# /proc/pid/fd + /proc/pid/ns: readdir fd, read ns

1 ^allow/readdir\+/proc/self/fd$
1 ^allow/read\+/proc/self/ns/pid$
1 ^allow/fs\+.*nsfs
1 ^allow/fs\+.*proc
0 ^allow/write

# Landlock: proc readdir is dir-only, nsfs promoted to parent dir
1 ^sandbox/lock:on$
1 ^allow/lock/readdir\+/proc/self$
1 ^allow/lock/read\+/proc/self/ns$

0 ^allow/cnet
