diff --git a/Documentation/Doxyfile-pal b/Documentation/Doxyfile-pal
index ebf5a69172..1033095c5d 100644
--- a/Documentation/Doxyfile-pal
+++ b/Documentation/Doxyfile-pal
@@ -1,7 +1,7 @@
 @INCLUDE = Doxyfile
 PROJECT_NAME = "PAL"
 OUTPUT_DIRECTORY = _build/doxygen-pal
-INPUT = ../pal/include/arch/x86_64 ../pal/include/pal ../pal/include ../common/include/iovec.h
+INPUT = ../pal/include/arch/x86_64 ../pal/include/pal ../pal/include ../common/include/pal_error.h ../common/include/iovec.h
 MACRO_EXPANSION = YES
 EXPAND_ONLY_PREDEF = YES
-PREDEFINED = noreturn= __x86_64__=1
+PREDEFINED = noreturn= __x86_64__=1 NODISCARD=
diff --git a/Documentation/pal/host-abi.rst b/Documentation/pal/host-abi.rst
index d5fb6e7edb..381d7887da 100644
--- a/Documentation/pal/host-abi.rst
+++ b/Documentation/pal/host-abi.rst
@@ -42,6 +42,17 @@ Data types and variables
 Data types
 ^^^^^^^^^^
 
+Return type
+"""""""""""
+
+All new PAL functions should return an error of :type:`pal_error_t`.
+
+.. doxygentypedef:: pal_error_t
+   :project: pal
+
+.. doxygenenum:: _pal_error_t
+   :project: pal
+
 PAL handles
 """""""""""
 
diff --git a/libos/src/fs/chroot/encrypted.c b/libos/src/fs/chroot/encrypted.c
index a4cff92afb..cc9319d7d6 100644
--- a/libos/src/fs/chroot/encrypted.c
+++ b/libos/src/fs/chroot/encrypted.c
@@ -272,10 +272,11 @@ static int chroot_encrypted_mkdir(struct libos_dentry* dent, mode_t perm) {
 
     /* This opens a "dir:..." URI */
     PAL_HANDLE palhdl;
-    ret = PalStreamOpen(uri, PAL_ACCESS_RDONLY, HOST_PERM(perm), PAL_CREATE_ALWAYS,
-                        PAL_OPTION_PASSTHROUGH, &palhdl);
-    if (ret < 0) {
-        ret = pal_to_unix_errno(ret);
+    pal_error_t pret;
+    pret = PalStreamOpen(uri, PAL_ACCESS_RDONLY, HOST_PERM(perm), PAL_CREATE_ALWAYS,
+                         PAL_OPTION_PASSTHROUGH, &palhdl);
+    if (pret != PAL_ERROR_SUCCESS) {
+        ret = -pal_to_unix_errno(pret);
         goto out;
     }
     PalObjectDestroy(palhdl);
@@ -304,10 +305,11 @@ static int chroot_encrypted_unlink(struct libos_dentry* dent) {
         return ret;
 
     PAL_HANDLE palhdl;
-    ret = PalStreamOpen(uri, PAL_ACCESS_RDONLY, /*share_flags=*/0, PAL_CREATE_NEVER,
-                        PAL_OPTION_PASSTHROUGH, &palhdl);
-    if (ret < 0) {
-        ret = pal_to_unix_errno(ret);
+    pal_error_t pret;
+    pret = PalStreamOpen(uri, PAL_ACCESS_RDONLY, /*share_flags=*/0, PAL_CREATE_NEVER,
+                         PAL_OPTION_PASSTHROUGH, &palhdl);
+    if (pret != PAL_ERROR_SUCCESS) {
+        ret = -pal_to_unix_errno(pret);
         goto out;
     }
 
@@ -369,10 +371,11 @@ static int chroot_encrypted_chmod(struct libos_dentry* dent, mode_t perm) {
         goto out;
 
     PAL_HANDLE palhdl;
-    ret = PalStreamOpen(uri, PAL_ACCESS_RDONLY, /*share_flags=*/0, PAL_CREATE_NEVER,
-                        PAL_OPTION_PASSTHROUGH, &palhdl);
-    if (ret < 0) {
-        ret = pal_to_unix_errno(ret);
+    pal_error_t pret;
+    pret = PalStreamOpen(uri, PAL_ACCESS_RDONLY, /*share_flags=*/0, PAL_CREATE_NEVER,
+                         PAL_OPTION_PASSTHROUGH, &palhdl);
+    if (pret != PAL_ERROR_SUCCESS) {
+        ret = -pal_to_unix_errno(pret);
         goto out;
     }
     mode_t host_perm = HOST_PERM(perm);
diff --git a/libos/src/fs/chroot/fs.c b/libos/src/fs/chroot/fs.c
index e1485a23b2..cd9b1d9782 100644
--- a/libos/src/fs/chroot/fs.c
+++ b/libos/src/fs/chroot/fs.c
@@ -114,14 +114,16 @@ static int chroot_lookup(struct libos_dentry* dent) {
 /* Open a temporary read-only PAL handle for a file (used by `unlink` etc.) */
 static int chroot_temp_open(struct libos_dentry* dent, PAL_HANDLE* out_palhdl) {
     char* uri;
+    pal_error_t pret;
+
     int ret = dentry_uri(dent, dent->inode->type, &uri);
     if (ret < 0)
         return ret;
 
-    ret = PalStreamOpen(uri, PAL_ACCESS_RDONLY, /*share_flags=*/0, PAL_CREATE_NEVER,
-                        /*options=*/0, out_palhdl);
+    pret = PalStreamOpen(uri, PAL_ACCESS_RDONLY, /*share_flags=*/0, PAL_CREATE_NEVER,
+                         /*options=*/0, out_palhdl);
     free(uri);
-    return pal_to_unix_errno(ret);
+    return -pal_to_unix_errno(pret);
 }
 
 /* Open a PAL handle, and associate it with a LibOS handle (if provided). */
@@ -130,8 +132,9 @@ static int chroot_do_open(struct libos_handle* hdl, struct libos_dentry* dent, m
     assert(locked(&g_dcache_lock));
 
     int ret;
-
+    pal_error_t pret;
     char* uri;
+
     ret = dentry_uri(dent, type, &uri);
     if (ret < 0)
         return ret;
@@ -141,9 +144,10 @@ static int chroot_do_open(struct libos_handle* hdl, struct libos_dentry* dent, m
     enum pal_create_mode create = LINUX_OPEN_FLAGS_TO_PAL_CREATE(flags);
     pal_stream_options_t options = LINUX_OPEN_FLAGS_TO_PAL_OPTIONS(flags);
     mode_t host_perm = HOST_PERM(perm);
-    ret = PalStreamOpen(uri, access, host_perm, create, options, &palhdl);
-    if (ret < 0) {
-        ret = pal_to_unix_errno(ret);
+
+    pret = PalStreamOpen(uri, access, host_perm, create, options, &palhdl);
+    if (pret != PAL_ERROR_SUCCESS) {
+        ret = -pal_to_unix_errno(pret);
         goto out;
     }
 
diff --git a/libos/src/fs/dev/fs.c b/libos/src/fs/dev/fs.c
index 3785ac2ae9..ada60f63bf 100644
--- a/libos/src/fs/dev/fs.c
+++ b/libos/src/fs/dev/fs.c
@@ -64,11 +64,12 @@ static int dev_tty_open(struct libos_handle* hdl, struct libos_dentry* dent, int
         return -ENOMEM;
 
     PAL_HANDLE palhdl;
-    int ret = PalStreamOpen(uri, LINUX_OPEN_FLAGS_TO_PAL_ACCESS(flags), PSEUDO_PERM_FILE_RW,
-                            PAL_CREATE_NEVER, /*options=*/0, &palhdl);
-    if (ret < 0) {
+    pal_error_t pret = PalStreamOpen(uri, LINUX_OPEN_FLAGS_TO_PAL_ACCESS(flags),
+                                     PSEUDO_PERM_FILE_RW, PAL_CREATE_NEVER, /*options=*/0,
+                                     &palhdl);
+    if (pret != PAL_ERROR_SUCCESS) {
         free(uri);
-        return pal_to_unix_errno(ret);
+        return -pal_to_unix_errno(pret);
     }
 
     assert(hdl);
diff --git a/libos/src/fs/libos_fs_encrypted.c b/libos/src/fs/libos_fs_encrypted.c
index 3926bb780a..52d10f64d6 100644
--- a/libos/src/fs/libos_fs_encrypted.c
+++ b/libos/src/fs/libos_fs_encrypted.c
@@ -168,11 +168,11 @@ static int encrypted_file_internal_open(struct libos_encrypted_file* enc, PAL_HA
 
     if (!pal_handle) {
         enum pal_create_mode create_mode = create ? PAL_CREATE_ALWAYS : PAL_CREATE_NEVER;
-        ret = PalStreamOpen(enc->uri, PAL_ACCESS_RDWR, share_flags, create_mode,
-                            PAL_OPTION_PASSTHROUGH, &pal_handle);
-        if (ret < 0) {
-            log_warning("PalStreamOpen failed: %s", pal_strerror(ret));
-            return pal_to_unix_errno(ret);
+        pal_error_t pret = PalStreamOpen(enc->uri, PAL_ACCESS_RDWR, share_flags, create_mode,
+                                         PAL_OPTION_PASSTHROUGH, &pal_handle);
+        if (pret != PAL_ERROR_SUCCESS) {
+            log_warning("PalStreamOpen failed: %s", pal_strerror(pret));
+            return -pal_to_unix_errno(pret);
         }
     }
 
diff --git a/libos/src/fs/shm/fs.c b/libos/src/fs/shm/fs.c
index 1527f16ebc..a4536affbb 100644
--- a/libos/src/fs/shm/fs.c
+++ b/libos/src/fs/shm/fs.c
@@ -57,6 +57,7 @@ static int shm_do_open(struct libos_handle* hdl, struct libos_dentry* dent, mode
     assert(locked(&g_dcache_lock));
 
     char* uri;
+    pal_error_t pret;
     int ret = dentry_uri(dent, type, &uri);
     if (ret < 0)
         return ret;
@@ -66,9 +67,9 @@ static int shm_do_open(struct libos_handle* hdl, struct libos_dentry* dent, mode
     enum pal_create_mode create = LINUX_OPEN_FLAGS_TO_PAL_CREATE(flags);
     pal_stream_options_t options = LINUX_OPEN_FLAGS_TO_PAL_OPTIONS(flags);
     mode_t host_perm = HOST_PERM(perm);
-    ret = PalStreamOpen(uri, access, host_perm, create, options, &palhdl);
-    if (ret < 0) {
-        ret = pal_to_unix_errno(ret);
+    pret = PalStreamOpen(uri, access, host_perm, create, options, &palhdl);
+    if (pret != PAL_ERROR_SUCCESS) {
+        ret = -pal_to_unix_errno(pret);
         goto out;
     }
 
