AIKIDO-2026-912985

TL;DR

The Linux Landlock sandbox determined a path's file type from a stat() call on the path string and then applied access rules to that path in a separate step. Because the check and the use are not bound to the same inode, a local process can replace a file with a directory between the two steps and be granted unintended recursive directory permissions. This lets code running under the sandbox widen its own filesystem access and weaken the isolation the sandbox is meant to enforce. The fix opens each path once with O_PATH to derive the file type and rights from a stable descriptor and rejects non-socket nodes for unix-socket capabilities.