The upstream MR# now contains safe code without using the directory file descriptor anymore. Basically this version can be whitelisted once the MR# is through and the packaging updated. I believe the code could still be simplified a lot, however, as I stated in the MR# just now.