If we are thinking of new syscalls, then I think that
open_if_stat_matches() would be more useful than open_as().  It
would be used like this: stat(path, statbuf); check attributes in
statbuf; open_if_stat_matches(path, statbuf, flags, mode).  There
is no race vulnerability between stat() and open_if_stat_matches()
because the kernel would refuse to open the file if the results from
fstat() after the open would be different from the results of stat()
before the open.  There should probably be a way of saying that
certain fields in the stat structure (such as access time) are not
important.

Note that an open_as() library function could be implemented using
an open_if_stat_matches() syscall.

--apb (Alan Barrett)