test/sandbox: migrate tests

This significantly improves performance, removing overhead of nix,
python, and virtualisation. Running this in an unprivileged container
required patching the kernel, but since special runner setup was already
needed, that was an acceptable tradeoff.

Signed-off-by: Ophestra <cat@gensokyo.uk>

7 files changed, 0 insertions, 1679 deletions

diff --git a/test/sandbox/case/default.nix b/test/sandbox/case/default.nix
deleted file mode 100644
index 337f4bf2..00000000
--- a/test/sandbox/case/default.nix
+++ /dev/null
@@ -1,97 +0,0 @@
-system: lib: testProgram:
-let
-  fs = mode: dir: data: {
-    mode = lib.fromHexString mode;
-    inherit
-      dir
-      data
-      ;
-  };
-
-  ignore = "//ignore";
-
-  ent = root: target: vfs_optstr: fstype: source: fs_optstr: {
-    id = -1;
-    parent = -1;
-    inherit
-      root
-      target
-      vfs_optstr
-      fstype
-      source
-      fs_optstr
-      ;
-  };
-
-  importTestCase =
-    path:
-    import path {
-      inherit
-        fs
-        ent
-        ignore
-        system
-        ;
-    };
-
-  callTestCase =
-    path: identity:
-    let
-      tc = importTestCase path;
-    in
-    {
-      name = "check-sandbox-${tc.name}";
-      inherit identity;
-      verbose = true;
-      inherit (tc)
-        tty
-        device
-        mapRealUid
-        useCommonPaths
-        userns
-        hostAbstract
-        shareRuntime
-        shareTmpdir
-        ;
-      enablements = {
-        inherit (tc) x11;
-      };
-      share = testProgram;
-      packages = [ ];
-      path = "${testProgram}/bin/hakurei-test";
-      args = [
-        "hakurei-test"
-        "-p"
-        "/var/tmp/.hakurei-check-ok.${toString identity}"
-        "-t"
-        (toString (builtins.toFile "hakurei-${tc.name}-want.json" (builtins.toJSON tc.want)))
-        "-s"
-        tc.expectedFilter.${system}
-      ];
-
-      extraPaths =
-        if tc.useCommonPaths then
-          [ ]
-        else
-          [
-            {
-              type = "bind";
-              src = "/var/tmp";
-              write = true;
-            }
-          ];
-    };
-
-  testCaseName = name: "cat.gensokyo.hakurei.test." + name;
-in
-{
-  apps = {
-    ${testCaseName "preset"} = callTestCase ./preset.nix 1;
-    ${testCaseName "tty"} = callTestCase ./tty.nix 2;
-    ${testCaseName "mapuid"} = callTestCase ./mapuid.nix 3;
-    ${testCaseName "device"} = callTestCase ./device.nix 4;
-    ${testCaseName "pdlike"} = callTestCase ./pdlike.nix 5;
-  };
-
-  pd = importTestCase ./pd.nix;
-}
diff --git a/test/sandbox/case/device.nix b/test/sandbox/case/device.nix
deleted file mode 100644
index 889e0a06..00000000
--- a/test/sandbox/case/device.nix
+++ /dev/null
@@ -1,255 +0,0 @@
-{
-  fs,
-  ent,
-  ignore,
-  system,
-}:
-let
-  extraPaths = {
-    x86_64-linux = {
-      fd = "fd0";
-      sr = {
-        sr0 = fs "80001ff" null null;
-      };
-    };
-    aarch64-linux = {
-      fd = "mtdblock0";
-      sr = { };
-    };
-  };
-in
-{
-  name = "device";
-  tty = false;
-  device = true;
-  mapRealUid = false;
-  useCommonPaths = true;
-  userns = false;
-  x11 = true;
-  hostAbstract = false;
-  shareRuntime = false;
-  shareTmpdir = true;
-
-  # 0, PresetStrict
-  expectedFilter = {
-    x86_64-linux = "e880298df2bd6751d0040fc21bc0ed4c00f95dc0d7ba506c244d8b8cf6866dba8ef4a33296f287b66cccc1d78e97026597f84cc7dec1573e148960fbd35cd735";
-    aarch64-linux = "79318538a3dc851314b6bd96f10d5861acb2aa7e13cb8de0619d0f6a76709d67f01ef3fd67e195862b02f9711e5b769bc4d1eb4fc0dfc41a723c89c968a93297";
-  };
-
-  want = {
-    env = [
-      "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/65534/bus"
-      "DISPLAY=unix:/tmp/.X11-unix/X0"
-      "HOME=/var/lib/hakurei/u0/a4"
-      "SHELL=/run/current-system/sw/bin/bash"
-      "TERM=linux"
-      "USER=u0_a4"
-      "WAYLAND_DISPLAY=wayland-0"
-      "XDG_RUNTIME_DIR=/run/user/65534"
-      "XDG_SESSION_CLASS=user"
-      "XDG_SESSION_TYPE=wayland"
-      "PULSE_SERVER=unix:/run/user/65534/pulse/native"
-    ];
-
-    fs = fs "dead" {
-      ".hakurei" = fs "800001ed" {
-        ".ro-store" = fs "801001fd" null null;
-        store = fs "800001ff" null null;
-      } null;
-      bin = fs "800001ed" { sh = fs "80001ff" null null; } null;
-      dev = fs "800001ed" null null;
-      etc = fs "800001ed" {
-        ".clean" = fs "80001ff" null null;
-        ".host" = fs "800001c0" null null;
-        ".updated" = fs "80001ff" null null;
-        "NIXOS" = fs "80001ff" null null;
-        "X11" = fs "80001ff" null null;
-        "alsa" = fs "80001ff" null null;
