# read+readdir -> rpath alias

# /etc has both read (via child files) and readdir -> rpath
1 ^allow/readdir\+/etc$
1 ^allow/read\+/etc/hostname$
0 ^allow/write
0 ^allow/cnet

# Landlock: read+readdir, file/dir category separation
1 ^sandbox/lock:on$
# read is file-only: lock/read on the file itself
1 ^allow/lock/read\+/etc/hostname$
# readdir is dir-only: lock/readdir on parent of /etc
1 ^allow/lock/readdir\+/$
# readdir must not appear on the file path
0 ^allow/lock/readdir\+/etc/hostname
0 ^allow/lock/write
0 ^allow/lock/truncate
