# write+truncate on CWD-local temp -> wpath on *** glob

# pandora merges write+truncate into wpath alias
1 ^allow/(wpath|write).+\*\*\*$
0 ^allow/cnet
0 ^allow/bnet

# Landlock: wpath on target dir, exec consolidated into parent
1 ^sandbox/lock:on$
1 ^allow/lock/read,exec.*\+.+$
1 ^allow/lock/(?=.*wpath)(?=.*read)[a-z,]+\+.+/target/[a-z]+$
# no standalone create,delete (merged into consolidated parent)
0 ^allow/lock/bind
0 ^allow/lock/connect
