diff --git a/cfg.mk b/cfg.mk
index 5d9b554c67..e93114c83e 100644
--- a/cfg.mk
+++ b/cfg.mk
@@ -421,9 +421,9 @@ sc_prohibit_gethostname:
 	  $(_sc_search_regexp)
 
 sc_prohibit_readdir:
-	@prohibit='\breaddir *\('					\
+	@prohibit='\b(read|close)dir *\('				\
 	exclude='exempt from syntax-check'				\
-	halt='use virDirRead, not readdir'				\
+	halt='use virDirRead and VIR_DIR_CLOSE'				\
 	  $(_sc_search_regexp)
 
 sc_prohibit_gettext_noop:
diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
index 02b8cd7039..1e4b7198b2 100644
--- a/src/conf/network_conf.c
+++ b/src/conf/network_conf.c
@@ -3258,7 +3258,7 @@ virNetworkLoadAllState(virNetworkObjListPtr nets,
         virNetworkObjEndAPI(&net);
     }
 
-    closedir(dir);
+    VIR_DIR_CLOSE(dir);
     return ret;
 }
 
@@ -3298,7 +3298,7 @@ int virNetworkLoadAllConfigs(virNetworkObjListPtr nets,
         virNetworkObjEndAPI(&net);
     }
 
-    closedir(dir);
+    VIR_DIR_CLOSE(dir);
     return ret;
 }
 
diff --git a/src/conf/nwfilter_conf.c b/src/conf/nwfilter_conf.c
index 3f90f65d1f..56f8b86f71 100644
--- a/src/conf/nwfilter_conf.c
+++ b/src/conf/nwfilter_conf.c
@@ -3227,7 +3227,7 @@ virNWFilterLoadAllConfigs(virNWFilterObjListPtr nwfilters,
             virNWFilterObjUnlock(nwfilter);
     }
 
-    closedir(dir);
+    VIR_DIR_CLOSE(dir);
     return ret;
 }
 
diff --git a/src/conf/storage_conf.c b/src/conf/storage_conf.c
index 69321952f0..5c044d2653 100644
--- a/src/conf/storage_conf.c
+++ b/src/conf/storage_conf.c
@@ -1964,7 +1964,7 @@ virStoragePoolLoadAllState(virStoragePoolObjListPtr pools,
         virStoragePoolObjUnlock(pool);
     }
 
-    closedir(dir);
+    VIR_DIR_CLOSE(dir);
     return ret;
 }
 
@@ -2015,7 +2015,7 @@ virStoragePoolLoadAllConfigs(virStoragePoolObjListPtr pools,
         VIR_FREE(autostartLink);
     }
 
-    closedir(dir);
+    VIR_DIR_CLOSE(dir);
     return ret;
 }
 
diff --git a/src/conf/virdomainobjlist.c b/src/conf/virdomainobjlist.c
index 485671e74b..4f7756d64e 100644
--- a/src/conf/virdomainobjlist.c
+++ b/src/conf/virdomainobjlist.c
@@ -616,7 +616,7 @@ virDomainObjListLoadAllConfigs(virDomainObjListPtr doms,
         }
     }
 
-    closedir(dir);
+    VIR_DIR_CLOSE(dir);
     virObjectUnlock(doms);
     return ret;
 }
diff --git a/src/conf/virsecretobj.c b/src/conf/virsecretobj.c
index c46d22c112..46042eb631 100644
--- a/src/conf/virsecretobj.c
+++ b/src/conf/virsecretobj.c
@@ -1000,6 +1000,6 @@ virSecretLoadAllConfigs(virSecretObjListPtr secrets,
         virSecretObjEndAPI(&secret);
     }
 
