# dd: read /dev/zero, wpath /dev/null

1 ^allow/exec\+.+/(dd|busybox|coreutils)$
1 ^allow/read\+/dev/zero$
1 ^allow/wpath\+/dev/null$
# tmpfs for /dev/zero
1 ^allow/fs\+.*tmpfs
0 ^allow/cnet

# Landlock: dd read+write on device nodes
1 ^sandbox/lock:on$
1 ^allow/lock/read,exec\+/.+/(dd|busybox|coreutils)$
1 ^allow/lock/read\+/dev/zero$
1 ^allow/lock/wpath\+/dev/null$
