openat2(2)

Synopsis

#include <fcntl.h>
#include <linux/openat2.h>
#include <sys/syscall.h>
#include <unistd.h>

long syscall(SYS_openat2, int dirfd, const char *path,
             struct open_how *how, size_t size);

Rod's take

chroot needs root, leaks through any directory fd you forgot to close, and was never a security boundary. openat2 doesn't fix chroot. It fixes the real bug: open() never let you say "don't resolve outside this tree." RESOLVE_BENEATH turns zip slip into an EXDEV instead of an overwritten file, and RESOLVE_NO_SYMLINKS kills the symlink games inside the tree too. No root, no subprocess, one struct. Unknown struct fields get E2BIG instead of being silently ignored, which is the first time open() has grown a spine in decades. Handle ENOSYS on old kernels and get on with your life.

Flags and arguments that matter

Errors you will actually hit

Example

int base = open(root, O_RDONLY | O_DIRECTORY | O_CLOEXEC);

struct open_how how = {
    .flags   = O_RDONLY | O_CLOEXEC,
    .resolve = RESOLVE_BENEATH | RESOLVE_NO_SYMLINKS,
};
long fd = syscall(SYS_openat2, base, untrusted_path, &how, sizeof(how));
if (fd < 0) {
    if (errno == EXDEV || errno == ELOOP)
        warnx("rejected: %s escapes or uses symlinks", untrusted_path);
    else if (errno == ENOSYS)
        warnx("kernel < 5.6: no openat2");
}

Trimmed from the full walkthrough in openat2(2): path resolution you can actually trust.

BSD equivalent

FreeBSD: O_RESOLVE_BENEATH flag to openat(2) (FreeBSD 13), which fails with ENOTCAPABLE on escape. OpenBSD: none; closest is unveil(2).