-    closedir(dir);
+    VIR_DIR_CLOSE(dir);
     return 0;
 }
diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index b118d1e3d7..366a45b9d4 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -1493,6 +1493,7 @@ saferead;
 safewrite;
 safezero;
 virBuildPathInternal;
+virDirClose;
 virDirCreate;
 virDirRead;
 virFileAbsPath;
diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
index 7c8d2cc9d5..7b021d84f6 100644
--- a/src/network/bridge_driver.c
+++ b/src/network/bridge_driver.c
@@ -577,7 +577,7 @@ networkMigrateStateFiles(virNetworkDriverStatePtr driver)
 
     ret = 0;
  cleanup:
-    closedir(dir);
+    VIR_DIR_CLOSE(dir);
     VIR_FREE(oldPath);
     VIR_FREE(newPath);
     VIR_FREE(contents);
diff --git a/src/openvz/openvz_conf.c b/src/openvz/openvz_conf.c
index 820dc22910..ff5e5b891b 100644
--- a/src/openvz/openvz_conf.c
+++ b/src/openvz/openvz_conf.c
@@ -1072,7 +1072,7 @@ static int openvzAssignUUIDs(void)
             openvzSetUUID(vpsid);
     }
 
-    closedir(dp);
+    VIR_DIR_CLOSE(dp);
     VIR_FREE(conf_dir);
     return ret;
 }
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index ee717f052a..9657b553a9 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -587,8 +587,7 @@ qemuDomainSnapshotLoad(virDomainObjPtr vm,
 
     ret = 0;
  cleanup:
-    if (dir)
-        closedir(dir);
+    VIR_DIR_CLOSE(dir);
     VIR_FREE(snapDir);
     virObjectUnref(caps);
     virObjectUnlock(vm);
diff --git a/src/qemu/qemu_hostdev.c b/src/qemu/qemu_hostdev.c
index e16d5fd027..84f36159c8 100644
--- a/src/qemu/qemu_hostdev.c
+++ b/src/qemu/qemu_hostdev.c
@@ -134,9 +134,7 @@ qemuHostdevHostSupportsPassthroughVFIO(void)
     ret = true;
 
  cleanup:
-    if (iommuDir)
-        closedir(iommuDir);
-
+    VIR_DIR_CLOSE(iommuDir);
     return ret;
 }
 
diff --git a/src/storage/storage_backend.c b/src/storage/storage_backend.c
index d041530521..4774f5f104 100644
--- a/src/storage/storage_backend.c
+++ b/src/storage/storage_backend.c
@@ -1946,12 +1946,12 @@ virStorageBackendStablePath(virStoragePoolObjPtr pool,
         if (virAsprintf(&stablepath, "%s/%s",
                         pool->def->target.path,
                         dent->d_name) == -1) {
-            closedir(dh);
+            VIR_DIR_CLOSE(dh);
             return NULL;
         }
 
         if (virFileLinkPointsTo(stablepath, devpath)) {
-            closedir(dh);
+            VIR_DIR_CLOSE(dh);
             return stablepath;
         }
 
@@ -1963,7 +1963,7 @@ virStorageBackendStablePath(virStoragePoolObjPtr pool,
         goto retry;
     }
 
-    closedir(dh);
+    VIR_DIR_CLOSE(dh);
 
  ret_strdup:
     /* Couldn't find any matching stable link so give back
diff --git a/src/storage/storage_backend_fs.c b/src/storage/storage_backend_fs.c
index a11df365b0..152f9f32ab 100644
--- a/src/storage/storage_backend_fs.c
+++ b/src/storage/storage_backend_fs.c
@@ -972,8 +972,7 @@ virStorageBackendFileSystemRefresh(virConnectPtr conn ATTRIBUTE_UNUSED,
     }
     if (direrr < 0)
         goto cleanup;
-    closedir(dir);
-    dir = NULL;
+    VIR_DIR_CLOSE(dir);
     vol = NULL;
 
     if (VIR_ALLOC(target))
@@ -1019,8 +1018,7 @@ virStorageBackendFileSystemRefresh(virConnectPtr conn ATTRIBUTE_UNUSED,
 
     ret = 0;
  cleanup:
-    if (dir)
-        closedir(dir);
+    VIR_DIR_CLOSE(dir);
     VIR_FORCE_CLOSE(fd);
     virStorageVolDefFree(vol);
     virStorageSourceFree(target);
diff --git a/src/storage/storage_backend_iscsi.c b/src/storage/storage_backend_iscsi.c
index e3a41b62a3..ad8633e3ea 100644
--- a/src/storage/storage_backend_iscsi.c
+++ b/src/storage/storage_backend_iscsi.c
@@ -122,7 +122,7 @@ virStorageBackendISCSIGetHostNumber(const char *sysfs_path,
     if (direrr < 0)
         retval = -1;
 