diff --git a/libos/src/ipc/libos_ipc.c b/libos/src/ipc/libos_ipc.c
index 9d8bec7e0b..cd1a6a3164 100644
--- a/libos/src/ipc/libos_ipc.c
+++ b/libos/src/ipc/libos_ipc.c
@@ -108,6 +108,7 @@ static int vmid_to_uri(IDTYPE vmid, char* uri, size_t uri_size) {
 static int ipc_connect(IDTYPE dest, struct libos_ipc_connection** conn_ptr) {
     struct libos_ipc_connection dummy = { .vmid = dest };
     int ret = 0;
+    pal_error_t pret;
 
     lock(&g_ipc_connections_lock);
     struct libos_ipc_connection* conn = node2conn(avl_tree_find(&g_ipc_connections, &dummy.node));
@@ -128,11 +129,11 @@ static int ipc_connect(IDTYPE dest, struct libos_ipc_connection** conn_ptr) {
             BUG();
         }
         do {
-            ret = PalStreamOpen(uri, PAL_ACCESS_RDONLY, /*share_flags=*/0, PAL_CREATE_IGNORED,
-                                /*options=*/0, &conn->handle);
-        } while (ret == -PAL_ERROR_INTERRUPTED);
-        if (ret < 0) {
-            ret = pal_to_unix_errno(ret);
+            pret = PalStreamOpen(uri, PAL_ACCESS_RDONLY, /*share_flags=*/0, PAL_CREATE_IGNORED,
+                                 /*options=*/0, &conn->handle);
+        } while (pret == PAL_ERROR_INTERRUPTED);
+        if (pret != PAL_ERROR_SUCCESS) {
+            ret = -pal_to_unix_errno(pret);
             goto out;
         }
         ret = write_exact(conn->handle, &g_process_ipc_ids.self_vmid,
diff --git a/libos/src/libos_init.c b/libos/src/libos_init.c
index 8d26d4b5ed..bb30b78e68 100644
--- a/libos/src/libos_init.c
+++ b/libos/src/libos_init.c
@@ -540,6 +540,7 @@ int create_pipe(char* name, char* uri, size_t size, PAL_HANDLE* hdl, bool use_vm
     int ret;
     size_t len;
     char pipename[PIPE_URI_SIZE];
+    pal_error_t pret;
     PAL_HANDLE pipe = NULL;
 
     assert(hdl);
@@ -566,14 +567,14 @@ int create_pipe(char* name, char* uri, size_t size, PAL_HANDLE* hdl, bool use_vm
         if (len >= size)
             return -ERANGE;
 
-        ret = PalStreamOpen(uri, PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_IGNORED,
-                            /*options=*/0, &pipe);
-        if (ret < 0) {
-            if (!use_vmid_for_name && ret == -PAL_ERROR_STREAMEXIST) {
+        pret = PalStreamOpen(uri, PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_IGNORED,
+                             /*options=*/0, &pipe);
+        if (pret != PAL_ERROR_SUCCESS) {
+            if (!use_vmid_for_name && pret == PAL_ERROR_STREAMEXIST) {
                 /* tried to create a pipe with random name but it already exists */
                 continue;
             }
-            return pal_to_unix_errno(ret);
+            return -pal_to_unix_errno(pret);
         }
 
         break; /* succeeded in creating the pipe with random/vmid name */
diff --git a/libos/src/libos_pollable_event.c b/libos/src/libos_pollable_event.c
index a5ce2723e0..1f3ba6928e 100644
--- a/libos/src/libos_pollable_event.c
+++ b/libos/src/libos_pollable_event.c
@@ -13,6 +13,7 @@
 int create_pollable_event(struct libos_pollable_event* event) {
     char uri[PIPE_URI_SIZE];
     PAL_HANDLE srv_handle;
+    pal_error_t pret;
     int ret = create_pipe(/*name=*/NULL, uri, sizeof(uri), &srv_handle,
                           /*use_vmid_for_name=*/false);
     if (ret < 0) {
@@ -22,12 +23,12 @@ int create_pollable_event(struct libos_pollable_event* event) {
 
     PAL_HANDLE write_handle;
     do {
-        ret = PalStreamOpen(uri, PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_IGNORED,
-                            PAL_OPTION_NONBLOCK, &write_handle);
-    } while (ret == -PAL_ERROR_INTERRUPTED);
-    if (ret < 0) {
-        log_error("PalStreamOpen failed: %s", pal_strerror(ret));
-        ret = pal_to_unix_errno(ret);
+        pret = PalStreamOpen(uri, PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_IGNORED,
+                             PAL_OPTION_NONBLOCK, &write_handle);
+    } while (pret == PAL_ERROR_INTERRUPTED);
+    if (pret != PAL_ERROR_SUCCESS) {
+        log_error("PalStreamOpen failed: %s", pal_strerror(pret));
+        ret = -pal_to_unix_errno(pret);
         goto out;
     }
 
diff --git a/libos/src/net/unix.c b/libos/src/net/unix.c
index af7a1e1bed..a9eb8d0fd1 100644
--- a/libos/src/net/unix.c
+++ b/libos/src/net/unix.c
@@ -146,10 +146,11 @@ static int bind(struct libos_handle* handle, void* addr, size_t addrlen) {
     unlock(&handle->lock);
 
     PAL_HANDLE pal_handle = NULL;
-    ret = PalStreamOpen(pipe_name, PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_IGNORED, options,
-                        &pal_handle);
-    if (ret < 0) {
-        return (ret == -PAL_ERROR_STREAMEXIST) ? -EADDRINUSE : pal_to_unix_errno(ret);
+    pal_error_t pret;
+    pret = PalStreamOpen(pipe_name, PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_IGNORED, options,
+                         &pal_handle);
+    if (pret != PAL_ERROR_SUCCESS) {
+        return (pret == PAL_ERROR_STREAMEXIST) ? -EADDRINUSE : -pal_to_unix_errno(pret);
     }
 
     __atomic_store_n(&handle->info.sock.pal_handle, pal_handle, __ATOMIC_RELEASE);
@@ -243,10 +244,11 @@ static int connect(struct libos_handle* handle, void* addr, size_t addrlen, bool
     unlock(&handle->lock);
 
     PAL_HANDLE pal_handle = NULL;
-    ret = PalStreamOpen(pipe_name, PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_IGNORED, options,
-                        &pal_handle);
-    if (ret < 0) {
-        return (ret == -PAL_ERROR_CONNFAILED) ? -ENOENT : pal_to_unix_errno(ret);
+    pal_error_t pret;
+    pret = PalStreamOpen(pipe_name, PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_IGNORED,
+                         options, &pal_handle);
+    if (pret != PAL_ERROR_SUCCESS) {
+        return (pret == PAL_ERROR_CONNFAILED) ? -ENOENT : -pal_to_unix_errno(pret);
     }
 
     assert(sock->pal_handle == NULL);
diff --git a/libos/src/sys/libos_eventfd.c b/libos/src/sys/libos_eventfd.c
index f4435460c8..41f7df8d20 100644
--- a/libos/src/sys/libos_eventfd.c
+++ b/libos/src/sys/libos_eventfd.c
@@ -71,18 +71,18 @@ int init_eventfd_mode(void) {
 static int create_eventfd_pal_handle(uint64_t initial_count, int flags,
                                      PAL_HANDLE* out_pal_handle) {
     int ret;
-
+    pal_error_t pret;
     PAL_HANDLE hdl = NULL;
 
     int pal_flags = 0;
     pal_flags |= flags & EFD_NONBLOCK ? PAL_OPTION_NONBLOCK : 0;
     pal_flags |= flags & EFD_SEMAPHORE ? PAL_OPTION_EFD_SEMAPHORE : 0;
 
-    ret = PalStreamOpen(URI_PREFIX_EVENTFD, PAL_ACCESS_RDWR, /*share_flags=*/0,
-                        PAL_CREATE_IGNORED, pal_flags, &hdl);
-    if (ret < 0) {
+    pret = PalStreamOpen(URI_PREFIX_EVENTFD, PAL_ACCESS_RDWR, /*share_flags=*/0,
+                         PAL_CREATE_IGNORED, pal_flags, &hdl);
+    if (pret != PAL_ERROR_SUCCESS) {
         log_error("eventfd: creation failure");
-        return pal_to_unix_errno(ret);
+        return -pal_to_unix_errno(pret);
     }
 
     /* set the initial count */
diff --git a/libos/src/sys/libos_pipe.c b/libos/src/sys/libos_pipe.c
index 33eaf1944e..79ff088317 100644
--- a/libos/src/sys/libos_pipe.c
+++ b/libos/src/sys/libos_pipe.c
@@ -22,6 +22,7 @@
 
 static int create_pipes(struct libos_handle* srv, struct libos_handle* cli, int flags, char* name) {
     int ret = 0;
+    pal_error_t pret;
     char uri[PIPE_URI_SIZE];
 
     PAL_HANDLE hdl0 = NULL; /* server pipe (temporary, waits for connect from hdl2) */
@@ -34,10 +35,10 @@ static int create_pipes(struct libos_handle* srv, struct libos_handle* cli, int
         return ret;
     }
 
-    ret = PalStreamOpen(uri, PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_IGNORED,
-                        LINUX_OPEN_FLAGS_TO_PAL_OPTIONS(flags), &hdl2);
-    if (ret < 0) {
-        ret = pal_to_unix_errno(ret);
+    pret = PalStreamOpen(uri, PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_IGNORED,
+                         LINUX_OPEN_FLAGS_TO_PAL_OPTIONS(flags), &hdl2);
+    if (pret != PAL_ERROR_SUCCESS) {
+        ret = -pal_to_unix_errno(pret);
         log_error("pipe connection failure");
         goto out;
     }
diff --git a/pal/include/pal/pal.h b/pal/include/pal/pal.h
index 259082fb76..a5c9a27cfb 100644
--- a/pal/include/pal/pal.h
+++ b/pal/include/pal/pal.h
@@ -339,7 +339,7 @@ typedef uint32_t pal_stream_options_t; /* bitfield */
  * \param handle[out]  If the resource is successfully opened or created, a PAL handle is returned
  *                     in `*handle` for further access such as reading or writing.
  *
- * \returns 0 on success, negative error code on failure.
+ * \returns PAL_ERROR_SUCCESS on success, error code on failure.
  *
  * Supported URI types:
  * * `%file:...`, `dir:...`: Files or directories on the host file system. If #PAL_CREATE_TRY or
@@ -351,8 +351,9 @@ typedef uint32_t pal_stream_options_t; /* bitfield */
  *   processes. The server side of a pipe can accept any number of connections. If `pipe:` is given
  *   as the URI (i.e., without a name), it will open an anonymous bidirectional pipe.
  */
-int PalStreamOpen(const char* typed_uri, enum pal_access access, pal_share_flags_t share_flags,
-                  enum pal_create_mode create, pal_stream_options_t options, PAL_HANDLE* handle);
+pal_error_t PalStreamOpen(const char* typed_uri, enum pal_access access,
+                          pal_share_flags_t share_flags, enum pal_create_mode create,
+                          pal_stream_options_t options, PAL_HANDLE* handle);
 
