */ NULL));
@@ -266,7 +266,7 @@ TEST(is_mount_point_at) {
         _cleanup_close_ int fd = -EBADF;
         int r;
 
-        fd = ASSERT_OK_ERRNO(open("/", O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/", O_RDONLY|O_DIRECTORY|O_NOCTTY));
 
         ASSERT_OK_POSITIVE(is_mount_point_at(fd, "/", /* flags= */ 0));
         ASSERT_OK_POSITIVE(is_mount_point_at(fd, "..", /* flags= */ 0));
@@ -280,7 +280,7 @@ TEST(is_mount_point_at) {
         ASSERT_OK_ZERO(is_mount_point_at(fd, "usr/lib", /* flags= */ 0));
 
         safe_close(fd);
-        fd = ASSERT_OK_ERRNO(open("/tmp", O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/tmp", O_RDONLY|O_DIRECTORY|O_NOCTTY));
 
         ASSERT_OK(mkdtemp_malloc("/tmp/not-mounted-XXXXXX", &tmpdir));
         ASSERT_OK(path_extract_filename(tmpdir, &tmpdir_basename));
@@ -288,7 +288,7 @@ TEST(is_mount_point_at) {
         ASSERT_OK_ZERO(is_mount_point_at(fd, strjoina(tmpdir_basename, "/"), /* flags= */ 0));
 
         safe_close(fd);
-        fd = ASSERT_OK_ERRNO(open("/proc", O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc", O_RDONLY|O_DIRECTORY|O_NOCTTY));
 
         ASSERT_OK_POSITIVE(is_mount_point_at(fd, /* path= */ NULL, /* flags= */ 0));
         ASSERT_OK_POSITIVE(is_mount_point_at(fd, "", /* flags= */ 0));
@@ -306,7 +306,7 @@ TEST(is_mount_point_at) {
         ASSERT_OK_ERRNO(chdir(pwd));
 
         safe_close(fd);
-        fd = ASSERT_OK_ERRNO(open("/proc/version", O_RDONLY|O_CLOEXEC|O_NOCTTY));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/version", O_RDONLY|O_NOCTTY));
 
         r = is_mount_point_at(fd, /* path= */ NULL, /* flags= */ 0);
         ASSERT_TRUE(IN_SET(r, 0, -ENOTDIR)); /* on old kernels we can't determine if regular files are mount points if we have no directory fd */
@@ -320,7 +320,7 @@ TEST(is_mount_point_at) {
         struct stat st;
 
         safe_close(fd);
-        ASSERT_OK_ERRNO(fd = open(tmpdir, O_DIRECTORY|O_PATH|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, tmpdir, O_DIRECTORY|O_PATH));
 
         ASSERT_OK_ERRNO(symlinkat("/usr", fd, "symlink"));
 
@@ -329,7 +329,7 @@ TEST(is_mount_point_at) {
                 return;
         ASSERT_OK_ERRNO(mfd);
 
-        ASSERT_OK_ERRNO(rfd = openat(fd, "regular", O_CLOEXEC|O_CREAT|O_EXCL, 0644));
+        ASSERT_OK(rfd = xopenat_full(fd, "regular", O_CREAT|O_EXCL, /* xopen_flags= */ 0, 0644));
 
         ASSERT_OK_ERRNO(move_mount(mfd, "", rfd, "", MOVE_MOUNT_F_EMPTY_PATH|MOVE_MOUNT_T_EMPTY_PATH));
 
@@ -393,7 +393,7 @@ TEST(path_get_mnt_id_at_null) {
         ASSERT_EQ(id1, id2);
         id2 = -1;
 
-        root_fd = ASSERT_OK_ERRNO(open("/", O_DIRECTORY|O_CLOEXEC));
+        root_fd = ASSERT_OK(xopenat(AT_FDCWD, "/", O_DIRECTORY));
 
         ASSERT_OK(path_get_mnt_id_at(root_fd, "/run/", &id2));
         ASSERT_EQ(id1, id2);
@@ -411,7 +411,7 @@ TEST(path_get_mnt_id_at_null) {
         ASSERT_EQ(id1, id2);
         id2 = -1;
 
-        run_fd = ASSERT_OK_ERRNO(openat(root_fd, "run", O_DIRECTORY|O_CLOEXEC));
+        run_fd = ASSERT_OK(xopenat(root_fd, "run", O_DIRECTORY));
 
         id2 = -1;
         ASSERT_OK(path_get_mnt_id_at(run_fd, "", &id2));
diff --git a/src/test/test-mstack.c b/src/test/test-mstack.c
index 7c370fcbe97..6c93e177ffc 100644
--- a/src/test/test-mstack.c
+++ b/src/test/test-mstack.c
@@ -24,8 +24,8 @@ static bool overlayfs_set_fd_lowerdir_plus_supported(void) {
                 return false;
         ASSERT_OK_ERRNO(sb_fd);
 
