# xattr: setxattr maps to chattr cap

1 ^allow/.+chattr.+\*\*\*$
# no fattr (needs chmod+chattr+utime, only chattr here)
0 ^allow/fattr

# Landlock: chattr has no Landlock equivalent
1 ^sandbox/lock:on$
0 ^allow/lock/chattr
# write from the temp file still produces lock/wpath
1 ^allow/lock/wpath

0 ^allow/cnet