 /*!
  * \brief Block until a new connection is accepted and return the PAL handle for the connection.
diff --git a/pal/include/pal_internal.h b/pal/include/pal_internal.h
index e149a9f001..b53aefd93b 100644
--- a/pal/include/pal_internal.h
+++ b/pal/include/pal_internal.h
@@ -40,8 +40,9 @@ struct handle_ops {
     /* 'open' is used by PalStreamOpen. 'handle' is a preallocated handle, 'type' will be a
      * normalized prefix, 'uri' is the remaining string of uri. access, share, create, and options
      * follow the same flags defined for PalStreamOpen in pal.h. */
-    int (*open)(PAL_HANDLE* handle, const char* type, const char* uri, enum pal_access access,
-                pal_share_flags_t share, enum pal_create_mode create, pal_stream_options_t options);
+    pal_error_t (*open)(PAL_HANDLE* handle, const char* type, const char* uri,
+                        enum pal_access access, pal_share_flags_t share,
+                        enum pal_create_mode create, pal_stream_options_t options);
 
     /* 'read' and 'write' is used by PalStreamRead and PalStreamWrite, so they have exactly same
      * prototype as them. */
@@ -167,9 +168,9 @@ int _PalDeviceIoControl(PAL_HANDLE handle, uint32_t cmd, unsigned long arg, int*
 int _PalGetCPUInfo(struct pal_cpu_info* info);
 
 /* PalStream calls */
-int _PalStreamOpen(PAL_HANDLE* handle, const char* uri, enum pal_access access,
-                   pal_share_flags_t share, enum pal_create_mode create,
-                   pal_stream_options_t options);
+pal_error_t _PalStreamOpen(PAL_HANDLE* handle, const char* uri, enum pal_access access,
+                           pal_share_flags_t share, enum pal_create_mode create,
+                           pal_stream_options_t options);
 int _PalStreamDelete(PAL_HANDLE handle, enum pal_delete_mode delete_mode);
 int64_t _PalStreamRead(PAL_HANDLE handle, uint64_t offset, uint64_t count, void* buf);
 int64_t _PalStreamWrite(PAL_HANDLE handle, uint64_t offset, uint64_t count, const void* buf);
diff --git a/pal/regression/Directory.c b/pal/regression/Directory.c
index ca65e4ddec..c9043a0f83 100644
--- a/pal/regression/Directory.c
+++ b/pal/regression/Directory.c
@@ -8,9 +8,10 @@ int main(int argc, char** argv, char** envp) {
     /* test regular directory opening */
 
     PAL_HANDLE dir1 = NULL;
-    int ret = PalStreamOpen("dir:dir_exist.tmp", PAL_ACCESS_RDONLY, /*share_flags=*/0,
-                            PAL_CREATE_NEVER, /*options=*/0, &dir1);
-    if (ret >= 0 && dir1) {
+    int ret;
+    pal_error_t pret = PalStreamOpen("dir:dir_exist.tmp", PAL_ACCESS_RDONLY, /*share_flags=*/0,
+                                     PAL_CREATE_NEVER, /*options=*/0, &dir1);
+    if (pret == PAL_ERROR_SUCCESS && dir1) {
         pal_printf("Directory Open Test 1 OK\n");
 
         PAL_STREAM_ATTR attr1;
@@ -31,17 +32,17 @@ int main(int argc, char** argv, char** envp) {
     }
 
     PAL_HANDLE dir2 = NULL;
-    ret = PalStreamOpen("dir:./dir_exist.tmp", PAL_ACCESS_RDONLY, /*share_flags=*/0,
-                        PAL_CREATE_NEVER, /*options=*/0, &dir2);
-    if (ret >= 0 && dir2) {
+    pret = PalStreamOpen("dir:./dir_exist.tmp", PAL_ACCESS_RDONLY, /*share_flags=*/0,
+                         PAL_CREATE_NEVER, /*options=*/0, &dir2);
+    if (pret == PAL_ERROR_SUCCESS && dir2) {
         pal_printf("Directory Open Test 2 OK\n");
         PalObjectDestroy(dir2);
     }
 
     PAL_HANDLE dir3 = NULL;
-    ret = PalStreamOpen("dir:../regression/dir_exist.tmp", PAL_ACCESS_RDONLY, /*share_flags=*/0,
-                        PAL_CREATE_NEVER, /*options=*/0, &dir3);
-    if (ret >= 0 && dir3) {
+    pret = PalStreamOpen("dir:../regression/dir_exist.tmp", PAL_ACCESS_RDONLY, /*share_flags=*/0,
+                         PAL_CREATE_NEVER, /*options=*/0, &dir3);
+    if (pret == PAL_ERROR_SUCCESS && dir3) {
         pal_printf("Directory Open Test 3 OK\n");
         PalObjectDestroy(dir3);
     }
@@ -55,37 +56,37 @@ int main(int argc, char** argv, char** envp) {
     /* test regular directory creation */
 
     PAL_HANDLE dir4 = NULL;
-    ret = PalStreamOpen("dir:dir_nonexist.tmp", PAL_ACCESS_RDONLY,
-                        PAL_SHARE_OWNER_R | PAL_SHARE_OWNER_W | PAL_SHARE_OWNER_X,
-                        PAL_CREATE_ALWAYS, /*options=*/0, &dir4);
-    if (ret >= 0 && dir4) {
+    pret = PalStreamOpen("dir:dir_nonexist.tmp", PAL_ACCESS_RDONLY,
+                         PAL_SHARE_OWNER_R | PAL_SHARE_OWNER_W | PAL_SHARE_OWNER_X,
+                         PAL_CREATE_ALWAYS, /*options=*/0, &dir4);
+    if (pret == PAL_ERROR_SUCCESS && dir4) {
         pal_printf("Directory Creation Test 1 OK\n");
         PalObjectDestroy(dir4);
     }
 
     PAL_HANDLE dir5 = NULL;
-    ret = PalStreamOpen("dir:dir_nonexist.tmp", PAL_ACCESS_RDONLY,
+    pret = PalStreamOpen("dir:dir_nonexist.tmp", PAL_ACCESS_RDONLY,
                         PAL_SHARE_OWNER_R | PAL_SHARE_OWNER_W | PAL_SHARE_OWNER_X,
                         PAL_CREATE_ALWAYS, /*options=*/0, &dir5);
-    if (ret >= 0) {
+    if (pret == PAL_ERROR_SUCCESS) {
         PalObjectDestroy(dir5);
     } else {
         pal_printf("Directory Creation Test 2 OK\n");
     }
 
     PAL_HANDLE dir6 = NULL;
-    ret = PalStreamOpen("dir:dir_nonexist.tmp", PAL_ACCESS_RDWR,
-                        PAL_SHARE_OWNER_R | PAL_SHARE_OWNER_W, PAL_CREATE_TRY, /*options=*/0,
-                        &dir6);
-    if (ret >= 0 && dir6) {
+    pret = PalStreamOpen("dir:dir_nonexist.tmp", PAL_ACCESS_RDWR,
+                         PAL_SHARE_OWNER_R | PAL_SHARE_OWNER_W, PAL_CREATE_TRY, /*options=*/0,
+                         &dir6);
+    if (pret == PAL_ERROR_SUCCESS && dir6) {
         pal_printf("Directory Creation Test 3 OK\n");
         PalObjectDestroy(dir6);
     }
 
     PAL_HANDLE dir7 = NULL;
-    ret = PalStreamOpen("dir:dir_delete.tmp", PAL_ACCESS_RDONLY, /*share_flags=*/0,
-                        PAL_CREATE_NEVER, /*options=*/0, &dir7);
-    if (ret >= 0 && dir7) {
+    pret = PalStreamOpen("dir:dir_delete.tmp", PAL_ACCESS_RDONLY, /*share_flags=*/0,
+                         PAL_CREATE_NEVER, /*options=*/0, &dir7);
+    if (pret == PAL_ERROR_SUCCESS && dir7) {
         ret = PalStreamDelete(dir7, PAL_DELETE_ALL);
         if (ret < 0) {
             pal_printf("PalStreamDelete failed\n");
@@ -98,7 +99,7 @@ int main(int argc, char** argv, char** envp) {
     ret = PalStreamOpen("dir:dir_rename.tmp", PAL_ACCESS_RDWR,
                         PAL_SHARE_OWNER_R | PAL_SHARE_OWNER_W | PAL_SHARE_OWNER_X,
                         PAL_CREATE_TRY, /*options=*/0, &dir8);
-    if (ret >= 0 && dir8) {
+    if (pret == PAL_ERROR_SUCCESS && dir8) {
         ret = PalStreamChangeName(dir8, "dir:dir_rename_delete.tmp");
         if (ret < 0) {
             pal_printf("PalStreamChangeName failed: %d\n", ret);
diff --git a/pal/regression/File.c b/pal/regression/File.c
index ea3005c2c9..15442dfc80 100644
--- a/pal/regression/File.c
+++ b/pal/regression/File.c
@@ -25,9 +25,11 @@ int main(int argc, char** argv, char** envp) {
     /* test regular file opening */
 
     PAL_HANDLE file1 = NULL;
-    ret = PalStreamOpen("file:File.manifest", PAL_ACCESS_RDWR, /*share_flags=*/0,
+    pal_error_t pret;
+
+    pret = PalStreamOpen("file:File.manifest", PAL_ACCESS_RDWR, /*share_flags=*/0,
                         PAL_CREATE_NEVER, /*options=*/0, &file1);
-    if (ret >= 0 && file1) {
+    if (pret == PAL_ERROR_SUCCESS && file1) {
         pal_printf("File Open Test 1 OK\n");
 
         /* test file read */
@@ -93,17 +95,17 @@ int main(int argc, char** argv, char** envp) {
     }
 
     PAL_HANDLE file2 = NULL;
-    ret = PalStreamOpen("file:File.manifest", PAL_ACCESS_RDWR, /*share_flags=*/0,
+    pret = PalStreamOpen("file:File.manifest", PAL_ACCESS_RDWR, /*share_flags=*/0,
                         PAL_CREATE_NEVER, /*options=*/0, &file2);
-    if (ret >= 0 && file2) {
+    if (pret == PAL_ERROR_SUCCESS && file2) {
         pal_printf("File Open Test 2 OK\n");
         PalObjectDestroy(file2);
     }
 
     PAL_HANDLE file3 = NULL;
-    ret = PalStreamOpen("file:../regression/File.manifest", PAL_ACCESS_RDWR, /*share_flags=*/0,
+    pret = PalStreamOpen("file:../regression/File.manifest", PAL_ACCESS_RDWR, /*share_flags=*/0,
                         PAL_CREATE_NEVER, /*options=*/0, &file3);
-    if (ret >= 0 && file3) {
+    if (pret == PAL_ERROR_SUCCESS && file3) {
         pal_printf("File Open Test 3 OK\n");
         PalObjectDestroy(file3);
     }
@@ -117,27 +119,27 @@ int main(int argc, char** argv, char** envp) {
     /* test regular file creation */
 
     PAL_HANDLE file4 = NULL;
-    ret = PalStreamOpen("file:file_nonexist.tmp", PAL_ACCESS_RDWR,
+    pret = PalStreamOpen("file:file_nonexist.tmp", PAL_ACCESS_RDWR,
                         PAL_SHARE_OWNER_R | PAL_SHARE_OWNER_W, PAL_CREATE_ALWAYS, /*options=*/0,
                         &file4);
-    if (ret >= 0 && file4)
+    if (pret == PAL_ERROR_SUCCESS && file4)
         pal_printf("File Creation Test 1 OK\n");
 