-        _cleanup_close_ int layer_fd = open("/", O_DIRECTORY|O_CLOEXEC);
-        ASSERT_OK_ERRNO(layer_fd);
+        _cleanup_close_ int layer_fd = xopenat(AT_FDCWD, "/", O_DIRECTORY);
+        ASSERT_OK(layer_fd);
 
         r = RET_NERRNO(fsconfig(sb_fd, FSCONFIG_SET_FD, "lowerdir+", /* value= */ NULL, layer_fd));
         if (r < 0 && (ERRNO_IS_NEG_NOT_SUPPORTED(r) || r == -EINVAL))
@@ -107,8 +107,8 @@ TEST(mstack) {
                         _cleanup_close_ int rfd = -EBADF;
                         ASSERT_OK(mstack_bind_mounts(mstack, w, /* where_fd= */ -EBADF, flags, &rfd));
 
-                        _cleanup_close_ int ofd = open(w, O_PATH|O_CLOEXEC);
-                        ASSERT_OK_ERRNO(ofd);
+                        _cleanup_close_ int ofd = xopenat(AT_FDCWD, w, O_PATH);
+                        ASSERT_OK(ofd);
 
                         ASSERT_OK_ERRNO(faccessat(ofd, "check1", F_OK, AT_SYMLINK_NOFOLLOW));
                         ASSERT_OK_ERRNO(faccessat(ofd, "check2/", F_OK, AT_SYMLINK_NOFOLLOW));
diff --git a/src/test/test-namespace-util.c b/src/test/test-namespace-util.c
index bb87d42dea3..db107a54835 100644
--- a/src/test/test-namespace-util.c
+++ b/src/test/test-namespace-util.c
@@ -8,6 +8,7 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "namespace-util.h"
 #include "pidref.h"
 #include "process-util.h"
@@ -15,7 +16,7 @@
 #include "tests.h"
 
 TEST(fd_is_namespace) {
-        _cleanup_close_ int fd = ASSERT_OK_ERRNO(open("/dev/null", O_RDONLY|O_CLOEXEC));
+        _cleanup_close_ int fd = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
 
         ASSERT_OK_ZERO(fd_is_namespace(fd, _NAMESPACE_TYPE_INVALID));
         ASSERT_OK_ZERO(fd_is_namespace(fd, NAMESPACE_USER));
@@ -35,9 +36,9 @@ TEST(fd_is_namespace) {
 }
 
 TEST(is_our_namespace) {
-        _cleanup_close_ int userns_fd = ASSERT_OK_ERRNO(open("/proc/self/ns/user", O_RDONLY|O_CLOEXEC));
-        _cleanup_close_ int mntns_fd = ASSERT_OK_ERRNO(open("/proc/self/ns/mnt", O_RDONLY|O_CLOEXEC));
-        _cleanup_close_ int fd = ASSERT_OK_ERRNO(open("/dev/null", O_RDONLY|O_CLOEXEC));
+        _cleanup_close_ int userns_fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self/ns/user", O_RDONLY));
+        _cleanup_close_ int mntns_fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self/ns/mnt", O_RDONLY));
+        _cleanup_close_ int fd = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
 
         ASSERT_OK_POSITIVE(is_our_namespace(userns_fd, NAMESPACE_USER));
         ASSERT_OK_POSITIVE(is_our_namespace(mntns_fd, NAMESPACE_MOUNT));
@@ -115,12 +116,12 @@ TEST(namespace_enter_nothing) {
 
                 ASSERT_OK(namespace_enter(-EBADF, -EBADF, -EBADF, -EBADF, -EBADF));
 
-                _cleanup_close_ int userns_fd = ASSERT_OK_ERRNO(open("/proc/self/ns/user", O_RDONLY|O_CLOEXEC));
+                _cleanup_close_ int userns_fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self/ns/user", O_RDONLY));
                 ASSERT_OK(namespace_enter(-EBADF, -EBADF, -EBADF, userns_fd, -EBADF));
 
-                _cleanup_close_ int mntns_fd = ASSERT_OK_ERRNO(open("/proc/self/ns/mnt", O_RDONLY|O_CLOEXEC));
-                _cleanup_close_ int pidns_fd = ASSERT_OK_ERRNO(open("/proc/self/ns/pid", O_RDONLY|O_CLOEXEC));
-                _cleanup_close_ int netns_fd = ASSERT_OK_ERRNO(open("/proc/self/ns/net", O_RDONLY|O_CLOEXEC));
+                _cleanup_close_ int mntns_fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self/ns/mnt", O_RDONLY));
+                _cleanup_close_ int pidns_fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self/ns/pid", O_RDONLY));
+                _cleanup_close_ int netns_fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self/ns/net", O_RDONLY));
                 ASSERT_OK(namespace_enter(pidns_fd, mntns_fd, netns_fd, userns_fd, -EBADF));
 
