Investigate using openat to lock down file access

[nightkr]

https://val.packett.cool/blog/use-openat/

This conflicts somewhat with #325, but we probably wouldn't be able to use that for unprivileged mode so both might end up being useful.