Merge release-20210628.0-16-g590b8d3e9 (automated)

95 files changed, 323 insertions, 326 deletions

diff --git a/pkg/sentry/fs/dirent.go b/pkg/sentry/fs/dirent.go
index 1b17aa991..3a45e9041 100644
--- a/pkg/sentry/fs/dirent.go
+++ b/pkg/sentry/fs/dirent.go
@@ -1375,7 +1375,7 @@ func (d *Dirent) mayDelete(ctx context.Context, victim *Dirent) error {
 	}
 
 	if victim.IsRoot() {
-		return syserror.EBUSY
+		return linuxerr.EBUSY
 	}
 
 	return nil
diff --git a/pkg/sentry/fs/file_overlay.go b/pkg/sentry/fs/file_overlay.go
index 7e2f107e0..02208ac3d 100644
--- a/pkg/sentry/fs/file_overlay.go
+++ b/pkg/sentry/fs/file_overlay.go
@@ -358,7 +358,7 @@ func (*overlayFileOperations) ConfigureMMap(ctx context.Context, file *File, opt
 	}
 
 	if !o.isMappableLocked() {
-		return syserror.ENODEV
+		return linuxerr.ENODEV
 	}
 
 	// FIXME(jamieliu): This is a copy/paste of fsutil.GenericConfigureMMap,
diff --git a/pkg/sentry/fs/fsutil/file.go b/pkg/sentry/fs/fsutil/file.go
index c3525ba8e..fe327235a 100644
--- a/pkg/sentry/fs/fsutil/file.go
+++ b/pkg/sentry/fs/fsutil/file.go
@@ -46,7 +46,7 @@ func SeekWithDirCursor(ctx context.Context, file *fs.File, whence fs.SeekWhence,
 
 	// Does the Inode represents a non-seekable type?
 	if fs.IsPipe(inode.StableAttr) || fs.IsSocket(inode.StableAttr) {
-		return current, syserror.ESPIPE
+		return current, linuxerr.ESPIPE
 	}
 
 	// Does the Inode represent a character device?
@@ -162,7 +162,7 @@ type FilePipeSeek struct{}
 
 // Seek implements fs.FileOperations.Seek.
 func (FilePipeSeek) Seek(context.Context, *fs.File, fs.SeekWhence, int64) (int64, error) {
-	return 0, syserror.ESPIPE
+	return 0, linuxerr.ESPIPE
 }
 
 // FileNotDirReaddir implements fs.FileOperations.Readdir for non-directories.
@@ -205,7 +205,7 @@ type FileNoMMap struct{}
 
 // ConfigureMMap implements fs.FileOperations.ConfigureMMap.
 func (FileNoMMap) ConfigureMMap(context.Context, *fs.File, *memmap.MMapOpts) error {
-	return syserror.ENODEV
+	return linuxerr.ENODEV
 }
 
 // GenericConfigureMMap implements fs.FileOperations.ConfigureMMap for most
diff --git a/pkg/sentry/fs/fsutil/inode.go b/pkg/sentry/fs/fsutil/inode.go
index bda07275d..d2b769007 100644
--- a/pkg/sentry/fs/fsutil/inode.go
+++ b/pkg/sentry/fs/fsutil/inode.go
@@ -219,7 +219,7 @@ func (i *InodeSimpleExtendedAttributes) GetXattr(_ context.Context, _ *fs.Inode,
 	value, ok := i.xattrs[name]
 	i.mu.RUnlock()
 	if !ok {
-		return "", syserror.ENOATTR
+		return "", linuxerr.ENOATTR
 	}
 	return value, nil
 }
@@ -230,7 +230,7 @@ func (i *InodeSimpleExtendedAttributes) SetXattr(_ context.Context, _ *fs.Inode,
 	defer i.mu.Unlock()
 	if i.xattrs == nil {
 		if flags&linux.XATTR_REPLACE != 0 {
-			return syserror.ENODATA
+			return linuxerr.ENODATA
 		}
 		i.xattrs = make(map[string]string)
 	}
@@ -240,7 +240,7 @@ func (i *InodeSimpleExtendedAttributes) SetXattr(_ context.Context, _ *fs.Inode,
 		return syserror.EEXIST
 	}
 	if !ok && flags&linux.XATTR_REPLACE != 0 {
-		return syserror.ENODATA
+		return linuxerr.ENODATA
 	}
 
 	i.xattrs[name] = value
@@ -266,7 +266,7 @@ func (i *InodeSimpleExtendedAttributes) RemoveXattr(_ context.Context, _ *fs.Ino
 		delete(i.xattrs, name)
 		return nil
 	}
-	return syserror.ENOATTR
+	return linuxerr.ENOATTR
 }
 
 // staticFile is a file with static contents. It is returned by
@@ -449,12 +449,12 @@ type InodeNotSymlink struct{}
 
 // Readlink implements fs.InodeOperations.Readlink.
 func (InodeNotSymlink) Readlink(context.Context, *fs.Inode) (string, error) {
-	return "", syserror.ENOLINK
+	return "", linuxerr.ENOLINK
 }
 
 // Getlink implements fs.InodeOperations.Getlink.
 func (InodeNotSymlink) Getlink(context.Context, *fs.Inode) (*fs.Dirent, error) {
-	return nil, syserror.ENOLINK
+	return nil, linuxerr.ENOLINK
 }
 
 // InodeNoExtendedAttributes can be used by Inodes that do not support
diff --git a/pkg/sentry/fs/gofer/inode.go b/pkg/sentry/fs/gofer/inode.go
index da3178527..9ff64a8b6 100644
--- a/pkg/sentry/fs/gofer/inode.go
+++ b/pkg/sentry/fs/gofer/inode.go
@@ -20,6 +20,7 @@ import (
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/fd"
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/p9"
@@ -476,7 +477,7 @@ func (i *inodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flags fs.Fi
 	switch d.Inode.StableAttr.Type {
 	case fs.Socket:
 		if i.session().overrides != nil {
-			return nil, syserror.ENXIO
+			return nil, linuxerr.ENXIO
 		}
 		return i.getFileSocket(ctx, d, flags)
 	case fs.Pipe:
@@ -676,7 +677,7 @@ func (i *inodeOperations) Readlink(ctx context.Context, inode *fs.Inode) (string
 // Getlink implementfs fs.InodeOperations.Getlink.
 func (i *inodeOperations) Getlink(context.Context, *fs.Inode) (*fs.Dirent, error) {
 	if !fs.IsSymlink(i.fileState.sattr) {
-		return nil, syserror.ENOLINK
+		return nil, linuxerr.ENOLINK
 	}
 	return nil, fs.ErrResolveViaReadlink
 }
@@ -714,7 +715,7 @@ func (i *inodeOperations) configureMMap(file *fs.File, opts *memmap.MMapOpts) er
 	if i.fileState.hostMappable != nil {
 		return fsutil.GenericConfigureMMap(file, i.fileState.hostMappable, opts)
 	}
-	return syserror.ENODEV
+	return linuxerr.ENODEV
 }
 
 func init() {
diff --git a/pkg/sentry/fs/gofer/path.go b/pkg/sentry/fs/gofer/path.go
index 79e165faf..aa2405f68 100644
--- a/pkg/sentry/fs/gofer/path.go
+++ b/pkg/sentry/fs/gofer/path.go
@@ -44,7 +44,7 @@ func changeType(mode p9.FileMode, newType p9.FileMode) p9.FileMode {
 // policy.
 func (i *inodeOperations) Lookup(ctx context.Context, dir *fs.Inode, name string) (*fs.Dirent, error) {
 	if len(name) > maxFilenameLen {
-		return nil, syserror.ENAMETOOLONG
+		return nil, linuxerr.ENAMETOOLONG
 	}
 
 	cp := i.session().cachePolicy
@@ -107,7 +107,7 @@ func (i *inodeOperations) Lookup(ctx context.Context, dir *fs.Inode, name string
 // Ownership is currently ignored.
 func (i *inodeOperations) Create(ctx context.Context, dir *fs.Inode, name string, flags fs.FileFlags, perm fs.FilePermissions) (*fs.File, error) {
 	if len(name) > maxFilenameLen {
-		return nil, syserror.ENAMETOOLONG
+		return nil, linuxerr.ENAMETOOLONG
 	}
 
 	// Create replaces the directory fid with the newly created/opened
@@ -196,7 +196,7 @@ func (i *inodeOperations) Create(ctx context.Context, dir *fs.Inode, name string
 // CreateLink uses Create to create a symlink between oldname and newname.
 func (i *inodeOperations) CreateLink(ctx context.Context, dir *fs.Inode, oldname string, newname string) error {
 	if len(newname) > maxFilenameLen {
-		return syserror.ENAMETOOLONG
+		return linuxerr.ENAMETOOLONG
 	}
 
 	owner := fs.FileOwnerFromContext(ctx)
@@ -210,12 +210,12 @@ func (i *inodeOperations) CreateLink(ctx context.Context, dir *fs.Inode, oldname
 // CreateHardLink implements InodeOperations.CreateHardLink.
 func (i *inodeOperations) CreateHardLink(ctx context.Context, inode *fs.Inode, target *fs.Inode, newName string) error {
 	if len(newName) > maxFilenameLen {
-		return syserror.ENAMETOOLONG
+		return linuxerr.ENAMETOOLONG
 	}
 
 	targetOpts, ok := target.InodeOperations.(*inodeOperations)
 	if !ok {
-		return syserror.EXDEV
+		return linuxerr.EXDEV
 	}
 
 	if err := i.fileState.file.link(ctx, &targetOpts.fileState.file, newName); err != nil {
@@ -232,7 +232,7 @@ func (i *inodeOperations) CreateHardLink(ctx context.Context, inode *fs.Inode, t
 // CreateDirectory uses Create to create a directory named s under inodeOperations.
 func (i *inodeOperations) CreateDirectory(ctx context.Context, dir *fs.Inode, s string, perm fs.FilePermissions) error {
 	if len(s) > maxFilenameLen {
-		return syserror.ENAMETOOLONG
+		return linuxerr.ENAMETOOLONG
 	}
 
 	// If the parent directory has setgid enabled, change the new directory's
@@ -266,7 +266,7 @@ func (i *inodeOperations) CreateDirectory(ctx context.Context, dir *fs.Inode, s
 // Bind implements InodeOperations.Bind.
 func (i *inodeOperations) Bind(ctx context.Context, dir *fs.Inode, name string, ep transport.BoundEndpoint, perm fs.FilePermissions) (*fs.Dirent, error) {
 	if len(name) > maxFilenameLen {
-		return nil, syserror.ENAMETOOLONG
+		return nil, linuxerr.ENAMETOOLONG
 	}
 
 	if i.session().overrides == nil {
@@ -291,7 +291,7 @@ func (i *inodeOperations) Bind(ctx context.Context, dir *fs.Inode, name string,
 // CreateFifo implements fs.InodeOperations.CreateFifo.
 func (i *inodeOperations) CreateFifo(ctx context.Context, dir *fs.Inode, name string, perm fs.FilePermissions) error {
 	if len(name) > maxFilenameLen {
-		return syserror.ENAMETOOLONG
+		return linuxerr.ENAMETOOLONG
 	}
 
 	owner := fs.FileOwnerFromContext(ctx)
@@ -383,7 +383,7 @@ func (i *inodeOperations) createEndpointFile(ctx context.Context, dir *fs.Inode,
 // Remove implements InodeOperations.Remove.
 func (i *inodeOperations) Remove(ctx context.Context, dir *fs.Inode, name string) error {
 	if len(name) > maxFilenameLen {
-		return syserror.ENAMETOOLONG
+		return linuxerr.ENAMETOOLONG
 	}
 
 	var key *device.MultiDeviceKey
@@ -422,7 +422,7 @@ func (i *inodeOperations) Remove(ctx context.Context, dir *fs.Inode, name string
 // Remove implements InodeOperations.RemoveDirectory.
 func (i *inodeOperations) RemoveDirectory(ctx context.Context, dir *fs.Inode, name string) error {
 	if len(name) > maxFilenameLen {
-		return syserror.ENAMETOOLONG
+		return linuxerr.ENAMETOOLONG
 	}
 
 	// 0x200 = AT_REMOVEDIR.
@@ -443,12 +443,12 @@ func (i *inodeOperations) RemoveDirectory(ctx context.Context, dir *fs.Inode, na
 // Rename renames this node.
 func (i *inodeOperations) Rename(ctx context.Context, inode *fs.Inode, oldParent *fs.Inode, oldName string, newParent *fs.Inode, newName string, replacement bool) error {
 	if len(newName) > maxFilenameLen {
-		return syserror.ENAMETOOLONG
+		return linuxerr.ENAMETOOLONG
 	}
 
 	// Don't allow renames across different mounts.
 	if newParent.MountSource != oldParent.MountSource {
-		return syserror.EXDEV
+		return linuxerr.EXDEV
 	}
 
 	// Unwrap the new parent to a *inodeOperations.
diff --git a/pkg/sentry/fs/host/file.go b/pkg/sentry/fs/host/file.go
index 07bd078b7..77c08a7ce 100644
--- a/pkg/sentry/fs/host/file.go
+++ b/pkg/sentry/fs/host/file.go
@@ -19,6 +19,7 @@ import (
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/context"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/fd"
 	"gvisor.dev/gvisor/pkg/fdnotifier"
 	"gvisor.dev/gvisor/pkg/log"
@@ -268,7 +269,7 @@ func (f *fileOperations) Flush(context.Context, *fs.File) error {
 // ConfigureMMap implements fs.FileOperations.ConfigureMMap.
 func (f *fileOperations) ConfigureMMap(ctx context.Context, file *fs.File, opts *memmap.MMapOpts) error {
 	if !canMap(file.Dirent.Inode) {
-		return syserror.ENODEV
+		return linuxerr.ENODEV
 	}
 	return fsutil.GenericConfigureMMap(file, f.iops.cachingInodeOps, opts)
 }
diff --git a/pkg/sentry/fs/host/inode.go b/pkg/sentry/fs/host/inode.go
index 1b56f0919..77bdf4925 100644
--- a/pkg/sentry/fs/host/inode.go
+++ b/pkg/sentry/fs/host/inode.go
@@ -277,7 +277,7 @@ func (i *inodeOperations) BoundEndpoint(inode *fs.Inode, path string) transport.
 // GetFile implements fs.InodeOperations.GetFile.
 func (i *inodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
 	if fs.IsSocket(d.Inode.StableAttr) {
-		return nil, syserror.ENXIO
+		return nil, linuxerr.ENXIO
 	}
 
 	return newFile(ctx, d, flags, i), nil
@@ -393,7 +393,7 @@ func (i *inodeOperations) Readlink(ctx context.Context, inode *fs.Inode) (string
 // Getlink implements fs.InodeOperations.Getlink.
 func (i *inodeOperations) Getlink(context.Context, *fs.Inode) (*fs.Dirent, error) {
 	if !fs.IsSymlink(i.fileState.sattr) {
-		return nil, syserror.ENOLINK
+		return nil, linuxerr.ENOLINK
 	}
 	return nil, fs.ErrResolveViaReadlink
 }
diff --git a/pkg/sentry/fs/host/socket.go b/pkg/sentry/fs/host/socket.go
index 225244868..54c421775 100644
--- a/pkg/sentry/fs/host/socket.go
+++ b/pkg/sentry/fs/host/socket.go
@@ -32,7 +32,6 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/uniqueid"
 	"gvisor.dev/gvisor/pkg/sync"
 	"gvisor.dev/gvisor/pkg/syserr"
-	"gvisor.dev/gvisor/pkg/syserror"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/unet"
 	"gvisor.dev/gvisor/pkg/waiter"
@@ -212,7 +211,7 @@ func (c *ConnectedEndpoint) Send(ctx context.Context, data [][]byte, controlMess
 	if n < totalLen && err == nil {
 		// The host only returns a short write if it would otherwise
 		// block (and only for stream sockets).
-		err = syserror.EAGAIN
+		err = linuxerr.EAGAIN
 	}
 	if n > 0 && !linuxerr.Equals(linuxerr.EAGAIN, err) {
 		// The caller may need to block to send more data, but
diff --git a/pkg/sentry/fs/host/socket_iovec.go b/pkg/sentry/fs/host/socket_iovec.go
index fd48aff11..d98e3c6d1 100644
--- a/pkg/sentry/fs/host/socket_iovec.go
+++ b/pkg/sentry/fs/host/socket_iovec.go
@@ -16,8 +16,8 @@ package host
 
 import (
 	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/sentry/hostfd"
-	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 // LINT.IfChange
@@ -66,9 +66,9 @@ func buildIovec(bufs [][]byte, maxlen int64, truncate bool) (length int64, iovec
 	if length > maxlen {
 		if truncate {
 			stopLen = maxlen
-			err = syserror.EAGAIN
+			err = linuxerr.EAGAIN
 		} else {
-			return 0, nil, nil, syserror.EMSGSIZE
+			return 0, nil, nil, linuxerr.EMSGSIZE
 		}
 	}
 
diff --git a/pkg/sentry/fs/inode.go b/pkg/sentry/fs/inode.go
index b8da3bdd4..ec204e5cf 100644
--- a/pkg/sentry/fs/inode.go
+++ b/pkg/sentry/fs/inode.go
@@ -299,7 +299,7 @@ func (i *Inode) RemoveXattr(ctx context.Context, d *Dirent, name string) error {
 func (i *Inode) CheckPermission(ctx context.Context, p PermMask) error {
 	// First check the outer-most mounted filesystem.
 	if p.Write && i.MountSource.Flags.ReadOnly {
-		return syserror.EROFS
+		return linuxerr.EROFS
 	}
 
 	if i.overlay != nil {
@@ -313,7 +313,7 @@ func (i *Inode) CheckPermission(ctx context.Context, p PermMask) error {
 		// we should not attempt to modify the writable layer if it
 		// is mounted read-only.
 		if p.Write && overlayUpperMountSource(i.MountSource).Flags.ReadOnly {
-			return syserror.EROFS
+			return linuxerr.EROFS
 		}
 	}
 
diff --git a/pkg/sentry/fs/inode_operations.go b/pkg/sentry/fs/inode_operations.go
index 2bbfb72ef..98e9fb2b1 100644
--- a/pkg/sentry/fs/inode_operations.go
+++ b/pkg/sentry/fs/inode_operations.go
@@ -283,7 +283,7 @@ type InodeOperations interface {
 	//
 	// Any error returned from Getlink other than ErrResolveViaReadlink
 	// indicates the caller's inability to traverse this Inode as a link
-	// (e.g. syserror.ENOLINK indicates that the Inode is not a link,
+	// (e.g. linuxerr.ENOLINK indicates that the Inode is not a link,
 	// syscall.EPERM indicates that traversing the link is not allowed, etc).
 	Getlink(context.Context, *Inode) (*Dirent, error)
 
diff --git a/pkg/sentry/fs/inode_overlay.go b/pkg/sentry/fs/inode_overlay.go
index ecd467533..c47b9ce58 100644
--- a/pkg/sentry/fs/inode_overlay.go
+++ b/pkg/sentry/fs/inode_overlay.go
@@ -344,7 +344,7 @@ func overlayRemove(ctx context.Context, o *overlayEntry, parent *Dirent, child *
 			return err
 		}
 		if ser.Written() != 0 {
-			return syserror.ENOTEMPTY
+			return linuxerr.ENOTEMPTY
 		}
 	}
 	if child.Inode.overlay.upper != nil {
@@ -375,7 +375,7 @@ func overlayRename(ctx context.Context, o *overlayEntry, oldParent *Dirent, rena
 	// Maybe some day we can allow the more complicated case of
 	// non-overlay X overlay renames, but that's not necessary right now.
 	if renamed.Inode.overlay == nil || newParent.Inode.overlay == nil || oldParent.Inode.overlay == nil {
-		return syserror.EXDEV
+		return linuxerr.EXDEV
 	}
 
 	if replacement {
@@ -421,7 +421,7 @@ func overlayRename(ctx context.Context, o *overlayEntry, oldParent *Dirent, rena
 				// need to bother checking for them.
 				if len(children) > 0 {
 					replaced.DecRef(ctx)
-					return syserror.ENOTEMPTY
+					return linuxerr.ENOTEMPTY
 				}
 			}
 
