# mv: cpath alias (rename) on CWD glob

1 ^allow/exec\+.+/(mv|busybox|coreutils)$
1 ^allow/.*(cpath|create|rename).+\*\*\*$
# no symlink/net caps from mv
0 ^allow/symlink
0 ^allow/cnet

# Landlock: mv rename + write consolidated
1 ^sandbox/lock:on$
1 ^allow/lock/read,exec\+.+/(mv|busybox|coreutils)$
1 ^allow/lock/(?=.*cpath)[a-z,]+\+.+$