                 _exit(EXIT_SUCCESS);
diff --git a/src/test/test-namespace.c b/src/test/test-namespace.c
index e69c07e4a80..1495f5c844e 100644
--- a/src/test/test-namespace.c
+++ b/src/test/test-namespace.c
@@ -16,6 +16,7 @@
 #include "alloc-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "libmount-util.h"
 #include "namespace-util.h"
 #include "namespace.h"
@@ -227,12 +228,12 @@ TEST(protect_kernel_logs) {
         if (r == 0) {
                 _cleanup_close_ int fd = -EBADF;
 
-                ASSERT_OK_ERRNO(fd = open("/dev/kmsg", O_RDONLY | O_CLOEXEC));
+                ASSERT_OK(fd = xopenat(AT_FDCWD, "/dev/kmsg", O_RDONLY));
 
                 ASSERT_OK_ZERO(setup_namespace(&p, /* reterr_path= */ NULL));
 
                 ASSERT_OK_ERRNO(setresuid(UID_NOBODY, UID_NOBODY, UID_NOBODY));
-                ASSERT_ERROR_ERRNO(open("/dev/kmsg", O_RDONLY | O_CLOEXEC), EACCES);
+                ASSERT_ERROR(xopenat(AT_FDCWD, "/dev/kmsg", O_RDONLY), EACCES);
 
                 _exit(EXIT_SUCCESS);
         }
@@ -288,7 +289,7 @@ TEST(userns_get_base_uid) {
 
 TEST(namespace_open_by_id) {
         /* Try our own user namespace first to see if the kernel exposes ns_id at all. */
-        _cleanup_close_ int userns_fd = ASSERT_OK_ERRNO(open("/proc/self/ns/user", O_RDONLY|O_CLOEXEC));
+        _cleanup_close_ int userns_fd = ASSERT_OK(xopenat(AT_FDCWD, "/proc/self/ns/user", O_RDONLY));
 
         uint64_t ns_id;
         int r = RET_NERRNO(ioctl(userns_fd, NS_GET_ID, &ns_id));
diff --git a/src/test/test-notify-recv.c b/src/test/test-notify-recv.c
index 49f946e4f2e..3396cb5b7ec 100644
--- a/src/test/test-notify-recv.c
+++ b/src/test/test-notify-recv.c
@@ -8,6 +8,7 @@
 #include "event-util.h"
 #include "fd-util.h"
 #include "fdset.h"
+#include "fs-util.h"
 #include "notify-recv.h"
 #include "pidref.h"
 #include "process-util.h"
@@ -98,10 +99,10 @@ TEST(notify_socket_prepare) {
                 ASSERT_OK_ERRNO(setenv("NOTIFY_SOCKET", path, /* overwrite= */ true));
                 ASSERT_OK_POSITIVE(sd_notify(/* unset_environment= */ false, "FIRST_MESSAGE=1"));
 
-                _cleanup_close_ int fd1 = open("/tmp", O_RDONLY|O_CLOEXEC|O_DIRECTORY);
-                ASSERT_OK_ERRNO(fd1);
-                _cleanup_close_ int fd2 = open("/dev/null", O_RDONLY|O_CLOEXEC);
-                ASSERT_OK_ERRNO(fd2);
+                _cleanup_close_ int fd1 = xopenat(AT_FDCWD, "/tmp", O_RDONLY|O_DIRECTORY);
+                ASSERT_OK(fd1);
+                _cleanup_close_ int fd2 = xopenat(AT_FDCWD, "/dev/null", O_RDONLY);
+                ASSERT_OK(fd2);
 
                 ASSERT_OK_POSITIVE(
                         sd_pid_notify_with_fds(
diff --git a/src/test/test-ns.c b/src/test/test-ns.c
index eb34d40f3e3..f4b04c5204c 100644
--- a/src/test/test-ns.c
+++ b/src/test/test-ns.c
@@ -4,6 +4,7 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+#include "fs-util.h"
 #include "log.h"
 #include "namespace.h"
 #include "tests.h"
@@ -81,7 +82,7 @@ int main(int argc, char *argv[]) {
         _cleanup_(pinned_resource_done) PinnedResource pr = PINNED_RESOURCE_NULL;
 
         if (root_directory) {
-                pr.directory_fd = ASSERT_OK_ERRNO(open(root_directory, O_PATH|O_CLOEXEC|O_DIRECTORY));
+                pr.directory_fd = ASSERT_OK(xopenat(AT_FDCWD, root_directory, O_PATH|O_DIRECTORY));
                 pr.directory = ASSERT_NOT_NULL(strdup(root_directory));
         }
 
diff --git a/src/test/test-pressure.c b/src/test/test-pressure.c
index 8900b3989df..283b2a55a02 100644
--- a/src/test/test-pressure.c
+++ b/src/test/test-pressure.c
@@ -17,6 +17,7 @@
 #include "event-util.h"
 #include "fd-util.h"
 #include "format-util.h"
+#include "fs-util.h"
 #include "hashmap.h"
 #include "path-util.h"
 #include "pidref.h"
@@ -119,8 +120,8 @@ static void test_fake_pressure(
 