@@ -553,7 +553,7 @@ func overlayGetXattr(ctx context.Context, o *overlayEntry, name string, size uin
 	// Don't forward the value of the extended attribute if it would
 	// unexpectedly change the behavior of a wrapping overlay layer.
 	if isXattrOverlay(name) {
-		return "", syserror.ENODATA
+		return "", linuxerr.ENODATA
 	}
 
 	o.copyMu.RLock()
diff --git a/pkg/sentry/fs/inotify.go b/pkg/sentry/fs/inotify.go
index ebdd418af..cf4d6d118 100644
--- a/pkg/sentry/fs/inotify.go
+++ b/pkg/sentry/fs/inotify.go
@@ -117,7 +117,7 @@ func (i *Inotify) Readiness(mask waiter.EventMask) waiter.EventMask {
 
 // Seek implements FileOperations.Seek.
 func (*Inotify) Seek(context.Context, *File, SeekWhence, int64) (int64, error) {
-	return 0, syserror.ESPIPE
+	return 0, linuxerr.ESPIPE
 }
 
 // Readdir implements FileOperatons.Readdir.
@@ -199,7 +199,7 @@ func (*Inotify) Flush(context.Context, *File) error {
 
 // ConfigureMMap implements FileOperations.ConfigureMMap.
 func (*Inotify) ConfigureMMap(context.Context, *File, *memmap.MMapOpts) error {
-	return syserror.ENODEV
+	return linuxerr.ENODEV
 }
 
 // UnstableAttr implements FileOperations.UnstableAttr.
diff --git a/pkg/sentry/fs/mock.go b/pkg/sentry/fs/mock.go
index 2a54c1242..fba7b961b 100644
--- a/pkg/sentry/fs/mock.go
+++ b/pkg/sentry/fs/mock.go
@@ -17,7 +17,6 @@ package fs
 import (
 	"gvisor.dev/gvisor/pkg/context"
 	"gvisor.dev/gvisor/pkg/errors/linuxerr"
-	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 // MockInodeOperations implements InodeOperations for testing Inodes.
@@ -173,5 +172,5 @@ func (n *MockInodeOperations) RemoveDirectory(context.Context, *Inode, string) e
 
 // Getlink implements fs.InodeOperations.Getlink.
 func (n *MockInodeOperations) Getlink(context.Context, *Inode) (*Dirent, error) {
-	return nil, syserror.ENOLINK
+	return nil, linuxerr.ENOLINK
 }
diff --git a/pkg/sentry/fs/mounts.go b/pkg/sentry/fs/mounts.go
index 340441974..3de1c5561 100644
--- a/pkg/sentry/fs/mounts.go
+++ b/pkg/sentry/fs/mounts.go
@@ -282,7 +282,7 @@ func (mns *MountNamespace) withMountLocked(node *Dirent, fn func() error) error
 	// Linux allows mounting over the root (?). It comes with a strange set
 	// of semantics. We'll just not do this for now.
 	if node.parent == nil {
-		return syserror.EBUSY
+		return linuxerr.EBUSY
 	}
 
 	// For both mount and unmount, we take this lock so we can swap out the
@@ -381,7 +381,7 @@ func (mns *MountNamespace) Unmount(ctx context.Context, node *Dirent, detachOnly
 			if refs := m.DirentRefs(); refs < 2 {
 				panic(fmt.Sprintf("have %d refs on unmount, expect 2 or more", refs))
 			} else if refs != 2 {
-				return syserror.EBUSY
+				return linuxerr.EBUSY
 			}
 		}
 
@@ -567,8 +567,8 @@ func (mns *MountNamespace) resolve(ctx context.Context, root, node *Dirent, rema
 	// Resolve the path.
 	target, err := node.Inode.Getlink(ctx)
 
-	switch err {
-	case nil:
+	switch {
+	case err == nil:
 		// Make sure we didn't exhaust the traversal budget.
 		if *remainingTraversals == 0 {
 			target.DecRef(ctx)
@@ -578,11 +578,11 @@ func (mns *MountNamespace) resolve(ctx context.Context, root, node *Dirent, rema
 		node.DecRef(ctx) // Drop the original reference.
 		return target, nil
 
-	case unix.ENOLINK:
+	case linuxerr.Equals(linuxerr.ENOLINK, err):
 		// Not a symlink.
 		return node, nil
 
-	case ErrResolveViaReadlink:
+	case err == ErrResolveViaReadlink:
 		defer node.DecRef(ctx) // See above.
 
 		// First, check if we should traverse.
diff --git a/pkg/sentry/fs/ramfs/dir.go b/pkg/sentry/fs/ramfs/dir.go
index daa396e42..33023af77 100644
--- a/pkg/sentry/fs/ramfs/dir.go
+++ b/pkg/sentry/fs/ramfs/dir.go
@@ -209,7 +209,7 @@ func (d *Dir) removeChildLocked(ctx context.Context, name string) (*fs.Inode, er
 // Remove removes the named non-directory.
 func (d *Dir) Remove(ctx context.Context, _ *fs.Inode, name string) error {
 	if len(name) > linux.NAME_MAX {
-		return syserror.ENAMETOOLONG
+		return linuxerr.ENAMETOOLONG
 	}
 
 	d.mu.Lock()
@@ -227,7 +227,7 @@ func (d *Dir) Remove(ctx context.Context, _ *fs.Inode, name string) error {
 // RemoveDirectory removes the named directory.
 func (d *Dir) RemoveDirectory(ctx context.Context, _ *fs.Inode, name string) error {
 	if len(name) > linux.NAME_MAX {
-		return syserror.ENAMETOOLONG
+		return linuxerr.ENAMETOOLONG
 	}
 
 	d.mu.Lock()
@@ -241,7 +241,7 @@ func (d *Dir) RemoveDirectory(ctx context.Context, _ *fs.Inode, name string) err
 	if ok, err := hasChildren(ctx, childInode); err != nil {
 		return err
 	} else if ok {
-		return syserror.ENOTEMPTY
+		return linuxerr.ENOTEMPTY
 	}
 
 	// Child was empty. Proceed with removal.
@@ -260,7 +260,7 @@ func (d *Dir) RemoveDirectory(ctx context.Context, _ *fs.Inode, name string) err
 // with a reference.
 func (d *Dir) Lookup(ctx context.Context, _ *fs.Inode, p string) (*fs.Dirent, error) {
 	if len(p) > linux.NAME_MAX {
-		return nil, syserror.ENAMETOOLONG
+		return nil, linuxerr.ENAMETOOLONG
 	}
 
 	d.mu.Lock()
@@ -293,7 +293,7 @@ func (d *Dir) walkLocked(ctx context.Context, p string) (*fs.Inode, error) {
 // makeInodeOperations. It is the common logic for creating a new child.
 func (d *Dir) createInodeOperationsCommon(ctx context.Context, name string, makeInodeOperations func() (*fs.Inode, error)) (*fs.Inode, error) {
 	if len(name) > linux.NAME_MAX {
-		return nil, syserror.ENAMETOOLONG
+		return nil, linuxerr.ENAMETOOLONG
 	}
 
 	d.mu.Lock()
@@ -345,7 +345,7 @@ func (d *Dir) CreateLink(ctx context.Context, dir *fs.Inode, oldname, newname st
 // CreateHardLink creates a new hard link.
 func (d *Dir) CreateHardLink(ctx context.Context, dir *fs.Inode, target *fs.Inode, name string) error {
 	if len(name) > linux.NAME_MAX {
-		return syserror.ENAMETOOLONG
+		return linuxerr.ENAMETOOLONG
 	}
 
 	d.mu.Lock()
@@ -497,14 +497,14 @@ func hasChildren(ctx context.Context, inode *fs.Inode) (bool, error) {
 func Rename(ctx context.Context, oldParent fs.InodeOperations, oldName string, newParent fs.InodeOperations, newName string, replacement bool) error {
 	op, ok := oldParent.(*Dir)
 	if !ok {
-		return syserror.EXDEV
+		return linuxerr.EXDEV
 	}
 	np, ok := newParent.(*Dir)
 	if !ok {
-		return syserror.EXDEV
+		return linuxerr.EXDEV
 	}
 	if len(newName) > linux.NAME_MAX {
-		return syserror.ENAMETOOLONG
+		return linuxerr.ENAMETOOLONG
 	}
 
 	np.mu.Lock()
@@ -522,7 +522,7 @@ func Rename(ctx context.Context, oldParent fs.InodeOperations, oldName string, n
 			if ok, err := hasChildren(ctx, replaced); err != nil {
 				return err
 			} else if ok {
-				return syserror.ENOTEMPTY
+				return linuxerr.ENOTEMPTY
 			}
 		}
 
diff --git a/pkg/sentry/fs/ramfs/socket.go b/pkg/sentry/fs/ramfs/socket.go
index d0c565879..dc9d27bb3 100644
--- a/pkg/sentry/fs/ramfs/socket.go
+++ b/pkg/sentry/fs/ramfs/socket.go
@@ -17,10 +17,10 @@ package ramfs
 import (
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/sentry/fs"
 	"gvisor.dev/gvisor/pkg/sentry/fs/fsutil"
 	"gvisor.dev/gvisor/pkg/sentry/socket/unix/transport"
-	"gvisor.dev/gvisor/pkg/syserror"
 	"gvisor.dev/gvisor/pkg/waiter"
 )
 
@@ -64,7 +64,7 @@ func (s *Socket) BoundEndpoint(*fs.Inode, string) transport.BoundEndpoint {
 
 // GetFile implements fs.FileOperations.GetFile.
 func (s *Socket) GetFile(ctx context.Context, dirent *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
-	return nil, syserror.ENXIO
+	return nil, linuxerr.ENXIO
 }
 
 // +stateify savable
diff --git a/pkg/sentry/fs/tmpfs/inode_file.go b/pkg/sentry/fs/tmpfs/inode_file.go
index 60c419b9f..1974523bf 100644
--- a/pkg/sentry/fs/tmpfs/inode_file.go
+++ b/pkg/sentry/fs/tmpfs/inode_file.go
@@ -32,7 +32,6 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/memmap"
 	"gvisor.dev/gvisor/pkg/sentry/usage"
 	"gvisor.dev/gvisor/pkg/sync"
-	"gvisor.dev/gvisor/pkg/syserror"
 	"gvisor.dev/gvisor/pkg/usermem"
 )
 
@@ -151,7 +150,7 @@ func (*fileInodeOperations) Rename(ctx context.Context, inode *fs.Inode, oldPare
 // GetFile implements fs.InodeOperations.GetFile.
 func (f *fileInodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flags fs.FileFlags) (*fs.File, error) {
 	if fs.IsSocket(d.Inode.StableAttr) {
-		return nil, syserror.ENXIO
+		return nil, linuxerr.ENXIO
 	}
 
 	if flags.Write {
@@ -675,7 +674,7 @@ func AddSeals(inode *fs.Inode, val uint32) error {
 		// F_SEAL_WRITE can only be added if there are no active writable maps.
 		if f.seals&linux.F_SEAL_WRITE == 0 && val&linux.F_SEAL_WRITE != 0 {
 			if f.writableMappingPages > 0 {
-				return syserror.EBUSY
+				return linuxerr.EBUSY
 			}
 		}
 
diff --git a/pkg/sentry/fs/tmpfs/tmpfs.go b/pkg/sentry/fs/tmpfs/tmpfs.go
index 6aa8ff331..9a835b556 100644
--- a/pkg/sentry/fs/tmpfs/tmpfs.go
+++ b/pkg/sentry/fs/tmpfs/tmpfs.go
@@ -20,6 +20,7 @@ import (
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/hostarch"
 	"gvisor.dev/gvisor/pkg/sentry/fs"
 	"gvisor.dev/gvisor/pkg/sentry/fs/fsutil"
@@ -28,7 +29,6 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/kernel/pipe"
 	"gvisor.dev/gvisor/pkg/sentry/socket/unix/transport"
 	"gvisor.dev/gvisor/pkg/sentry/usage"
-	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 var fsInfo = fs.Info{
@@ -49,7 +49,7 @@ var fsInfo = fs.Info{
 func rename(ctx context.Context, oldParent *fs.Inode, oldName string, newParent *fs.Inode, newName string, replacement bool) error {
 	// Don't allow renames across different mounts.
 	if newParent.MountSource != oldParent.MountSource {
-		return syserror.EXDEV
+		return linuxerr.EXDEV
 	}
 
 	op := oldParent.InodeOperations.(*Dir)
diff --git a/pkg/sentry/fsbridge/fs.go b/pkg/sentry/fsbridge/fs.go
index 2b6c93e12..36d7c110a 100644
--- a/pkg/sentry/fsbridge/fs.go
+++ b/pkg/sentry/fsbridge/fs.go
@@ -128,7 +128,7 @@ func (l *fsLookup) OpenPath(ctx context.Context, path string, opts vfs.OpenOptio
 	defer d.DecRef(ctx)
 
 	if !resolveFinal && fs.IsSymlink(d.Inode.StableAttr) {
-		return nil, syserror.ELOOP
+		return nil, linuxerr.ELOOP
 	}
 
 	fsPerm := openOptionsToPermMask(&opts)
diff --git a/pkg/sentry/fsimpl/cgroupfs/cgroupfs.go b/pkg/sentry/fsimpl/cgroupfs/cgroupfs.go
index cabe87c94..24e28a51f 100644
--- a/pkg/sentry/fsimpl/cgroupfs/cgroupfs.go
+++ b/pkg/sentry/fsimpl/cgroupfs/cgroupfs.go
@@ -68,7 +68,6 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
 	"gvisor.dev/gvisor/pkg/sentry/vfs"
 	"gvisor.dev/gvisor/pkg/sync"
-	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 const (
@@ -295,7 +294,7 @@ func (fsType FilesystemType) GetFilesystem(ctx context.Context, vfsObj *vfs.Virt
 		ctx.Infof("cgroupfs.FilesystemType.GetFilesystem: failed to register new hierarchy with controllers %v: %v", wantControllers, err)
 		rootD.DecRef(ctx)
 		fs.VFSFilesystem().DecRef(ctx)
-		return nil, nil, syserror.EBUSY
+		return nil, nil, linuxerr.EBUSY
 	}
 
 	// Move all existing tasks to the root of the new hierarchy.
diff --git a/pkg/sentry/fsimpl/fuse/connection.go b/pkg/sentry/fsimpl/fuse/connection.go
index 077bf9307..d404edaf0 100644
--- a/pkg/sentry/fsimpl/fuse/connection.go
+++ b/pkg/sentry/fsimpl/fuse/connection.go
@@ -19,9 +19,9 @@ import (
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
-	"gvisor.dev/gvisor/pkg/syserror"
 	"gvisor.dev/gvisor/pkg/waiter"
 )
 
@@ -252,11 +252,11 @@ func (conn *connection) Call(t *kernel.Task, r *Request) (*Response, error) {
 	}
 
 	if !conn.connected {
-		return nil, syserror.ENOTCONN
+		return nil, linuxerr.ENOTCONN
 	}
 
 	if conn.connInitError {
-		return nil, syserror.ECONNREFUSED
+		return nil, linuxerr.ECONNREFUSED
 	}
 
 	fut, err := conn.callFuture(t, r)
@@ -306,7 +306,7 @@ func (conn *connection) callFutureLocked(t *kernel.Task, r *Request) (*futureRes
 		conn.mu.Unlock()
 		// we checked connected before,
 		// this must be due to aborted connection.
-		return nil, syserror.ECONNABORTED
+		return nil, linuxerr.ECONNABORTED
 	}
 	conn.mu.Unlock()
 
diff --git a/pkg/sentry/fsimpl/fuse/dev.go b/pkg/sentry/fsimpl/fuse/dev.go
index 41fc6e512..dab1e779d 100644
--- a/pkg/sentry/fsimpl/fuse/dev.go
+++ b/pkg/sentry/fsimpl/fuse/dev.go
@@ -257,7 +257,7 @@ func (fd *DeviceFD) writeLocked(ctx context.Context, src usermem.IOSequence, opt
 
 	// Return ENODEV if the filesystem is umounted.
 	if fd.fs.umounted {
-		return 0, syserror.ENODEV
+		return 0, linuxerr.ENODEV
 	}
 
 	var cn, n int64
diff --git a/pkg/sentry/fsimpl/fuse/fusefs.go b/pkg/sentry/fsimpl/fuse/fusefs.go
index a48db0d24..e9379e350 100644
--- a/pkg/sentry/fsimpl/fuse/fusefs.go
+++ b/pkg/sentry/fsimpl/fuse/fusefs.go
@@ -397,7 +397,7 @@ func (i *inode) Open(ctx context.Context, rp *vfs.ResolvingPath, d *kernfs.Dentr
 		return nil, syserror.ENOTDIR
 	}
 	if opts.Flags&linux.O_LARGEFILE == 0 && atomic.LoadUint64(&i.size) > linux.MAX_NON_LFS {
-		return nil, syserror.EOVERFLOW
+		return nil, linuxerr.EOVERFLOW
 	}
 
 	var fd *fileDescription
diff --git a/pkg/sentry/fsimpl/gofer/filesystem.go b/pkg/sentry/fsimpl/gofer/filesystem.go
index 9b900801b..237d17921 100644
--- a/pkg/sentry/fsimpl/gofer/filesystem.go
+++ b/pkg/sentry/fsimpl/gofer/filesystem.go
@@ -245,7 +245,7 @@ afterSymlink:
 // * dentry at name has been revalidated
 func (fs *filesystem) getChildLocked(ctx context.Context, parent *dentry, name string, ds **[]*dentry) (*dentry, error) {
 	if len(name) > maxFilenameLen {
-		return nil, syserror.ENAMETOOLONG
+		return nil, linuxerr.ENAMETOOLONG
 	}
 	if child, ok := parent.children[name]; ok || parent.isSynthetic() {
 		if child == nil {
@@ -373,7 +373,7 @@ func (fs *filesystem) doCreateAt(ctx context.Context, rp *vfs.ResolvingPath, dir
 	defer parent.dirMu.Unlock()
 
 	if len(name) > maxFilenameLen {
-		return syserror.ENAMETOOLONG
+		return linuxerr.ENAMETOOLONG
 	}
 	// Check for existence only if caching information is available. Otherwise,
 	// don't check for existence just yet. We will check for existence if the
@@ -473,7 +473,7 @@ func (fs *filesystem) unlinkAt(ctx context.Context, rp *vfs.ResolvingPath, dir b
 			return linuxerr.EINVAL
 		}
 		if name == ".." {
-			return syserror.ENOTEMPTY
+			return linuxerr.ENOTEMPTY
 		}
 	} else {
 		if name == "." || name == ".." {
@@ -541,7 +541,7 @@ func (fs *filesystem) unlinkAt(ctx context.Context, rp *vfs.ResolvingPath, dir b
 				// This is definitely not an empty directory, irrespective of
 				// fs.opts.interop.
 				vfsObj.AbortDeleteDentry(&child.vfsd)
-				return syserror.ENOTEMPTY
+				return linuxerr.ENOTEMPTY
 			}
 			// If InteropModeShared is in effect and the first call to
 			// PrepareDeleteDentry above succeeded, then child wasn't
@@ -556,7 +556,7 @@ func (fs *filesystem) unlinkAt(ctx context.Context, rp *vfs.ResolvingPath, dir b
 				for _, grandchild := range child.children {
 					if grandchild != nil {
 						vfsObj.AbortDeleteDentry(&child.vfsd)
-						return syserror.ENOTEMPTY
+						return linuxerr.ENOTEMPTY
 					}
 				}
 			}
@@ -675,7 +675,7 @@ func (fs *filesystem) GetParentDentryAt(ctx context.Context, rp *vfs.ResolvingPa
 func (fs *filesystem) LinkAt(ctx context.Context, rp *vfs.ResolvingPath, vd vfs.VirtualDentry) error {
 	return fs.doCreateAt(ctx, rp, false /* dir */, func(parent *dentry, childName string, _ **[]*dentry) error {
 		if rp.Mount() != vd.Mount() {
-			return syserror.EXDEV
+			return linuxerr.EXDEV
 		}
 		d := vd.Dentry().Impl().(*dentry)
 		if d.isDir() {
@@ -691,7 +691,7 @@ func (fs *filesystem) LinkAt(ctx context.Context, rp *vfs.ResolvingPath, vd vfs.
 			return syserror.ENOENT
 		}
 		if d.nlink == math.MaxUint32 {
-			return syserror.EMLINK
+			return linuxerr.EMLINK
 		}
 		if err := parent.file.link(ctx, d.file, childName); err != nil {
 			return err
@@ -963,10 +963,10 @@ func (d *dentry) open(ctx context.Context, rp *vfs.ResolvingPath, opts *vfs.Open
 		return &fd.vfsfd, nil
 	case linux.S_IFLNK:
 		// Can't open symlinks without O_PATH, which is handled at the VFS layer.
-		return nil, syserror.ELOOP
+		return nil, linuxerr.ELOOP
 	case linux.S_IFSOCK:
 		if d.isSynthetic() {
-			return nil, syserror.ENXIO
+			return nil, linuxerr.ENXIO
 		}
 		if d.fs.iopts.OpenSocketsByConnecting {
 			return d.openSocketByConnecting(ctx, opts)
@@ -1218,11 +1218,11 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 		if opts.Flags&linux.RENAME_NOREPLACE != 0 {
 			return syserror.EEXIST
 		}
-		return syserror.EBUSY
+		return linuxerr.EBUSY
 	}
 	mnt := rp.Mount()
 	if mnt != oldParentVD.Mount() {
-		return syserror.EXDEV
+		return linuxerr.EXDEV
 	}
 	if err := mnt.CheckBeginWrite(); err != nil {
 		return err
@@ -1299,7 +1299,7 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 				return syserror.EISDIR
 			}
 			if genericIsAncestorDentry(replaced, renamed) {
-				return syserror.ENOTEMPTY
+				return linuxerr.ENOTEMPTY
 			}
 		} else {
 			if rp.MustBeDir() || renamed.isDir() {
@@ -1508,7 +1508,7 @@ func (fs *filesystem) BoundEndpointAt(ctx context.Context, rp *vfs.ResolvingPath
 			return d.endpoint, nil
 		}
 	}
-	return nil, syserror.ECONNREFUSED
+	return nil, linuxerr.ECONNREFUSED
 }
 