     PAL_HANDLE file5 = NULL;
-    ret = PalStreamOpen("file:file_nonexist.tmp", PAL_ACCESS_RDWR,
+    pret = PalStreamOpen("file:file_nonexist.tmp", PAL_ACCESS_RDWR,
                         PAL_SHARE_OWNER_R | PAL_SHARE_OWNER_W, PAL_CREATE_ALWAYS, /*options=*/0,
                         &file5);
-    if (ret >= 0) {
+    if (pret == PAL_ERROR_SUCCESS) {
         PalObjectDestroy(file5);
     } else {
         pal_printf("File Creation Test 2 OK\n");
     }
 
     PAL_HANDLE file6 = NULL;
-    ret = PalStreamOpen("file:file_nonexist.tmp", PAL_ACCESS_RDWR,
+    pret = PalStreamOpen("file:file_nonexist.tmp", PAL_ACCESS_RDWR,
                         PAL_SHARE_OWNER_R | PAL_SHARE_OWNER_W, PAL_CREATE_TRY, /*options=*/0,
                         &file6);
-    if (ret >= 0 && file6) {
+    if (pret == PAL_ERROR_SUCCESS && file6) {
         pal_printf("File Creation Test 3 OK\n");
         PalObjectDestroy(file6);
     }
@@ -174,9 +176,9 @@ int main(int argc, char** argv, char** envp) {
     }
 
     PAL_HANDLE file7 = NULL;
-    ret = PalStreamOpen("file:file_delete.tmp", PAL_ACCESS_RDONLY, /*share_flags=*/0,
+    pret = PalStreamOpen("file:file_delete.tmp", PAL_ACCESS_RDONLY, /*share_flags=*/0,
                         PAL_CREATE_NEVER, /*options=*/0, &file7);
-    if (ret >= 0 && file7) {
+    if (pret == PAL_ERROR_SUCCESS && file7) {
         ret = PalStreamDelete(file7, PAL_DELETE_ALL);
         if (ret < 0) {
             pal_printf("PalStreamDelete failed\n");
diff --git a/pal/regression/File2.c b/pal/regression/File2.c
index d364b84118..95aa1e07f5 100644
--- a/pal/regression/File2.c
+++ b/pal/regression/File2.c
@@ -9,10 +9,12 @@ int main(int argc, char** argv, char** envp) {
     pal_printf("Enter Main Thread\n");
 
     PAL_HANDLE out = NULL;
-    int ret = PalStreamOpen(FILE_URI, PAL_ACCESS_RDWR, PAL_SHARE_OWNER_W | PAL_SHARE_OWNER_R,
-                            PAL_CREATE_TRY, /*options=*/0, &out);
+    int ret;
+    pal_error_t pret;
 
-    if (ret < 0) {
+    pret = PalStreamOpen(FILE_URI, PAL_ACCESS_RDWR, PAL_SHARE_OWNER_W | PAL_SHARE_OWNER_R,
+                         PAL_CREATE_TRY, /*options=*/0, &out);
+    if (pret != PAL_ERROR_SUCCESS) {
         pal_printf("first PalStreamOpen failed\n");
         return 1;
     }
@@ -27,9 +29,9 @@ int main(int argc, char** argv, char** envp) {
     PalObjectDestroy(out);
 
     PAL_HANDLE in = NULL;
-    ret = PalStreamOpen(FILE_URI, PAL_ACCESS_RDONLY, /*share_flags=*/0, PAL_CREATE_NEVER,
-                        /*options=*/0, &in);
-    if (ret < 0) {
+    pret = PalStreamOpen(FILE_URI, PAL_ACCESS_RDONLY, /*share_flags=*/0, PAL_CREATE_NEVER,
+                         /*options=*/0, &in);
+    if (pret != PAL_ERROR_SUCCESS) {
         pal_printf("third PalStreamOpen failed\n");
         return 1;
     }
@@ -56,10 +58,9 @@ int main(int argc, char** argv, char** envp) {
     }
 
     PAL_HANDLE del = NULL;
-    ret = PalStreamOpen(FILE_URI, PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_NEVER,
-                        /*options=*/0, &del);
-
-    if (ret >= 0) {
+    pret = PalStreamOpen(FILE_URI, PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_NEVER,
+                         /*options=*/0, &del);
+    if (pret == PAL_ERROR_SUCCESS) {
         pal_printf("PalStreamDelete did not actually delete\n");
         return 1;
     }
diff --git a/pal/regression/HelloWorld.c b/pal/regression/HelloWorld.c
index 465c9e74f6..9789deb940 100644
--- a/pal/regression/HelloWorld.c
+++ b/pal/regression/HelloWorld.c
@@ -5,12 +5,14 @@ char str[13] = "Hello World\n";
 
 int main(int argc, char** argv, char** envp) {
     pal_printf("start program: HelloWorld\n");
-
     PAL_HANDLE out = NULL;
-    int ret = PalStreamOpen("console:", PAL_ACCESS_WRONLY, /*share_flags=*/0, PAL_CREATE_NEVER,
+    int ret;
+    pal_error_t pret;
+
+    pret = PalStreamOpen("console:", PAL_ACCESS_WRONLY, /*share_flags=*/0, PAL_CREATE_NEVER,
                             /*options=*/0, &out);
 
-    if (ret < 0) {
+    if (pret != PAL_ERROR_SUCCESS) {
         pal_printf("PalStreamOpen failed\n");
         return 1;
     }
diff --git a/pal/regression/Pie.c b/pal/regression/Pie.c
index 39814f2d4d..e851d63fea 100644
--- a/pal/regression/Pie.c
+++ b/pal/regression/Pie.c
@@ -7,16 +7,16 @@ int main(int argc, char** argv, char** envp) {
     pal_printf("start program: Pie\n");
 
     PAL_HANDLE out = NULL;
-    int ret = PalStreamOpen("console:", PAL_ACCESS_WRONLY, /*share_flags=*/0, PAL_CREATE_NEVER,
-                            /*options=*/0, &out);
+    pal_error_t pret = PalStreamOpen("console:", PAL_ACCESS_WRONLY, /*share_flags=*/0,
+                                     PAL_CREATE_NEVER, /*options=*/0, &out);
 
-    if (ret < 0) {
+    if (pret != PAL_ERROR_SUCCESS) {
         pal_printf("PalStreamOpen failed\n");
         return 1;
     }
 
     size_t bytes = sizeof(str) - 1;
-    ret = PalStreamWrite(out, 0, &bytes, str);
+    int ret = PalStreamWrite(out, 0, &bytes, str);
 
     if (ret < 0 || bytes != sizeof(str) - 1) {
         pal_printf("PalStreamWrite failed\n");
diff --git a/pal/regression/Pipe.c b/pal/regression/Pipe.c
index 9e760b52a1..594412fe90 100644
--- a/pal/regression/Pipe.c
+++ b/pal/regression/Pipe.c
@@ -8,12 +8,13 @@ int main(int argc, char** argv, char** envp) {
     char buffer3[20];
     char buffer4[20];
     int ret;
+    pal_error_t pret;
 
     PAL_HANDLE pipe1 = NULL;
-    ret = PalStreamOpen("pipe.srv:1", PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_IGNORED,
+    pret = PalStreamOpen("pipe.srv:1", PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_IGNORED,
                         /*options=*/0, &pipe1);
 
-    if (ret >= 0 && pipe1) {
+    if (pret == PAL_ERROR_SUCCESS && pipe1) {
         pal_printf("Pipe Creation 1 OK\n");
 
         // DEP 10/24/16: Try to read some attributes of the pipe
@@ -29,10 +30,10 @@ int main(int argc, char** argv, char** envp) {
         // Job for another day...
 
         PAL_HANDLE pipe2 = NULL;
-        ret = PalStreamOpen("pipe:1", PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_IGNORED,
+        pret = PalStreamOpen("pipe:1", PAL_ACCESS_RDWR, /*share_flags=*/0, PAL_CREATE_IGNORED,
                             /*options=*/0, &pipe2);
 
-        if (ret >= 0 && pipe2) {
+        if (pret == PAL_ERROR_SUCCESS && pipe2) {
             PAL_HANDLE pipe3 = NULL;
             ret = PalStreamWaitForClient(pipe1, &pipe3, /*options=*/0);
 
diff --git a/pal/regression/Process4.c b/pal/regression/Process4.c
index 7232349d05..6fad54d0e4 100644
--- a/pal/regression/Process4.c
+++ b/pal/regression/Process4.c
@@ -13,10 +13,10 @@ int main(int argc, char** argv) {
 
     if (argc == 1) {
         PAL_HANDLE pipe_srv = NULL;
-        int ret = PalStreamOpen("pipe.srv:Process4", PAL_ACCESS_RDWR, /*share_flags=*/0,
-                                PAL_CREATE_IGNORED, /*options=*/0, &pipe_srv);
-        if (ret < 0) {
-            pal_printf("PalStreamOpen(\"pipe.srv\", ...) failed: %d\n", ret);
+        pal_error_t pret = PalStreamOpen("pipe.srv:Process4", PAL_ACCESS_RDWR, /*share_flags=*/0,
+                                         PAL_CREATE_IGNORED, /*options=*/0, &pipe_srv);
+        if (pret != PAL_ERROR_SUCCESS) {
+            pal_printf("PalStreamOpen(\"pipe.srv\", ...) failed: %d\n", pret);
             return 1;
         }
 
@@ -31,7 +31,7 @@ int main(int argc, char** argv) {
         const char* newargs[4] = {"Process4", "0", time_arg, NULL};
 
         PAL_HANDLE proc = NULL;
-        ret = PalProcessCreate(newargs, NULL, 0, &proc);
+        int ret = PalProcessCreate(newargs, NULL, 0, &proc);
 
         if (ret < 0)
             pal_printf("Can't create process\n");
@@ -72,10 +72,10 @@ int main(int argc, char** argv) {
             pal_printf("wall time = %ld\n", end - start);
 
             PAL_HANDLE pipe = NULL;
-            int ret = PalStreamOpen("pipe:Process4", PAL_ACCESS_RDWR, /*share_flags=*/0,
-                                    PAL_CREATE_IGNORED, /*options=*/0, &pipe);
-            if (ret < 0) {
-                pal_printf("Failed to open pipe: %d\n", ret);
+            pal_error_t pret = PalStreamOpen("pipe:Process4", PAL_ACCESS_RDWR, /*share_flags=*/0,
+                                             PAL_CREATE_IGNORED, /*options=*/0, &pipe);
+            if (pret != PAL_ERROR_SUCCESS) {
+                pal_printf("Failed to open pipe: %d\n", pret);
                 return 1;
             }
             PalObjectDestroy(pipe);
diff --git a/pal/src/host/linux-sgx/pal_console.c b/pal/src/host/linux-sgx/pal_console.c
index ed89a9624c..d97aabab34 100644
--- a/pal/src/host/linux-sgx/pal_console.c
+++ b/pal/src/host/linux-sgx/pal_console.c
@@ -21,30 +21,30 @@
 #include "pal_linux_error.h"
 #include "perm.h"
 
