# nftw(3) /proc with PANDORA_LIMIT=0

# /proc top-level
1 ^allow/readdir\+/proc$

# /proc/self subtree
1 ^allow/readdir\+/proc/self$
1 ^allow/readdir\+/proc/self/attr$
1 ^allow/readdir\+/proc/self/fd$
1 ^allow/readdir\+/proc/self/fdinfo$
1 ^allow/readdir\+/proc/self/net$
1 ^allow/readdir\+/proc/self/ns$
1 ^allow/readdir\+/proc/self/task$

# /proc/self/task/tid subtree (TID globbed as [0-9]* by smart glob)
1 ^allow/readdir\+/proc/self/task/\[0-9\]\*
1 ^allow/readdir\+/proc/self/task/\[0-9\]\*/fd
1 ^allow/readdir\+/proc/self/task/\[0-9\]\*/ns

# /proc/sys subtree
1 ^allow/readdir\+/proc/sys$
1 ^allow/readdir\+/proc/sys/kernel$
1 ^allow/readdir\+/proc/sys/net$
1 ^allow/readdir\+/proc/sys/fs$

# /proc/bus /proc/fs /proc/tty
1 ^allow/readdir\+/proc/bus$
1 ^allow/readdir\+/proc/fs$
1 ^allow/readdir\+/proc/tty$

# No network or write rules
0 ^allow/cnet
0 ^allow/bnet
0 ^allow/snet

# Landlock: nftw /proc produces many lock/readdir entries
1 ^sandbox/lock:on$
1 ^allow/lock/readdir\+/proc$
1 ^allow/lock/readdir\+/proc/self$
0 ^allow/lock/write

0 ^allow/write
