# /dev/ptmx: read+write tracked directly, tmpfs

1 ^allow/read,write\+/dev/ptmx$
1 ^allow/fs\+.*tmpfs

# Landlock: /dev/ptmx gets lock/wpath (file-level device)
1 ^sandbox/lock:on$
1 ^allow/lock/wpath.*\+/dev/ptmx$

0 ^allow/cnet