-static int console_open(PAL_HANDLE* handle, const char* type, const char* uri,
-                        enum pal_access access, pal_share_flags_t share,
-                        enum pal_create_mode create, pal_stream_options_t options) {
+static pal_error_t console_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                                enum pal_access access, pal_share_flags_t share,
+                                enum pal_create_mode create, pal_stream_options_t options) {
     __UNUSED(uri);
     __UNUSED(share);
     __UNUSED(create);
     __UNUSED(options);
 
     if (strcmp(type, URI_TYPE_CONSOLE))
-        return -PAL_ERROR_INVAL;
+        return PAL_ERROR_INVAL;
 
     if (access != PAL_ACCESS_RDONLY && access != PAL_ACCESS_WRONLY)
-        return -PAL_ERROR_INVAL;
+        return PAL_ERROR_INVAL;
 
     PAL_HANDLE hdl = calloc(1, HANDLE_SIZE(console));
     if (!hdl)
-        return -PAL_ERROR_NOMEM;
+        return PAL_ERROR_NOMEM;
 
     hdl->hdr.type = PAL_TYPE_CONSOLE;
     hdl->flags = access == PAL_ACCESS_RDONLY ? PAL_HANDLE_FD_READABLE : PAL_HANDLE_FD_WRITABLE;
     hdl->console.fd = access == PAL_ACCESS_RDONLY ? /*host stdin*/0 : /*host stdout*/1;
 
     *handle = hdl;
-    return 0;
+    return PAL_ERROR_SUCCESS;
 }
 
 static int64_t console_read(PAL_HANDLE handle, uint64_t offset, uint64_t size, void* buffer) {
diff --git a/pal/src/host/linux-sgx/pal_devices.c b/pal/src/host/linux-sgx/pal_devices.c
index ff5f1fb324..f1de95fcea 100644
--- a/pal/src/host/linux-sgx/pal_devices.c
+++ b/pal/src/host/linux-sgx/pal_devices.c
@@ -24,10 +24,11 @@
 #include "toml.h"
 #include "toml_utils.h"
 
-static int dev_open(PAL_HANDLE* handle, const char* type, const char* uri, enum pal_access access,
-                    pal_share_flags_t share, enum pal_create_mode create,
-                    pal_stream_options_t options) {
+static pal_error_t dev_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                            enum pal_access access, pal_share_flags_t share,
+                            enum pal_create_mode create, pal_stream_options_t options) {
     int ret;
+    pal_error_t pret;
     char* normpath = NULL;
 
     assert(create != PAL_CREATE_IGNORED);
@@ -36,11 +37,11 @@ static int dev_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
     assert(WITHIN_MASK(options, PAL_OPTION_MASK));
 
     if (strcmp(type, URI_TYPE_DEV))
-        return -PAL_ERROR_INVAL;
+        return PAL_ERROR_INVAL;
 
     PAL_HANDLE hdl = calloc(1, HANDLE_SIZE(dev));
     if (!hdl)
-        return -PAL_ERROR_NOMEM;
+        return PAL_ERROR_NOMEM;
 
     init_handle_hdr(hdl, PAL_TYPE_DEV);
 
@@ -52,7 +53,7 @@ static int dev_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
                           O_CLOEXEC,
                      share);
     if (ret < 0) {
-        ret = unix_to_pal_error(ret);
+        pret = -unix_to_pal_error(ret);
         goto fail;
     }
     hdl->dev.fd = ret;
@@ -60,13 +61,13 @@ static int dev_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
     size_t normpath_size = strlen(uri) + 1;
     normpath = malloc(normpath_size);
     if (!normpath) {
-        ret = -PAL_ERROR_NOMEM;
+        pret = PAL_ERROR_NOMEM;
         goto fail;
     }
     ret = get_norm_path(uri, normpath, &normpath_size);
     if (ret < 0) {
         log_warning("Could not normalize path (%s): %s", uri, pal_strerror(ret));
-        ret = -PAL_ERROR_DENIED;
+        pret = PAL_ERROR_DENIED;
         goto fail;
     }
     hdl->dev.realpath = normpath;
@@ -76,7 +77,7 @@ static int dev_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
         if (get_file_check_policy() != FILE_CHECK_POLICY_ALLOW_ALL_BUT_LOG) {
             log_warning("Disallowing access to device '%s'; device is not allowed.",
                         hdl->dev.realpath);
-            ret = -PAL_ERROR_DENIED;
+            pret = PAL_ERROR_DENIED;
             goto fail;
         }
         log_warning("Allowing access to unknown device '%s' due to file_check_policy settings.",
@@ -93,11 +94,11 @@ static int dev_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
     }
 
     *handle = hdl;
-    return 0;
+    return PAL_ERROR_SUCCESS;
 fail:
     free(hdl);
     free(normpath);
-    return ret;
+    return pret;
 }
 
 static int64_t dev_read(PAL_HANDLE handle, uint64_t offset, uint64_t size, void* buffer) {
diff --git a/pal/src/host/linux-sgx/pal_eventfd.c b/pal/src/host/linux-sgx/pal_eventfd.c
index 8abf138b1c..d3c0a317c0 100644
--- a/pal/src/host/linux-sgx/pal_eventfd.c
+++ b/pal/src/host/linux-sgx/pal_eventfd.c
@@ -28,26 +28,26 @@ static inline int eventfd_type(int options) {
 
 /* `type` must be eventfd, `uri` & `access` & `share` are unused, `create` holds eventfd's initval,
  * `options` holds eventfd's flags */
-static int eventfd_pal_open(PAL_HANDLE* handle, const char* type, const char* uri,
-                            enum pal_access access, pal_share_flags_t share,
-                            enum pal_create_mode create, pal_stream_options_t options) {
+static pal_error_t eventfd_pal_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                                    enum pal_access access, pal_share_flags_t share,
+                                    enum pal_create_mode create, pal_stream_options_t options) {
     __UNUSED(access);
     __UNUSED(share);
     __UNUSED(create);
     assert(create == PAL_CREATE_IGNORED);
 
     if (strcmp(type, URI_TYPE_EVENTFD) != 0 || *uri != '\0') {
-        return -PAL_ERROR_INVAL;
+        return PAL_ERROR_INVAL;
     }
 
     int fd = ocall_eventfd(eventfd_type(options));
     if (fd < 0)
-        return unix_to_pal_error(fd);
+        return -unix_to_pal_error(fd);
 
     PAL_HANDLE hdl = calloc(1, HANDLE_SIZE(eventfd));
     if (!hdl) {
         ocall_close(fd);
-        return -PAL_ERROR_NOMEM;
+        return PAL_ERROR_NOMEM;
     }
     init_handle_hdr(hdl, PAL_TYPE_EVENTFD);
 
@@ -58,7 +58,7 @@ static int eventfd_pal_open(PAL_HANDLE* handle, const char* type, const char* ur
     hdl->eventfd.nonblocking = !!(options & PAL_OPTION_NONBLOCK);
     *handle = hdl;
 
-    return 0;
+    return PAL_ERROR_SUCCESS;
 }
 
 static int64_t eventfd_pal_read(PAL_HANDLE handle, uint64_t offset, uint64_t len, void* buffer) {
diff --git a/pal/src/host/linux-sgx/pal_files.c b/pal/src/host/linux-sgx/pal_files.c
index 7f6a01b95b..e533b1f382 100644
--- a/pal/src/host/linux-sgx/pal_files.c
+++ b/pal/src/host/linux-sgx/pal_files.c
@@ -60,11 +60,12 @@ void fixup_file_handle_after_deserialization(PAL_HANDLE handle) {
     handle->file.umem = umem;
 }
 
-static int file_open(PAL_HANDLE* handle, const char* type, const char* uri,
-                     enum pal_access pal_access, pal_share_flags_t pal_share,
-                     enum pal_create_mode pal_create, pal_stream_options_t pal_options) {
+static pal_error_t file_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                             enum pal_access pal_access, pal_share_flags_t pal_share,
+                             enum pal_create_mode pal_create, pal_stream_options_t pal_options) {
     assert(pal_create != PAL_CREATE_IGNORED);
     int ret;
+    pal_error_t pret;
     int fd = -1;
     PAL_HANDLE hdl = NULL;
     bool do_create = (pal_create == PAL_CREATE_ALWAYS) || (pal_create == PAL_CREATE_TRY);
@@ -73,25 +74,25 @@ static int file_open(PAL_HANDLE* handle, const char* type, const char* uri,
                 | PAL_OPTION_TO_LINUX_OPEN(pal_options) | O_CLOEXEC;
 
     if (strcmp(type, URI_TYPE_FILE))
-        return -PAL_ERROR_INVAL;
+        return PAL_ERROR_INVAL;
 
     /* normalize uri into normpath */
     size_t normpath_size = strlen(uri) + 1;
     char* normpath = malloc(normpath_size);
     if (!normpath)
-        return -PAL_ERROR_NOMEM;
+        return PAL_ERROR_NOMEM;
 
     if (!get_norm_path(uri, normpath, &normpath_size)) {
         log_warning("Could not normalize path (%s)", uri);
         free(normpath);
-        return -PAL_ERROR_DENIED;
+        return PAL_ERROR_DENIED;
     }
 
     /* create file PAL handle with path string placed at the end of this handle object */
     hdl = calloc(1, HANDLE_SIZE(file));
     if (!hdl) {
         free(normpath);
-        return -PAL_ERROR_NOMEM;
+        return PAL_ERROR_NOMEM;
     }
 
     init_handle_hdr(hdl, PAL_TYPE_FILE);
@@ -107,7 +108,7 @@ static int file_open(PAL_HANDLE* handle, const char* type, const char* uri,
             if (get_file_check_policy() != FILE_CHECK_POLICY_ALLOW_ALL_BUT_LOG) {
                 log_warning("Disallowing access to file '%s'; file is not trusted or allowed.",
                             hdl->file.realpath);
-                ret = -PAL_ERROR_DENIED;
+                pret = PAL_ERROR_DENIED;
                 goto fail;
             }
             log_warning("Allowing access to unknown file '%s' due to file_check_policy settings.",
@@ -119,20 +120,20 @@ static int file_open(PAL_HANDLE* handle, const char* type, const char* uri,
                                || (pal_access == PAL_ACCESS_RDWR)
                                || (pal_access == PAL_ACCESS_WRONLY))) {
         log_error("Disallowing create/write/append to a trusted file '%s'", hdl->file.realpath);
-        ret = -PAL_ERROR_DENIED;
+        pret = PAL_ERROR_DENIED;
         goto fail;
     }
 
     fd = ocall_open(uri, flags, pal_share);
     if (fd < 0) {
-        ret = unix_to_pal_error(fd);
+        pret = -unix_to_pal_error(fd);
         goto fail;
     }
 
     struct stat st;
     ret = ocall_fstat(fd, &st);
     if (ret < 0) {
-        ret = unix_to_pal_error(ret);
+        pret = -unix_to_pal_error(ret);
         goto fail;
     }
 
