# /dev/random + /dev/urandom: separate read rules, tmpfs

1 ^allow/read\+/dev/urandom$
1 ^allow/read\+/dev/random$
1 ^allow/fs\+.*tmpfs
0 ^allow/write
0 ^allow/cnet

# Landlock: separate lock/read for each device file
1 ^sandbox/lock:on$
1 ^allow/lock/read\+/dev/urandom$
1 ^allow/lock/read\+/dev/random$
0 ^allow/lock/write
