Function open_beneath 

pub fn open_beneath(
    root: &Path,
    relative_path: &Path,
    flags: i32,
    mode: u32,
) -> Result<File>

Open a file beneath root using openat2(2) with RESOLVE_BENEATH. The kernel rejects any path that escapes root via .. or symlinks. Falls back to canonicalize_safe + standard open if openat2 unavailable.