@@ -142,7 +143,7 @@ static int file_open(PAL_HANDLE* handle, const char* type, const char* uri,
 
     if (!tf) {
         *handle = hdl;
-        return 0;
+        return PAL_ERROR_SUCCESS;
     }
 
     /* at this point, we work with a trusted or allowed file */
@@ -152,8 +153,10 @@ static int file_open(PAL_HANDLE* handle, const char* type, const char* uri,
     uint64_t file_size;
     void* umem;
     ret = load_trusted_or_allowed_file(tf, hdl, do_create, &chunk_hashes, &file_size, &umem);
-    if (ret < 0)
+    if (ret < 0) {
+        pret = -ret;
         goto fail;
+    }
 
     hdl->file.chunk_hashes = chunk_hashes;
     hdl->file.size = file_size;
@@ -161,13 +164,13 @@ static int file_open(PAL_HANDLE* handle, const char* type, const char* uri,
     hdl->file.trusted = !tf->allowed;
 
     *handle = hdl;
-    return 0;
+    return PAL_ERROR_SUCCESS;
 fail:
     if (fd >= 0)
         ocall_close(fd);
     free(hdl->file.realpath);
     free(hdl);
-    return ret;
+    return pret;
 }
 
 static int64_t file_read(PAL_HANDLE handle, uint64_t offset, uint64_t count, void* buffer) {
@@ -462,34 +465,34 @@ static int file_rename(PAL_HANDLE handle, const char* type, const char* uri) {
     return 0;
 }
 
-static int dir_open(PAL_HANDLE* handle, const char* type, const char* uri, enum pal_access access,
-                    pal_share_flags_t share, enum pal_create_mode create,
-                    pal_stream_options_t options) {
+static pal_error_t dir_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                            enum pal_access access, pal_share_flags_t share,
+                            enum pal_create_mode create, pal_stream_options_t options) {
     __UNUSED(access);
 
     if (strcmp(type, URI_TYPE_DIR))
-        return -PAL_ERROR_INVAL;
+        return PAL_ERROR_INVAL;
 
     if (create == PAL_CREATE_TRY || create == PAL_CREATE_ALWAYS) {
         int ret = ocall_mkdir(uri, share);
 
         if (ret < 0) {
             if (ret == -EEXIST && create == PAL_CREATE_ALWAYS)
-                return -PAL_ERROR_STREAMEXIST;
+                return PAL_ERROR_STREAMEXIST;
             if (ret != -EEXIST)
-                return unix_to_pal_error(ret);
+                return -unix_to_pal_error(ret);
             assert(ret == -EEXIST && create == PAL_CREATE_TRY);
         }
     }
 
     int fd = ocall_open(uri, O_DIRECTORY | O_CLOEXEC | PAL_OPTION_TO_LINUX_OPEN(options), 0);
     if (fd < 0)
-        return unix_to_pal_error(fd);
+        return -unix_to_pal_error(fd);
 
     PAL_HANDLE hdl = calloc(1, HANDLE_SIZE(dir));
     if (!hdl) {
         ocall_close(fd);
-        return -PAL_ERROR_NOMEM;
+        return PAL_ERROR_NOMEM;
     }
 
     init_handle_hdr(hdl, PAL_TYPE_DIR);
@@ -501,7 +504,7 @@ static int dir_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
     if (!path) {
         ocall_close(fd);
         free(hdl);
-        return -PAL_ERROR_NOMEM;
+        return PAL_ERROR_NOMEM;
     }
 
     hdl->dir.realpath    = path;
@@ -510,7 +513,7 @@ static int dir_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
     hdl->dir.end         = NULL;
     hdl->dir.endofstream = false;
     *handle              = hdl;
-    return 0;
+    return PAL_ERROR_SUCCESS;
 }
 
 #define DIRBUF_SIZE 1024
diff --git a/pal/src/host/linux-sgx/pal_pipes.c b/pal/src/host/linux-sgx/pal_pipes.c
index 4846e77626..a1dce6c16c 100644
--- a/pal/src/host/linux-sgx/pal_pipes.c
+++ b/pal/src/host/linux-sgx/pal_pipes.c
@@ -315,7 +315,7 @@ static int pipe_connect(PAL_HANDLE* handle, const char* name, pal_stream_options
  * \param      create   Not used.
  * \param      options  May contain PAL_OPTION_NONBLOCK.
  *
- * \returns 0 on success, negative PAL error code otherwise.
+ * \returns PAL_ERROR_SUCCESS on success, PAL error code otherwise.
  *
  * Depending on the combination of `type` and `uri`, the following PAL handles are created:
  *
@@ -326,23 +326,23 @@ static int pipe_connect(PAL_HANDLE* handle, const char* name, pal_stream_options
  * - `type` is URI_TYPE_PIPE: create `pipe` handle (connecting socket) with the name created by
  *                            `get_gramine_unix_socket_addr`.
  */
-static int pipe_open(PAL_HANDLE* handle, const char* type, const char* uri, enum pal_access access,
-                     pal_share_flags_t share, enum pal_create_mode create,
-                     pal_stream_options_t options) {
+static pal_error_t pipe_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                             enum pal_access access, pal_share_flags_t share,
+                             enum pal_create_mode create, pal_stream_options_t options) {
     __UNUSED(access);
     __UNUSED(create);
     assert(create == PAL_CREATE_IGNORED);
 
     if (!WITHIN_MASK(share, PAL_SHARE_MASK) || !WITHIN_MASK(options, PAL_OPTION_MASK))
-        return -PAL_ERROR_INVAL;
+        return PAL_ERROR_INVAL;
 
     if (!strcmp(type, URI_TYPE_PIPE_SRV))
-        return pipe_listen(handle, uri, options);
+        return -pipe_listen(handle, uri, options);
 
     if (!strcmp(type, URI_TYPE_PIPE))
-        return pipe_connect(handle, uri, options);
+        return -pipe_connect(handle, uri, options);
 
-    return -PAL_ERROR_INVAL;
+    return PAL_ERROR_INVAL;
 }
 
 /*!
diff --git a/pal/src/host/linux/pal_console.c b/pal/src/host/linux/pal_console.c
index 646e193c00..c131c30aef 100644
--- a/pal/src/host/linux/pal_console.c
+++ b/pal/src/host/linux/pal_console.c
@@ -20,30 +20,30 @@
 #include "pal_linux_error.h"
 #include "perm.h"
 
-static int console_open(PAL_HANDLE* handle, const char* type, const char* uri,
-                        enum pal_access access, pal_share_flags_t share,
-                        enum pal_create_mode create, pal_stream_options_t options) {
+static pal_error_t console_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                                enum pal_access access, pal_share_flags_t share,
+                                enum pal_create_mode create, pal_stream_options_t options) {
     __UNUSED(uri);
     __UNUSED(share);
     __UNUSED(create);
     __UNUSED(options);
 
     if (strcmp(type, URI_TYPE_CONSOLE))
-        return -PAL_ERROR_INVAL;
+        return PAL_ERROR_INVAL;
 
     if (access != PAL_ACCESS_RDONLY && access != PAL_ACCESS_WRONLY)
-        return -PAL_ERROR_INVAL;
+        return PAL_ERROR_INVAL;
 
     PAL_HANDLE hdl = calloc(1, HANDLE_SIZE(console));
     if (!hdl)
-        return -PAL_ERROR_NOMEM;
+        return PAL_ERROR_NOMEM;
 
     hdl->hdr.type = PAL_TYPE_CONSOLE;
     hdl->flags = access == PAL_ACCESS_RDONLY ? PAL_HANDLE_FD_READABLE : PAL_HANDLE_FD_WRITABLE;
     hdl->console.fd = access == PAL_ACCESS_RDONLY ? /*host stdin*/0 : /*host stdout*/1;
 
     *handle = hdl;
-    return 0;
+    return PAL_ERROR_SUCCESS;
 }
 
 static int64_t console_read(PAL_HANDLE handle, uint64_t offset, uint64_t size, void* buffer) {
diff --git a/pal/src/host/linux/pal_devices.c b/pal/src/host/linux/pal_devices.c
index c8275f031e..306596b37f 100644
--- a/pal/src/host/linux/pal_devices.c
+++ b/pal/src/host/linux/pal_devices.c
@@ -20,10 +20,11 @@
 #include "path_utils.h"
 #include "perm.h"
 
-static int dev_open(PAL_HANDLE* handle, const char* type, const char* uri, enum pal_access access,
-                    pal_share_flags_t share, enum pal_create_mode create,
-                    pal_stream_options_t options) {
+static pal_error_t dev_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                            enum pal_access access, pal_share_flags_t share,
+                            enum pal_create_mode create, pal_stream_options_t options) {
     int ret;
+    pal_error_t pret;
     char* normpath = NULL;
 
     assert(create != PAL_CREATE_IGNORED);
@@ -32,11 +33,11 @@ static int dev_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
     assert(WITHIN_MASK(options, PAL_OPTION_MASK));
 
     if (strcmp(type, URI_TYPE_DEV))
-        return -PAL_ERROR_INVAL;
+        return PAL_ERROR_INVAL;
 
     PAL_HANDLE hdl = calloc(1, HANDLE_SIZE(dev));
     if (!hdl)
-        return -PAL_ERROR_NOMEM;
+        return PAL_ERROR_NOMEM;
 
     init_handle_hdr(hdl, PAL_TYPE_DEV);
 
@@ -48,7 +49,7 @@ static int dev_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
                                 O_CLOEXEC,
                      share);
     if (ret < 0) {
-        ret = unix_to_pal_error(ret);
+        pret = -unix_to_pal_error(ret);
         goto fail;
     }
     hdl->dev.fd = ret;
@@ -56,13 +57,13 @@ static int dev_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
     size_t normpath_size = strlen(uri) + 1;
     normpath = malloc(normpath_size);
     if (!normpath) {
-        ret = -PAL_ERROR_NOMEM;
+        pret = PAL_ERROR_NOMEM;
         goto fail;
     }
     ret = get_norm_path(uri, normpath, &normpath_size);
     if (ret < 0) {
         log_warning("Could not normalize path (%s): %s", uri, pal_strerror(ret));
-        ret = -PAL_ERROR_DENIED;
+        pret = PAL_ERROR_DENIED;
         goto fail;
     }
     hdl->dev.realpath = normpath;
@@ -77,11 +78,11 @@ static int dev_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
     }
 
     *handle = hdl;
-    return 0;
+    return PAL_ERROR_SUCCESS;
 fail:
     free(hdl);
     free(normpath);
-    return ret;
+    return pret;
 }
 
 static int64_t dev_read(PAL_HANDLE handle, uint64_t offset, uint64_t size, void* buffer) {
diff --git a/pal/src/host/linux/pal_eventfd.c b/pal/src/host/linux/pal_eventfd.c
index 00e2f75afd..679d9c661e 100644
--- a/pal/src/host/linux/pal_eventfd.c
+++ b/pal/src/host/linux/pal_eventfd.c
@@ -31,27 +31,27 @@ static inline int eventfd_type(pal_stream_options_t options) {
 