 // ListXattrAt implements vfs.FilesystemImpl.ListXattrAt.
diff --git a/pkg/sentry/fsimpl/gofer/gofer.go b/pkg/sentry/fsimpl/gofer/gofer.go
index 2397e2427..fe4c2e0e1 100644
--- a/pkg/sentry/fsimpl/gofer/gofer.go
+++ b/pkg/sentry/fsimpl/gofer/gofer.go
@@ -1704,7 +1704,7 @@ func (d *dentry) listXattr(ctx context.Context, creds *auth.Credentials, size ui
 
 func (d *dentry) getXattr(ctx context.Context, creds *auth.Credentials, opts *vfs.GetXattrOptions) (string, error) {
 	if d.file.isNil() {
-		return "", syserror.ENODATA
+		return "", linuxerr.ENODATA
 	}
 	if err := d.checkXattrPermissions(creds, opts.Name, vfs.MayRead); err != nil {
 		return "", err
diff --git a/pkg/sentry/fsimpl/gofer/regular_file.go b/pkg/sentry/fsimpl/gofer/regular_file.go
index 89eab04cd..7f458dd05 100644
--- a/pkg/sentry/fsimpl/gofer/regular_file.go
+++ b/pkg/sentry/fsimpl/gofer/regular_file.go
@@ -653,12 +653,12 @@ func regularFileSeekLocked(ctx context.Context, d *dentry, fdOffset, offset int6
 			offset += size
 		case linux.SEEK_DATA:
 			if offset > size {
-				return 0, syserror.ENXIO
+				return 0, linuxerr.ENXIO
 			}
 			// Use offset as specified.
 		case linux.SEEK_HOLE:
 			if offset > size {
-				return 0, syserror.ENXIO
+				return 0, linuxerr.ENXIO
 			}
 			offset = size
 		}
@@ -696,7 +696,7 @@ func (fd *regularFileFD) ConfigureMMap(ctx context.Context, opts *memmap.MMapOpt
 			// All mappings require a host FD to be coherent with other
 			// filesystem users.
 			if atomic.LoadInt32(&d.mmapFD) < 0 {
-				return syserror.ENODEV
+				return linuxerr.ENODEV
 			}
 		default:
 			panic(fmt.Sprintf("unknown InteropMode %v", d.fs.opts.interop))
diff --git a/pkg/sentry/fsimpl/gofer/special_file.go b/pkg/sentry/fsimpl/gofer/special_file.go
index 2a922d120..690cde707 100644
--- a/pkg/sentry/fsimpl/gofer/special_file.go
+++ b/pkg/sentry/fsimpl/gofer/special_file.go
@@ -355,7 +355,7 @@ func (fd *specialFileFD) Write(ctx context.Context, src usermem.IOSequence, opts
 // Seek implements vfs.FileDescriptionImpl.Seek.
 func (fd *specialFileFD) Seek(ctx context.Context, offset int64, whence int32) (int64, error) {
 	if !fd.seekable {
-		return 0, syserror.ESPIPE
+		return 0, linuxerr.ESPIPE
 	}
 	fd.mu.Lock()
 	defer fd.mu.Unlock()
diff --git a/pkg/sentry/fsimpl/host/host.go b/pkg/sentry/fsimpl/host/host.go
index 7ec4832c3..cdd33e0fe 100644
--- a/pkg/sentry/fsimpl/host/host.go
+++ b/pkg/sentry/fsimpl/host/host.go
@@ -115,7 +115,7 @@ func newInode(ctx context.Context, fs *filesystem, hostFD int, savable bool, fil
 	// be memory-mappable.
 	if !seekable && fileType == unix.S_IFREG {
 		ctx.Infof("host.newInode: host FD %d is a non-seekable regular file", hostFD)
-		return nil, syserror.ESPIPE
+		return nil, linuxerr.ESPIPE
 	}
 
 	i := &inode{
@@ -471,7 +471,7 @@ func (i *inode) DecRef(ctx context.Context) {
 func (i *inode) Open(ctx context.Context, rp *vfs.ResolvingPath, d *kernfs.Dentry, opts vfs.OpenOptions) (*vfs.FileDescription, error) {
 	// Once created, we cannot re-open a socket fd through /proc/[pid]/fd/.
 	if i.Mode().FileType() == linux.S_IFSOCK {
-		return nil, syserror.ENXIO
+		return nil, linuxerr.ENXIO
 	}
 	return i.open(ctx, d, rp.Mount(), opts.Flags)
 }
@@ -590,7 +590,7 @@ func (f *fileDescription) PRead(ctx context.Context, dst usermem.IOSequence, off
 
 	i := f.inode
 	if !i.seekable {
-		return 0, syserror.ESPIPE
+		return 0, linuxerr.ESPIPE
 	}
 
 	return readFromHostFD(ctx, i.hostFD, dst, offset, opts.Flags)
@@ -661,7 +661,7 @@ func readFromHostFD(ctx context.Context, hostFD int, dst usermem.IOSequence, off
 // PWrite implements vfs.FileDescriptionImpl.PWrite.
 func (f *fileDescription) PWrite(ctx context.Context, src usermem.IOSequence, offset int64, opts vfs.WriteOptions) (int64, error) {
 	if !f.inode.seekable {
-		return 0, syserror.ESPIPE
+		return 0, linuxerr.ESPIPE
 	}
 
 	return f.writeToHostFD(ctx, src, offset, opts.Flags)
@@ -722,7 +722,7 @@ func (f *fileDescription) writeToHostFD(ctx context.Context, src usermem.IOSeque
 func (f *fileDescription) Seek(_ context.Context, offset int64, whence int32) (int64, error) {
 	i := f.inode
 	if !i.seekable {
-		return 0, syserror.ESPIPE
+		return 0, linuxerr.ESPIPE
 	}
 
 	f.offsetMu.Lock()
@@ -738,7 +738,7 @@ func (f *fileDescription) Seek(_ context.Context, offset int64, whence int32) (i
 	case linux.SEEK_CUR:
 		// Check for overflow. Note that underflow cannot occur, since f.offset >= 0.
 		if offset > math.MaxInt64-f.offset {
-			return f.offset, syserror.EOVERFLOW
+			return f.offset, linuxerr.EOVERFLOW
 		}
 		if f.offset+offset < 0 {
 			return f.offset, linuxerr.EINVAL
@@ -754,7 +754,7 @@ func (f *fileDescription) Seek(_ context.Context, offset int64, whence int32) (i
 
 		// Check for overflow. Note that underflow cannot occur, since size >= 0.
 		if offset > math.MaxInt64-size {
-			return f.offset, syserror.EOVERFLOW
+			return f.offset, linuxerr.EOVERFLOW
 		}
 		if size+offset < 0 {
 			return f.offset, linuxerr.EINVAL
@@ -791,7 +791,7 @@ func (f *fileDescription) ConfigureMMap(_ context.Context, opts *memmap.MMapOpts
 	// NOTE(b/38213152): Technically, some obscure char devices can be memory
 	// mapped, but we only allow regular files.
 	if f.inode.ftype != unix.S_IFREG {
-		return syserror.ENODEV
+		return linuxerr.ENODEV
 	}
 	i := f.inode
 	i.CachedMappable.InitFileMapperOnce()
diff --git a/pkg/sentry/fsimpl/host/socket.go b/pkg/sentry/fsimpl/host/socket.go
index 8cce36212..709d5747d 100644
--- a/pkg/sentry/fsimpl/host/socket.go
+++ b/pkg/sentry/fsimpl/host/socket.go
@@ -29,7 +29,6 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/uniqueid"
 	"gvisor.dev/gvisor/pkg/sync"
 	"gvisor.dev/gvisor/pkg/syserr"
-	"gvisor.dev/gvisor/pkg/syserror"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/unet"
 	"gvisor.dev/gvisor/pkg/waiter"
@@ -159,7 +158,7 @@ func (c *ConnectedEndpoint) Send(ctx context.Context, data [][]byte, controlMess
 	if n < totalLen && err == nil {
 		// The host only returns a short write if it would otherwise
 		// block (and only for stream sockets).
-		err = syserror.EAGAIN
+		err = linuxerr.EAGAIN
 	}
 	if n > 0 && !linuxerr.Equals(linuxerr.EAGAIN, err) {
 		// The caller may need to block to send more data, but
diff --git a/pkg/sentry/fsimpl/host/socket_iovec.go b/pkg/sentry/fsimpl/host/socket_iovec.go
index e090bb725..292b44c43 100644
--- a/pkg/sentry/fsimpl/host/socket_iovec.go
+++ b/pkg/sentry/fsimpl/host/socket_iovec.go
@@ -16,8 +16,8 @@ package host
 
 import (
 	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/sentry/hostfd"
-	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 // copyToMulti copies as many bytes from src to dst as possible.
@@ -64,9 +64,9 @@ func buildIovec(bufs [][]byte, maxlen int64, truncate bool) (length int64, iovec
 	if length > maxlen {
 		if truncate {
 			stopLen = maxlen
-			err = syserror.EAGAIN
+			err = linuxerr.EAGAIN
 		} else {
-			return 0, nil, nil, syserror.EMSGSIZE
+			return 0, nil, nil, linuxerr.EMSGSIZE
 		}
 	}
 
diff --git a/pkg/sentry/fsimpl/kernfs/filesystem.go b/pkg/sentry/fsimpl/kernfs/filesystem.go
index a7214a796..38c2b6df1 100644
--- a/pkg/sentry/fsimpl/kernfs/filesystem.go
+++ b/pkg/sentry/fsimpl/kernfs/filesystem.go
@@ -71,7 +71,7 @@ afterSymlink:
 		return d.parent, nil
 	}
 	if len(name) > linux.NAME_MAX {
-		return nil, syserror.ENAMETOOLONG
+		return nil, linuxerr.ENAMETOOLONG
 	}
 	d.dirMu.Lock()
 	next, err := fs.revalidateChildLocked(ctx, rp.VirtualFilesystem(), d, name, d.children[name])
@@ -218,7 +218,7 @@ func checkCreateLocked(ctx context.Context, creds *auth.Credentials, name string
 		return syserror.EEXIST
 	}
 	if len(name) > linux.NAME_MAX {
-		return syserror.ENAMETOOLONG
+		return linuxerr.ENAMETOOLONG
 	}
 	if _, ok := parent.children[name]; ok {
 		return syserror.EEXIST
@@ -238,7 +238,7 @@ func checkCreateLocked(ctx context.Context, creds *auth.Credentials, name string
 func checkDeleteLocked(ctx context.Context, rp *vfs.ResolvingPath, d *Dentry) error {
 	parent := d.parent
 	if parent == nil {
-		return syserror.EBUSY
+		return linuxerr.EBUSY
 	}
 	if parent.vfsd.IsDead() {
 		return syserror.ENOENT
@@ -365,7 +365,7 @@ func (fs *Filesystem) LinkAt(ctx context.Context, rp *vfs.ResolvingPath, vd vfs.
 		return syserror.ENOENT
 	}
 	if rp.Mount() != vd.Mount() {
-		return syserror.EXDEV
+		return linuxerr.EXDEV
 	}
 	if err := rp.Mount().CheckBeginWrite(); err != nil {
 		return err
@@ -543,7 +543,7 @@ afterTrailingSymlink:
 		return nil, syserror.EISDIR
 	}
 	if len(pc) > linux.NAME_MAX {
-		return nil, syserror.ENAMETOOLONG
+		return nil, linuxerr.ENAMETOOLONG
 	}
 	// Determine whether or not we need to create a file.
 	child, err := fs.stepExistingLocked(ctx, rp, parent, false /* mayFollowSymlinks */)
@@ -655,7 +655,7 @@ func (fs *Filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 
 	mnt := rp.Mount()
 	if mnt != oldParentVD.Mount() {
-		return syserror.EXDEV
+		return linuxerr.EXDEV
 	}
 	if err := mnt.CheckBeginWrite(); err != nil {
 		return err
@@ -683,7 +683,7 @@ func (fs *Filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 		if noReplace {
 			return syserror.EEXIST
 		}
-		return syserror.EBUSY
+		return linuxerr.EBUSY
 	}
 
 	err = checkCreateLocked(ctx, rp.Credentials(), newName, dstDir)
@@ -777,7 +777,7 @@ func (fs *Filesystem) RmdirAt(ctx context.Context, rp *vfs.ResolvingPath) error
 		return syserror.ENOTDIR
 	}
 	if d.inode.HasChildren() {
-		return syserror.ENOTEMPTY
+		return linuxerr.ENOTEMPTY
 	}
 	virtfs := rp.VirtualFilesystem()
 	parentDentry := d.parent
@@ -930,7 +930,7 @@ func (fs *Filesystem) BoundEndpointAt(ctx context.Context, rp *vfs.ResolvingPath
 	if err := d.inode.CheckPermissions(ctx, rp.Credentials(), vfs.MayWrite); err != nil {
 		return nil, err
 	}
-	return nil, syserror.ECONNREFUSED
+	return nil, linuxerr.ECONNREFUSED
 }
 
 // ListXattrAt implements vfs.FilesystemImpl.ListXattrAt.
@@ -943,7 +943,7 @@ func (fs *Filesystem) ListXattrAt(ctx context.Context, rp *vfs.ResolvingPath, si
 		return nil, err
 	}
 	// kernfs currently does not support extended attributes.
-	return nil, syserror.ENOTSUP
+	return nil, linuxerr.ENOTSUP
 }
 
 // GetXattrAt implements vfs.FilesystemImpl.GetXattrAt.
@@ -956,7 +956,7 @@ func (fs *Filesystem) GetXattrAt(ctx context.Context, rp *vfs.ResolvingPath, opt
 		return "", err
 	}
 	// kernfs currently does not support extended attributes.
-	return "", syserror.ENOTSUP
+	return "", linuxerr.ENOTSUP
 }
 
 // SetXattrAt implements vfs.FilesystemImpl.SetXattrAt.
@@ -969,7 +969,7 @@ func (fs *Filesystem) SetXattrAt(ctx context.Context, rp *vfs.ResolvingPath, opt
 		return err
 	}
 	// kernfs currently does not support extended attributes.
-	return syserror.ENOTSUP
+	return linuxerr.ENOTSUP
 }
 
 // RemoveXattrAt implements vfs.FilesystemImpl.RemoveXattrAt.
@@ -982,7 +982,7 @@ func (fs *Filesystem) RemoveXattrAt(ctx context.Context, rp *vfs.ResolvingPath,
 		return err
 	}
 	// kernfs currently does not support extended attributes.
-	return syserror.ENOTSUP
+	return linuxerr.ENOTSUP
 }
 
 // PrependPath implements vfs.FilesystemImpl.PrependPath.
diff --git a/pkg/sentry/fsimpl/kernfs/inode_impl_util.go b/pkg/sentry/fsimpl/kernfs/inode_impl_util.go
index 996f2f03a..df29c8838 100644
--- a/pkg/sentry/fsimpl/kernfs/inode_impl_util.go
+++ b/pkg/sentry/fsimpl/kernfs/inode_impl_util.go
@@ -605,7 +605,7 @@ func (o *OrderedChildren) Rename(ctx context.Context, oldname, newname string, c
 
 	dst, ok := dstDir.(interface{}).(*OrderedChildren)
 	if !ok {
-		return syserror.EXDEV
+		return linuxerr.EXDEV
 	}
 	if !dst.writable {
 		return linuxerr.EPERM
@@ -654,7 +654,7 @@ type InodeSymlink struct {
 
 // Open implements Inode.Open.
 func (InodeSymlink) Open(ctx context.Context, rp *vfs.ResolvingPath, d *Dentry, opts vfs.OpenOptions) (*vfs.FileDescription, error) {
-	return nil, syserror.ELOOP
+	return nil, linuxerr.ELOOP
 }
 
