diff --git a/src/confd/src/containers.c b/src/confd/src/containers.c
index f8f219b7..8dabcc69 100644
--- a/src/confd/src/containers.c
+++ b/src/confd/src/containers.c
@@ -348,7 +348,7 @@ static int del(const char *name)
 
 	/* Schedule a cleanup job for this container as soon as it has stopped */
 	snprintf(prune_dir, sizeof(prune_dir), "%s/%s", _PATH_CLEAN, name);
-	systemf("mkdir -p %s", prune_dir);
+	mkpath(prune_dir, 0755);
 
 	/* Finit cleanup:script runs when container is deleted, it will remove any image by-ID */
 	pp = popenf("r", "podman inspect %s 2>/dev/null | jq -r '.[].Id' 2>/dev/null", name);
diff --git a/src/confd/src/dagger.c b/src/confd/src/dagger.c
index 554354a6..3dafa877 100644
--- a/src/confd/src/dagger.c
+++ b/src/confd/src/dagger.c
@@ -21,7 +21,7 @@ static FILE *dagger_fopen(struct dagger *d, int gen, const char *action,
 		return NULL;
 	}
 
-	if (systemf("mkdir -p " PATH_ACTION_, d->path, gen, action, node))
+	if (fmkpath(0755, PATH_ACTION_, d->path, gen, action, node))
 		return NULL;
 
 	if (asprintf(&path, PATH_ACTION_"/%02u-%s", d->path, gen, action, node, prio, script) == -1)
@@ -117,7 +117,7 @@ int dagger_add_dep(const struct dagger *d, const char *depender, const char *dep
 
 int dagger_add_node(struct dagger *d, const char *node)
 {
-	return systemf("mkdir -p %s/%d/dag/%s", d->path, d->next, node);
+	return fmkpath(0755, "%s/%d/dag/%s", d->path, d->next, node);
 }
 
 int dagger_abandon(struct dagger *d)
@@ -192,13 +192,12 @@ int dagger_is_bootstrap(struct dagger *d)
 
 int dagger_claim(struct dagger *d, const char *path)
 {
-	int err;
+	char lnk[strlen(path) + 32];
 
 	memset(d, 0, sizeof(*d));
 
-	err = systemf("mkdir -p %s", path);
-	if (err)
-		return err;
+	if (mkpath(path, 0755))
+		return -1;
 
 	d->next_fp = fopenf("wx", "%s/next", path);
 	if (!d->next_fp) {
@@ -209,23 +208,22 @@ int dagger_claim(struct dagger *d, const char *path)
 	if (readdf(&d->current, "%s/current", path)) {
 		d->current = -1;
 	} else {
-		err = systemf("mkdir -p %s/%d/action/exit"
-			      " && "
-			      "ln -sf ../../top-down-order %s/%d/action/exit/order",
-			      path, d->current, path, d->current);
-		if (err)
-			return err;
+		if (fmkpath(0755, "%s/%d/action/exit", path, d->current))
+			return -1;
+		snprintf(lnk, sizeof(lnk), "%s/%d/action/exit/order", path, d->current);
+		erase(lnk);
+		if (symlink("../../top-down-order", lnk))
+			return -1;
 	}
 
 	d->next = d->current + 1;
-	err = systemf("mkdir -p %s/%d/action/init"
-		      " && "
-		      "mkdir -p %s/%d/skip"
-		      " && "
-		      "ln -s ../../bottom-up-order %s/%d/action/init/order",
-		      path, d->next, path, d->next, path, d->next);
-	if (err)
-		return err;
+	if (fmkpath(0755, "%s/%d/action/init", path, d->next))
+		return -1;
+	if (fmkpath(0755, "%s/%d/skip", path, d->next))
+		return -1;
+	snprintf(lnk, sizeof(lnk), "%s/%d/action/init/order", path, d->next);
+	if (symlink("../../bottom-up-order", lnk) && errno != EEXIST)
+		return -1;
 
 	strlcpy(d->path, path, sizeof(d->path));
 	return 0;
diff --git a/src/confd/src/firewall.c b/src/confd/src/firewall.c
index f563a38f..ba6969e8 100644
--- a/src/confd/src/firewall.c
+++ b/src/confd/src/firewall.c
@@ -504,7 +504,7 @@ int firewall_change(sr_session_ctx_t *session, struct lyd_node *config, struct l
 		break;
 
 	case SR_EV_ABORT:
-		systemf("rm -rf " FIREWALLD_DIR_NEXT);
+		rmrf(FIREWALLD_DIR_NEXT);
 		return SR_ERR_OK;
 
 	case SR_EV_DONE:
@@ -515,7 +515,7 @@ int firewall_change(sr_session_ctx_t *session, struct lyd_node *config, struct l
 		}
 
 		/* Firewall is enabled, roll in new configuration */
-		systemf("rm -rf " FIREWALLD_DIR);
+		rmrf(FIREWALLD_DIR);
 		if (rename(FIREWALLD_DIR_NEXT, FIREWALLD_DIR)) {
 			ERRNO("Failed rolling in firewalld configuration");
 			return SR_ERR_SYS;
@@ -533,7 +533,7 @@ int firewall_change(sr_session_ctx_t *session, struct lyd_node *config, struct l
 	global = lydx_get_descendant(tree, "firewall", NULL);
 
 	/* Clean up any stale /etc/firewalld+ first */
-	systemf("rm -rf " FIREWALLD_DIR_NEXT);
+	rmrf(FIREWALLD_DIR_NEXT);
 