         _cleanup_free_ char *j = ASSERT_NOT_NULL(path_join(tmp, "fifo"));
         ASSERT_OK_ERRNO(mkfifo(j, 0600));
-        fifo_fd = open(j, O_CLOEXEC|O_RDWR|O_NONBLOCK);
-        ASSERT_OK_ERRNO(fifo_fd);
+        fifo_fd = xopenat(AT_FDCWD, j, O_RDWR|O_NONBLOCK);
+        ASSERT_OK(fifo_fd);
 
         _cleanup_free_ char *k = ASSERT_NOT_NULL(path_join(tmp, "sock"));
         socket_fd = socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC, 0);
@@ -544,7 +545,8 @@ _noreturn_ static void real_pressure_eat_io(int pipe_fd) {
         for (;;) {
                 _cleanup_close_ int fd = -EBADF;
 
-                fd = open("/var/tmp/.io-pressure-test", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0600);
+                fd = xopenat_full(AT_FDCWD, "/var/tmp/.io-pressure-test", O_WRONLY|O_CREAT|O_TRUNC,
+                                  /* xopen_flags= */ 0, 0600);
                 if (fd < 0)
                         continue;
 
diff --git a/src/test/test-recurse-dir.c b/src/test/test-recurse-dir.c
index 749706941fa..cd90d1af2b5 100644
--- a/src/test/test-recurse-dir.c
+++ b/src/test/test-recurse-dir.c
@@ -5,6 +5,7 @@
 #include <sys/stat.h>
 
 #include "fd-util.h"
+#include "fs-util.h"
 #include "log.h"
 #include "recurse-dir.h"
 #include "rm-rf.h"
@@ -168,7 +169,7 @@ static void test_must_be_flags(void) {
         ASSERT_OK(tfd = mkdtemp_open(/* template= */ NULL, O_DIRECTORY, &t));
 
         ASSERT_OK_ERRNO(mkdirat(tfd, "dir", 0777));
-        ASSERT_OK_ERRNO(reg_fd = openat(tfd, "reg", O_CREAT|O_EXCL|O_WRONLY|O_CLOEXEC, 0666));
+        ASSERT_OK(reg_fd = xopenat_full(tfd, "reg", O_CREAT|O_EXCL|O_WRONLY, /* xopen_flags= */ 0, 0666));
         reg_fd = safe_close(reg_fd);
         ASSERT_OK_ERRNO(symlinkat("reg", tfd, "lnk"));
         ASSERT_OK_ERRNO(mknodat(tfd, "sock", S_IFSOCK|0666, 0));
@@ -203,10 +204,10 @@ int main(int argc, char *argv[]) {
         else
                 p = "/usr/share/man"; /* something hopefully reasonably stable while we run (and limited in size) */
 
-        fd = open(p, O_DIRECTORY|O_CLOEXEC);
-        if (fd < 0 && errno == ENOENT)
-                return log_tests_skipped_errno(errno, "Couldn't open directory %s", p);
-        ASSERT_OK_ERRNO(fd);
+        fd = xopenat(AT_FDCWD, p, O_DIRECTORY);
+        if (fd == -ENOENT)
+                return log_tests_skipped_errno(fd, "Couldn't open directory %s", p);
+        ASSERT_OK(fd);
 
         /* If the test directory is on an overlayfs then files and their directory may return different
          * st_dev in stat results, which confuses nftw into thinking they're on different filesystems and
diff --git a/src/test/test-reread-partition-table-manual.c b/src/test/test-reread-partition-table-manual.c
index 9e10a37354a..a2dbc1c936f 100644
--- a/src/test/test-reread-partition-table-manual.c
+++ b/src/test/test-reread-partition-table-manual.c
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "fd-util.h"
+#include "fs-util.h"
 #include "log.h"
 #include "main-func.h"
 #include "reread-partition-table.h"
@@ -14,9 +15,9 @@ static int run(int argc, char *argv[]) {
         if (argc != 2)
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Expected single parameter, the device node to open.");
 
-        _cleanup_close_ int fd = open(argv[1], O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
+        _cleanup_close_ int fd = xopenat(AT_FDCWD, argv[1], O_RDONLY|O_NONBLOCK|O_NOCTTY);
         if (fd < 0)
-                return log_error_errno(errno, "Failed to open '%s': %m", argv[1]);
+                return log_error_errno(fd, "Failed to open '%s': %m", argv[1]);
 
         r = reread_partition_table_fd(fd, REREADPT_BSD_LOCK|REREADPT_FORCE_UEVENT, /* args= */ NULL);
         if (r < 0)
diff --git a/src/test/test-reread-partition-table.c b/src/test/test-reread-partition-table.c
index 9471faaf330..3b900f8dd32 100644
--- a/src/test/test-reread-partition-table.c
+++ b/src/test/test-reread-partition-table.c
@@ -7,6 +7,7 @@
 #include "capability-util.h"
 #include "errno-util.h"
 #include "fd-util.h"
+#include "fs-util.h"
 #include "loop-util.h"
 #include "memfd-util.h"
 #include "path-util.h"
@@ -98,7 +99,7 @@ TEST(rereadpt) {
         ASSERT_OK_ZERO_ERRNO(access(p, F_OK));
 