 // StaticDirectory is a standard implementation of a directory with static
diff --git a/pkg/sentry/fsimpl/overlay/copy_up.go b/pkg/sentry/fsimpl/overlay/copy_up.go
index 532e73457..1f85a1f0d 100644
--- a/pkg/sentry/fsimpl/overlay/copy_up.go
+++ b/pkg/sentry/fsimpl/overlay/copy_up.go
@@ -58,7 +58,7 @@ func (d *dentry) copyUpLocked(ctx context.Context) error {
 	// Ensure that our parent directory is copied-up.
 	if d.parent == nil {
 		// d is a filesystem root with no upper layer.
-		return syserror.EROFS
+		return linuxerr.EROFS
 	}
 	if err := d.parent.copyUpLocked(ctx); err != nil {
 		return err
@@ -272,7 +272,7 @@ func (d *dentry) copyUpLocked(ctx context.Context) error {
 		}
 		if upperStat.Mask&linux.STATX_INO == 0 {
 			cleanupUndoCopyUp()
-			return syserror.EREMOTE
+			return linuxerr.EREMOTE
 		}
 		atomic.StoreUint32(&d.devMajor, upperStat.DevMajor)
 		atomic.StoreUint32(&d.devMinor, upperStat.DevMinor)
diff --git a/pkg/sentry/fsimpl/overlay/directory.go b/pkg/sentry/fsimpl/overlay/directory.go
index 417a7c630..ad3cdbb56 100644
--- a/pkg/sentry/fsimpl/overlay/directory.go
+++ b/pkg/sentry/fsimpl/overlay/directory.go
@@ -23,7 +23,6 @@ import (
 	"gvisor.dev/gvisor/pkg/fspath"
 	"gvisor.dev/gvisor/pkg/sentry/vfs"
 	"gvisor.dev/gvisor/pkg/sync"
-	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 func (d *dentry) isDir() bool {
@@ -70,7 +69,7 @@ func (d *dentry) collectWhiteoutsForRmdirLocked(ctx context.Context) (map[string
 				return nil
 			}
 			// Non-whiteout file in the directory prevents rmdir.
-			return syserror.ENOTEMPTY
+			return linuxerr.ENOTEMPTY
 		}))
 		if err != nil {
 			readdirErr = err
@@ -89,7 +88,7 @@ func (d *dentry) collectWhiteoutsForRmdirLocked(ctx context.Context) (map[string
 			}
 			if stat.RdevMajor != 0 || stat.RdevMinor != 0 {
 				// This file is a real character device, not a whiteout.
-				readdirErr = syserror.ENOTEMPTY
+				readdirErr = linuxerr.ENOTEMPTY
 				return false
 			}
 			whiteouts[maybeWhiteoutName] = isUpper
diff --git a/pkg/sentry/fsimpl/overlay/filesystem.go b/pkg/sentry/fsimpl/overlay/filesystem.go
index 20d56f0d8..41207211a 100644
--- a/pkg/sentry/fsimpl/overlay/filesystem.go
+++ b/pkg/sentry/fsimpl/overlay/filesystem.go
@@ -246,7 +246,7 @@ func (fs *filesystem) lookupLocked(ctx context.Context, parent *dentry, name str
 			return false
 		}
 		if stat.Mask&mask != mask {
-			lookupErr = syserror.EREMOTE
+			lookupErr = linuxerr.EREMOTE
 			return false
 		}
 
@@ -366,7 +366,7 @@ func (fs *filesystem) lookupLayerLocked(ctx context.Context, parent *dentry, nam
 			// Linux's overlayfs tends to return EREMOTE in cases where a file
 			// is unusable for reasons that are not better captured by another
 			// errno.
-			lookupErr = syserror.EREMOTE
+			lookupErr = linuxerr.EREMOTE
 			return false
 		}
 		if isWhiteout(&stat) {
@@ -621,7 +621,7 @@ func (fs *filesystem) GetParentDentryAt(ctx context.Context, rp *vfs.ResolvingPa
 func (fs *filesystem) LinkAt(ctx context.Context, rp *vfs.ResolvingPath, vd vfs.VirtualDentry) error {
 	return fs.doCreateAt(ctx, rp, false /* dir */, func(parent *dentry, childName string, haveUpperWhiteout bool) error {
 		if rp.Mount() != vd.Mount() {
-			return syserror.EXDEV
+			return linuxerr.EXDEV
 		}
 		old := vd.Dentry().Impl().(*dentry)
 		if old.isDir() {
@@ -1036,11 +1036,11 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 		if opts.Flags&linux.RENAME_NOREPLACE != 0 {
 			return syserror.EEXIST
 		}
-		return syserror.EBUSY
+		return linuxerr.EBUSY
 	}
 	mnt := rp.Mount()
 	if mnt != oldParentVD.Mount() {
-		return syserror.EXDEV
+		return linuxerr.EXDEV
 	}
 	if err := mnt.CheckBeginWrite(); err != nil {
 		return err
@@ -1108,7 +1108,7 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 				return syserror.EISDIR
 			}
 			if genericIsAncestorDentry(replaced, renamed) {
-				return syserror.ENOTEMPTY
+				return linuxerr.ENOTEMPTY
 			}
 			replaced.dirMu.Lock()
 			defer replaced.dirMu.Unlock()
@@ -1289,7 +1289,7 @@ func (fs *filesystem) RmdirAt(ctx context.Context, rp *vfs.ResolvingPath) error
 		return linuxerr.EINVAL
 	}
 	if name == ".." {
-		return syserror.ENOTEMPTY
+		return linuxerr.ENOTEMPTY
 	}
 	vfsObj := rp.VirtualFilesystem()
 	mntns := vfs.MountNamespaceFromContext(ctx)
diff --git a/pkg/sentry/fsimpl/overlay/overlay.go b/pkg/sentry/fsimpl/overlay/overlay.go
index 4c7243764..46d9f1f1d 100644
--- a/pkg/sentry/fsimpl/overlay/overlay.go
+++ b/pkg/sentry/fsimpl/overlay/overlay.go
@@ -47,7 +47,6 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/memmap"
 	"gvisor.dev/gvisor/pkg/sentry/vfs"
 	"gvisor.dev/gvisor/pkg/sync"
-	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 // Name is the default filesystem name.
@@ -278,7 +277,7 @@ func (fstype FilesystemType) GetFilesystem(ctx context.Context, vfsObj *vfs.Virt
 	if rootStat.Mask&rootStatMask != rootStatMask {
 		root.destroyLocked(ctx)
 		fs.vfsfs.DecRef(ctx)
-		return nil, nil, syserror.EREMOTE
+		return nil, nil, linuxerr.EREMOTE
 	}
 	if isWhiteout(&rootStat) {
 		ctx.Infof("overlay.FilesystemType.GetFilesystem: filesystem root is a whiteout")
diff --git a/pkg/sentry/fsimpl/overlay/regular_file.go b/pkg/sentry/fsimpl/overlay/regular_file.go
index 82491a0f8..156ffeaeb 100644
--- a/pkg/sentry/fsimpl/overlay/regular_file.go
+++ b/pkg/sentry/fsimpl/overlay/regular_file.go
@@ -19,6 +19,7 @@ import (
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/hostarch"
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
@@ -26,7 +27,6 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/memmap"
 	"gvisor.dev/gvisor/pkg/sentry/vfs"
 	"gvisor.dev/gvisor/pkg/sync"
-	"gvisor.dev/gvisor/pkg/syserror"
 	"gvisor.dev/gvisor/pkg/usermem"
 	"gvisor.dev/gvisor/pkg/waiter"
 )
@@ -415,7 +415,7 @@ func (fd *regularFileFD) ensureMappable(ctx context.Context, opts *memmap.MMapOp
 	// Only permit mmap of regular files, since other file types may have
 	// unpredictable behavior when mmapped (e.g. /dev/zero).
 	if atomic.LoadUint32(&d.mode)&linux.S_IFMT != linux.S_IFREG {
-		return syserror.ENODEV
+		return linuxerr.ENODEV
 	}
 
 	// Get a Mappable for the current top layer.
diff --git a/pkg/sentry/fsimpl/sockfs/sockfs.go b/pkg/sentry/fsimpl/sockfs/sockfs.go
index 735756280..75934ecd0 100644
--- a/pkg/sentry/fsimpl/sockfs/sockfs.go
+++ b/pkg/sentry/fsimpl/sockfs/sockfs.go
@@ -20,11 +20,11 @@ import (
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/fspath"
 	"gvisor.dev/gvisor/pkg/sentry/fsimpl/kernfs"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
 	"gvisor.dev/gvisor/pkg/sentry/vfs"
-	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 // filesystemType implements vfs.FilesystemType.
@@ -102,7 +102,7 @@ type inode struct {
 
 // Open implements kernfs.Inode.Open.
 func (i *inode) Open(ctx context.Context, rp *vfs.ResolvingPath, d *kernfs.Dentry, opts vfs.OpenOptions) (*vfs.FileDescription, error) {
-	return nil, syserror.ENXIO
+	return nil, linuxerr.ENXIO
 }
 
 // StatFS implements kernfs.Inode.StatFS.
diff --git a/pkg/sentry/fsimpl/tmpfs/filesystem.go b/pkg/sentry/fsimpl/tmpfs/filesystem.go
index 0a7e7b444..2370fc95e 100644
--- a/pkg/sentry/fsimpl/tmpfs/filesystem.go
+++ b/pkg/sentry/fsimpl/tmpfs/filesystem.go
@@ -71,7 +71,7 @@ afterSymlink:
 		return d.parent, nil
 	}
 	if len(name) > linux.NAME_MAX {
-		return nil, syserror.ENAMETOOLONG
+		return nil, linuxerr.ENAMETOOLONG
 	}
 	child, ok := dir.childMap[name]
 	if !ok {
@@ -165,7 +165,7 @@ func (fs *filesystem) doCreateAt(ctx context.Context, rp *vfs.ResolvingPath, dir
 		return syserror.EEXIST
 	}
 	if len(name) > linux.NAME_MAX {
-		return syserror.ENAMETOOLONG
+		return linuxerr.ENAMETOOLONG
 	}
 	if _, ok := parentDir.childMap[name]; ok {
 		return syserror.EEXIST
@@ -247,7 +247,7 @@ func (fs *filesystem) GetParentDentryAt(ctx context.Context, rp *vfs.ResolvingPa
 func (fs *filesystem) LinkAt(ctx context.Context, rp *vfs.ResolvingPath, vd vfs.VirtualDentry) error {
 	return fs.doCreateAt(ctx, rp, false /* dir */, func(parentDir *directory, name string) error {
 		if rp.Mount() != vd.Mount() {
-			return syserror.EXDEV
+			return linuxerr.EXDEV
 		}
 		d := vd.Dentry().Impl().(*dentry)
 		i := d.inode
@@ -261,7 +261,7 @@ func (fs *filesystem) LinkAt(ctx context.Context, rp *vfs.ResolvingPath, vd vfs.
 			return syserror.ENOENT
 		}
 		if i.nlink == maxLinks {
-			return syserror.EMLINK
+			return linuxerr.EMLINK
 		}
 		i.incLinksLocked()
 		i.watches.Notify(ctx, "", linux.IN_ATTRIB, 0, vfs.InodeEvent, false /* unlinked */)
@@ -275,7 +275,7 @@ func (fs *filesystem) MkdirAt(ctx context.Context, rp *vfs.ResolvingPath, opts v
 	return fs.doCreateAt(ctx, rp, true /* dir */, func(parentDir *directory, name string) error {
 		creds := rp.Credentials()
 		if parentDir.inode.nlink == maxLinks {
-			return syserror.EMLINK
+			return linuxerr.EMLINK
 		}
 		parentDir.inode.incLinksLocked() // from child's ".."
 		childDir := fs.newDirectory(creds.EffectiveKUID, creds.EffectiveKGID, opts.Mode, parentDir)
@@ -373,7 +373,7 @@ afterTrailingSymlink:
 		return nil, syserror.EISDIR
 	}
 	if len(name) > linux.NAME_MAX {
-		return nil, syserror.ENAMETOOLONG
+		return nil, linuxerr.ENAMETOOLONG
 	}
 	// Determine whether or not we need to create a file.
 	child, ok := parentDir.childMap[name]
@@ -467,13 +467,13 @@ func (d *dentry) open(ctx context.Context, rp *vfs.ResolvingPath, opts *vfs.Open
 		return &fd.vfsfd, nil
 	case *symlink:
 		// Can't open symlinks without O_PATH, which is handled at the VFS layer.
-		return nil, syserror.ELOOP
+		return nil, linuxerr.ELOOP
 	case *namedPipe:
 		return impl.pipe.Open(ctx, rp.Mount(), &d.vfsd, opts.Flags, &d.inode.locks)
 	case *deviceFile:
 		return rp.VirtualFilesystem().OpenDeviceSpecialFile(ctx, rp.Mount(), &d.vfsd, impl.kind, impl.major, impl.minor, opts)
 	case *socketFile:
-		return nil, syserror.ENXIO
+		return nil, linuxerr.ENXIO
 	default:
 		panic(fmt.Sprintf("unknown inode type: %T", d.inode.impl))
 	}
@@ -515,11 +515,11 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 		if opts.Flags&linux.RENAME_NOREPLACE != 0 {
 			return syserror.EEXIST
 		}
-		return syserror.EBUSY
+		return linuxerr.EBUSY
 	}
 	mnt := rp.Mount()
 	if mnt != oldParentVD.Mount() {
-		return syserror.EXDEV
+		return linuxerr.EXDEV
 	}
 	if err := mnt.CheckBeginWrite(); err != nil {
 		return err
@@ -570,7 +570,7 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 				return syserror.EISDIR
 			}
 			if len(replacedDir.childMap) != 0 {
-				return syserror.ENOTEMPTY
+				return linuxerr.ENOTEMPTY
 			}
 		} else {
 			if rp.MustBeDir() {
@@ -582,7 +582,7 @@ func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldPa
 		}
 	} else {
 		if renamed.inode.isDir() && newParentDir.inode.nlink == maxLinks {
-			return syserror.EMLINK
+			return linuxerr.EMLINK
 		}
 	}
 	// tmpfs never calls VFS.InvalidateDentry(), so newParentDir.dentry can
@@ -650,7 +650,7 @@ func (fs *filesystem) RmdirAt(ctx context.Context, rp *vfs.ResolvingPath) error
 		return linuxerr.EINVAL
 	}
 	if name == ".." {
-		return syserror.ENOTEMPTY
+		return linuxerr.ENOTEMPTY
 	}
 	child, ok := parentDir.childMap[name]
 	if !ok {
@@ -664,7 +664,7 @@ func (fs *filesystem) RmdirAt(ctx context.Context, rp *vfs.ResolvingPath) error
 		return syserror.ENOTDIR
 	}
 	if len(childDir.childMap) != 0 {
-		return syserror.ENOTEMPTY
+		return linuxerr.ENOTEMPTY
 	}
 	mnt := rp.Mount()
 	if err := mnt.CheckBeginWrite(); err != nil {
@@ -807,11 +807,11 @@ func (fs *filesystem) BoundEndpointAt(ctx context.Context, rp *vfs.ResolvingPath
 	switch impl := d.inode.impl.(type) {
 	case *socketFile:
 		if impl.ep == nil {
-			return nil, syserror.ECONNREFUSED
+			return nil, linuxerr.ECONNREFUSED
 		}
 		return impl.ep, nil
 	default:
-		return nil, syserror.ECONNREFUSED
+		return nil, linuxerr.ECONNREFUSED
 	}
 }
 
diff --git a/pkg/sentry/fsimpl/tmpfs/regular_file.go b/pkg/sentry/fsimpl/tmpfs/regular_file.go
index 55a347c1c..ce595ce85 100644
--- a/pkg/sentry/fsimpl/tmpfs/regular_file.go
+++ b/pkg/sentry/fsimpl/tmpfs/regular_file.go
@@ -713,7 +713,7 @@ func AddSeals(fd *vfs.FileDescription, val uint32) error {
 	// F_SEAL_WRITE can only be added if there are no active writable maps.
 	if rf.seals&linux.F_SEAL_WRITE == 0 && val&linux.F_SEAL_WRITE != 0 {
 		if rf.writableMappingPages > 0 {
-			return syserror.EBUSY
+			return linuxerr.EBUSY
 		}
 	}
 
diff --git a/pkg/sentry/fsimpl/verity/filesystem.go b/pkg/sentry/fsimpl/verity/filesystem.go
index 058eede42..e4bfbd3c9 100644
--- a/pkg/sentry/fsimpl/verity/filesystem.go
+++ b/pkg/sentry/fsimpl/verity/filesystem.go
@@ -712,7 +712,7 @@ func (fs *filesystem) resolveLocked(ctx context.Context, rp *vfs.ResolvingPath,
 func (fs *filesystem) AccessAt(ctx context.Context, rp *vfs.ResolvingPath, creds *auth.Credentials, ats vfs.AccessTypes) error {
 	// Verity file system is read-only.
 	if ats&vfs.MayWrite != 0 {
-		return syserror.EROFS
+		return linuxerr.EROFS
 	}
 	var ds *[]*dentry
 	fs.renameMu.RLock()
@@ -762,26 +762,26 @@ func (fs *filesystem) GetParentDentryAt(ctx context.Context, rp *vfs.ResolvingPa
 // LinkAt implements vfs.FilesystemImpl.LinkAt.
 func (fs *filesystem) LinkAt(ctx context.Context, rp *vfs.ResolvingPath, vd vfs.VirtualDentry) error {
 	// Verity file system is read-only.
-	return syserror.EROFS
+	return linuxerr.EROFS
 }
 
 // MkdirAt implements vfs.FilesystemImpl.MkdirAt.
 func (fs *filesystem) MkdirAt(ctx context.Context, rp *vfs.ResolvingPath, opts vfs.MkdirOptions) error {
 	// Verity file system is read-only.
-	return syserror.EROFS
+	return linuxerr.EROFS
 }
 
 // MknodAt implements vfs.FilesystemImpl.MknodAt.
 func (fs *filesystem) MknodAt(ctx context.Context, rp *vfs.ResolvingPath, opts vfs.MknodOptions) error {
 	// Verity file system is read-only.
-	return syserror.EROFS
+	return linuxerr.EROFS
 }
 
 // OpenAt implements vfs.FilesystemImpl.OpenAt.
 func (fs *filesystem) OpenAt(ctx context.Context, rp *vfs.ResolvingPath, opts vfs.OpenOptions) (*vfs.FileDescription, error) {
 	// Verity fs is read-only.
 	if opts.Flags&(linux.O_WRONLY|linux.O_CREAT) != 0 {
-		return nil, syserror.EROFS
+		return nil, linuxerr.EROFS
 	}
 
 	var ds *[]*dentry
@@ -839,7 +839,7 @@ func (d *dentry) openLocked(ctx context.Context, rp *vfs.ResolvingPath, opts *vf
 
 	// Verity fs is read-only.
 	if ats&vfs.MayWrite != 0 {
-		return nil, syserror.EROFS
+		return nil, linuxerr.EROFS
 	}
 
 	// Get the path to the target file. This is only used to provide path
@@ -973,19 +973,19 @@ func (fs *filesystem) ReadlinkAt(ctx context.Context, rp *vfs.ResolvingPath) (st
 // RenameAt implements vfs.FilesystemImpl.RenameAt.
 func (fs *filesystem) RenameAt(ctx context.Context, rp *vfs.ResolvingPath, oldParentVD vfs.VirtualDentry, oldName string, opts vfs.RenameOptions) error {
 	// Verity file system is read-only.
-	return syserror.EROFS
+	return linuxerr.EROFS
 }
 
 // RmdirAt implements vfs.FilesystemImpl.RmdirAt.
 func (fs *filesystem) RmdirAt(ctx context.Context, rp *vfs.ResolvingPath) error {
 	// Verity file system is read-only.
-	return syserror.EROFS
+	return linuxerr.EROFS
 }
 
 // SetStatAt implements vfs.FilesystemImpl.SetStatAt.
 func (fs *filesystem) SetStatAt(ctx context.Context, rp *vfs.ResolvingPath, opts vfs.SetStatOptions) error {
 	// Verity file system is read-only.
-	return syserror.EROFS
+	return linuxerr.EROFS
 }
 
 // StatAt implements vfs.FilesystemImpl.StatAt.
@@ -1025,13 +1025,13 @@ func (fs *filesystem) StatFSAt(ctx context.Context, rp *vfs.ResolvingPath) (linu
 // SymlinkAt implements vfs.FilesystemImpl.SymlinkAt.
 func (fs *filesystem) SymlinkAt(ctx context.Context, rp *vfs.ResolvingPath, target string) error {
 	// Verity file system is read-only.
-	return syserror.EROFS
+	return linuxerr.EROFS
 }
 
 // UnlinkAt implements vfs.FilesystemImpl.UnlinkAt.
 func (fs *filesystem) UnlinkAt(ctx context.Context, rp *vfs.ResolvingPath) error {
 	// Verity file system is read-only.
-	return syserror.EROFS
+	return linuxerr.EROFS
 }
 
 // BoundEndpointAt implements vfs.FilesystemImpl.BoundEndpointAt.
@@ -1042,7 +1042,7 @@ func (fs *filesystem) BoundEndpointAt(ctx context.Context, rp *vfs.ResolvingPath
 	if _, err := fs.resolveLocked(ctx, rp, &ds); err != nil {
 		return nil, err
 	}
-	return nil, syserror.ECONNREFUSED
+	return nil, linuxerr.ECONNREFUSED
 }
 
