# read: exact allow/read+PATH, no alias

1 ^allow/read\+/etc/hostname$
0 ^allow/rpath\+/etc/hostname
0 ^allow/write
0 ^allow/wpath
0 ^allow/cnet
0 ^allow/bnet

# Landlock: read single file
1 ^sandbox/lock:on$
1 ^allow/lock/read\+/etc/hostname$
# file-level path, not collapsed to parent /etc
0 ^allow/lock/read\+/etc$
0 ^allow/lock/write
0 ^allow/lock/truncate
0 ^allow/lock/readdir