         _cleanup_close_ int pfd = -EBADF;
-        ASSERT_OK_ERRNO(pfd = open(p, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY));
+        ASSERT_OK(pfd = xopenat(AT_FDCWD, p, O_RDONLY|O_NONBLOCK|O_NOCTTY));
         uint64_t size;
         ASSERT_OK(blockdev_get_device_size(pfd, &size));
         ASSERT_EQ(size, 20U*1024U*1024U);
@@ -123,14 +124,14 @@ TEST(rereadpt) {
         ASSERT_OK(reread_partition_table_fd(loop->fd, /* flags= */ 0, /* args= */ NULL));
         ASSERT_OK_ZERO_ERRNO(access(p, F_OK));
 
-        ASSERT_OK_ERRNO(pfd = open(p, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY));
+        ASSERT_OK(pfd = xopenat(AT_FDCWD, p, O_RDONLY|O_NONBLOCK|O_NOCTTY));
         ASSERT_OK(blockdev_get_device_size(pfd, &size));
         ASSERT_EQ(size, 30U*1024U*1024U);
         pfd = safe_close(pfd);
 
         /* No change */
         ASSERT_OK(reread_partition_table_fd(loop->fd, /* flags= */ 0, /* args= */ NULL));
-        ASSERT_OK_ERRNO(pfd = open(p, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY));
+        ASSERT_OK(pfd = xopenat(AT_FDCWD, p, O_RDONLY|O_NONBLOCK|O_NOCTTY));
 
         /* Move */
         log_notice("MOVING BY 50M");
@@ -146,14 +147,14 @@ TEST(rereadpt) {
         ASSERT_OK_ZERO_ERRNO(access(p, F_OK));
         ASSERT_OK(reread_partition_table_fd(loop->fd, /* flags= */ 0, /* args= */ NULL));
 
-        pfd = ASSERT_OK_ERRNO(open(p, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY));
+        pfd = ASSERT_OK(xopenat(AT_FDCWD, p, O_RDONLY|O_NONBLOCK|O_NOCTTY));
         ASSERT_OK(blockdev_get_device_size(pfd, &size));
         ASSERT_EQ(size, 15U*1024U*1024U);
         pfd = safe_close(pfd);
 
         /* No change */
         ASSERT_OK(reread_partition_table_fd(loop->fd, /* flags= */ 0, /* args= */ NULL));
-        pfd = ASSERT_OK_ERRNO(open(p, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY));
+        pfd = ASSERT_OK(xopenat(AT_FDCWD, p, O_RDONLY|O_NONBLOCK|O_NOCTTY));
 
         /* Remove */
         log_notice("REMOVING");
diff --git a/src/test/test-rm-rf.c b/src/test/test-rm-rf.c
index 21c2de3a401..e58fac62b8c 100644
--- a/src/test/test-rm-rf.c
+++ b/src/test/test-rm-rf.c
@@ -147,7 +147,7 @@ TEST(rm_rf_children_rewind) {
         _cleanup_close_ int fd = -EBADF;
 
         ASSERT_OK(mkdtemp_malloc("/tmp/test-rm-rf-rewind.XXXXXXX", &d));
-        fd = ASSERT_OK_ERRNO(open(d, O_RDONLY|O_DIRECTORY|O_CLOEXEC));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, d, O_RDONLY|O_DIRECTORY));
 
         /* Exclude the directory from automatic aging by systemd-tmpfiles, as per
          * https://systemd.io/TEMPORARY_DIRECTORIES */
diff --git a/src/test/test-seccomp.c b/src/test/test-seccomp.c
index 39c6752814b..063aa905751 100644
--- a/src/test/test-seccomp.c
+++ b/src/test/test-seccomp.c
@@ -1013,7 +1013,7 @@ static int real_open(const char *path, int flags, mode_t mode) {
 #if defined __NR_open && __NR_open >= 0
         return (int) syscall(__NR_open, path, flags, mode);
 #else
-        return open(path, flags, mode);
+        return open(path, flags, mode); /* NOLINT(bugprone-unsafe-functions) */
 #endif
 }
 
@@ -1035,6 +1035,9 @@ static int try_fchmodat2(int dirfd, const char *path, mode_t mode, int flags) {
         return RET_NERRNO(fchmodat(dirfd, path, mode, flags));
 }
 
+/* restrict_suid_sgid tests the seccomp filter on the creat() and openat() syscalls. The test has to call
+ * creat() and openat() directly. */
+/* NOLINTBEGIN(bugprone-unsafe-functions) */
 TEST(restrict_suid_sgid) {
         int r;
 
@@ -1228,7 +1231,11 @@ TEST(restrict_suid_sgid) {
                 _exit(EXIT_SUCCESS);
         }
 }
+/* NOLINTEND(bugprone-unsafe-functions) */
 
