diff --git a/libglnx b/libglnx
index 47d81632..627d4e2f 160000
--- a/libglnx
+++ b/libglnx
@@ -1 +1 @@
-Subproject commit 47d816329370ca315d4ffec9872690b1fd4c27c9
+Subproject commit 627d4e2f15572e853279d4bb9511ef2618bef6b5
diff --git a/src/app/rpmostree-compose-builtin-tree.c b/src/app/rpmostree-compose-builtin-tree.c
index 32748078..73b7d77c 100644
--- a/src/app/rpmostree-compose-builtin-tree.c
+++ b/src/app/rpmostree-compose-builtin-tree.c
@@ -256,12 +256,10 @@ libcontainer_prep_dev (int         rootfs_dfd,
     {
       const char *nodename = devnodes[i];
       struct stat stbuf;
-      if (fstatat (src_fd, nodename, &stbuf, 0) == -1)
-        {
-          if (errno == ENOENT)
-            continue;
-          return glnx_throw_errno (error);
-        }
+      if (!glnx_fstatat_allow_noent (src_fd, nodename, &stbuf, 0, error))
+        return FALSE;
+      if (errno == ENOENT)
+        continue;
 
       if (mknodat (dest_fd, nodename, stbuf.st_mode, stbuf.st_rdev) != 0)
         return glnx_throw_errno (error);
diff --git a/src/libpriv/rpmostree-core.c b/src/libpriv/rpmostree-core.c
index 31a8638a..4e44539d 100644
--- a/src/libpriv/rpmostree-core.c
+++ b/src/libpriv/rpmostree-core.c
@@ -372,12 +372,9 @@ rpmostree_context_new_internal (int           userroot_dfd,
 
   /* open user root repo if exists (container path) */
   struct stat stbuf;
-  if (fstatat (userroot_dfd, "repo", &stbuf, 0) < 0)
-    {
-      if (errno != ENOENT)
-        return glnx_null_throw_errno_prefix (error, "fstat");
-    }
-  else
+  if (!glnx_fstatat_allow_noent (userroot_dfd, "repo", &stbuf, 0, error))
+    return NULL;
+  if (errno == 0)
     {
       ret->ostreerepo = ostree_repo_open_at (userroot_dfd, "repo", cancellable, error);
       if (!ret->ostreerepo)
@@ -713,13 +710,12 @@ checkout_pkg_metadata (RpmOstreeContext *self,
   /* give it a .rpm extension so we can fool the libdnf stack */
   path = get_nevra_relpath (nevra);
 
+  if (!glnx_fstatat_allow_noent (self->tmpdir.fd, path, &stbuf, 0, error))
+    return FALSE;
   /* we may have already written the header out for this one */
-  if (fstatat (self->tmpdir.fd, path, &stbuf, 0) == 0)
+  if (errno == 0)
     return TRUE;
 
-  if (errno != ENOENT)
-    return glnx_throw_errno (error);
-
   return glnx_file_replace_contents_at (self->tmpdir.fd, path,
                                         g_variant_get_data (header),
                                         g_variant_get_size (header),
@@ -2134,9 +2130,9 @@ relabel_dir_recurse_at (OstreeRepo        *repo,
       {
         struct stat stbuf;
 
-        if (fstatat (dfd_iter.fd, dent->d_name, &stbuf,
-                     AT_SYMLINK_NOFOLLOW) != 0)
-          return glnx_throw_errno_prefix (error, "fstatat");
+        if (!glnx_fstatat (dfd_iter.fd, dent->d_name, &stbuf,
+                           AT_SYMLINK_NOFOLLOW, error))
+          return FALSE;
 
         /* may be NULL */
         if (!ostree_sepolicy_get_label (sepolicy, fullpath, stbuf.st_mode,
diff --git a/src/libpriv/rpmostree-passwd-util.c b/src/libpriv/rpmostree-passwd-util.c
index 8540c048..0d0ab9cc 100644
--- a/src/libpriv/rpmostree-passwd-util.c
+++ b/src/libpriv/rpmostree-passwd-util.c
@@ -1017,17 +1017,9 @@ rootfs_has_usrlib_passwd (int rootfs_dfd,
   /* Does this rootfs have a usr/lib/passwd?  We might be doing a
    * container or something else.
    */
-  if (fstatat (rootfs_dfd, "usr/lib/passwd", &stbuf, 0) < 0)
-    {
-      if (errno == ENOENT)
-        {
-          *out_have_passwd = FALSE;
-          return TRUE;
-        }
-      else
-        return glnx_throw_errno_prefix (error, "fstatat");
-    }
-  *out_have_passwd = TRUE;
+  if (!glnx_fstatat_allow_noent (rootfs_dfd, "usr/lib/passwd", &stbuf, 0, error))
+    return FALSE;
+  *out_have_passwd = (errno == 0);
   return TRUE;
 }
 
diff --git a/src/libpriv/rpmostree-postprocess.c b/src/libpriv/rpmostree-postprocess.c
index 4d872cd6..53bee7b5 100644
--- a/src/libpriv/rpmostree-postprocess.c
+++ b/src/libpriv/rpmostree-postprocess.c
@@ -449,12 +449,10 @@ rpmostree_prepare_rootfs_get_sepolicy (int            dfd,
   /* Handle the policy being in both /usr/etc and /etc since
    * this function can be called at different points.
    */
-  if (fstatat (dfd, "usr/etc", &stbuf, 0) < 0)
-    {
-      if (errno != ENOENT)
-        return glnx_throw_errno_prefix (error, "fstatat");
-      policy_path = "etc/selinux";
-    }
+  if (!glnx_fstatat_allow_noent (dfd, "usr/etc", &stbuf, 0, error))
+    return FALSE;
+  if (errno == ENOENT)
+    policy_path = "etc/selinux";
   else
     policy_path = "usr/etc/selinux";
 
@@ -598,11 +596,10 @@ postprocess_selinux_policy_store_location (int rootfs_dfd,
 
   var_policy_location = glnx_strjoina ("var/lib/selinux/", name);
   const char *modules_location = glnx_strjoina (var_policy_location, "/active/modules");
-  if (fstatat (rootfs_dfd, modules_location, &stbuf, 0) != 0)
+  if (!glnx_fstatat_allow_noent (rootfs_dfd, modules_location, &stbuf, 0, error))
+    return FALSE;
+  if (errno == ENOENT)
     {
-      if (errno != ENOENT)
-        return glnx_throw_errno_prefix (error, "fstat(%s)", modules_location);
-
       /* Okay, this is probably CentOS 7, or maybe we have a build of
        * selinux-policy with the path moved back into /etc (or maybe it's
        * in /usr).
@@ -957,12 +954,9 @@ rename_if_exists (int         dfd,
   const char *errmsg = glnx_strjoina ("renaming ", from);
   GLNX_AUTO_PREFIX_ERROR (errmsg, error);
 
-  if (fstatat (dfd, from, &stbuf, 0) < 0)
-    {
-      if (errno != ENOENT)
-        return glnx_throw_errno_prefix (error, "fstatat(%s)", from);
-    }
-  else
+  if (!glnx_fstatat_allow_noent (dfd, from, &stbuf, 0, error))
+    return FALSE;
+  if (errno == 0)
     {
       if (renameat (dfd, from, dfd, to) < 0)
         {