 // ListXattrAt implements vfs.FilesystemImpl.ListXattrAt.
@@ -1080,13 +1080,13 @@ func (fs *filesystem) GetXattrAt(ctx context.Context, rp *vfs.ResolvingPath, opt
 // SetXattrAt implements vfs.FilesystemImpl.SetXattrAt.
 func (fs *filesystem) SetXattrAt(ctx context.Context, rp *vfs.ResolvingPath, opts vfs.SetXattrOptions) error {
 	// Verity file system is read-only.
-	return syserror.EROFS
+	return linuxerr.EROFS
 }
 
 // RemoveXattrAt implements vfs.FilesystemImpl.RemoveXattrAt.
 func (fs *filesystem) RemoveXattrAt(ctx context.Context, rp *vfs.ResolvingPath, name string) error {
 	// Verity file system is read-only.
-	return syserror.EROFS
+	return linuxerr.EROFS
 }
 
 // PrependPath implements vfs.FilesystemImpl.PrependPath.
diff --git a/pkg/sentry/fsimpl/verity/verity.go b/pkg/sentry/fsimpl/verity/verity.go
index 3bfe40204..104a28227 100644
--- a/pkg/sentry/fsimpl/verity/verity.go
+++ b/pkg/sentry/fsimpl/verity/verity.go
@@ -1159,7 +1159,7 @@ func (fd *fileDescription) measureVerity(ctx context.Context, verityDigest hosta
 	// enabled, in which case fd.d.hash should be set.
 	if len(fd.d.hash) == 0 {
 		if fd.d.fs.allowRuntimeEnable {
-			return 0, syserror.ENODATA
+			return 0, linuxerr.ENODATA
 		}
 		return 0, fd.d.fs.alertIntegrityViolation("Ioctl measureVerity: no hash found")
 	}
@@ -1169,7 +1169,7 @@ func (fd *fileDescription) measureVerity(ctx context.Context, verityDigest hosta
 		return 0, err
 	}
 	if metadata.DigestSize < uint16(len(fd.d.hash)) {
-		return 0, syserror.EOVERFLOW
+		return 0, linuxerr.EOVERFLOW
 	}
 
 	// Populate the output digest size, since DigestSize is both input and
@@ -1298,12 +1298,12 @@ func (fd *fileDescription) PRead(ctx context.Context, dst usermem.IOSequence, of
 
 // PWrite implements vfs.FileDescriptionImpl.PWrite.
 func (fd *fileDescription) PWrite(ctx context.Context, src usermem.IOSequence, offset int64, opts vfs.WriteOptions) (int64, error) {
-	return 0, syserror.EROFS
+	return 0, linuxerr.EROFS
 }
 
 // Write implements vfs.FileDescriptionImpl.Write.
 func (fd *fileDescription) Write(ctx context.Context, src usermem.IOSequence, opts vfs.WriteOptions) (int64, error) {
-	return 0, syserror.EROFS
+	return 0, linuxerr.EROFS
 }
 
 // ConfigureMMap implements vfs.FileDescriptionImpl.ConfigureMMap.
@@ -1319,7 +1319,7 @@ func (fd *fileDescription) ConfigureMMap(ctx context.Context, opts *memmap.MMapO
 
 	// Check if mmap is allowed on the lower filesystem.
 	if !opts.SentryOwnedContent {
-		return syserror.ENODEV
+		return linuxerr.ENODEV
 	}
 	return vfs.GenericConfigureMMap(&fd.vfsfd, fd, opts)
 }
diff --git a/pkg/sentry/kernel/auth/user_namespace.go b/pkg/sentry/kernel/auth/user_namespace.go
index bec0c28cd..40a406f9d 100644
--- a/pkg/sentry/kernel/auth/user_namespace.go
+++ b/pkg/sentry/kernel/auth/user_namespace.go
@@ -19,7 +19,6 @@ import (
 
 	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/sync"
-	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 // A UserNamespace represents a user namespace. See user_namespaces(7) for
@@ -106,7 +105,7 @@ func (c *Credentials) NewChildUserNamespace() (*UserNamespace, error) {
 	if c.UserNamespace.depth() >= maxUserNamespaceDepth {
 		// "... Calls to unshare(2) or clone(2) that would cause this limit to
 		// be exceeded fail with the error EUSERS." - user_namespaces(7)
-		return nil, syserror.EUSERS
+		return nil, linuxerr.EUSERS
 	}
 	// "EPERM: CLONE_NEWUSER was specified in flags, but either the effective
 	// user ID or the effective group ID of the caller does not have a mapping
diff --git a/pkg/sentry/kernel/futex/futex.go b/pkg/sentry/kernel/futex/futex.go
index 52fc6f2b7..6377abb94 100644
--- a/pkg/sentry/kernel/futex/futex.go
+++ b/pkg/sentry/kernel/futex/futex.go
@@ -123,7 +123,7 @@ func check(t Target, addr hostarch.Addr, val uint32) error {
 		return err
 	}
 	if cur != val {
-		return syserror.EAGAIN
+		return linuxerr.EAGAIN
 	}
 	return nil
 }
@@ -671,7 +671,7 @@ func (m *Manager) lockPILocked(w *Waiter, t Target, addr hostarch.Addr, tid uint
 			return false, err
 		}
 		if (cur & linux.FUTEX_TID_MASK) == tid {
-			return false, syserror.EDEADLK
+			return false, linuxerr.EDEADLK
 		}
 
 		if (cur & linux.FUTEX_TID_MASK) == 0 {
@@ -774,7 +774,7 @@ func (m *Manager) unlockPILocked(t Target, addr hostarch.Addr, tid uint32, b *bu
 		if prev != cur {
 			// Let user mode handle CAS races. This is different than lock, which
 			// retries when CAS fails.
-			return syserror.EAGAIN
+			return linuxerr.EAGAIN
 		}
 		return nil
 	}
diff --git a/pkg/sentry/kernel/kcov.go b/pkg/sentry/kernel/kcov.go
index 941cc373f..e8a71bec1 100644
--- a/pkg/sentry/kernel/kcov.go
+++ b/pkg/sentry/kernel/kcov.go
@@ -29,7 +29,6 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/mm"
 	"gvisor.dev/gvisor/pkg/sentry/pgalloc"
 	"gvisor.dev/gvisor/pkg/sentry/usage"
-	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 // kcovAreaSizeMax is the maximum number of uint64 entries allowed in the kcov
@@ -126,7 +125,7 @@ func (kcov *Kcov) InitTrace(size uint64) error {
 	defer kcov.mu.Unlock()
 
 	if kcov.mode != linux.KCOV_MODE_DISABLED {
-		return syserror.EBUSY
+		return linuxerr.EBUSY
 	}
 
 	// To simplify all the logic around mapping, we require that the length of the
@@ -166,13 +165,13 @@ func (kcov *Kcov) EnableTrace(ctx context.Context, traceKind uint8) error {
 		kcov.mode = linux.KCOV_MODE_TRACE_PC
 	case linux.KCOV_TRACE_CMP:
 		// We do not support KCOV_MODE_TRACE_CMP.
-		return syserror.ENOTSUP
+		return linuxerr.ENOTSUP
 	default:
 		return linuxerr.EINVAL
 	}
 
 	if kcov.owningTask != nil && kcov.owningTask != t {
-		return syserror.EBUSY
+		return linuxerr.EBUSY
 	}
 
 	kcov.owningTask = t
diff --git a/pkg/sentry/kernel/pipe/node.go b/pkg/sentry/kernel/pipe/node.go
index 2321d26dc..08786d704 100644
--- a/pkg/sentry/kernel/pipe/node.go
+++ b/pkg/sentry/kernel/pipe/node.go
@@ -113,7 +113,7 @@ func (i *inodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flags fs.Fi
 			// read side isn't open yet.
 			if flags.NonBlocking {
 				w.DecRef(ctx)
-				return nil, syserror.ENXIO
+				return nil, linuxerr.ENXIO
 			}
 
 			if !waitFor(&i.mu, &i.rWakeup, ctx) {
@@ -136,5 +136,5 @@ func (i *inodeOperations) GetFile(ctx context.Context, d *fs.Dirent, flags fs.Fi
 }
 
 func (*inodeOperations) Allocate(_ context.Context, _ *fs.Inode, _, _ int64) error {
-	return syserror.EPIPE
+	return linuxerr.EPIPE
 }
diff --git a/pkg/sentry/kernel/pipe/pipe.go b/pkg/sentry/kernel/pipe/pipe.go
index 4d68a6e4a..85e3ce9f4 100644
--- a/pkg/sentry/kernel/pipe/pipe.go
+++ b/pkg/sentry/kernel/pipe/pipe.go
@@ -440,7 +440,7 @@ func (p *Pipe) SetFifoSize(size int64) (int64, error) {
 	p.mu.Lock()
 	defer p.mu.Unlock()
 	if size < p.size {
-		return 0, syserror.EBUSY
+		return 0, linuxerr.EBUSY
 	}
 	p.max = size
 	return size, nil
diff --git a/pkg/sentry/kernel/pipe/pipe_util.go b/pkg/sentry/kernel/pipe/pipe_util.go
index 3fa5d1d2f..84f9f6234 100644
--- a/pkg/sentry/kernel/pipe/pipe_util.go
+++ b/pkg/sentry/kernel/pipe/pipe_util.go
@@ -22,6 +22,7 @@ import (
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/amutex"
 	"gvisor.dev/gvisor/pkg/context"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/marshal/primitive"
 	"gvisor.dev/gvisor/pkg/safemem"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
@@ -86,7 +87,7 @@ func (p *Pipe) Write(ctx context.Context, src usermem.IOSequence) (int64, error)
 	if n > 0 {
 		p.Notify(waiter.ReadableEvents)
 	}
-	if err == unix.EPIPE {
+	if linuxerr.Equals(linuxerr.EPIPE, err) {
 		// If we are returning EPIPE send SIGPIPE to the task.
 		if sendSig := linux.SignalNoInfoFuncFromContext(ctx); sendSig != nil {
 			sendSig(linux.SIGPIPE)
diff --git a/pkg/sentry/kernel/pipe/vfs.go b/pkg/sentry/kernel/pipe/vfs.go
index 623375417..077d5fd7f 100644
--- a/pkg/sentry/kernel/pipe/vfs.go
+++ b/pkg/sentry/kernel/pipe/vfs.go
@@ -80,7 +80,7 @@ func (vp *VFSPipe) ReaderWriterPair(ctx context.Context, mnt *vfs.Mount, vfsd *v
 
 // Allocate implements vfs.FileDescriptionImpl.Allocate.
 func (*VFSPipe) Allocate(context.Context, uint64, uint64, uint64) error {
-	return syserror.ESPIPE
+	return linuxerr.ESPIPE
 }
 
 // Open opens the pipe represented by vp.
@@ -132,7 +132,7 @@ func (vp *VFSPipe) Open(ctx context.Context, mnt *vfs.Mount, vfsd *vfs.Dentry, s
 			// side isn't open yet.
 			if statusFlags&linux.O_NONBLOCK != 0 {
 				fd.DecRef(ctx)
-				return nil, syserror.ENXIO
+				return nil, linuxerr.ENXIO
 			}
 			// Wait for a reader to open the other end.
 			if !waitFor(&vp.mu, &vp.rWakeup, ctx) {
@@ -225,7 +225,7 @@ func (fd *VFSPipeFD) Readiness(mask waiter.EventMask) waiter.EventMask {
 
 // Allocate implements vfs.FileDescriptionImpl.Allocate.
 func (fd *VFSPipeFD) Allocate(ctx context.Context, mode, offset, length uint64) error {
-	return syserror.ESPIPE
+	return linuxerr.ESPIPE
 }
 
 // EventRegister implements waiter.Waitable.EventRegister.
diff --git a/pkg/sentry/kernel/posixtimer.go b/pkg/sentry/kernel/posixtimer.go
index 049cc07df..319754a42 100644
--- a/pkg/sentry/kernel/posixtimer.go
+++ b/pkg/sentry/kernel/posixtimer.go
@@ -20,7 +20,6 @@ import (
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	ktime "gvisor.dev/gvisor/pkg/sentry/kernel/time"
-	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 // IntervalTimer represents a POSIX interval timer as described by
@@ -176,7 +175,7 @@ func (t *Task) IntervalTimerCreate(c ktime.Clock, sigev *linux.Sigevent) (linux.
 			break
 		}
 		if t.tg.nextTimerID == end {
-			return 0, syserror.EAGAIN
+			return 0, linuxerr.EAGAIN
 		}
 	}
 
diff --git a/pkg/sentry/kernel/rseq.go b/pkg/sentry/kernel/rseq.go
index 47babaa7a..5e0618e44 100644
--- a/pkg/sentry/kernel/rseq.go
+++ b/pkg/sentry/kernel/rseq.go
@@ -65,7 +65,7 @@ func (t *Task) SetRSeq(addr hostarch.Addr, length, signature uint32) error {
 		if t.rseqSignature != signature {
 			return linuxerr.EINVAL
 		}
-		return syserror.EBUSY
+		return linuxerr.EBUSY
 	}
 
 	// rseq must be aligned and correctly sized.
diff --git a/pkg/sentry/kernel/semaphore/semaphore.go b/pkg/sentry/kernel/semaphore/semaphore.go
index dda22cfb8..067cc75c1 100644
--- a/pkg/sentry/kernel/semaphore/semaphore.go
+++ b/pkg/sentry/kernel/semaphore/semaphore.go
@@ -582,7 +582,7 @@ func (s *Set) ExecuteOps(ctx context.Context, ops []linux.Sembuf, creds *auth.Cr
 	readOnly := true
 	for _, op := range ops {
 		if s.findSem(int32(op.SemNum)) == nil {
-			return nil, 0, syserror.EFBIG
+			return nil, 0, linuxerr.EFBIG
 		}
 		if op.SemOp != 0 {
 			readOnly = false
diff --git a/pkg/sentry/kernel/task_block.go b/pkg/sentry/kernel/task_block.go
index 07533d982..b2520eecf 100644
--- a/pkg/sentry/kernel/task_block.go
+++ b/pkg/sentry/kernel/task_block.go
@@ -163,7 +163,7 @@ func (t *Task) block(C <-chan struct{}, timerChan <-chan struct{}) error {
 		region.End()
 		t.SleepFinish(true)
 		// We've timed out.
-		return syserror.ETIMEDOUT
+		return linuxerr.ETIMEDOUT
 	}
 }
 
diff --git a/pkg/sentry/kernel/task_cgroup.go b/pkg/sentry/kernel/task_cgroup.go
index 7c138e80f..7dd6d3108 100644
--- a/pkg/sentry/kernel/task_cgroup.go
+++ b/pkg/sentry/kernel/task_cgroup.go
@@ -20,8 +20,8 @@ import (
 	"sort"
 	"strings"
 
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/log"
-	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 // EnterInitialCgroups moves t into an initial set of cgroups.
@@ -67,7 +67,7 @@ func (t *Task) EnterCgroup(c Cgroup) error {
 				//
 				// TODO(b/183137098): Implement cgroup migration.
 				log.Warningf("Cgroup migration is not implemented")
-				return syserror.EBUSY
+				return linuxerr.EBUSY
 			}
 		}
 	}
diff --git a/pkg/sentry/kernel/task_exit.go b/pkg/sentry/kernel/task_exit.go
index d115b8783..fe08c7519 100644
--- a/pkg/sentry/kernel/task_exit.go
+++ b/pkg/sentry/kernel/task_exit.go
@@ -31,6 +31,7 @@ import (
 	"strings"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
 	"gvisor.dev/gvisor/pkg/syserror"
 	"gvisor.dev/gvisor/pkg/waiter"
@@ -942,7 +943,7 @@ func (t *Task) waitOnce(opts *WaitOptions) (*WaitResult, error) {
 	if anyWaitableTasks {
 		return nil, ErrNoWaitableEvent
 	}
-	return nil, syserror.ECHILD
+	return nil, linuxerr.ECHILD
 }
 
 // Preconditions: The TaskSet mutex must be locked for writing.
diff --git a/pkg/sentry/kernel/task_signals.go b/pkg/sentry/kernel/task_signals.go
index f54c774cb..72dce7cd9 100644
--- a/pkg/sentry/kernel/task_signals.go
+++ b/pkg/sentry/kernel/task_signals.go
@@ -339,7 +339,7 @@ func (t *Task) Sigtimedwait(set linux.SignalSet, timeout time.Duration) (*linux.
 	}
 
 	if timeout == 0 {
-		return nil, syserror.EAGAIN
+		return nil, linuxerr.EAGAIN
 	}
 
 	// Unblock signals we're waiting for. Remember the original signal mask so
@@ -360,8 +360,8 @@ func (t *Task) Sigtimedwait(set linux.SignalSet, timeout time.Duration) (*linux.
 	if info := t.dequeueSignalLocked(mask); info != nil {
 		return info, nil
 	}
-	if err == syserror.ETIMEDOUT {
-		return nil, syserror.EAGAIN
+	if err == linuxerr.ETIMEDOUT {
+		return nil, linuxerr.EAGAIN
 	}
 	return nil, err
 }
@@ -372,7 +372,7 @@ func (t *Task) Sigtimedwait(set linux.SignalSet, timeout time.Duration) (*linux.
 //
 //	syserror.ESRCH - The task has exited.
 //	linuxerr.EINVAL - The signal is not valid.
-//	syserror.EAGAIN - THe signal is realtime, and cannot be queued.
+//	linuxerr.EAGAIN - THe signal is realtime, and cannot be queued.
 //
 func (t *Task) SendSignal(info *linux.SignalInfo) error {
 	t.tg.pidns.owner.mu.RLock()
@@ -451,7 +451,7 @@ func (t *Task) sendSignalTimerLocked(info *linux.SignalInfo, group bool, timer *
 	}
 	if !q.enqueue(info, timer) {
 		if sig.IsRealtime() {
-			return syserror.EAGAIN
+			return linuxerr.EAGAIN
 		}
 		t.Debugf("Discarding duplicate signal %d", sig)
 		if timer != nil {
diff --git a/pkg/sentry/kernel/task_start.go b/pkg/sentry/kernel/task_start.go
index 41fd2d471..0565059c1 100644
--- a/pkg/sentry/kernel/task_start.go
+++ b/pkg/sentry/kernel/task_start.go
@@ -17,6 +17,7 @@ package kernel
 import (
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/hostarch"
 	"gvisor.dev/gvisor/pkg/sentry/inet"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
@@ -299,7 +300,7 @@ func (ns *PIDNamespace) allocateTID() (ThreadID, error) {
 		// Did we do a full cycle?
 		if tid == ns.last {
 			// No tid available.
-			return 0, syserror.EAGAIN
+			return 0, linuxerr.EAGAIN
 		}
 	}
 }
diff --git a/pkg/sentry/loader/elf.go b/pkg/sentry/loader/elf.go
index 1db6fbd76..577374fa4 100644
--- a/pkg/sentry/loader/elf.go
+++ b/pkg/sentry/loader/elf.go
@@ -624,18 +624,18 @@ func loadInterpreterELF(ctx context.Context, m *mm.MemoryManager, f fsbridge.Fil
 	if err != nil {
 		if linuxerr.Equals(linuxerr.ENOEXEC, err) {
 			// Bad interpreter.
-			err = syserror.ELIBBAD
+			err = linuxerr.ELIBBAD
 		}
 		return loadedELF{}, err
 	}
 
 	if info.os != initial.os {
 		ctx.Infof("Initial ELF OS %v and interpreter ELF OS %v differ", initial.os, info.os)
-		return loadedELF{}, syserror.ELIBBAD
+		return loadedELF{}, linuxerr.ELIBBAD
 	}
 	if info.arch != initial.arch {
 		ctx.Infof("Initial ELF arch %v and interpreter ELF arch %v differ", initial.arch, info.arch)
-		return loadedELF{}, syserror.ELIBBAD
+		return loadedELF{}, linuxerr.ELIBBAD
 	}
 