+/* After seccomp_suppress_sync(), the open() syscall fails with EINVAL when O_SYNC is set. The test calls
+ * open() directly to check that. */
+/* NOLINTBEGIN(bugprone-unsafe-functions) */
 static void test_seccomp_suppress_sync_child(void) {
         _cleanup_(unlink_and_freep) char *path = NULL;
         _cleanup_close_ int fd = -EBADF;
@@ -1260,6 +1267,7 @@ static void test_seccomp_suppress_sync_child(void) {
         ASSERT_ERROR_ERRNO(fsync(-1), EBADF);
         ASSERT_ERROR_ERRNO(syncfs(-1), EBADF);
 }
+/* NOLINTEND(bugprone-unsafe-functions) */
 
 TEST(seccomp_suppress_sync) {
         int r;
diff --git a/src/test/test-socket-util.c b/src/test/test-socket-util.c
index 3ceb88bc967..569774bac5f 100644
--- a/src/test/test-socket-util.c
+++ b/src/test/test-socket-util.c
@@ -230,7 +230,7 @@ TEST(passfd_read) {
                 char tmpfile[] = "/tmp/test-socket-util-passfd-read-XXXXXX";
                 ASSERT_OK_ZERO(write_tmpfile(tmpfile, file_contents));
 
-                _cleanup_close_ int tmpfd = ASSERT_OK_ERRNO(open(tmpfile, O_RDONLY));
+                _cleanup_close_ int tmpfd = ASSERT_OK(xopenat(AT_FDCWD, tmpfile, O_RDONLY));
                 ASSERT_OK_ERRNO(unlink(tmpfile));
 
                 ASSERT_OK_ZERO(send_one_fd(pair[1], tmpfd, MSG_DONTWAIT));
@@ -296,7 +296,7 @@ TEST(passfd_contents_read) {
 
                 ASSERT_OK_ZERO(write_tmpfile(tmpfile, file_contents));
 
-                _cleanup_close_ int tmpfd = ASSERT_OK_ERRNO(open(tmpfile, O_RDONLY));
+                _cleanup_close_ int tmpfd = ASSERT_OK(xopenat(AT_FDCWD, tmpfile, O_RDONLY));
                 ASSERT_OK_ERRNO(unlink(tmpfile));
 
                 ASSERT_OK_POSITIVE(send_one_fd_iov(pair[1], tmpfd, &iov, 1, MSG_DONTWAIT));
@@ -505,7 +505,7 @@ TEST(sockaddr_un_set_path) {
         free(j);
         ASSERT_NOT_NULL(j = path_join(t, "sock"));
 
-        ASSERT_OK_ERRNO(fd3 = open(j, O_CLOEXEC|O_PATH|O_NOFOLLOW));
+        ASSERT_OK(fd3 = xopenat(AT_FDCWD, j, O_PATH|O_NOFOLLOW));
         ASSERT_OK(sockaddr_un_set_path(&sa.un, FORMAT_PROC_FD_PATH(fd3))); /* connect via O_PATH instead, circumventing 108ch limit */
 
         ASSERT_OK_ERRNO(connect(fd2, &sa.sa, sockaddr_len(&sa)));
diff --git a/src/test/test-stat-util.c b/src/test/test-stat-util.c
index 05e412cd36e..a41bda75046 100644
--- a/src/test/test-stat-util.c
+++ b/src/test/test-stat-util.c
@@ -119,8 +119,8 @@ TEST(inode_same) {
         ASSERT_OK_POSITIVE(inode_same("/proc", "/proc", /* flags= */ 0));
         ASSERT_OK_POSITIVE(inode_same("/proc", "/proc", AT_SYMLINK_NOFOLLOW));
 
-        _cleanup_close_ int fd1 = ASSERT_OK_ERRNO(open("/dev/null", O_CLOEXEC|O_RDONLY)),
-                fd2 = ASSERT_OK_ERRNO(open("/dev/null", O_CLOEXEC|O_RDONLY));
+        _cleanup_close_ int fd1 = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY)),
+                fd2 = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
 
         ASSERT_OK_POSITIVE(inode_same_at(fd1, /* filea= */ NULL, fd2, /* fileb= */ NULL, AT_EMPTY_PATH));
         ASSERT_OK_POSITIVE(inode_same_at(fd2, /* filea= */ NULL, fd1, /* fileb= */ NULL, AT_EMPTY_PATH));
@@ -130,7 +130,7 @@ TEST(inode_same) {
         ASSERT_OK_POSITIVE(inode_same_at(fd2, /* filea= */ NULL, fd2, /* fileb= */ NULL, AT_EMPTY_PATH|AT_SYMLINK_NOFOLLOW));
 
         safe_close(fd2);
-        fd2 = ASSERT_OK_ERRNO(open("/dev/urandom", O_CLOEXEC|O_RDONLY));
+        fd2 = ASSERT_OK(xopenat(AT_FDCWD, "/dev/urandom", O_RDONLY));
 
