> between the two calls, an attacker could open the file, and then keep it open until next reboot.

I feel like if there's a malicious user (or program) on your system with the necessary access for this, you have much bigger problems.