diff --git a/runsc/boot/filter/config.go b/runsc/boot/filter/config.go
index e138ef5b0..1e97f20e4 100644
--- a/runsc/boot/filter/config.go
+++ b/runsc/boot/filter/config.go
@@ -416,7 +416,7 @@ func hostFilesystemFilters() seccomp.SyscallRules {
 			{
 				validFDCheck,
 				seccomp.MatchAny{},
-				seccomp.MatchAny{},
+				seccomp.MaskedEqual(unix.O_NOFOLLOW, unix.O_NOFOLLOW),
 				seccomp.MatchAny{},
 			},
 		},