diff --git a/changes/bug25440 b/changes/bug25440
new file mode 100644
index 0000000000000000000000000000000000000000..f8d9dd4fabdf6871f440e6ec8f01178595373fa9
--- /dev/null
+++ b/changes/bug25440
@@ -0,0 +1,5 @@
+  o Minor bugfixes (linux seccomp2 sandbox):
+    - Fix a bug in out sandboxing rules for the openat() syscall.
+      Previously, no openat() call would be permitted, which would break
+      filesystem operations on recent glibc versions. Fixes bug 25440;
+      bugfix on 0.2.9.15. Diagnosis and patch from Daniel Pinto.
diff --git a/src/common/sandbox.c b/src/common/sandbox.c
index 97acf894f3ff5c5e4071fbf018dfe54de0b85721..e311ffaa86dd60f0eb8d9d4f08cd2b35f9253887 100644
--- a/src/common/sandbox.c
+++ b/src/common/sandbox.c
@@ -449,7 +449,7 @@ allow_file_open(scmp_filter_ctx ctx, int use_openat, const char *file)
 {
   if (use_openat) {
     return seccomp_rule_add_2(ctx, SCMP_ACT_ALLOW, SCMP_SYS(openat),
-                              SCMP_CMP_STR(0, SCMP_CMP_EQ, AT_FDCWD),
+                              SCMP_CMP(0, SCMP_CMP_EQ, (unsigned int)AT_FDCWD),
                               SCMP_CMP_STR(1, SCMP_CMP_EQ, file));
   } else {
     return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(open),