# TCP connect -> exact cnet rule

1 ^allow/cnet\+127\.0\.0\.1!1$
# socat uses unnamed socket internally
1 ^allow/bnet\+!unnamed$
# socat binary in force
1 ^force\+.+socat
# no mutating fs caps
0 ^allow/rename
0 ^allow/mkdir
0 ^allow/delete
0 ^allow/symlink

# Landlock: TCP connect produces lock/connect port rule
1 ^sandbox/lock:on$
1 ^allow/lock/connect\+1$
# connect-only, no bind ports
0 ^allow/lock/bind\+[0-9]
