# epoll: opens /dev/null, adds tmpfs

1 ^allow/read\+/dev/null$
1 ^allow/fs\+.*tmpfs
0 ^allow/write

# Landlock: epoll opens /dev/null, not the epoll itself
1 ^sandbox/lock:on$
0 ^allow/lock/write

0 ^allow/cnet