-    closedir(sysdir);
+    VIR_DIR_CLOSE(sysdir);
  out:
     return retval;
 }
diff --git a/src/storage/storage_backend_scsi.c b/src/storage/storage_backend_scsi.c
index be993f19d4..b08d96096d 100644
--- a/src/storage/storage_backend_scsi.c
+++ b/src/storage/storage_backend_scsi.c
@@ -290,8 +290,7 @@ getNewStyleBlockDevice(const char *lun_path,
     retval = 0;
 
  cleanup:
-    if (block_dir)
-        closedir(block_dir);
+    VIR_DIR_CLOSE(block_dir);
     VIR_FREE(block_path);
     return retval;
 }
@@ -387,8 +386,7 @@ getBlockDevice(uint32_t host,
     retval = 0;
 
  cleanup:
-    if (lun_dir)
-        closedir(lun_dir);
+    VIR_DIR_CLOSE(lun_dir);
     VIR_FREE(lun_path);
     return retval;
 }
@@ -501,7 +499,7 @@ virStorageBackendSCSIFindLUs(virStoragePoolObjPtr pool,
             found++;
     }
 
-    closedir(devicedir);
+    VIR_DIR_CLOSE(devicedir);
 
     if (retval < 0)
         return -1;
diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c
index 7bab08659f..c76c94f68a 100644
--- a/src/util/vircgroup.c
+++ b/src/util/vircgroup.c
@@ -3409,7 +3409,7 @@ virCgroupRemoveRecursively(char *grppath)
         VIR_ERROR(_("Failed to readdir for %s (%d)"), grppath, errno);
     }
 
-    closedir(grpdir);
+    VIR_DIR_CLOSE(grpdir);
 
     VIR_DEBUG("Removing cgroup %s", grppath);
     if (rmdir(grppath) != 0 && errno != ENOENT) {
@@ -3669,9 +3669,7 @@ virCgroupKillRecursiveInternal(virCgroupPtr group,
  cleanup:
     virCgroupFree(&subgroup);
     VIR_FREE(keypath);
-    if (dp)
-        closedir(dp);
-
+    VIR_DIR_CLOSE(dp);
     return ret;
 }
 
@@ -3993,15 +3991,13 @@ int virCgroupSetOwner(virCgroupPtr cgroup,
         }
 
         VIR_FREE(base);
-        closedir(dh);
-        dh = NULL;
+        VIR_DIR_CLOSE(dh);
     }
 
     ret = 0;
 
  cleanup:
-    if (dh)
-        closedir(dh);
+    VIR_DIR_CLOSE(dh);
     VIR_FREE(entry);
     VIR_FREE(base);
     return ret;
diff --git a/src/util/virfile.c b/src/util/virfile.c
index f47bf391c9..ce8f7fd860 100644
--- a/src/util/virfile.c
+++ b/src/util/virfile.c
@@ -667,8 +667,7 @@ static int virFileLoopDeviceOpenSearch(char **dev_name)
         VIR_DEBUG("No free loop devices available");
         VIR_FREE(looppath);
     }
-    if (dh)
-        closedir(dh);
+    VIR_DIR_CLOSE(dh);
     return fd;
 }
 