 	// The interpreter is not given a load offset, as its location does not
diff --git a/pkg/sentry/loader/loader.go b/pkg/sentry/loader/loader.go
index 7dc884bd5..86d0c54cd 100644
--- a/pkg/sentry/loader/loader.go
+++ b/pkg/sentry/loader/loader.go
@@ -208,7 +208,7 @@ func loadExecutable(ctx context.Context, args LoadArgs) (loadedELF, arch.Context
 		args.File = nil
 	}
 
-	return loadedELF{}, nil, nil, nil, syserror.ELOOP
+	return loadedELF{}, nil, nil, nil, linuxerr.ELOOP
 }
 
 // Load loads args.File into a MemoryManager. If args.File is nil, the path
diff --git a/pkg/sentry/mm/aio_context.go b/pkg/sentry/mm/aio_context.go
index 8426fc90e..23747daba 100644
--- a/pkg/sentry/mm/aio_context.go
+++ b/pkg/sentry/mm/aio_context.go
@@ -163,7 +163,7 @@ func (ctx *AIOContext) Prepare() error {
 	}
 	if ctx.outstanding >= ctx.maxOutstanding {
 		// Context is busy.
-		return syserror.EAGAIN
+		return linuxerr.EAGAIN
 	}
 	ctx.outstanding++
 	return nil
diff --git a/pkg/sentry/mm/syscalls.go b/pkg/sentry/mm/syscalls.go
index b558d9900..125fd855b 100644
--- a/pkg/sentry/mm/syscalls.go
+++ b/pkg/sentry/mm/syscalls.go
@@ -380,7 +380,7 @@ func (mm *MemoryManager) MRemap(ctx context.Context, oldAddr hostarch.Addr, oldS
 		mlockLimit := limits.FromContext(ctx).Get(limits.MemoryLocked).Cur
 		if creds := auth.CredentialsFromContext(ctx); !creds.HasCapabilityIn(linux.CAP_IPC_LOCK, creds.UserNamespace.Root()) {
 			if newLockedAS := mm.lockedAS - oldSize + newSize; newLockedAS > mlockLimit {
-				return 0, syserror.EAGAIN
+				return 0, linuxerr.EAGAIN
 			}
 		}
 	}
@@ -860,7 +860,7 @@ func (mm *MemoryManager) MLock(ctx context.Context, addr hostarch.Addr, length u
 					return syserror.ENOMEM
 				}
 				if linuxerr.Equals(linuxerr.ENOMEM, err) {
-					return syserror.EAGAIN
+					return linuxerr.EAGAIN
 				}
 				return err
 			}
@@ -1151,7 +1151,7 @@ func (mm *MemoryManager) MSync(ctx context.Context, addr hostarch.Addr, length u
 		vma := vseg.ValuePtr()
 		if opts.Invalidate && vma.mlockMode != memmap.MLockNone {
 			mm.mappingMu.RUnlock()
-			return syserror.EBUSY
+			return linuxerr.EBUSY
 		}
 		// It's only possible to have dirtied the Mappable through a shared
 		// mapping. Don't check if the mapping is writable, because mprotect
diff --git a/pkg/sentry/mm/vma.go b/pkg/sentry/mm/vma.go
index 2847a59ae..a411eabbf 100644
--- a/pkg/sentry/mm/vma.go
+++ b/pkg/sentry/mm/vma.go
@@ -74,7 +74,7 @@ func (mm *MemoryManager) createVMALocked(ctx context.Context, opts memmap.MMapOp
 				newLockedAS -= mm.mlockedBytesRangeLocked(ar)
 			}
 			if newLockedAS > mlockLimit {
-				return vmaIterator{}, hostarch.AddrRange{}, syserror.EAGAIN
+				return vmaIterator{}, hostarch.AddrRange{}, linuxerr.EAGAIN
 			}
 		}
 	}
diff --git a/pkg/sentry/socket/hostinet/socket_vfs2.go b/pkg/sentry/socket/hostinet/socket_vfs2.go
index 5d55cc64d..2c5c3e2cd 100644
--- a/pkg/sentry/socket/hostinet/socket_vfs2.go
+++ b/pkg/sentry/socket/hostinet/socket_vfs2.go
@@ -18,6 +18,7 @@ import (
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/fdnotifier"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/fsimpl/sockfs"
@@ -105,7 +106,7 @@ func (s *socketVFS2) Ioctl(ctx context.Context, uio usermem.IO, args arch.Syscal
 
 // PRead implements vfs.FileDescriptionImpl.PRead.
 func (s *socketVFS2) PRead(ctx context.Context, dst usermem.IOSequence, offset int64, opts vfs.ReadOptions) (int64, error) {
-	return 0, syserror.ESPIPE
+	return 0, linuxerr.ESPIPE
 }
 
 // Read implements vfs.FileDescriptionImpl.
@@ -124,7 +125,7 @@ func (s *socketVFS2) Read(ctx context.Context, dst usermem.IOSequence, opts vfs.
 
 // PWrite implements vfs.FileDescriptionImpl.
 func (s *socketVFS2) PWrite(ctx context.Context, dst usermem.IOSequence, offset int64, opts vfs.WriteOptions) (int64, error) {
-	return 0, syserror.ESPIPE
+	return 0, linuxerr.ESPIPE
 }
 
 // Write implements vfs.FileDescriptionImpl.
diff --git a/pkg/sentry/socket/netlink/socket_vfs2.go b/pkg/sentry/socket/netlink/socket_vfs2.go
index 842036764..1a98a1373 100644
--- a/pkg/sentry/socket/netlink/socket_vfs2.go
+++ b/pkg/sentry/socket/netlink/socket_vfs2.go
@@ -17,6 +17,7 @@ package netlink
 import (
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/sentry/socket"
@@ -113,7 +114,7 @@ func (*SocketVFS2) Ioctl(context.Context, usermem.IO, arch.SyscallArguments) (ui
 
 // PRead implements vfs.FileDescriptionImpl.
 func (s *SocketVFS2) PRead(ctx context.Context, dst usermem.IOSequence, offset int64, opts vfs.ReadOptions) (int64, error) {
-	return 0, syserror.ESPIPE
+	return 0, linuxerr.ESPIPE
 }
 
 // Read implements vfs.FileDescriptionImpl.
@@ -134,7 +135,7 @@ func (s *SocketVFS2) Read(ctx context.Context, dst usermem.IOSequence, opts vfs.
 
 // PWrite implements vfs.FileDescriptionImpl.
 func (s *SocketVFS2) PWrite(ctx context.Context, src usermem.IOSequence, offset int64, opts vfs.WriteOptions) (int64, error) {
-	return 0, syserror.ESPIPE
+	return 0, linuxerr.ESPIPE
 }
 
 // Write implements vfs.FileDescriptionImpl.
diff --git a/pkg/sentry/socket/netstack/stack.go b/pkg/sentry/socket/netstack/stack.go
index 9d343b671..0fd0ad32c 100644
--- a/pkg/sentry/socket/netstack/stack.go
+++ b/pkg/sentry/socket/netstack/stack.go
@@ -22,7 +22,6 @@ import (
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/sentry/inet"
 	"gvisor.dev/gvisor/pkg/syserr"
-	"gvisor.dev/gvisor/pkg/syserror"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
 	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
@@ -128,7 +127,7 @@ func convertAddr(addr inet.InterfaceAddr) (tcpip.ProtocolAddress, error) {
 		protocol = ipv6.ProtocolNumber
 		address = tcpip.Address(addr.Addr)
 	default:
-		return protocolAddress, syserror.ENOTSUP
+		return protocolAddress, linuxerr.ENOTSUP
 	}
 
 	protocolAddress = tcpip.ProtocolAddress{
diff --git a/pkg/sentry/socket/unix/unix_vfs2.go b/pkg/sentry/socket/unix/unix_vfs2.go
index 08a00a12f..5401f99e6 100644
--- a/pkg/sentry/socket/unix/unix_vfs2.go
+++ b/pkg/sentry/socket/unix/unix_vfs2.go
@@ -254,7 +254,7 @@ func (s *SocketVFS2) Ioctl(ctx context.Context, uio usermem.IO, args arch.Syscal
 
 // PRead implements vfs.FileDescriptionImpl.
 func (s *SocketVFS2) PRead(ctx context.Context, dst usermem.IOSequence, offset int64, opts vfs.ReadOptions) (int64, error) {
-	return 0, syserror.ESPIPE
+	return 0, linuxerr.ESPIPE
 }
 
 // Read implements vfs.FileDescriptionImpl.
@@ -283,7 +283,7 @@ func (s *SocketVFS2) Read(ctx context.Context, dst usermem.IOSequence, opts vfs.
 
 // PWrite implements vfs.FileDescriptionImpl.
 func (s *SocketVFS2) PWrite(ctx context.Context, src usermem.IOSequence, offset int64, opts vfs.WriteOptions) (int64, error) {
-	return 0, syserror.ESPIPE
+	return 0, linuxerr.ESPIPE
 }
 
 // Write implements vfs.FileDescriptionImpl.
diff --git a/pkg/sentry/syscalls/linux/error.go b/pkg/sentry/syscalls/linux/error.go
index 165922332..76389fbe3 100644
--- a/pkg/sentry/syscalls/linux/error.go
+++ b/pkg/sentry/syscalls/linux/error.go
@@ -113,7 +113,7 @@ func handleIOErrorImpl(ctx context.Context, partialResult bool, errOrig, intr er
 		// Do not consume the error and return it as EFBIG.
 		// Simultaneously send a SIGXFSZ per setrlimit(2).
 		t.SendSignal(kernel.SignalInfoNoInfo(linux.SIGXFSZ, t, t))
-		return true, syserror.EFBIG
+		return true, linuxerr.EFBIG
 	case linuxerr.Equals(linuxerr.EINTR, translatedErr):
 		// The syscall was interrupted. Return nil if it completed
 		// partially, otherwise return the error code that the syscall
diff --git a/pkg/sentry/syscalls/linux/linux64.go b/pkg/sentry/syscalls/linux/linux64.go
index 039a595ab..8935ea5b8 100644
--- a/pkg/sentry/syscalls/linux/linux64.go
+++ b/pkg/sentry/syscalls/linux/linux64.go
@@ -351,7 +351,7 @@ var AMD64 = &kernel.SyscallTable{
 		295: syscalls.Supported("preadv", Preadv),
 		296: syscalls.Supported("pwritev", Pwritev),
 		297: syscalls.Supported("rt_tgsigqueueinfo", RtTgsigqueueinfo),
-		298: syscalls.ErrorWithEvent("perf_event_open", syserror.ENODEV, "No support for perf counters", nil),
+		298: syscalls.ErrorWithEvent("perf_event_open", linuxerr.ENODEV, "No support for perf counters", nil),
 		299: syscalls.PartiallySupported("recvmmsg", RecvMMsg, "Not all flags and control messages are supported.", nil),
 		300: syscalls.ErrorWithEvent("fanotify_init", syserror.ENOSYS, "Needs CONFIG_FANOTIFY", nil),
 		301: syscalls.ErrorWithEvent("fanotify_mark", syserror.ENOSYS, "Needs CONFIG_FANOTIFY", nil),
@@ -671,7 +671,7 @@ var ARM64 = &kernel.SyscallTable{
 		238: syscalls.CapError("migrate_pages", linux.CAP_SYS_NICE, "", nil),
 		239: syscalls.CapError("move_pages", linux.CAP_SYS_NICE, "", nil), // requires cap_sys_nice (mostly)
 		240: syscalls.Supported("rt_tgsigqueueinfo", RtTgsigqueueinfo),
-		241: syscalls.ErrorWithEvent("perf_event_open", syserror.ENODEV, "No support for perf counters", nil),
+		241: syscalls.ErrorWithEvent("perf_event_open", linuxerr.ENODEV, "No support for perf counters", nil),
 		242: syscalls.Supported("accept4", Accept4),
 		243: syscalls.PartiallySupported("recvmmsg", RecvMMsg, "Not all flags and control messages are supported.", nil),
 		260: syscalls.Supported("wait4", Wait4),
diff --git a/pkg/sentry/syscalls/linux/sys_file.go b/pkg/sentry/syscalls/linux/sys_file.go
index 2bafb9efc..a08449824 100644
--- a/pkg/sentry/syscalls/linux/sys_file.go
+++ b/pkg/sentry/syscalls/linux/sys_file.go
@@ -153,7 +153,7 @@ func openAt(t *kernel.Task, dirFD int32, addr hostarch.Addr, flags uint) (fd uin
 		}
 
 		if fs.IsSymlink(d.Inode.StableAttr) && !resolve {
-			return syserror.ELOOP
+			return linuxerr.ELOOP
 		}
 
 		fileFlags := linuxToFlags(flags)
@@ -351,7 +351,7 @@ func createAt(t *kernel.Task, dirFD int32, addr hostarch.Addr, flags uint, mode
 			// If O_NOFOLLOW was passed, then don't try to resolve
 			// anything.
 			if flags&linux.O_NOFOLLOW != 0 {
-				return syserror.ELOOP
+				return linuxerr.ELOOP
 			}
 
 			// Try to resolve the symlink directly to a Dirent.
@@ -810,7 +810,7 @@ func Dup(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallCo
 
 	newFD, err := t.NewFDFrom(0, file, kernel.FDFlags{})
 	if err != nil {
-		return 0, nil, syserror.EMFILE
+		return 0, nil, linuxerr.EMFILE
 	}
 	return uintptr(newFD), nil, nil
 }
@@ -1015,7 +1015,7 @@ func Fcntl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 			if cmd == linux.F_SETLK {
 				// Non-blocking lock, provide a nil lock.Blocker.
 				if !file.Dirent.Inode.LockCtx.Posix.LockRegionVFS1(t.FDTable(), lock.ReadLock, rng, nil) {
-					return 0, nil, syserror.EAGAIN
+					return 0, nil, linuxerr.EAGAIN
 				}
 			} else {
 				// Blocking lock, pass in the task to satisfy the lock.Blocker interface.
@@ -1031,7 +1031,7 @@ func Fcntl(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 			if cmd == linux.F_SETLK {
 				// Non-blocking lock, provide a nil lock.Blocker.
 				if !file.Dirent.Inode.LockCtx.Posix.LockRegionVFS1(t.FDTable(), lock.WriteLock, rng, nil) {
-					return 0, nil, syserror.EAGAIN
+					return 0, nil, linuxerr.EAGAIN
 				}
 			} else {
 				// Blocking lock, pass in the task to satisfy the lock.Blocker interface.
@@ -1143,7 +1143,7 @@ func Fadvise64(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sys
 
 	// If the FD refers to a pipe or FIFO, return error.
 	if fs.IsPipe(file.Dirent.Inode.StableAttr) {
-		return 0, nil, syserror.ESPIPE
+		return 0, nil, linuxerr.ESPIPE
 	}
 
 	switch advice {
@@ -1225,7 +1225,7 @@ func rmdirAt(t *kernel.Task, dirFD int32, addr hostarch.Addr) error {
 
 	// Special case: removing the root always returns EBUSY.
 	if path == "/" {
-		return syserror.EBUSY
+		return linuxerr.EBUSY
 	}
 
 	return fileOpAt(t, dirFD, path, func(root *fs.Dirent, d *fs.Dirent, name string, _ uint) error {
@@ -1239,7 +1239,7 @@ func rmdirAt(t *kernel.Task, dirFD int32, addr hostarch.Addr) error {
 		case ".":
 			return linuxerr.EINVAL
 		case "..":
-			return syserror.ENOTEMPTY
+			return linuxerr.ENOTEMPTY
 		}
 
 		if err := d.MayDelete(t, root, name); err != nil {
@@ -1574,7 +1574,7 @@ func Truncate(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 			Signo: int32(linux.SIGXFSZ),
 			Code:  linux.SI_USER,
 		})
-		return 0, nil, syserror.EFBIG
+		return 0, nil, linuxerr.EFBIG
 	}
 
 	return 0, nil, fileOpOn(t, linux.AT_FDCWD, path, true /* resolve */, func(root *fs.Dirent, d *fs.Dirent, _ uint) error {
@@ -1637,7 +1637,7 @@ func Ftruncate(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sys
 			Signo: int32(linux.SIGXFSZ),
 			Code:  linux.SI_USER,
 		})
-		return 0, nil, syserror.EFBIG
+		return 0, nil, linuxerr.EFBIG
 	}
 
 	if err := file.Dirent.Inode.Truncate(t, file.Dirent, length); err != nil {
@@ -2066,7 +2066,7 @@ func renameAt(t *kernel.Task, oldDirFD int32, oldAddr hostarch.Addr, newDirFD in
 		// the root) with EBUSY.
 		switch oldName {
 		case "", ".", "..":
-			return syserror.EBUSY
+			return linuxerr.EBUSY
 		}
 
 		return fileOpAt(t, newDirFD, newPath, func(root *fs.Dirent, newParent *fs.Dirent, newName string, _ uint) error {
@@ -2078,7 +2078,7 @@ func renameAt(t *kernel.Task, oldDirFD int32, oldAddr hostarch.Addr, newDirFD in
 			// (i.e.  the root) with EBUSY.
 			switch newName {
 			case "", ".", "..":
-				return syserror.EBUSY
+				return linuxerr.EBUSY
 			}
 
 			return fs.Rename(t, root, oldParent, oldName, newParent, newName)
@@ -2122,30 +2122,30 @@ func Fallocate(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sys
 	}
 	if mode != 0 {
 		t.Kernel().EmitUnimplementedEvent(t)
-		return 0, nil, syserror.ENOTSUP
+		return 0, nil, linuxerr.ENOTSUP
 	}
 	if !file.Flags().Write {
 		return 0, nil, linuxerr.EBADF
 	}
 	if fs.IsPipe(file.Dirent.Inode.StableAttr) {
-		return 0, nil, syserror.ESPIPE
+		return 0, nil, linuxerr.ESPIPE
 	}
 	if fs.IsDir(file.Dirent.Inode.StableAttr) {
 		return 0, nil, syserror.EISDIR
 	}
 	if !fs.IsRegular(file.Dirent.Inode.StableAttr) {
-		return 0, nil, syserror.ENODEV
+		return 0, nil, linuxerr.ENODEV
 	}
 	size := offset + length
 	if size < 0 {
-		return 0, nil, syserror.EFBIG
+		return 0, nil, linuxerr.EFBIG
 	}
 	if uint64(size) >= t.ThreadGroup().Limits().Get(limits.FileSize).Cur {
 		t.SendSignal(&linux.SignalInfo{
 			Signo: int32(linux.SIGXFSZ),
 			Code:  linux.SI_USER,
 		})
-		return 0, nil, syserror.EFBIG
+		return 0, nil, linuxerr.EFBIG
 	}
 
 	if err := file.Dirent.Inode.Allocate(t, file.Dirent, offset, length); err != nil {
@@ -2184,7 +2184,7 @@ func Flock(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 		if nonblocking {
 			// Since we're nonblocking we pass a nil lock.Blocker implementation.
 			if !file.Dirent.Inode.LockCtx.BSD.LockRegionVFS1(file, lock.WriteLock, rng, nil) {
-				return 0, nil, syserror.EWOULDBLOCK
+				return 0, nil, linuxerr.EWOULDBLOCK
 			}
 		} else {
 			// Because we're blocking we will pass the task to satisfy the lock.Blocker interface.
@@ -2196,7 +2196,7 @@ func Flock(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 		if nonblocking {
 			// Since we're nonblocking we pass a nil lock.Blocker implementation.
 			if !file.Dirent.Inode.LockCtx.BSD.LockRegionVFS1(file, lock.ReadLock, rng, nil) {
-				return 0, nil, syserror.EWOULDBLOCK
+				return 0, nil, linuxerr.EWOULDBLOCK
 			}
 		} else {
 			// Because we're blocking we will pass the task to satisfy the lock.Blocker interface.
diff --git a/pkg/sentry/syscalls/linux/sys_futex.go b/pkg/sentry/syscalls/linux/sys_futex.go
index a9e9126cc..a66514c7f 100644
--- a/pkg/sentry/syscalls/linux/sys_futex.go
+++ b/pkg/sentry/syscalls/linux/sys_futex.go
@@ -160,7 +160,7 @@ func tryLockPI(t *kernel.Task, addr hostarch.Addr, private bool) error {
 		return err
 	}
 	if !locked {
-		return syserror.EWOULDBLOCK
+		return linuxerr.EWOULDBLOCK
 	}
 	return nil
 }
diff --git a/pkg/sentry/syscalls/linux/sys_mount.go b/pkg/sentry/syscalls/linux/sys_mount.go
index 5b84c32dd..6d26f89b9 100644
--- a/pkg/sentry/syscalls/linux/sys_mount.go
+++ b/pkg/sentry/syscalls/linux/sys_mount.go
@@ -21,7 +21,6 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/arch"
 	"gvisor.dev/gvisor/pkg/sentry/fs"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
-	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 // Mount implements Linux syscall mount(2).
@@ -88,7 +87,7 @@ func Mount(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscall
 
 	rsys, ok := fs.FindFilesystem(fsType)
 	if !ok {
-		return 0, nil, syserror.ENODEV
+		return 0, nil, linuxerr.ENODEV
 	}
 	if !rsys.AllowUserMount() {
 		return 0, nil, linuxerr.EPERM
diff --git a/pkg/sentry/syscalls/linux/sys_read.go b/pkg/sentry/syscalls/linux/sys_read.go
index 02651b709..50f98fc8f 100644
--- a/pkg/sentry/syscalls/linux/sys_read.go
+++ b/pkg/sentry/syscalls/linux/sys_read.go
@@ -128,7 +128,7 @@ func Pread64(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysca
 
