# cp: exec cp, write/create on CWD glob

1 ^allow/exec\+.+/(cp|busybox|coreutils)$
1 ^allow/.+(write|create).+\*\*\*$
0 ^allow/cnet
0 ^allow/bnet

# Landlock: cp with exec, wpath consolidated
1 ^sandbox/lock:on$
1 ^allow/lock/read,exec\+(/usr)?/bin/(cp|busybox|coreutils)$
1 ^allow/lock/.*exec.*\+.+$