@@ -807,7 +806,7 @@ virFileNBDDeviceFindUnused(void)
                          _("No free NBD devices"));
 
  cleanup:
-    closedir(dh);
+    VIR_DIR_CLOSE(dh);
     return ret;
 }
 
@@ -994,7 +993,7 @@ int virFileDeleteTree(const char *dir)
 
  cleanup:
     VIR_FREE(filepath);
-    closedir(dh);
+    VIR_DIR_CLOSE(dh);
     return ret;
 }
 
@@ -2770,6 +2769,15 @@ int virDirRead(DIR *dirp, struct dirent **ent, const char *name)
     return !!*ent;
 }
 
+void virDirClose(DIR **dirp)
+{
+    if (!*dirp)
+        return;
+
+    closedir(*dirp); /* exempt from syntax-check */
+    *dirp = NULL;
+}
+
 static int
 virFileMakePathHelper(char *path, mode_t mode)
 {
diff --git a/src/util/virfile.h b/src/util/virfile.h
index dae234e2e4..ab9eeba330 100644
--- a/src/util/virfile.h
+++ b/src/util/virfile.h
@@ -232,6 +232,9 @@ int virDirCreate(const char *path, mode_t mode, uid_t uid, gid_t gid,
                  unsigned int flags) ATTRIBUTE_RETURN_CHECK;
 int virDirRead(DIR *dirp, struct dirent **ent, const char *dirname)
     ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_RETURN_CHECK;
+void virDirClose(DIR **dirp)
+    ATTRIBUTE_NONNULL(1);
+# define VIR_DIR_CLOSE(dir)  virDirClose(&(dir))
 
 int virFileMakePath(const char *path) ATTRIBUTE_RETURN_CHECK;
 int virFileMakePathWithMode(const char *path,
diff --git a/src/util/virhostcpu.c b/src/util/virhostcpu.c
index 0cdba0a0cd..6883466b70 100644
--- a/src/util/virhostcpu.c
+++ b/src/util/virhostcpu.c
@@ -477,8 +477,7 @@ virHostCPUParseNode(const char *node,
     ret = processors;
 
  cleanup:
-    if (cpudir)
-        closedir(cpudir);
+    VIR_DIR_CLOSE(cpudir);
     if (cores_maps)
         for (i = 0; i < sock_max; i++)
             virBitmapFree(cores_maps[i]);
@@ -774,8 +773,7 @@ virHostCPUGetInfoPopulateLinux(FILE *cpuinfo,
     ret = 0;
 
  cleanup:
-    if (nodedir)
-        closedir(nodedir);
+    VIR_DIR_CLOSE(nodedir);
     virBitmapFree(present_cpus_map);
     virBitmapFree(online_cpus_map);
     VIR_FREE(sysfs_nodedir);
diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c
index 5a4ccc62e3..75ec484a4a 100644
--- a/src/util/virnetdev.c
+++ b/src/util/virnetdev.c
@@ -3188,7 +3188,7 @@ virNetDevRDMAFeature(const char *ifname,
     ret = 0;
 
  cleanup:
-    closedir(dirp);
+    VIR_DIR_CLOSE(dirp);
     VIR_FREE(eth_devpath);
     VIR_FREE(ib_devpath);
     VIR_FREE(eth_res_buf);
diff --git a/src/util/virnetdevtap.c b/src/util/virnetdevtap.c
index b34cbb7e8a..eec7614f54 100644
--- a/src/util/virnetdevtap.c
+++ b/src/util/virnetdevtap.c
@@ -144,7 +144,7 @@ virNetDevTapGetRealDeviceName(char *ifname ATTRIBUTE_UNUSED)
  cleanup:
     VIR_FREE(devpath);
     VIR_FORCE_CLOSE(fd);
-    closedir(dirp);
+    VIR_DIR_CLOSE(dirp);
     return ret;
 #else
     return NULL;
diff --git a/src/util/virnuma.c b/src/util/virnuma.c
index 23064ff377..b756f7f242 100644
--- a/src/util/virnuma.c
+++ b/src/util/virnuma.c
@@ -833,8 +833,7 @@ virNumaGetPages(int node,
     VIR_FREE(tmp_free);
     VIR_FREE(tmp_avail);
     VIR_FREE(tmp_size);
-    if (dir)
-        closedir(dir);
+    VIR_DIR_CLOSE(dir);
     VIR_FREE(path);
     return ret;
 }
diff --git a/src/util/virpci.c b/src/util/virpci.c
index 095d7068c2..5cb5d3ab09 100644
--- a/src/util/virpci.c
+++ b/src/util/virpci.c
@@ -509,7 +509,7 @@ virPCIDeviceIterDevices(virPCIDeviceIterPredicate predicate,
 
