diff --git a/cfg.mk b/cfg.mk
index c3d18279cefefc543c8150542e2f6bab19959c3e..6bebd0ad9f91df7addebaefd6fa7a495cbe2eb56 100644
--- a/cfg.mk
+++ b/cfg.mk
@@ -462,6 +462,13 @@ sc_prohibit_ctype_h:
 	halt='use c-ctype.h instead of ctype.h' \
 	  $(_sc_search_regexp)
 
+# We have our own wrapper for mocking purposes
+sc_prohibit_canonicalize_file_name:
+	@prohibit='\<canonicalize_file_name\(' \
+	exclude='exempt from syntax-check' \
+	halt='use virFileCanonicalizePath() instead of canonicalize_file_name()' \
+	  $(_sc_search_regexp)
+
 # Insist on correct types for [pug]id.
 sc_correct_id_types:
 	@prohibit='\<(int|long) *[pug]id\>' \
@@ -1208,6 +1215,9 @@ exclude_file_name_regexp--sc_prohibit_nonreentrant = \
 exclude_file_name_regexp--sc_prohibit_select = \
 	^cfg\.mk$$
 
+exclude_file_name_regexp--sc_prohibit_canonicalize_file_name = \
+  ^cfg\.mk$$
+
 exclude_file_name_regexp--sc_prohibit_raw_allocation = \
   ^(docs/hacking\.html\.in|src/util/viralloc\.[ch]|examples/.*|tests/(securityselinuxhelper|(vircgroup|nss)mock|commandhelper)\.c|tools/wireshark/src/packet-libvirt\.c)$$
 
diff --git a/src/util/virfile.c b/src/util/virfile.c
index 41dda410cbac0c591a99bfb405627aa34f8ab14f..40f106d01d35522ac2772e4c6f4cd54783983361 100644
--- a/src/util/virfile.c
+++ b/src/util/virfile.c
@@ -3309,7 +3309,7 @@ virFileSanitizePath(const char *path)
 char *
 virFileCanonicalizePath(const char *path)
 {
-    return canonicalize_file_name(path);
+    return canonicalize_file_name(path); /* exempt from syntax-check */
 }
 
 /**