 /* `type` must be eventfd, `uri` & `access` & `share` are unused, `create` holds eventfd's initval,
  * `options` holds eventfd's flags */
-static int eventfd_pal_open(PAL_HANDLE* handle, const char* type, const char* uri,
-                            enum pal_access access, pal_share_flags_t share,
-                            enum pal_create_mode create, pal_stream_options_t options) {
+static pal_error_t eventfd_pal_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                                    enum pal_access access, pal_share_flags_t share,
+                                    enum pal_create_mode create, pal_stream_options_t options) {
     __UNUSED(access);
     __UNUSED(share);
     __UNUSED(create);
     assert(create == PAL_CREATE_IGNORED);
 
     if (strcmp(type, URI_TYPE_EVENTFD) != 0 || *uri != '\0') {
-        return -PAL_ERROR_INVAL;
+        return PAL_ERROR_INVAL;
     }
 
     int fd = DO_SYSCALL(eventfd2, 0, eventfd_type(options));
 
     if (fd < 0)
-        return unix_to_pal_error(fd);
+        return -unix_to_pal_error(fd);
 
     PAL_HANDLE hdl = calloc(1, HANDLE_SIZE(eventfd));
     if (!hdl) {
         DO_SYSCALL(close, fd);
-        return -PAL_ERROR_NOMEM;
+        return PAL_ERROR_NOMEM;
     }
     init_handle_hdr(hdl, PAL_TYPE_EVENTFD);
 
@@ -62,7 +62,7 @@ static int eventfd_pal_open(PAL_HANDLE* handle, const char* type, const char* ur
     hdl->eventfd.nonblocking = !!(options & PAL_OPTION_NONBLOCK);
     *handle = hdl;
 
-    return 0;
+    return PAL_ERROR_SUCCESS;
 }
 
 static int64_t eventfd_pal_read(PAL_HANDLE handle, uint64_t offset, uint64_t len, void* buffer) {
diff --git a/pal/src/host/linux/pal_files.c b/pal/src/host/linux/pal_files.c
index acca5897c9..ad8e365ba7 100644
--- a/pal/src/host/linux/pal_files.c
+++ b/pal/src/host/linux/pal_files.c
@@ -16,16 +16,17 @@
 #include "path_utils.h"
 #include "stat.h"
 
-static int file_open(PAL_HANDLE* handle, const char* type, const char* uri, enum pal_access access,
-                     pal_share_flags_t share, enum pal_create_mode create,
-                     pal_stream_options_t options) {
+static pal_error_t file_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                             enum pal_access access, pal_share_flags_t share,
+                             enum pal_create_mode create, pal_stream_options_t options) {
+    pal_error_t pret;
     int ret;
     int fd = -1;
     PAL_HANDLE hdl = NULL;
     char* path = NULL;
 
     if (strcmp(type, URI_TYPE_FILE))
-        return -PAL_ERROR_INVAL;
+        return PAL_ERROR_INVAL;
 
     assert(WITHIN_MASK(share,   PAL_SHARE_MASK));
     assert(WITHIN_MASK(options, PAL_OPTION_MASK));
@@ -36,14 +37,14 @@ static int file_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
                                 O_CLOEXEC,
                      share);
     if (ret < 0)
-        return unix_to_pal_error(ret);
+        return -unix_to_pal_error(ret);
 
     fd = ret;
 
     size_t uri_size = strlen(uri) + 1;
     hdl = calloc(1, HANDLE_SIZE(file));
     if (!hdl) {
-        ret = -PAL_ERROR_NOMEM;
+        pret = PAL_ERROR_NOMEM;
         goto fail;
     }
 
@@ -53,12 +54,12 @@ static int file_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
 
     path = malloc(uri_size);
     if (!path) {
-        ret = -PAL_ERROR_NOMEM;
+        pret = PAL_ERROR_NOMEM;
         goto fail;
     }
 
     if (!get_norm_path(uri, path, &uri_size)) {
-        ret = -PAL_ERROR_INVAL;
+        pret = PAL_ERROR_INVAL;
         goto fail;
     }
 
@@ -67,20 +68,20 @@ static int file_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
     struct stat st;
     ret = DO_SYSCALL(fstat, hdl->file.fd, &st);
     if (ret < 0) {
-        ret = unix_to_pal_error(ret);
+        pret = -unix_to_pal_error(ret);
         goto fail;
     }
 
     hdl->file.seekable = !S_ISFIFO(st.st_mode);
 
     *handle = hdl;
-    return 0;
+    return PAL_ERROR_SUCCESS;
 fail:
     if (fd >= 0)
         DO_SYSCALL(close, fd);
     free(path);
     free(hdl);
-    return ret;
+    return pret;
 }
 
 static int64_t file_read(PAL_HANDLE handle, uint64_t offset, uint64_t count, void* buffer) {
@@ -193,35 +194,35 @@ static int file_rename(PAL_HANDLE handle, const char* type, const char* uri) {
     return 0;
 }
 
-static int dir_open(PAL_HANDLE* handle, const char* type, const char* uri, enum pal_access access,
-                    pal_share_flags_t share, enum pal_create_mode create,
-                    pal_stream_options_t options) {
+static pal_error_t dir_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                            enum pal_access access, pal_share_flags_t share,
+                            enum pal_create_mode create, pal_stream_options_t options) {
     __UNUSED(access);
     assert(create != PAL_CREATE_IGNORED);
 
     if (strcmp(type, URI_TYPE_DIR))
-        return -PAL_ERROR_INVAL;
+        return PAL_ERROR_INVAL;
 
     if (create == PAL_CREATE_TRY || create == PAL_CREATE_ALWAYS) {
         int ret = DO_SYSCALL(mkdir, uri, share);
 
         if (ret < 0) {
             if (ret == -EEXIST && create == PAL_CREATE_ALWAYS)
-                return -PAL_ERROR_STREAMEXIST;
+                return PAL_ERROR_STREAMEXIST;
             if (ret != -EEXIST)
-                return unix_to_pal_error(ret);
+                return -unix_to_pal_error(ret);
             assert(ret == -EEXIST && create == PAL_CREATE_TRY);
         }
     }
 
     int fd = DO_SYSCALL(open, uri, O_DIRECTORY | PAL_OPTION_TO_LINUX_OPEN(options) | O_CLOEXEC, 0);
     if (fd < 0)
-        return unix_to_pal_error(fd);
+        return -unix_to_pal_error(fd);
 
     PAL_HANDLE hdl = calloc(1, HANDLE_SIZE(dir));
     if (!hdl) {
         DO_SYSCALL(close, fd);
-        return -PAL_ERROR_NOMEM;
+        return PAL_ERROR_NOMEM;
     }
 
     init_handle_hdr(hdl, PAL_TYPE_DIR);
@@ -233,7 +234,7 @@ static int dir_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
     if (!path) {
         DO_SYSCALL(close, hdl->dir.fd);
         free(hdl);
-        return -PAL_ERROR_NOMEM;
+        return PAL_ERROR_NOMEM;
     }
 
     hdl->dir.realpath    = path;
@@ -243,7 +244,7 @@ static int dir_open(PAL_HANDLE* handle, const char* type, const char* uri, enum
     hdl->dir.endofstream = false;
 
     *handle = hdl;
-    return 0;
+    return PAL_ERROR_SUCCESS;
 }
 
 #define DIRBUF_SIZE 1024
diff --git a/pal/src/host/linux/pal_pipes.c b/pal/src/host/linux/pal_pipes.c
index 4c06011df1..36a59bb92b 100644
--- a/pal/src/host/linux/pal_pipes.c
+++ b/pal/src/host/linux/pal_pipes.c
@@ -177,7 +177,7 @@ static int pipe_connect(PAL_HANDLE* handle, const char* name, pal_stream_options
  * \param      create   Not used.
  * \param      options  May contain PAL_OPTION_NONBLOCK.
  *
- * \returns 0 on success, negative PAL error code otherwise.
+ * \returns PAL_ERROR_SUCCESS on success, PAL error code otherwise.
  *
  * Depending on the combination of `type` and `uri`, the following PAL handles are created:
  *
@@ -188,23 +188,23 @@ static int pipe_connect(PAL_HANDLE* handle, const char* name, pal_stream_options
  * - `type` is URI_TYPE_PIPE: create `pipe` handle (connecting socket) with the name created by
  *                            `get_gramine_unix_socket_addr`.
  */
-static int pipe_open(PAL_HANDLE* handle, const char* type, const char* uri, enum pal_access access,
-                     pal_share_flags_t share, enum pal_create_mode create,
-                     pal_stream_options_t options) {
+static pal_error_t pipe_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                             enum pal_access access, pal_share_flags_t share,
+                             enum pal_create_mode create, pal_stream_options_t options) {
     __UNUSED(access);
     __UNUSED(create);
     assert(create == PAL_CREATE_IGNORED);
 
     if (!WITHIN_MASK(share, PAL_SHARE_MASK) || !WITHIN_MASK(options, PAL_OPTION_MASK))
-        return -PAL_ERROR_INVAL;
+        return PAL_ERROR_INVAL;
 
     if (!strcmp(type, URI_TYPE_PIPE_SRV))
-        return pipe_listen(handle, uri, options);
+        return -pipe_listen(handle, uri, options);
 
     if (!strcmp(type, URI_TYPE_PIPE))
-        return pipe_connect(handle, uri, options);
+        return -pipe_connect(handle, uri, options);
 
-    return -PAL_ERROR_INVAL;
+    return PAL_ERROR_INVAL;
 }
 
 /*!
diff --git a/pal/src/host/skeleton/pal_console.c b/pal/src/host/skeleton/pal_console.c
index e08f278fd6..5a755ceb9c 100644
--- a/pal/src/host/skeleton/pal_console.c
+++ b/pal/src/host/skeleton/pal_console.c
@@ -13,10 +13,10 @@
 #include "pal_error.h"
 #include "pal_internal.h"
 
-static int console_open(PAL_HANDLE* handle, const char* type, const char* uri,
-                        enum pal_access access, pal_share_flags_t share,
-                        enum pal_create_mode create, pal_stream_options_t options) {
-    return -PAL_ERROR_NOTIMPLEMENTED;
+static pal_error_t console_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                                enum pal_access access, pal_share_flags_t share,
+                                enum pal_create_mode create, pal_stream_options_t options) {
+    return PAL_ERROR_NOTIMPLEMENTED;
 }
 
 static int64_t console_read(PAL_HANDLE handle, uint64_t offset, uint64_t size, void* buffer) {
diff --git a/pal/src/host/skeleton/pal_devices.c b/pal/src/host/skeleton/pal_devices.c
index 5c5d4fd84c..2f2cd010f8 100644
--- a/pal/src/host/skeleton/pal_devices.c
+++ b/pal/src/host/skeleton/pal_devices.c
@@ -10,10 +10,10 @@
 #include "pal_error.h"
 #include "pal_internal.h"
 