         virPCIDeviceFree(check);
     }
-    closedir(dir);
+    VIR_DIR_CLOSE(dir);
     return ret;
 }
 
@@ -1993,8 +1993,7 @@ int virPCIDeviceFileIterate(virPCIDevicePtr dev,
     ret = 0;
 
  cleanup:
-    if (dir)
-        closedir(dir);
+    VIR_DIR_CLOSE(dir);
     VIR_FREE(file);
     VIR_FREE(pcidir);
     return ret;
@@ -2051,8 +2050,7 @@ virPCIDeviceAddressIOMMUGroupIterate(virPCIDeviceAddressPtr orig,
 
  cleanup:
     VIR_FREE(groupPath);
-    if (groupDir)
-        closedir(groupDir);
+    VIR_DIR_CLOSE(groupDir);
     return ret;
 }
 
@@ -2713,7 +2711,7 @@ virPCIGetNetName(char *device_link_sysfs_path, char **netname)
         break;
     }
 
-    closedir(dir);
+    VIR_DIR_CLOSE(dir);
 
  out:
     VIR_FREE(pcidev_sysfs_net_path);
diff --git a/src/util/virprocess.c b/src/util/virprocess.c
index bf6a6df8a6..b0ca1ce38a 100644
--- a/src/util/virprocess.c
+++ b/src/util/virprocess.c
@@ -637,8 +637,7 @@ int virProcessGetPids(pid_t pid, size_t *npids, pid_t **pids)
     ret = 0;
 
  cleanup:
-    if (dir)
-        closedir(dir);
+    VIR_DIR_CLOSE(dir);
     VIR_FREE(taskPath);
     if (ret < 0)
         VIR_FREE(*pids);
diff --git a/src/util/virscsi.c b/src/util/virscsi.c
index 66b901791b..72a56614a3 100644
--- a/src/util/virscsi.c
+++ b/src/util/virscsi.c
@@ -143,8 +143,7 @@ virSCSIDeviceGetSgName(const char *sysfs_prefix,
     }
 
  cleanup:
-    if (dir)
-        closedir(dir);
+    VIR_DIR_CLOSE(dir);
     VIR_FREE(path);
     return sg;
 }
@@ -189,8 +188,7 @@ virSCSIDeviceGetDevName(const char *sysfs_prefix,
     }
 
  cleanup:
-    if (dir)
-        closedir(dir);
+    VIR_DIR_CLOSE(dir);
     VIR_FREE(path);
     return name;
 }
diff --git a/src/util/virusb.c b/src/util/virusb.c
index 5c39667920..33b188e624 100644
--- a/src/util/virusb.c
+++ b/src/util/virusb.c
@@ -202,9 +202,7 @@ virUSBDeviceSearch(unsigned int vendor,
     ret = list;
 
  cleanup:
-    if (dir)
-        closedir(dir);
-
+    VIR_DIR_CLOSE(dir);
     if (!ret)
         virObjectUnref(list);
     return ret;
diff --git a/src/util/virutil.c b/src/util/virutil.c
index 60da17b2f9..a6c1273fd2 100644
--- a/src/util/virutil.c
+++ b/src/util/virutil.c
@@ -1915,7 +1915,7 @@ virFindSCSIHostByPCI(const char *sysfs_prefix,
     }
 
  cleanup:
-    closedir(dir);
+    VIR_DIR_CLOSE(dir);
     VIR_FREE(unique_path);
     VIR_FREE(host_link);
     VIR_FREE(host_path);
@@ -2265,7 +2265,7 @@ virGetFCHostNameByWWN(const char *sysfs_prefix,
 
