# memfd_create: special !memfd:** path

1 ^allow/create\+!memfd:\*\*$
# no real file operations
0 ^allow/cnet
0 ^allow/bnet
0 ^allow/write\+/

# Landlock: memfd has no filesystem path, no lock/create for it
1 ^sandbox/lock:on$
0 ^allow/lock/create\+!memfd
0 ^allow/lock/write
