[hvenev]

> can be implemented in terms of `openat` + `fgetxattr`

Except for symlinks. `fgetxattr` requires a file opened for read or write, but symlinks can only be opened as `O_PATH`.