 	// Is reading at an offset supported?
 	if !file.Flags().Pread {
-		return 0, nil, syserror.ESPIPE
+		return 0, nil, linuxerr.ESPIPE
 	}
 
 	// Check that the file is readable.
@@ -205,7 +205,7 @@ func Preadv(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscal
 
 	// Is reading at an offset supported?
 	if !file.Flags().Pread {
-		return 0, nil, syserror.ESPIPE
+		return 0, nil, linuxerr.ESPIPE
 	}
 
 	// Check that the file is readable.
@@ -254,7 +254,7 @@ func Preadv2(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysca
 
 	// Is reading at an offset supported?
 	if offset > -1 && !file.Flags().Pread {
-		return 0, nil, syserror.ESPIPE
+		return 0, nil, linuxerr.ESPIPE
 	}
 
 	// Check that the file is readable.
diff --git a/pkg/sentry/syscalls/linux/sys_sem.go b/pkg/sentry/syscalls/linux/sys_sem.go
index d12a4303b..ef61b8f33 100644
--- a/pkg/sentry/syscalls/linux/sys_sem.go
+++ b/pkg/sentry/syscalls/linux/sys_sem.go
@@ -83,7 +83,7 @@ func Semtimedop(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sy
 
 	if err := semTimedOp(t, id, ops, true, timeout.ToDuration()); err != nil {
 		if linuxerr.Equals(linuxerr.ETIMEDOUT, err) {
-			return 0, nil, syserror.EAGAIN
+			return 0, nil, linuxerr.EAGAIN
 		}
 		return 0, nil, err
 	}
diff --git a/pkg/sentry/syscalls/linux/sys_socket.go b/pkg/sentry/syscalls/linux/sys_socket.go
index 4cb0ad274..ea2b2f40c 100644
--- a/pkg/sentry/syscalls/linux/sys_socket.go
+++ b/pkg/sentry/syscalls/linux/sys_socket.go
@@ -750,7 +750,7 @@ func recvSingleMsg(t *kernel.Task, s socket.Socket, msgPtr hostarch.Addr, flags
 	}
 
 	if msg.IovLen > linux.UIO_MAXIOV {
-		return 0, syserror.EMSGSIZE
+		return 0, linuxerr.EMSGSIZE
 	}
 	dst, err := t.IovecsIOSequence(hostarch.Addr(msg.Iov), int(msg.IovLen), usermem.IOOpts{
 		AddressSpaceActive: true,
@@ -781,7 +781,7 @@ func recvSingleMsg(t *kernel.Task, s socket.Socket, msgPtr hostarch.Addr, flags
 	}
 
 	if msg.ControlLen > maxControlLen {
-		return 0, syserror.ENOBUFS
+		return 0, linuxerr.ENOBUFS
 	}
 	n, mflags, sender, senderLen, cms, e := s.RecvMsg(t, dst, int(flags), haveDeadline, deadline, msg.NameLen != 0, msg.ControlLen)
 	if e != nil {
@@ -1015,7 +1015,7 @@ func sendSingleMsg(t *kernel.Task, s socket.Socket, file *fs.File, msgPtr hostar
 	if msg.ControlLen > 0 {
 		// Put an upper bound to prevent large allocations.
 		if msg.ControlLen > maxControlLen {
-			return 0, syserror.ENOBUFS
+			return 0, linuxerr.ENOBUFS
 		}
 		controlData = make([]byte, msg.ControlLen)
 		if _, err := t.CopyInBytes(hostarch.Addr(msg.Control), controlData); err != nil {
@@ -1035,7 +1035,7 @@ func sendSingleMsg(t *kernel.Task, s socket.Socket, file *fs.File, msgPtr hostar
 
 	// Read data then call the sendmsg implementation.
 	if msg.IovLen > linux.UIO_MAXIOV {
-		return 0, syserror.EMSGSIZE
+		return 0, linuxerr.EMSGSIZE
 	}
 	src, err := t.IovecsIOSequence(hostarch.Addr(msg.Iov), int(msg.IovLen), usermem.IOOpts{
 		AddressSpaceActive: true,
diff --git a/pkg/sentry/syscalls/linux/sys_splice.go b/pkg/sentry/syscalls/linux/sys_splice.go
index 398485a72..34d87ac1f 100644
--- a/pkg/sentry/syscalls/linux/sys_splice.go
+++ b/pkg/sentry/syscalls/linux/sys_splice.go
@@ -143,7 +143,7 @@ func Sendfile(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 		// Verify that when offset address is not null, infile must be
 		// seekable. The fs.Splice routine itself validates basic read.
 		if !inFile.Flags().Pread {
-			return 0, nil, syserror.ESPIPE
+			return 0, nil, linuxerr.ESPIPE
 		}
 
 		// Copy in the offset.
@@ -227,7 +227,7 @@ func Splice(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscal
 	switch {
 	case fs.IsPipe(inFileAttr) && !fs.IsPipe(outFileAttr):
 		if inOffset != 0 {
-			return 0, nil, syserror.ESPIPE
+			return 0, nil, linuxerr.ESPIPE
 		}
 		if outOffset != 0 {
 			if !outFile.Flags().Pwrite {
@@ -245,7 +245,7 @@ func Splice(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscal
 		}
 	case !fs.IsPipe(inFileAttr) && fs.IsPipe(outFileAttr):
 		if outOffset != 0 {
-			return 0, nil, syserror.ESPIPE
+			return 0, nil, linuxerr.ESPIPE
 		}
 		if inOffset != 0 {
 			if !inFile.Flags().Pread {
@@ -263,7 +263,7 @@ func Splice(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscal
 		}
 	case fs.IsPipe(inFileAttr) && fs.IsPipe(outFileAttr):
 		if inOffset != 0 || outOffset != 0 {
-			return 0, nil, syserror.ESPIPE
+			return 0, nil, linuxerr.ESPIPE
 		}
 
 		// We may not refer to the same pipe; otherwise it's a continuous loop.
diff --git a/pkg/sentry/syscalls/linux/sys_write.go b/pkg/sentry/syscalls/linux/sys_write.go
index fe7da4261..eec917d95 100644
--- a/pkg/sentry/syscalls/linux/sys_write.go
+++ b/pkg/sentry/syscalls/linux/sys_write.go
@@ -95,7 +95,7 @@ func Pwrite64(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 
 	// Is writing at an offset supported?
 	if !file.Flags().Pwrite {
-		return 0, nil, syserror.ESPIPE
+		return 0, nil, linuxerr.ESPIPE
 	}
 
 	// Check that the file is writable.
@@ -172,7 +172,7 @@ func Pwritev(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysca
 
 	// Is writing at an offset supported?
 	if !file.Flags().Pwrite {
-		return 0, nil, syserror.ESPIPE
+		return 0, nil, linuxerr.ESPIPE
 	}
 
 	// Check that the file is writable.
@@ -225,7 +225,7 @@ func Pwritev2(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 
 	// Is writing at an offset supported?
 	if offset > -1 && !file.Flags().Pwrite {
-		return 0, nil, syserror.ESPIPE
+		return 0, nil, linuxerr.ESPIPE
 	}
 
 	// Note: gVisor does not implement the RWF_HIPRI feature, but the flag is
diff --git a/pkg/sentry/syscalls/linux/sys_xattr.go b/pkg/sentry/syscalls/linux/sys_xattr.go
index ea67d1398..717e23c59 100644
--- a/pkg/sentry/syscalls/linux/sys_xattr.go
+++ b/pkg/sentry/syscalls/linux/sys_xattr.go
@@ -244,7 +244,7 @@ func checkXattrPermissions(t *kernel.Task, i *fs.Inode, perms fs.PermMask) error
 		if perms.Write {
 			return linuxerr.EPERM
 		}
-		return syserror.ENODATA
+		return linuxerr.ENODATA
 	}
 
 	return i.CheckPermission(t, perms)
diff --git a/pkg/sentry/syscalls/linux/vfs2/fd.go b/pkg/sentry/syscalls/linux/vfs2/fd.go
index bf2627c36..55272fbbc 100644
--- a/pkg/sentry/syscalls/linux/vfs2/fd.go
+++ b/pkg/sentry/syscalls/linux/vfs2/fd.go
@@ -57,7 +57,7 @@ func Dup(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.SyscallCo
 
 	newFD, err := t.NewFDFromVFS2(0, file, kernel.FDFlags{})
 	if err != nil {
-		return 0, nil, syserror.EMFILE
+		return 0, nil, linuxerr.EMFILE
 	}
 	return uintptr(newFD), nil, nil
 }
@@ -411,7 +411,7 @@ func Fadvise64(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sys
 
 	// If the FD refers to a pipe or FIFO, return error.
 	if _, isPipe := file.Impl().(*pipe.VFSPipeFD); isPipe {
-		return 0, nil, syserror.ESPIPE
+		return 0, nil, linuxerr.ESPIPE
 	}
 
 	switch advice {
diff --git a/pkg/sentry/syscalls/linux/vfs2/setstat.go b/pkg/sentry/syscalls/linux/vfs2/setstat.go
index 989cd75f1..b5a3b92c5 100644
--- a/pkg/sentry/syscalls/linux/vfs2/setstat.go
+++ b/pkg/sentry/syscalls/linux/vfs2/setstat.go
@@ -230,7 +230,7 @@ func Fallocate(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sys
 		return 0, nil, linuxerr.EBADF
 	}
 	if mode != 0 {
-		return 0, nil, syserror.ENOTSUP
+		return 0, nil, linuxerr.ENOTSUP
 	}
 	if offset < 0 || length <= 0 {
 		return 0, nil, linuxerr.EINVAL
@@ -238,7 +238,7 @@ func Fallocate(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sys
 
 	size := offset + length
 	if size < 0 {
-		return 0, nil, syserror.EFBIG
+		return 0, nil, linuxerr.EFBIG
 	}
 	limit := limits.FromContext(t).Get(limits.FileSize).Cur
 	if uint64(size) >= limit {
@@ -246,7 +246,7 @@ func Fallocate(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sys
 			Signo: int32(linux.SIGXFSZ),
 			Code:  linux.SI_USER,
 		})
-		return 0, nil, syserror.EFBIG
+		return 0, nil, linuxerr.EFBIG
 	}
 
 	return 0, nil, file.Allocate(t, mode, uint64(offset), uint64(length))
@@ -468,7 +468,7 @@ func handleSetSizeError(t *kernel.Task, err error) error {
 	if err == syserror.ErrExceedsFileSizeLimit {
 		// Convert error to EFBIG and send a SIGXFSZ per setrlimit(2).
 		t.SendSignal(kernel.SignalInfoNoInfo(linux.SIGXFSZ, t, t))
-		return syserror.EFBIG
+		return linuxerr.EFBIG
 	}
 	return err
 }
diff --git a/pkg/sentry/syscalls/linux/vfs2/socket.go b/pkg/sentry/syscalls/linux/vfs2/socket.go
index ee6e07a80..b39292f50 100644
--- a/pkg/sentry/syscalls/linux/vfs2/socket.go
+++ b/pkg/sentry/syscalls/linux/vfs2/socket.go
@@ -754,7 +754,7 @@ func recvSingleMsg(t *kernel.Task, s socket.SocketVFS2, msgPtr hostarch.Addr, fl
 	}
 
 	if msg.IovLen > linux.UIO_MAXIOV {
-		return 0, syserror.EMSGSIZE
+		return 0, linuxerr.EMSGSIZE
 	}
 	dst, err := t.IovecsIOSequence(hostarch.Addr(msg.Iov), int(msg.IovLen), usermem.IOOpts{
 		AddressSpaceActive: true,
@@ -785,7 +785,7 @@ func recvSingleMsg(t *kernel.Task, s socket.SocketVFS2, msgPtr hostarch.Addr, fl
 	}
 
 	if msg.ControlLen > maxControlLen {
-		return 0, syserror.ENOBUFS
+		return 0, linuxerr.ENOBUFS
 	}
 	n, mflags, sender, senderLen, cms, e := s.RecvMsg(t, dst, int(flags), haveDeadline, deadline, msg.NameLen != 0, msg.ControlLen)
 	if e != nil {
@@ -1019,7 +1019,7 @@ func sendSingleMsg(t *kernel.Task, s socket.SocketVFS2, file *vfs.FileDescriptio
 	if msg.ControlLen > 0 {
 		// Put an upper bound to prevent large allocations.
 		if msg.ControlLen > maxControlLen {
-			return 0, syserror.ENOBUFS
+			return 0, linuxerr.ENOBUFS
 		}
 		controlData = make([]byte, msg.ControlLen)
 		if _, err := t.CopyInBytes(hostarch.Addr(msg.Control), controlData); err != nil {
@@ -1039,7 +1039,7 @@ func sendSingleMsg(t *kernel.Task, s socket.SocketVFS2, file *vfs.FileDescriptio
 
 	// Read data then call the sendmsg implementation.
 	if msg.IovLen > linux.UIO_MAXIOV {
-		return 0, syserror.EMSGSIZE
+		return 0, linuxerr.EMSGSIZE
 	}
 	src, err := t.IovecsIOSequence(hostarch.Addr(msg.Iov), int(msg.IovLen), usermem.IOOpts{
 		AddressSpaceActive: true,
diff --git a/pkg/sentry/syscalls/linux/vfs2/splice.go b/pkg/sentry/syscalls/linux/vfs2/splice.go
index 7a8aef5d4..d8009123f 100644
--- a/pkg/sentry/syscalls/linux/vfs2/splice.go
+++ b/pkg/sentry/syscalls/linux/vfs2/splice.go
@@ -90,7 +90,7 @@ func Splice(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscal
 	inOffset := int64(-1)
 	if inOffsetPtr != 0 {
 		if inIsPipe {
-			return 0, nil, syserror.ESPIPE
+			return 0, nil, linuxerr.ESPIPE
 		}
 		if inFile.Options().DenyPRead {
 			return 0, nil, linuxerr.EINVAL
@@ -105,7 +105,7 @@ func Splice(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Syscal
 	outOffset := int64(-1)
 	if outOffsetPtr != 0 {
 		if outIsPipe {
-			return 0, nil, syserror.ESPIPE
+			return 0, nil, linuxerr.ESPIPE
 		}
 		if outFile.Options().DenyPWrite {
 			return 0, nil, linuxerr.EINVAL
@@ -306,7 +306,7 @@ func Sendfile(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 	offset := int64(-1)
 	if offsetAddr != 0 {
 		if inFile.Options().DenyPRead {
-			return 0, nil, syserror.ESPIPE
+			return 0, nil, linuxerr.ESPIPE
 		}
 		var offsetP primitive.Int64
 		if _, err := offsetP.CopyIn(t, offsetAddr); err != nil {
diff --git a/pkg/sentry/vfs/anonfs.go b/pkg/sentry/vfs/anonfs.go
index bb8c26e46..40863cbb6 100644
--- a/pkg/sentry/vfs/anonfs.go
+++ b/pkg/sentry/vfs/anonfs.go
@@ -157,7 +157,7 @@ func (fs *anonFilesystem) OpenAt(ctx context.Context, rp *ResolvingPath, opts Op
 	if !rp.Done() {
 		return nil, syserror.ENOTDIR
 	}
-	return nil, syserror.ENODEV
+	return nil, linuxerr.ENODEV
 }
 
 // ReadlinkAt implements FilesystemImpl.ReadlinkAt.
@@ -251,7 +251,7 @@ func (fs *anonFilesystem) BoundEndpointAt(ctx context.Context, rp *ResolvingPath
 	if err := GenericCheckPermissions(rp.Credentials(), MayWrite, anonFileMode, anonFileUID, anonFileGID); err != nil {
 		return nil, err
 	}
-	return nil, syserror.ECONNREFUSED
+	return nil, linuxerr.ECONNREFUSED
 }
 
 // ListXattrAt implements FilesystemImpl.ListXattrAt.
@@ -267,7 +267,7 @@ func (fs *anonFilesystem) GetXattrAt(ctx context.Context, rp *ResolvingPath, opt
 	if !rp.Done() {
 		return "", syserror.ENOTDIR
 	}
-	return "", syserror.ENOTSUP
+	return "", linuxerr.ENOTSUP
 }
 
 // SetXattrAt implements FilesystemImpl.SetXattrAt.
diff --git a/pkg/sentry/vfs/dentry.go b/pkg/sentry/vfs/dentry.go
index e7ca24d96..242eb5ecb 100644
--- a/pkg/sentry/vfs/dentry.go
+++ b/pkg/sentry/vfs/dentry.go
@@ -18,8 +18,8 @@ import (
 	"sync/atomic"
 
 	"gvisor.dev/gvisor/pkg/context"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/sync"
-	"gvisor.dev/gvisor/pkg/syserror"
 )
 
 // Dentry represents a node in a Filesystem tree at which a file exists.
@@ -200,7 +200,7 @@ func (vfs *VirtualFilesystem) PrepareDeleteDentry(mntns *MountNamespace, d *Dent
 	vfs.mountMu.Lock()
 	if mntns.mountpoints[d] != 0 {
 		vfs.mountMu.Unlock()
-		return syserror.EBUSY
+		return linuxerr.EBUSY
 	}
 	d.mu.Lock()
 	vfs.mountMu.Unlock()
@@ -253,12 +253,12 @@ func (vfs *VirtualFilesystem) PrepareRenameDentry(mntns *MountNamespace, from, t
 	vfs.mountMu.Lock()
 	if mntns.mountpoints[from] != 0 {
 		vfs.mountMu.Unlock()
-		return syserror.EBUSY
+		return linuxerr.EBUSY
 	}
 	if to != nil {
 		if mntns.mountpoints[to] != 0 {
 			vfs.mountMu.Unlock()
-			return syserror.EBUSY
+			return linuxerr.EBUSY
 		}
 		to.mu.Lock()
 	}
diff --git a/pkg/sentry/vfs/device.go b/pkg/sentry/vfs/device.go
index dde2ad79b..572d81afc 100644
--- a/pkg/sentry/vfs/device.go
+++ b/pkg/sentry/vfs/device.go
@@ -18,7 +18,7 @@ import (
 	"fmt"
 
 	"gvisor.dev/gvisor/pkg/context"
-	"gvisor.dev/gvisor/pkg/syserror"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 )
 
