# /proc/self/fd/N: open resolves symlink, fd path invisible

1 ^allow/read\+/etc/hostname$
0 ^allow/read\+/proc/self/fd

# Landlock: /proc/self/fd paths invisible, only resolved file tracked
1 ^sandbox/lock:on$
0 ^allow/lock/read\+/proc/self/fd

0 ^allow/write
