pub fn open_beneath(dirfd: BorrowedFd<'_>, filename: &[u8]) -> Result<OwnedFd>Expand description
Open a file at filename relative to dirfd using safe kernel primitives.
Internally calls openat2(2) with RESOLVE_BENEATH | RESOLVE_NO_MAGICLINKS | RESOLVE_NO_XDEV when available. On kernels that do not support openat2
(ENOSYS), falls back to plain openat(2).
§Security note
The openat2 path prevents directory escapes (RESOLVE_BENEATH), blocks
magic-link traversal (RESOLVE_NO_MAGICLINKS), prevents crossing filesystem
boundaries (RESOLVE_NO_XDEV), and does allow symlinks as long as they
resolve within the base directory. A symlink pointing outside the base
directory is still rejected by RESOLVE_BENEATH.
The openat fallback does not enforce RESOLVE_BENEATH (that kernel
feature is unavailable on old kernels), so callers should prefer environments
with kernel ≥ 5.6 (where openat2 is available) when strict confinement is
required. validate_filename is still called before any syscall to reject
.. components and absolute paths.
§Errors
Returns any error from validate_filename, or an Error::Io wrapping
the kernel error (EXDEV for escape attempts, etc.).