 	/* If firewall is disabled or not enabled, don't generate config */
 	if (!global || !lydx_is_enabled(global, "enabled")) {
diff --git a/src/confd/src/services.c b/src/confd/src/services.c
index 7a8870e7..0981f80d 100644
--- a/src/confd/src/services.c
+++ b/src/confd/src/services.c
@@ -285,16 +285,28 @@ static void svc_enable(int ena, svc type, const char *svcname)
 		svcname = name[type];
 
 	if (fexistf("/etc/nginx/available/%s.conf", svcname)) {
-		if (ena)
-			systemf("ln -sf ../available/%s.conf /etc/nginx/enabled/", svcname);
-		else
-			systemf("rm -f /etc/nginx/enabled/%s.conf", svcname);
+		char src[256], dst[256];
+
+		snprintf(dst, sizeof(dst), "/etc/nginx/enabled/%s.conf", svcname);
+		if (ena) {
+			snprintf(src, sizeof(src), "../available/%s.conf", svcname);
+			erase(dst);
+			symlink(src, dst);
+		} else {
+			erase(dst);
+		}
 	}
 	if (fexistf("/etc/nginx/%s.app", svcname)) {
-		if (ena)
-			systemf("ln -sf ../%s.app /etc/nginx/app/%s.conf", svcname, svcname);
-		else
-			systemf("rm -f /etc/nginx/app/%s.conf", svcname);
+		char src[256], dst[256];
+
+		snprintf(dst, sizeof(dst), "/etc/nginx/app/%s.conf", svcname);
+		if (ena) {
+			snprintf(src, sizeof(src), "../%s.app", svcname);
+			erase(dst);
+			symlink(src, dst);
+		} else {
+			erase(dst);
+		}
 	}
 
 	ena ? finit_enable(svcname) : finit_disable(svcname);
diff --git a/src/confd/src/system.c b/src/confd/src/system.c
index 1991e194..9286afdf 100644
--- a/src/confd/src/system.c
+++ b/src/confd/src/system.c
@@ -268,8 +268,11 @@ static int change_clock(sr_session_ctx_t *session, struct lyd_node *config, stru
 		}
 	}
 
+	char zonelink[256];
+
+	snprintf(zonelink, sizeof(zonelink), "/usr/share/zoneinfo/%s", timezone);
 	(void)remove("/etc/localtime+");
-	if (systemf("ln -sf /usr/share/zoneinfo/%s /etc/localtime+", timezone)) {
+	if (symlink(zonelink, "/etc/localtime+")) {
 		ERROR("No such timezone %s", timezone);
 		rc = SR_ERR_VALIDATION_FAILED;
 	}
@@ -306,7 +309,8 @@ static int change_ntp_client(sr_session_ctx_t *session, struct lyd_node *config,
 	case SR_EV_DONE:
 		if (!srx_enabled(session, XPATH_NTP_"/enabled")) {
 			(void)remove(NTP_CLIENT_CONF);
-			systemf("rm -f /etc/chrony/sources.d/*");
+			rmrf("/etc/chrony/sources.d");
+			mkpath("/etc/chrony/sources.d", 0755);
 			/* Note: chronyd enable/disable is managed centrally in core.c */
 			finit_reload("chronyd");
 			return SR_ERR_OK;
@@ -701,7 +705,9 @@ static int sys_del_user(char *user, bool silent)
 			ERROR("Error deleting user \"%s\"", user);
 
 		/* Ensure $HOME is removed at least. */
-		systemf("rm -rf /home/%s", user);
+		char home[256];
+		snprintf(home, sizeof(home), "/home/%s", user);
+		rmrf(home);
 
 		return SR_ERR_SYS;
 	}
@@ -825,9 +831,14 @@ static int sys_add_user(sr_session_ctx_t *sess, char *name)
 	 * /home/%s/.ssh/authorized_keys file.  This creates a both the
 	 * directory and the symlink owned by root to prevent tampering.
 	 */
+	char src[256], dst[256];
+
 	DEBUG("Adding secure /home/%s/.ssh directory.", name);
 	fmkpath(0750, "/home/%s/.ssh", name);
-	systemf("ln -sf /var/run/sshd/%s.keys /home/%s/.ssh/authorized_keys", name, name);
+	snprintf(src, sizeof(src), "/var/run/sshd/%s.keys", name);
+	snprintf(dst, sizeof(dst), "/home/%s/.ssh/authorized_keys", name);
+	erasef("/home/%s/.ssh/authorized_keys", name);
+	symlink(src, dst);
 
 	return SR_ERR_OK;
 }
@@ -1491,7 +1502,7 @@ static int change_editor(sr_session_ctx_t *session, struct lyd_node *config, str
 			continue;
 
 		erase(alt);
-		rc = systemf("ln -s %s %s", map[i].path, alt);
+		rc = symlink(map[i].path, alt);
 		if (rc)
 			ERROR("Failed setting system editor '%s'", map[i].editor);
 	}
@@ -1611,7 +1622,7 @@ static int change_hostname(sr_session_ctx_t *session, struct lyd_node *config, s
 	}
 
 	/* Use hostname.d for deterministic hostname management */
-	systemf("mkdir -p /etc/hostname.d");
+	mkpath("/etc/hostname.d", 0755);
 
 	fp = fopen("/etc/hostname.d/50-configured", "w");
 	if (!fp)