diff --git a/libglnx b/libglnx
index 607f1775..ea6df95f 160000
--- a/libglnx
+++ b/libglnx
@@ -1 +1 @@
-Subproject commit 607f1775bb1c626cae1875a957a34802daebe81c
+Subproject commit ea6df95f22c8f2973714bdbb8b1accc4e37d4d56
diff --git a/src/libostree/ostree-bootloader-grub2.c b/src/libostree/ostree-bootloader-grub2.c
index 63e4b968..86970d36 100644
--- a/src/libostree/ostree-bootloader-grub2.c
+++ b/src/libostree/ostree-bootloader-grub2.c
@@ -420,15 +420,13 @@ _ostree_bootloader_grub2_write_config (OstreeBootloader      *bootloader,
     }
 
   /* Now let's fdatasync() for the new file */
-  { glnx_fd_close int new_config_fd = open (gs_file_get_path_cached (new_config_path), O_RDONLY | O_CLOEXEC);
-    if (new_config_fd < 0)
-      {
-        glnx_set_prefix_error_from_errno (error, "Opening %s", gs_file_get_path_cached (new_config_path));
-        goto out;
-      }
+  { glnx_fd_close int new_config_fd = -1;
+    if (!glnx_openat_rdonly (AT_FDCWD, gs_file_get_path_cached (new_config_path), TRUE, &new_config_fd, error))
+      goto out;
+
     if (fdatasync (new_config_fd) < 0)
       {
-        glnx_set_error_from_errno (error);
+        (void)glnx_throw_errno_prefix (error, "fdatasync");
         goto out;
       }
   }
diff --git a/src/libostree/ostree-core.c b/src/libostree/ostree-core.c
index 116f376f..c13d2f2e 100644
--- a/src/libostree/ostree-core.c
+++ b/src/libostree/ostree-core.c
@@ -775,9 +775,9 @@ ostree_content_file_parse_at (gboolean                compressed,
                               GCancellable           *cancellable,
                               GError                **error)
 {
-  int glnx_fd_close fd = openat (parent_dfd, path, O_RDONLY | O_CLOEXEC);
-  if (fd < 0)
-    return glnx_throw_errno_prefix (error, "open(%s)", path);
+  glnx_fd_close int fd = -1;
+  if (!glnx_openat_rdonly (parent_dfd, path, TRUE, &fd, error))
+    return FALSE;
 
   struct stat stbuf;
   if (!glnx_fstat (fd, &stbuf, error))
diff --git a/src/libostree/ostree-gpg-verifier.c b/src/libostree/ostree-gpg-verifier.c
index c008bdaf..77594d9b 100644
--- a/src/libostree/ostree-gpg-verifier.c
+++ b/src/libostree/ostree-gpg-verifier.c
@@ -167,12 +167,8 @@ _ostree_gpg_verifier_check_signature (OstreeGpgVerifier  *self,
           glnx_fd_close int fd = -1;
           ot_auto_gpgme_data gpgme_data_t kdata = NULL;
 
-          fd = openat (AT_FDCWD, path, O_RDONLY | O_CLOEXEC) ;
-          if (fd < 0)
-            {
-              glnx_set_prefix_error_from_errno (error, "Opening %s", path);
-              goto out;
-            }
+          if (!glnx_openat_rdonly (AT_FDCWD, path, TRUE, &fd, error))
+            goto out;
 
           gpg_error = gpgme_data_new_from_fd (&kdata, fd);
           if (gpg_error != GPG_ERR_NO_ERROR)
diff --git a/src/libostree/ostree-repo-commit.c b/src/libostree/ostree-repo-commit.c
index bcd9c2d9..1d3d6840 100644
--- a/src/libostree/ostree-repo-commit.c
+++ b/src/libostree/ostree-repo-commit.c
@@ -2824,18 +2824,16 @@ write_dfd_iter_to_mtree_internal (OstreeRepo                  *self,
   while (TRUE)
     {
       struct dirent *dent;
-      struct stat stbuf;
-      g_autoptr(GFileInfo) child_info = NULL;
-      const char *loose_checksum;
       if (!glnx_dirfd_iterator_next_dent (src_dfd_iter, &dent, cancellable, error))
         return FALSE;
       if (dent == NULL)
         break;
 
-      if (fstatat (src_dfd_iter->fd, dent->d_name, &stbuf, AT_SYMLINK_NOFOLLOW) == -1)
-        return glnx_throw_errno (error);
+      struct stat stbuf;
+      if (!glnx_fstatat (src_dfd_iter->fd, dent->d_name, &stbuf, AT_SYMLINK_NOFOLLOW, error))
+        return FALSE;
 
