# fork: child read visible in parent profile

1 ^allow/read\+/etc/hosts$
# both parent and child share the CWD exec glob
1 ^allow/exec\+.+\*\*\*$
1 ^sandbox/force:on$
0 ^allow/write
0 ^allow/cnet

# Landlock: child reads visible in lock rules
1 ^sandbox/lock:on$
1 ^allow/lock/read\+/etc/hosts$
0 ^allow/lock/write
