> The new syscall implementation would still need a fallback impl. for older kernels after all. Yup, this is why I'm planning on getting a sane API available i

> The new syscall implementation would still need a fallback impl. for older kernels after all. Yup, this is why I'm planning on getting a sane API available in <https://github.com/cyphar/filepath-securejoin> https://github.com/cyphar/filepath-securejoin> which projects can use so that the correct thing is done with both old and new kernels. Right now it has a (slighly) improved version of the code Docker has, but I'm rewriting it. It should be noted that there are lots of examples of interfaces which are incredibly hard to make safe without openat2 -- such as O_CREAT.