-      loose_checksum = devino_cache_lookup (self, modifier, stbuf.st_dev, stbuf.st_ino);
+      const char *loose_checksum = devino_cache_lookup (self, modifier, stbuf.st_dev, stbuf.st_ino);
       if (loose_checksum)
         {
           if (!ostree_mutable_tree_replace_file (mtree, dent->d_name, loose_checksum,
@@ -2845,7 +2843,7 @@ write_dfd_iter_to_mtree_internal (OstreeRepo                  *self,
           continue;
         }
 
-      child_info = _ostree_stbuf_to_gfileinfo (&stbuf);
+      g_autoptr(GFileInfo) child_info = _ostree_stbuf_to_gfileinfo (&stbuf);
       g_file_info_set_name (child_info, dent->d_name);
 
       if (S_ISREG (stbuf.st_mode))
diff --git a/src/libostree/ostree-repo-pull.c b/src/libostree/ostree-repo-pull.c
index 33ea489c..1c0f79ea 100644
--- a/src/libostree/ostree-repo-pull.c
+++ b/src/libostree/ostree-repo-pull.c
@@ -1229,12 +1229,8 @@ meta_fetch_on_complete (GObject           *object,
   if (objtype == OSTREE_OBJECT_TYPE_TOMBSTONE_COMMIT)
     goto out;
 
-  fd = openat (_ostree_fetcher_get_dfd (fetcher), tmp_unlinker.path, O_RDONLY | O_CLOEXEC);
-  if (fd == -1)
-    {
-      glnx_set_error_from_errno (error);
-      goto out;
-    }
+  if (!glnx_openat_rdonly (_ostree_fetcher_get_dfd (fetcher), tmp_unlinker.path, TRUE, &fd, error))
+    goto out;
 
   /* Now delete it, keeping the fd open as the last reference; see comment in
    * corresponding content fetch path.
@@ -1342,12 +1338,8 @@ static_deltapart_fetch_on_complete (GObject           *object,
   if (!_ostree_fetcher_request_to_tmpfile_finish (fetcher, result, &temp_path, error))
     goto out;
 
-  fd = openat (_ostree_fetcher_get_dfd (fetcher), temp_path, O_RDONLY | O_CLOEXEC);
-  if (fd == -1)
-    {
-      glnx_set_error_from_errno (error);
-      goto out;
-    }
+  if (!glnx_openat_rdonly (_ostree_fetcher_get_dfd (fetcher), temp_path, TRUE, &fd, error))
+    goto out;
 
   /* From here on, if we fail to apply the delta, we'll re-fetch it */
   if (unlinkat (_ostree_fetcher_get_dfd (fetcher), temp_path, 0) < 0)
diff --git a/src/libostree/ostree-repo.c b/src/libostree/ostree-repo.c
index a009f1c8..896c57bc 100644
--- a/src/libostree/ostree-repo.c
+++ b/src/libostree/ostree-repo.c
@@ -4718,9 +4718,10 @@ ostree_repo_regenerate_summary (OstreeRepo     *self,
           return FALSE;
 
         g_autofree char *superblock = _ostree_get_relative_static_delta_superblock_path ((from && from[0]) ? from : NULL, to);
-        glnx_fd_close int superblock_file_fd = openat (self->repo_dir_fd, superblock, O_RDONLY | O_CLOEXEC);
-        if (superblock_file_fd == -1)
-          return glnx_throw_errno (error);
+        glnx_fd_close int superblock_file_fd = -1;
+
+        if (!glnx_openat_rdonly (self->repo_dir_fd, superblock, TRUE, &superblock_file_fd, error))
+          return FALSE;
 
         g_autoptr(GInputStream) in_stream = g_unix_input_stream_new (superblock_file_fd, FALSE);
         if (!in_stream)
diff --git a/src/libostree/ostree-sysroot-deploy.c b/src/libostree/ostree-sysroot-deploy.c
index bf4424a9..b2b46b36 100644
--- a/src/libostree/ostree-sysroot-deploy.c
+++ b/src/libostree/ostree-sysroot-deploy.c
@@ -178,9 +178,9 @@ copy_dir_recurse (int              src_parent_dfd,
       if (dent == NULL)
         break;
 
-      if (fstatat (src_dfd_iter.fd, dent->d_name, &child_stbuf,
-                   AT_SYMLINK_NOFOLLOW) != 0)
-        return glnx_throw_errno (error);
+      if (!glnx_fstatat (src_dfd_iter.fd, dent->d_name, &child_stbuf,
+                         AT_SYMLINK_NOFOLLOW, error))
+        return FALSE;
 
       if (S_ISDIR (child_stbuf.st_mode))
         {