diff --git a/pkg/lisafs/handlers.go b/pkg/lisafs/handlers.go
index 3c61a8671..b24b399b2 100644
--- a/pkg/lisafs/handlers.go
+++ b/pkg/lisafs/handlers.go
@@ -524,7 +524,7 @@ func OpenAtHandler(c *Connection, comm Communicator, payloadLen uint32) (uint32,
 		hostOpenFD int
 	)
 	if err := fd.safelyRead(func() error {
-		if fd.node.isDeleted() || !p9.CanOpen(p9.FileMode(fd.ftype)) {
+		if fd.node.isDeleted() || fd.IsSymlink() {
 			return unix.EINVAL
 		}
 		openFD, hostOpenFD, err = fd.impl.Open(req.Flags)
diff --git a/pkg/sentry/fsimpl/gofer/gofer.go b/pkg/sentry/fsimpl/gofer/gofer.go
index db0d34cdd..c6df8fccd 100644
--- a/pkg/sentry/fsimpl/gofer/gofer.go
+++ b/pkg/sentry/fsimpl/gofer/gofer.go
@@ -1628,7 +1628,7 @@ func (d *dentry) setStat(ctx context.Context, creds *auth.Credentials, opts *vfs
 // - d.isDir().
 // - fs.opts.lisaEnabled.
 func (d *dentry) mknodLisaLocked(ctx context.Context, name string, creds *auth.Credentials, opts vfs.MknodOptions, ds **[]*dentry) error {
-	if opts.Endpoint == nil {
+	if _, ok := opts.Endpoint.(transport.HostBoundEndpoint); !ok {
 		childInode, err := d.controlFDLisa.MknodAt(ctx, name, opts.Mode, lisafs.UID(creds.EffectiveKUID), lisafs.GID(creds.EffectiveKGID), opts.DevMinor, opts.DevMajor)
 		if err != nil {
 			return err
diff --git a/runsc/fsgofer/lisafs.go b/runsc/fsgofer/lisafs.go
index 77a38a14b..cba36f220 100644
--- a/runsc/fsgofer/lisafs.go
+++ b/runsc/fsgofer/lisafs.go
@@ -756,7 +756,7 @@ func (fd *controlFDLisa) BindAt(name string, sockType uint32, mode linux.FileMod
 	}
 	cu.Release()
 
-	socketControlFD := newControlFDLisa(sockFD, fd, socketPath, linux.ModeSocket)
+	socketControlFD := newControlFDLisa(sockFD, fd, name, linux.ModeSocket)
 	boundSocketFD := &boundSocketFDLisa{
 		sock: os.NewFile(uintptr(sockFD), socketPath),
 	}