         ASSERT_OK_EQ(inode_same_at(fd1, /* filea= */ NULL, fd2, /* fileb= */ NULL, AT_EMPTY_PATH), 0);
         ASSERT_OK_EQ(inode_same_at(fd2, /* filea= */ NULL, fd1, /* fileb= */ NULL, AT_EMPTY_PATH), 0);
@@ -173,7 +173,7 @@ TEST(is_symlink_at) {
         _cleanup_close_ int tfd = -EBADF, fd = -EBADF;
 
         ASSERT_OK(tfd = mkdtemp_open(/* template= */ NULL, /* flags= */ 0, &t));
-        ASSERT_OK_ERRNO(fd = openat(tfd, "file", O_CREAT|O_EXCL|O_WRONLY|O_CLOEXEC, 0600));
+        ASSERT_OK(fd = xopenat_full(tfd, "file", O_CREAT|O_EXCL|O_WRONLY, /* xopen_flags= */ 0, 0600));
         fd = safe_close(fd);
         ASSERT_OK_ERRNO(symlinkat("missing", tfd, "dangling"));
 
@@ -182,7 +182,7 @@ TEST(is_symlink_at) {
         ASSERT_ERROR(is_symlink_at(tfd, "missing"), ENOENT);
         ASSERT_OK_ZERO(is_symlink_at(tfd, /* path= */ NULL));
 
-        ASSERT_OK_ERRNO(fd = openat(tfd, "dangling", O_PATH|O_NOFOLLOW|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(tfd, "dangling", O_PATH|O_NOFOLLOW));
         ASSERT_OK_POSITIVE(is_symlink_at(fd, /* path= */ NULL));
         ASSERT_OK_POSITIVE(is_symlink_at(fd, ""));
         ASSERT_ERROR(is_symlink_at(fd, "file"), ENOTDIR);
@@ -270,7 +270,7 @@ TEST(dir_is_empty) {
 
         /* A NULL path checks the directory the fd refers to */
         _cleanup_close_ int fd = -EBADF;
-        ASSERT_OK_ERRNO(fd = open(empty_dir, O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, empty_dir, O_DIRECTORY));
         ASSERT_OK_POSITIVE(dir_is_empty_at(fd, /* path= */ NULL, /* ignore_hidden_or_backup= */ false));
         ASSERT_OK(touch(j));
         ASSERT_OK_ZERO(dir_is_empty_at(fd, /* path= */ NULL, /* ignore_hidden_or_backup= */ false));
@@ -315,7 +315,7 @@ TEST(fd_verify_linked) {
         ASSERT_NOT_NULL(p = path_join(t, "hoge"));
         ASSERT_OK(touch(p));
 
-        fd = ASSERT_OK_ERRNO(open(p, O_CLOEXEC | O_PATH));
+        fd = ASSERT_OK(xopenat(AT_FDCWD, p, O_PATH));
 
         ASSERT_OK(fd_verify_linked(fd));
         ASSERT_OK_ERRNO(unlinkat(tfd, "hoge", 0));
diff --git a/src/test/test-terminal-util.c b/src/test/test-terminal-util.c
index 2f038ab9b1a..0b175a15c71 100644
--- a/src/test/test-terminal-util.c
+++ b/src/test/test-terminal-util.c
@@ -13,6 +13,7 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "memfd-util.h"
 #include "path-util.h"
 #include "process-util.h"
@@ -224,9 +225,9 @@ TEST(terminal_fix_size_vc) {
         /* On a virtual console terminal_fix_size() must not query the terminal at all: it should report
          * success without touching the dimensions the kernel gave us. */
 
-        _cleanup_close_ int fd = open("/dev/tty1", O_RDWR|O_NOCTTY|O_CLOEXEC);
+        _cleanup_close_ int fd = xopenat(AT_FDCWD, "/dev/tty1", O_RDWR|O_NOCTTY);
         if (fd < 0)
-                return (void) log_notice_errno(errno, "Can't open /dev/tty1, skipping: %m");
+                return (void) log_notice_errno(fd, "Can't open /dev/tty1, skipping: %m");
 
         _cleanup_free_ char *name = NULL;
         r = getttyname_harder(fd, &name);
@@ -325,7 +326,7 @@ TEST(terminal_is_pty_fd) {
         fd1 = safe_close(fd1);
         fd2 = safe_close(fd2);
 
-        fd1 = ASSERT_OK_ERRNO(open("/dev/null", O_RDONLY|O_CLOEXEC));
+        fd1 = ASSERT_OK(xopenat(AT_FDCWD, "/dev/null", O_RDONLY));
         ASSERT_OK_ZERO(terminal_is_pty_fd(fd1));
 
         /* In container managers real tty devices might be weird, avoid them. */
diff --git a/src/test/test-voa-util.c b/src/test/test-voa-util.c
index 9669239f3d1..25b2589ec6f 100644
--- a/src/test/test-voa-util.c
+++ b/src/test/test-voa-util.c
@@ -8,6 +8,7 @@
 #include "conf-files.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "fs-util.h"
 #include "mkdir.h"
 #include "path-util.h"
 #include "rm-rf.h"
@@ -64,7 +65,7 @@ TEST(voa_os_identifiers) {
         _cleanup_close_ int root_fd = -EBADF;
 