 // DeviceKind indicates whether a device is a block or character device.
@@ -100,7 +100,7 @@ func (vfs *VirtualFilesystem) OpenDeviceSpecialFile(ctx context.Context, mnt *Mo
 	defer vfs.devicesMu.RUnlock()
 	rd, ok := vfs.devices[tup]
 	if !ok {
-		return nil, syserror.ENXIO
+		return nil, linuxerr.ENXIO
 	}
 	return rd.dev.Open(ctx, mnt, d, *opts)
 }
@@ -120,7 +120,7 @@ func (vfs *VirtualFilesystem) GetAnonBlockDevMinor() (uint32, error) {
 		}
 		minor++
 	}
-	return 0, syserror.EMFILE
+	return 0, linuxerr.EMFILE
 }
 
 // PutAnonBlockDevMinor deallocates a minor device number returned by a
diff --git a/pkg/sentry/vfs/epoll.go b/pkg/sentry/vfs/epoll.go
index ae004b371..a93e757f8 100644
--- a/pkg/sentry/vfs/epoll.go
+++ b/pkg/sentry/vfs/epoll.go
@@ -17,6 +17,7 @@ package vfs
 import (
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/sync"
 	"gvisor.dev/gvisor/pkg/syserror"
 	"gvisor.dev/gvisor/pkg/waiter"
@@ -174,7 +175,7 @@ func (ep *EpollInstance) AddInterest(file *FileDescription, num int32, event lin
 		// that cyclic polling is not introduced after the check.
 		defer epollCycleMu.Unlock()
 		if subep.mightPoll(ep) {
-			return syserror.ELOOP
+			return linuxerr.ELOOP
 		}
 	}
 
diff --git a/pkg/sentry/vfs/file_description.go b/pkg/sentry/vfs/file_description.go
index 6ded82baf..ca3303dec 100644
--- a/pkg/sentry/vfs/file_description.go
+++ b/pkg/sentry/vfs/file_description.go
@@ -27,7 +27,6 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
 	"gvisor.dev/gvisor/pkg/sentry/memmap"
 	"gvisor.dev/gvisor/pkg/sync"
-	"gvisor.dev/gvisor/pkg/syserror"
 	"gvisor.dev/gvisor/pkg/usermem"
 	"gvisor.dev/gvisor/pkg/waiter"
 )
@@ -603,7 +602,7 @@ func (fd *FileDescription) EventUnregister(e *waiter.Entry) {
 // partial reads with a nil error.
 func (fd *FileDescription) PRead(ctx context.Context, dst usermem.IOSequence, offset int64, opts ReadOptions) (int64, error) {
 	if fd.opts.DenyPRead {
-		return 0, syserror.ESPIPE
+		return 0, linuxerr.ESPIPE
 	}
 	if !fd.readable {
 		return 0, linuxerr.EBADF
@@ -638,7 +637,7 @@ func (fd *FileDescription) Read(ctx context.Context, dst usermem.IOSequence, opt
 // return partial writes with a nil error.
 func (fd *FileDescription) PWrite(ctx context.Context, src usermem.IOSequence, offset int64, opts WriteOptions) (int64, error) {
 	if fd.opts.DenyPWrite {
-		return 0, syserror.ESPIPE
+		return 0, linuxerr.ESPIPE
 	}
 	if !fd.writable {
 		return 0, linuxerr.EBADF
diff --git a/pkg/sentry/vfs/file_description_impl_util.go b/pkg/sentry/vfs/file_description_impl_util.go
index c947d0c6c..c1ab2f56c 100644
--- a/pkg/sentry/vfs/file_description_impl_util.go
+++ b/pkg/sentry/vfs/file_description_impl_util.go
@@ -66,7 +66,7 @@ func (FileDescriptionDefaultImpl) StatFS(ctx context.Context) (linux.Statfs, err
 // should technically return EISDIR. Allocate should never be called for a
 // directory, because it requires a writable fd.
 func (FileDescriptionDefaultImpl) Allocate(ctx context.Context, mode, offset, length uint64) error {
-	return syserror.ENODEV
+	return linuxerr.ENODEV
 }
 
 // Readiness implements waiter.Waitable.Readiness analogously to
@@ -120,7 +120,7 @@ func (FileDescriptionDefaultImpl) IterDirents(ctx context.Context, cb IterDirent
 // Seek implements FileDescriptionImpl.Seek analogously to
 // file_operations::llseek == NULL in Linux.
 func (FileDescriptionDefaultImpl) Seek(ctx context.Context, offset int64, whence int32) (int64, error) {
-	return 0, syserror.ESPIPE
+	return 0, linuxerr.ESPIPE
 }
 
 // Sync implements FileDescriptionImpl.Sync analogously to
@@ -132,7 +132,7 @@ func (FileDescriptionDefaultImpl) Sync(ctx context.Context) error {
 // ConfigureMMap implements FileDescriptionImpl.ConfigureMMap analogously to
 // file_operations::mmap == NULL in Linux.
 func (FileDescriptionDefaultImpl) ConfigureMMap(ctx context.Context, opts *memmap.MMapOpts) error {
-	return syserror.ENODEV
+	return linuxerr.ENODEV
 }
 
 // Ioctl implements FileDescriptionImpl.Ioctl analogously to
@@ -145,25 +145,25 @@ func (FileDescriptionDefaultImpl) Ioctl(ctx context.Context, uio usermem.IO, arg
 // inode_operations::listxattr == NULL in Linux.
 func (FileDescriptionDefaultImpl) ListXattr(ctx context.Context, size uint64) ([]string, error) {
 	// This isn't exactly accurate; see FileDescription.ListXattr.
-	return nil, syserror.ENOTSUP
+	return nil, linuxerr.ENOTSUP
 }
 
 // GetXattr implements FileDescriptionImpl.GetXattr analogously to
 // inode::i_opflags & IOP_XATTR == 0 in Linux.
 func (FileDescriptionDefaultImpl) GetXattr(ctx context.Context, opts GetXattrOptions) (string, error) {
-	return "", syserror.ENOTSUP
+	return "", linuxerr.ENOTSUP
 }
 
 // SetXattr implements FileDescriptionImpl.SetXattr analogously to
 // inode::i_opflags & IOP_XATTR == 0 in Linux.
 func (FileDescriptionDefaultImpl) SetXattr(ctx context.Context, opts SetXattrOptions) error {
-	return syserror.ENOTSUP
+	return linuxerr.ENOTSUP
 }
 
 // RemoveXattr implements FileDescriptionImpl.RemoveXattr analogously to
 // inode::i_opflags & IOP_XATTR == 0 in Linux.
 func (FileDescriptionDefaultImpl) RemoveXattr(ctx context.Context, name string) error {
-	return syserror.ENOTSUP
+	return linuxerr.ENOTSUP
 }
 
 // DirectoryFileDescriptionDefaultImpl may be embedded by implementations of
@@ -468,27 +468,27 @@ func (NoLockFD) SupportsLocks() bool {
 
 // LockBSD implements FileDescriptionImpl.LockBSD.
 func (NoLockFD) LockBSD(ctx context.Context, uid fslock.UniqueID, ownerPID int32, t fslock.LockType, block fslock.Blocker) error {
-	return syserror.ENOLCK
+	return linuxerr.ENOLCK
 }
 
 // UnlockBSD implements FileDescriptionImpl.UnlockBSD.
 func (NoLockFD) UnlockBSD(ctx context.Context, uid fslock.UniqueID) error {
-	return syserror.ENOLCK
+	return linuxerr.ENOLCK
 }
 
 // LockPOSIX implements FileDescriptionImpl.LockPOSIX.
 func (NoLockFD) LockPOSIX(ctx context.Context, uid fslock.UniqueID, ownerPID int32, t fslock.LockType, r fslock.LockRange, block fslock.Blocker) error {
-	return syserror.ENOLCK
+	return linuxerr.ENOLCK
 }
 
 // UnlockPOSIX implements FileDescriptionImpl.UnlockPOSIX.
 func (NoLockFD) UnlockPOSIX(ctx context.Context, uid fslock.UniqueID, r fslock.LockRange) error {
-	return syserror.ENOLCK
+	return linuxerr.ENOLCK
 }
 
 // TestPOSIX implements FileDescriptionImpl.TestPOSIX.
 func (NoLockFD) TestPOSIX(ctx context.Context, uid fslock.UniqueID, t fslock.LockType, r fslock.LockRange) (linux.Flock, error) {
-	return linux.Flock{}, syserror.ENOLCK
+	return linux.Flock{}, linuxerr.ENOLCK
 }
 
 // BadLockFD implements Lock*/Unlock* portion of FileDescriptionImpl interface
diff --git a/pkg/sentry/vfs/inotify.go b/pkg/sentry/vfs/inotify.go
index ebbbda697..e0624b2fa 100644
--- a/pkg/sentry/vfs/inotify.go
+++ b/pkg/sentry/vfs/inotify.go
@@ -185,12 +185,12 @@ func (i *Inotify) Readiness(mask waiter.EventMask) waiter.EventMask {
 
 // PRead implements FileDescriptionImpl.PRead.
 func (*Inotify) PRead(ctx context.Context, dst usermem.IOSequence, offset int64, opts ReadOptions) (int64, error) {
-	return 0, syserror.ESPIPE
+	return 0, linuxerr.ESPIPE
 }
 
 // PWrite implements FileDescriptionImpl.PWrite.
 func (*Inotify) PWrite(ctx context.Context, src usermem.IOSequence, offset int64, opts WriteOptions) (int64, error) {
-	return 0, syserror.ESPIPE
+	return 0, linuxerr.ESPIPE
 }
 
 // Write implements FileDescriptionImpl.Write.
diff --git a/pkg/sentry/vfs/memxattr/xattr.go b/pkg/sentry/vfs/memxattr/xattr.go
index 9b7953fa3..efc9c6a5d 100644
--- a/pkg/sentry/vfs/memxattr/xattr.go
+++ b/pkg/sentry/vfs/memxattr/xattr.go
@@ -20,6 +20,7 @@ import (
 	"strings"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
 	"gvisor.dev/gvisor/pkg/sentry/vfs"
 	"gvisor.dev/gvisor/pkg/sync"
@@ -49,7 +50,7 @@ func (x *SimpleExtendedAttributes) GetXattr(creds *auth.Credentials, mode linux.
 	value, ok := x.xattrs[opts.Name]
 	x.mu.RUnlock()
 	if !ok {
-		return "", syserror.ENODATA
+		return "", linuxerr.ENODATA
 	}
 	// Check that the size of the buffer provided in getxattr(2) is large enough
 	// to contain the value.
@@ -69,7 +70,7 @@ func (x *SimpleExtendedAttributes) SetXattr(creds *auth.Credentials, mode linux.
 	defer x.mu.Unlock()
 	if x.xattrs == nil {
 		if opts.Flags&linux.XATTR_REPLACE != 0 {
-			return syserror.ENODATA
+			return linuxerr.ENODATA
 		}
 		x.xattrs = make(map[string]string)
 	}
@@ -79,7 +80,7 @@ func (x *SimpleExtendedAttributes) SetXattr(creds *auth.Credentials, mode linux.
 		return syserror.EEXIST
 	}
 	if !ok && opts.Flags&linux.XATTR_REPLACE != 0 {
-		return syserror.ENODATA
+		return linuxerr.ENODATA
 	}
 
 	x.xattrs[opts.Name] = opts.Value
@@ -120,7 +121,7 @@ func (x *SimpleExtendedAttributes) RemoveXattr(creds *auth.Credentials, mode lin
 	x.mu.Lock()
 	defer x.mu.Unlock()
 	if _, ok := x.xattrs[name]; !ok {
-		return syserror.ENODATA
+		return linuxerr.ENODATA
 	}
 	delete(x.xattrs, name)
 	return nil
diff --git a/pkg/sentry/vfs/mount.go b/pkg/sentry/vfs/mount.go
index ceb1e5fff..4d6b59a26 100644
--- a/pkg/sentry/vfs/mount.go
+++ b/pkg/sentry/vfs/mount.go
@@ -160,7 +160,7 @@ func (vfs *VirtualFilesystem) NewMountNamespace(ctx context.Context, creds *auth
 	rft := vfs.getFilesystemType(fsTypeName)
 	if rft == nil {
 		ctx.Warningf("Unknown filesystem type: %s", fsTypeName)
-		return nil, syserror.ENODEV
+		return nil, linuxerr.ENODEV
 	}
 	fs, root, err := rft.fsType.GetFilesystem(ctx, vfs, creds, source, opts.GetFilesystemOptions)
 	if err != nil {
@@ -193,10 +193,10 @@ func (vfs *VirtualFilesystem) NewDisconnectedMount(fs *Filesystem, root *Dentry,
 func (vfs *VirtualFilesystem) MountDisconnected(ctx context.Context, creds *auth.Credentials, source string, fsTypeName string, opts *MountOptions) (*Mount, error) {
 	rft := vfs.getFilesystemType(fsTypeName)
 	if rft == nil {
-		return nil, syserror.ENODEV
+		return nil, linuxerr.ENODEV
 	}
 	if !opts.InternalMount && !rft.opts.AllowUserMount {
-		return nil, syserror.ENODEV
+		return nil, linuxerr.ENODEV
 	}
 	fs, root, err := rft.fsType.GetFilesystem(ctx, vfs, creds, source, opts.GetFilesystemOptions)
 	if err != nil {
@@ -327,7 +327,7 @@ func (vfs *VirtualFilesystem) UmountAt(ctx context.Context, creds *auth.Credenti
 		if len(vd.mount.children) != 0 {
 			vfs.mounts.seq.EndWrite()
 			vfs.mountMu.Unlock()
-			return syserror.EBUSY
+			return linuxerr.EBUSY
 		}
 		// We are holding a reference on vd.mount.
 		expectedRefs := int64(1)
@@ -337,7 +337,7 @@ func (vfs *VirtualFilesystem) UmountAt(ctx context.Context, creds *auth.Credenti
 		if atomic.LoadInt64(&vd.mount.refs)&^math.MinInt64 != expectedRefs { // mask out MSB
 			vfs.mounts.seq.EndWrite()
 			vfs.mountMu.Unlock()
-			return syserror.EBUSY
+			return linuxerr.EBUSY
 		}
 	}
 	vdsToDecRef, mountsToDecRef := vfs.umountRecursiveLocked(vd.mount, &umountRecursiveOptions{
@@ -711,7 +711,7 @@ func (vfs *VirtualFilesystem) SetMountReadOnly(mnt *Mount, ro bool) error {
 func (mnt *Mount) CheckBeginWrite() error {
 	if atomic.AddInt64(&mnt.writers, 1) < 0 {
 		atomic.AddInt64(&mnt.writers, -1)
-		return syserror.EROFS
+		return linuxerr.EROFS
 	}
 	return nil
 }
@@ -729,7 +729,7 @@ func (mnt *Mount) setReadOnlyLocked(ro bool) error {
 	}
 	if ro {
 		if !atomic.CompareAndSwapInt64(&mnt.writers, 0, math.MinInt64) {
-			return syserror.EBUSY
+			return linuxerr.EBUSY
 		}
 		return nil
 	}
diff --git a/pkg/sentry/vfs/permissions.go b/pkg/sentry/vfs/permissions.go
index 22abdd5b8..4744514bd 100644
--- a/pkg/sentry/vfs/permissions.go
+++ b/pkg/sentry/vfs/permissions.go
@@ -309,7 +309,7 @@ func CheckXattrPermissions(creds *auth.Credentials, ats AccessTypes, mode linux.
 		if ats.MayWrite() {
 			return linuxerr.EPERM
 		}
-		return syserror.ENODATA
+		return linuxerr.ENODATA
 	case strings.HasPrefix(name, linux.XATTR_USER_PREFIX):
 		// In the user.* namespace, only regular files and directories can have
 		// extended attributes. For sticky directories, only the owner and
@@ -319,7 +319,7 @@ func CheckXattrPermissions(creds *auth.Credentials, ats AccessTypes, mode linux.
 			if ats.MayWrite() {
 				return linuxerr.EPERM
 			}
-			return syserror.ENODATA
+			return linuxerr.ENODATA
 		}
 		if filetype == linux.ModeDirectory && mode&linux.ModeSticky != 0 && ats.MayWrite() && !CanActAsOwner(creds, kuid) {
 			return linuxerr.EPERM
diff --git a/pkg/sentry/vfs/resolving_path.go b/pkg/sentry/vfs/resolving_path.go
index 97b898aba..6f58f33ce 100644
--- a/pkg/sentry/vfs/resolving_path.go
+++ b/pkg/sentry/vfs/resolving_path.go
@@ -19,6 +19,7 @@ import (
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
 	"gvisor.dev/gvisor/pkg/context"
+	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/fspath"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
 	"gvisor.dev/gvisor/pkg/sync"
@@ -327,7 +328,7 @@ func (rp *ResolvingPath) ShouldFollowSymlink() bool {
 // Postconditions: If HandleSymlink returns a nil error, then !rp.Done().
 func (rp *ResolvingPath) HandleSymlink(target string) error {
 	if rp.symlinks >= linux.MaxSymlinkTraversals {
-		return syserror.ELOOP
+		return linuxerr.ELOOP
 	}
 	if len(target) == 0 {
 		return syserror.ENOENT
@@ -377,7 +378,7 @@ func (rp *ResolvingPath) relpathPrepend(path fspath.Path) {
 // Preconditions: !rp.Done().
 func (rp *ResolvingPath) HandleJump(target VirtualDentry) error {
 	if rp.symlinks >= linux.MaxSymlinkTraversals {
-		return syserror.ELOOP
+		return linuxerr.ELOOP
 	}
 	rp.symlinks++
 	// Consume the path component that represented the magic link.
diff --git a/pkg/sentry/vfs/vfs.go b/pkg/sentry/vfs/vfs.go
index 0e94be174..cb9ed81d8 100644
--- a/pkg/sentry/vfs/vfs.go
+++ b/pkg/sentry/vfs/vfs.go
@@ -494,7 +494,7 @@ func (vfs *VirtualFilesystem) ReadlinkAt(ctx context.Context, creds *auth.Creden
 func (vfs *VirtualFilesystem) RenameAt(ctx context.Context, creds *auth.Credentials, oldpop, newpop *PathOperation, opts *RenameOptions) error {
 	if !oldpop.Path.Begin.Ok() {
 		if oldpop.Path.Absolute {
-			return syserror.EBUSY
+			return linuxerr.EBUSY
 		}
 		return syserror.ENOENT
 	}
@@ -509,13 +509,13 @@ func (vfs *VirtualFilesystem) RenameAt(ctx context.Context, creds *auth.Credenti
 	}
 	if oldName == "." || oldName == ".." {
 		oldParentVD.DecRef(ctx)
-		return syserror.EBUSY
+		return linuxerr.EBUSY
 	}
 
 	if !newpop.Path.Begin.Ok() {
 		oldParentVD.DecRef(ctx)
 		if newpop.Path.Absolute {
-			return syserror.EBUSY
+			return linuxerr.EBUSY
 		}
 		return syserror.ENOENT
 	}
@@ -556,7 +556,7 @@ func (vfs *VirtualFilesystem) RmdirAt(ctx context.Context, creds *auth.Credentia
 		// pop.Path should not be empty in operations that create/delete files.
 		// This is consistent with unlinkat(dirfd, "", AT_REMOVEDIR).
 		if pop.Path.Absolute {
-			return syserror.EBUSY
+			return linuxerr.EBUSY
 		}
 		return syserror.ENOENT
 	}
@@ -673,7 +673,7 @@ func (vfs *VirtualFilesystem) UnlinkAt(ctx context.Context, creds *auth.Credenti
 		// pop.Path should not be empty in operations that create/delete files.
 		// This is consistent with unlinkat(dirfd, "", 0).
 		if pop.Path.Absolute {
-			return syserror.EBUSY
+			return linuxerr.EBUSY
 		}
 		return syserror.ENOENT
 	}