# create+delete+rename -> cpath

1 ^allow/.*(cpath|create|delete|rename)
0 ^allow/cnet
0 ^allow/bnet

# Landlock: cpath consolidated into parent
1 ^sandbox/lock:on$
1 ^allow/lock/(?=.*cpath)(?=.*read)[a-z,]+\+.+$
1 ^allow/lock/(?=.*wpath)(?=.*read)[a-z,]+\+.+/target/[a-z]+$
# no file-level cpath (merged into consolidated parent)
0 ^allow/lock/cpath\+.+XXXXXX