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &root));
-        ASSERT_OK_ERRNO(root_fd = open(root, O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(root_fd = xopenat(AT_FDCWD, root, O_PATH|O_DIRECTORY));
 
         /* No os-release at all yields the documented default */
         ASSERT_OK_ZERO(voa_os_identifiers(root_fd, &l));
@@ -173,7 +174,7 @@ TEST(voa_list_verifiers) {
         };
 
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &root));
-        ASSERT_OK_ERRNO(root_fd = open(root, O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(root_fd = xopenat(AT_FDCWD, root, O_PATH|O_DIRECTORY));
 
         /* Every copy counts */
         add_file(root, "/usr/share/voa/testos" X509_DIR "a-certificate.pem");
@@ -316,7 +317,7 @@ TEST(voa_list_verifiers_symlinked_load_path_parent) {
         };
 
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &root));
-        ASSERT_OK_ERRNO(root_fd = open(root, O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(root_fd = xopenat(AT_FDCWD, root, O_PATH|O_DIRECTORY));
 
         /* rpm-ostree layout: /usr/local is a symlink to ../var/usrlocal */
         add_dir(root, "/usr");
@@ -356,7 +357,7 @@ TEST(voa_list_verifiers_mode) {
         };
 
         ASSERT_OK(mkdtemp_malloc(/* template= */ NULL, &root));
-        ASSERT_OK_ERRNO(root_fd = open(root, O_PATH|O_DIRECTORY|O_CLOEXEC));
+        ASSERT_OK(root_fd = xopenat(AT_FDCWD, root, O_PATH|O_DIRECTORY));
 
         add_file(root, "/etc/voa/testos" X509_DIR "a-certificate.pem");
         add_file(root, "/run/voa/testos" X509_DIR "b-certificate.pem");
diff --git a/src/test/test-xattr-util.c b/src/test/test-xattr-util.c
index 56ad2f7315a..b1fbaa9562a 100644
--- a/src/test/test-xattr-util.c
+++ b/src/test/test-xattr-util.c
@@ -42,7 +42,7 @@ TEST(getxattr_at_malloc) {
         value = mfree(value);
 
         safe_close(fd);
-        ASSERT_OK_ERRNO(fd = open("/", O_RDONLY|O_DIRECTORY|O_CLOEXEC|O_NOCTTY));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, "/", O_RDONLY|O_DIRECTORY|O_NOCTTY));
         r = getxattr_at_malloc(fd, "usr", "user.idontexist", /* at_flags= */ 0, &value, /* ret_size= */ NULL);
         ASSERT_TRUE(ERRNO_IS_NEG_XATTR_ABSENT(r));
 
@@ -57,7 +57,7 @@ TEST(getxattr_at_malloc) {
         ASSERT_TRUE(ERRNO_IS_NEG_XATTR_ABSENT(r));
 
         safe_close(fd);
-        ASSERT_OK_ERRNO(fd = open(x, O_PATH|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(AT_FDCWD, x, O_PATH));
         ASSERT_OK(getxattr_at_malloc(fd, /* path= */ NULL, "user.foo", /* at_flags= */ 0, &value, /* ret_size= */ NULL));
         ASSERT_STREQ(value, "bar");
         value = mfree(value);
@@ -164,7 +164,7 @@ TEST(xsetxattr) {
         verify_xattr(dfd, "");
 
         /* by fd (O_PATH) */
-        ASSERT_OK_ERRNO(fd = openat(dfd, "test", O_PATH|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(dfd, "test", O_PATH));
 
         ASSERT_OK(xremovexattr(fd, "", /* at_flags= */ 0, "user.foo"));
 
@@ -176,7 +176,7 @@ TEST(xsetxattr) {
 
         fd = safe_close(fd);
 
-        fd = openat(dfd, "test", O_RDONLY|O_CLOEXEC);
+        fd = xopenat(dfd, "test", O_RDONLY);
 
         ASSERT_OK(xsetxattr_full(fd, /* path= */ NULL, /* at_flags= */ 0, "user.foo", "fd_regular", SIZE_MAX, XATTR_REPLACE));
         verify_xattr(dfd, "fd_regular");
@@ -188,7 +188,7 @@ TEST(xsetxattr) {
 
         /* user.* xattrs are not supported on symlinks. Use trusted.* which requires privilege. */
         ASSERT_OK_ERRNO(symlinkat("empty", dfd, "symlink"));
-        ASSERT_OK_ERRNO(fd = openat(dfd, "symlink", O_NOFOLLOW|O_PATH|O_CLOEXEC));
+        ASSERT_OK(fd = xopenat(dfd, "symlink", O_NOFOLLOW|O_PATH));
 
         ASSERT_ERROR(xsetxattr(dfd, "symlink", AT_SYMLINK_FOLLOW, "trusted.test", "bogus"), ENOENT);