Edit: OpenAt is not a valid counterexample since the program checks file descriptors. But e.g renameAt[0] allows to overwrite protected files. There are numerous other options to circumvent that tool too.

[0]: http://man7.org/linux/man-pages/man2/renameat.2.html