  cleanup:
 # undef READ_WWN
-    closedir(dir);
+    VIR_DIR_CLOSE(dir);
     VIR_FREE(wwnn_path);
     VIR_FREE(wwpn_path);
     VIR_FREE(wwnn_buf);
@@ -2354,7 +2354,7 @@ virFindFCHostCapableVport(const char *sysfs_prefix)
     }
 
  cleanup:
-    closedir(dir);
+    VIR_DIR_CLOSE(dir);
     VIR_FREE(max_vports);
     VIR_FREE(vports);
     return ret;
diff --git a/src/xen/xen_inotify.c b/src/xen/xen_inotify.c
index d81a35d427..cd169e01e1 100644
--- a/src/xen/xen_inotify.c
+++ b/src/xen/xen_inotify.c
@@ -372,21 +372,21 @@ xenInotifyOpen(virConnectPtr conn,
 
             /* Build the full file path */
             if (!(path = virFileBuildPath(priv->configDir, ent->d_name, NULL))) {
-                closedir(dh);
+                VIR_DIR_CLOSE(dh);
                 return -1;
             }
 
             if (xenInotifyAddDomainConfigInfo(conn, path, now) < 0) {
                 virReportError(VIR_ERR_INTERNAL_ERROR,
                                "%s", _("Error adding file to config list"));
-                closedir(dh);
+                VIR_DIR_CLOSE(dh);
                 VIR_FREE(path);
                 return -1;
             }
 
             VIR_FREE(path);
         }
-        closedir(dh);
+        VIR_DIR_CLOSE(dh);
         if (direrr < 0)
             return -1;
     }
diff --git a/src/xen/xm_internal.c b/src/xen/xm_internal.c
index f7486b5c25..e7ac57e659 100644
--- a/src/xen/xm_internal.c
+++ b/src/xen/xm_internal.c
@@ -358,7 +358,7 @@ xenXMConfigCacheRefresh(virConnectPtr conn)
 
         /* Build the full file path */
         if (!(path = virFileBuildPath(priv->configDir, ent->d_name, NULL))) {
-            closedir(dh);
+            VIR_DIR_CLOSE(dh);
             return -1;
         }
 
@@ -386,7 +386,7 @@ xenXMConfigCacheRefresh(virConnectPtr conn)
     args.priv = priv;
     virHashRemoveSet(priv->configCache, xenXMConfigReaper, &args);
 
-    closedir(dh);
+    VIR_DIR_CLOSE(dh);
 
     return ret;
 }
diff --git a/tests/virschematest.c b/tests/virschematest.c
index 638fd0f43d..14a9e2031b 100644
--- a/tests/virschematest.c
+++ b/tests/virschematest.c
@@ -112,7 +112,7 @@ testSchemaDir(const char *schema,
  cleanup:
     VIR_FREE(test_name);
     VIR_FREE(xml_path);
-    closedir(dir);
+    VIR_DIR_CLOSE(dir);
     return ret;
 }
 
diff --git a/tools/nss/libvirt_nss.c b/tools/nss/libvirt_nss.c
index de34bafbe6..d179514945 100644
--- a/tools/nss/libvirt_nss.c
+++ b/tools/nss/libvirt_nss.c
@@ -159,8 +159,7 @@ findLease(const char *name,
         VIR_FREE(path);
     }
 
-    closedir(dir);
-    dir = NULL;
+    VIR_DIR_CLOSE(dir);
 
     nleases = virJSONValueArraySize(leases_array);
     DEBUG("Read %zd leases", nleases);
@@ -231,8 +230,7 @@ findLease(const char *name,
     *errnop = errno;
     VIR_FREE(tmpAddress);
     virJSONValueFree(leases_array);
-    if (dir)
-        closedir(dir);
+    VIR_DIR_CLOSE(dir);
     return ret;
 }