# read-only: must NOT have any mutating/net caps

1 ^allow/read\+/etc/hostname$
0 ^allow/write
0 ^allow/wpath
0 ^allow/cpath
0 ^allow/dpath
0 ^allow/spath
0 ^allow/tpath
0 ^allow/fown
0 ^allow/fattr
0 ^allow/cnet
0 ^allow/bnet
0 ^allow/snet
0 ^allow/rename
0 ^allow/symlink
0 ^allow/mkdir
0 ^allow/delete
0 ^allow/truncate
0 ^allow/chmod
0 ^allow/create
0 ^allow/utime
0 ^allow/chown
0 ^allow/chgrp

# Landlock: read-only: no mutating lock rules
1 ^sandbox/lock:on$
1 ^allow/lock/read\+/etc/hostname$
0 ^allow/lock/write
0 ^allow/lock/truncate
0 ^allow/lock/wpath
0 ^allow/lock/create
0 ^allow/lock/delete
0 ^allow/lock/rename
0 ^allow/lock/bind
0 ^allow/lock/connect
0 ^allow/lock/readdir