-static int dev_open(PAL_HANDLE* handle, const char* type, const char* uri, enum pal_access access,
-                    pal_share_flags_t share, enum pal_create_mode create,
-                    pal_stream_options_t options) {
-    return -PAL_ERROR_NOTIMPLEMENTED;
+static pal_error_t dev_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                            enum pal_access access, pal_share_flags_t share,
+                            enum pal_create_mode create, pal_stream_options_t options) {
+    return PAL_ERROR_NOTIMPLEMENTED;
 }
 
 static int64_t dev_read(PAL_HANDLE handle, uint64_t offset, uint64_t size, void* buffer) {
diff --git a/pal/src/host/skeleton/pal_eventfd.c b/pal/src/host/skeleton/pal_eventfd.c
index af9aeda635..ca0f768c34 100644
--- a/pal/src/host/skeleton/pal_eventfd.c
+++ b/pal/src/host/skeleton/pal_eventfd.c
@@ -12,10 +12,10 @@
 
 /* `type` must be eventfd, `uri` & `access` & `share` are unused, `create` holds eventfd's initval,
  * `options` holds eventfd's flags */
-static int eventfd_pal_open(PAL_HANDLE* handle, const char* type, const char* uri,
-                            enum pal_access access, pal_share_flags_t share,
-                            enum pal_create_mode create, pal_stream_options_t options) {
-    return -PAL_ERROR_NOTIMPLEMENTED;
+static pal_error_t eventfd_pal_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                                    enum pal_access access, pal_share_flags_t share,
+                                    enum pal_create_mode create, pal_stream_options_t options) {
+    return PAL_ERROR_NOTIMPLEMENTED;
 }
 
 /* offset does not apply here. */
diff --git a/pal/src/host/skeleton/pal_files.c b/pal/src/host/skeleton/pal_files.c
index edec49bb29..874d56e921 100644
--- a/pal/src/host/skeleton/pal_files.c
+++ b/pal/src/host/skeleton/pal_files.c
@@ -10,10 +10,10 @@
 #include "pal_error.h"
 #include "pal_internal.h"
 
-static int file_open(PAL_HANDLE* handle, const char* type, const char* uri, enum pal_access access,
-                     pal_share_flags_t share, enum pal_create_mode create,
-                     pal_stream_options_t options) {
-    return -PAL_ERROR_NOTIMPLEMENTED;
+static pal_error_t file_open(PAL_HANDLE* handle, const char* type, const char* uri, enum pal_access access,
+                             pal_share_flags_t share, enum pal_create_mode create,
+                             pal_stream_options_t options) {
+    return PAL_ERROR_NOTIMPLEMENTED;
 }
 
 static int64_t file_read(PAL_HANDLE handle, uint64_t offset, uint64_t count, void* buffer) {
@@ -57,10 +57,10 @@ static int file_rename(PAL_HANDLE handle, const char* type, const char* uri) {
     return -PAL_ERROR_NOTIMPLEMENTED;
 }
 
-static int dir_open(PAL_HANDLE* handle, const char* type, const char* uri, enum pal_access access,
-                    pal_share_flags_t share, enum pal_create_mode create,
-                    pal_stream_options_t options) {
-    return -PAL_ERROR_NOTIMPLEMENTED;
+static pal_error_t dir_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                            enum pal_access access, pal_share_flags_t share,
+                            enum pal_create_mode create, pal_stream_options_t options) {
+    return PAL_ERROR_NOTIMPLEMENTED;
 }
 
 static int64_t dir_read(PAL_HANDLE handle, uint64_t offset, uint64_t count, void* buf) {
diff --git a/pal/src/host/skeleton/pal_pipes.c b/pal/src/host/skeleton/pal_pipes.c
index 8f77bfee3e..c66c72e9a9 100644
--- a/pal/src/host/skeleton/pal_pipes.c
+++ b/pal/src/host/skeleton/pal_pipes.c
@@ -22,16 +22,16 @@ static int pipe_connect(PAL_HANDLE* handle, const char* name, pal_stream_options
     return -PAL_ERROR_NOTIMPLEMENTED;
 }
 
-static int pipe_open(PAL_HANDLE* handle, const char* type, const char* uri, enum pal_access access,
-                     pal_share_flags_t share, enum pal_create_mode create,
-                     pal_stream_options_t options) {
+static pal_error_t pipe_open(PAL_HANDLE* handle, const char* type, const char* uri,
+                             enum pal_access access, pal_share_flags_t share,
+                             enum pal_create_mode create, pal_stream_options_t options) {
     if (!strcmp(type, URI_TYPE_PIPE_SRV))
-        return pipe_listen(handle, uri, options);
+        return -pipe_listen(handle, uri, options);
 
     if (!strcmp(type, URI_TYPE_PIPE))
-        return pipe_connect(handle, uri, options);
+        return -pipe_connect(handle, uri, options);
 
-    return -PAL_ERROR_INVAL;
+    return PAL_ERROR_INVAL;
 }
 
 /* 'read' operation of pipe stream. offset does not apply here. */
diff --git a/pal/src/pal_main.c b/pal/src/pal_main.c
index 6ce935f1c3..3e14474d63 100644
--- a/pal/src/pal_main.c
+++ b/pal/src/pal_main.c
@@ -311,11 +311,12 @@ static int load_cstring_array(const char* uri, const char*** res) {
     char* buf = NULL;
     const char** array = NULL;
     int ret;
+    pal_error_t pret;
 
-    ret = _PalStreamOpen(&hdl, uri, PAL_ACCESS_RDONLY, /*share_flags=*/0, PAL_CREATE_NEVER,
+    pret = _PalStreamOpen(&hdl, uri, PAL_ACCESS_RDONLY, /*share_flags=*/0, PAL_CREATE_NEVER,
                          /*options=*/0);
-    if (ret < 0)
-        return ret;
+    if (pret != PAL_ERROR_SUCCESS)
+        return -pret;
     ret = _PalStreamAttributesQueryByHandle(hdl, &attr);
     if (ret < 0)
         goto out_fail;
diff --git a/pal/src/pal_rtld.c b/pal/src/pal_rtld.c
index f6f9df5f5b..ac9ba8d7a9 100644
--- a/pal/src/pal_rtld.c
+++ b/pal/src/pal_rtld.c
@@ -643,10 +643,12 @@ int load_entrypoint(const char* uri) {
     PAL_HANDLE handle;
 
     char buf[1024]; /* must be enough to hold ELF header and all its program headers */
-    ret = _PalStreamOpen(&handle, uri, PAL_ACCESS_RDONLY, /*share_flags=*/0, PAL_CREATE_NEVER,
+    pal_error_t pret;
+
+    pret = _PalStreamOpen(&handle, uri, PAL_ACCESS_RDONLY, /*share_flags=*/0, PAL_CREATE_NEVER,
                          /*options=*/0);
-    if (ret < 0)
-        return ret;
+    if (pret != PAL_ERROR_SUCCESS)
+        return -pret;
 
     ret = _PalStreamRead(handle, 0, sizeof(buf), buf);
     if (ret < 0) {
diff --git a/pal/src/pal_streams.c b/pal/src/pal_streams.c
index 10d342db1f..6df470cded 100644
--- a/pal/src/pal_streams.c
+++ b/pal/src/pal_streams.c
@@ -37,8 +37,8 @@ const struct handle_ops* g_pal_handle_ops[PAL_HANDLE_TYPE_BOUND] = {
 };
 
 /* `out_type` is provided by the caller; `out_uri` is the pointer inside `typed_uri` */
-static int split_uri_and_find_ops(const char* typed_uri, char* out_type, const char** out_uri,
-                                  struct handle_ops** out_ops) {
+static pal_error_t split_uri_and_find_ops(const char* typed_uri, char* out_type,
+                                          const char** out_uri, struct handle_ops** out_ops) {
     if (strstartswith(typed_uri, URI_PREFIX_DIR)) {
         memcpy(out_type, URI_TYPE_DIR, sizeof(URI_TYPE_DIR));
         *out_ops = &g_dir_ops;
@@ -69,14 +69,14 @@ static int split_uri_and_find_ops(const char* typed_uri, char* out_type, const c
         *out_uri = typed_uri + URI_PREFIX_PIPE_SRV_LEN;
     } else {
         /* unknown handle type */
-        return -PAL_ERROR_NOTSUPPORT;
+        return PAL_ERROR_NOTSUPPORT;
     }
-    return 0;
+    return PAL_ERROR_SUCCESS;
 }
 
-int _PalStreamOpen(PAL_HANDLE* handle, const char* typed_uri, enum pal_access access,
-                   pal_share_flags_t share, enum pal_create_mode create,
-                   pal_stream_options_t options) {
+pal_error_t _PalStreamOpen(PAL_HANDLE* handle, const char* typed_uri, enum pal_access access,
+                           pal_share_flags_t share, enum pal_create_mode create,
+                           pal_stream_options_t options) {
     assert(WITHIN_MASK(share,   PAL_SHARE_MASK));
     assert(WITHIN_MASK(options, PAL_OPTION_MASK));
 
@@ -84,8 +84,8 @@ int _PalStreamOpen(PAL_HANDLE* handle, const char* typed_uri, enum pal_access ac
     const char* uri;
     struct handle_ops* ops;
 
-    int ret = split_uri_and_find_ops(typed_uri, type, &uri, &ops);
-    if (ret < 0)
+    pal_error_t ret = split_uri_and_find_ops(typed_uri, type, &uri, &ops);
+    if (ret != PAL_ERROR_SUCCESS)
         return ret;
 
     assert(ops && ops->open);
@@ -99,8 +99,9 @@ int _PalStreamOpen(PAL_HANDLE* handle, const char* typed_uri, enum pal_access ac
  * FIXME: Currently `share` must match 1-1 to Linux open() `mode` argument. This isn't really
  * portable and will cause problems when implementing other PALs.
  */
-int PalStreamOpen(const char* typed_uri, enum pal_access access, pal_share_flags_t share,
-                  enum pal_create_mode create, pal_stream_options_t options, PAL_HANDLE* handle) {
+pal_error_t PalStreamOpen(const char* typed_uri, enum pal_access access, pal_share_flags_t share,
+                          enum pal_create_mode create, pal_stream_options_t options,
+                          PAL_HANDLE* handle) {
     *handle = NULL;
     return _PalStreamOpen(handle, typed_uri, access, share, create, options);
 }
@@ -202,9 +203,9 @@ int _PalStreamAttributesQuery(const char* typed_uri, PAL_STREAM_ATTR* attr) {
     const char* uri;
     struct handle_ops* ops;
 
-    int ret = split_uri_and_find_ops(typed_uri, type, &uri, &ops);
-    if (ret < 0)
-        return ret;
+    pal_error_t ret = split_uri_and_find_ops(typed_uri, type, &uri, &ops);
+    if (ret != PAL_ERROR_SUCCESS)
+        return -ret;
 
     if (!ops->attrquery)
         return -PAL_ERROR_NOTSUPPORT;
@@ -376,9 +377,9 @@ int PalStreamChangeName(PAL_HANDLE hdl, const char* typed_uri) {
     const char* uri;
     struct handle_ops* ops;
 
-    int ret = split_uri_and_find_ops(typed_uri, type, &uri, &ops);
-    if (ret < 0)
-        return ret;
+    pal_error_t ret = split_uri_and_find_ops(typed_uri, type, &uri, &ops);
+    if (ret != PAL_ERROR_SUCCESS)
+        return -ret;
 
     const struct handle_ops* hops = HANDLE_OPS(hdl);
     if (!hops || !hops->rename || hops != ops)