-        "bash_logout" = fs "80001ff" null null;
-        "bashrc" = fs "80001ff" null null;
-        "binfmt.d" = fs "80001ff" null null;
-        "dbus-1" = fs "80001ff" null null;
-        "default" = fs "80001ff" null null;
-        "dhcpcd.exit-hook" = fs "80001ff" null null;
-        "environment.d" = fs "80001ff" null null;
-        "fonts" = fs "80001ff" null null;
-        "fstab" = fs "80001ff" null null;
-        "hsurc" = fs "80001ff" null null;
-        "fuse.conf" = fs "80001ff" null null;
-        "gai.conf" = fs "80001ff" null null;
-        "group" = fs "180" null "hakurei:x:65534:\n";
-        "host.conf" = fs "80001ff" null null;
-        "hostname" = fs "80001ff" null null;
-        "hosts" = fs "80001ff" null null;
-        "inputrc" = fs "80001ff" null null;
-        "issue" = fs "80001ff" null null;
-        "kbd" = fs "80001ff" null null;
-        "locale.conf" = fs "80001ff" null null;
-        "login.defs" = fs "80001ff" null null;
-        "lsb-release" = fs "80001ff" null null;
-        "lvm" = fs "80001ff" null null;
-        "machine-id" = fs "80001ff" null null;
-        "man_db.conf" = fs "80001ff" null null;
-        "modprobe.d" = fs "80001ff" null null;
-        "modules-load.d" = fs "80001ff" null null;
-        "mtab" = fs "80001ff" null null;
-        "nanorc" = fs "80001ff" null null;
-        "netgroup" = fs "80001ff" null null;
-        "nix" = fs "80001ff" null null;
-        "nixos" = fs "80001ff" null null;
-        "nscd.conf" = fs "80001ff" null null;
-        "nsswitch.conf" = fs "80001ff" null null;
-        "os-release" = fs "80001ff" null null;
-        "pam" = fs "80001ff" null null;
-        "pam.d" = fs "80001ff" null null;
-        "passwd" = fs "180" null "u0_a4:x:65534:65534:Hakurei:/var/lib/hakurei/u0/a4:/run/current-system/sw/bin/bash\n";
-        "pipewire" = fs "80001ff" null null;
-        "pki" = fs "80001ff" null null;
-        "polkit-1" = fs "80001ff" null null;
-        "profile" = fs "80001ff" null null;
-        "protocols" = fs "80001ff" null null;
-        "resolv.conf" = fs "80001ff" null null;
-        "resolvconf.conf" = fs "80001ff" null null;
-        "rpc" = fs "80001ff" null null;
-        "services" = fs "80001ff" null null;
-        "set-environment" = fs "80001ff" null null;
-        "shadow" = fs "80001ff" null null;
-        "shells" = fs "80001ff" null null;
-        "speech-dispatcher" = fs "80001ff" null null;
-        "ssh" = fs "80001ff" null null;
-        "ssl" = fs "80001ff" null null;
-        "static" = fs "80001ff" null null;
-        "subgid" = fs "80001ff" null null;
-        "subuid" = fs "80001ff" null null;
-        "sudoers" = fs "80001ff" null null;
-        "sway" = fs "80001ff" null null;
-        "sysctl.d" = fs "80001ff" null null;
-        "systemd" = fs "80001ff" null null;
-        "terminfo" = fs "80001ff" null null;
-        "tmpfiles.d" = fs "80001ff" null null;
-        "udev" = fs "80001ff" null null;
-        "vconsole.conf" = fs "80001ff" null null;
-        "xdg" = fs "80001ff" null null;
-        "zoneinfo" = fs "80001ff" null null;
-      } null;
-      nix = fs "800001c0" { store = fs "801001fd" null null; } null;
-      proc = fs "8000016d" null null;
-      run = fs "800001ed" {
-        current-system = fs "80001ff" null null;
-        opengl-driver = fs "80001ff" null null;
-        user = fs "800001ed" {
-          "65534" = fs "800001c0" {
-            bus = fs "10001fd" null null;
-            pulse = fs "800001c0" { native = fs "10001ff" null null; } null;
-            wayland-0 = fs "1000038" null null;
-          } null;
-        } null;
-      } null;
-      sys = fs "800001c0" {
-        block = fs "800001ed" (
-          {
-            ${extraPaths.${system}.fd} = fs "80001ff" null null;
-            loop0 = fs "80001ff" null null;
-            loop1 = fs "80001ff" null null;
-            loop2 = fs "80001ff" null null;
-            loop3 = fs "80001ff" null null;
-            loop4 = fs "80001ff" null null;
-            loop5 = fs "80001ff" null null;
-            loop6 = fs "80001ff" null null;
-            loop7 = fs "80001ff" null null;
-            vda = fs "80001ff" null null;
-          }
-          // extraPaths.${system}.sr
-        ) null;
-        bus = fs "800001ed" null null;
-        class = fs "800001ed" null null;
-        dev = fs "800001ed" {
-          block = fs "800001ed" null null;
-          char = fs "800001ed" null null;
-        } null;
-        devices = fs "800001ed" null null;
-      } null;
-      tmp = fs "800001f8" {
-        ".X11-unix" = fs "801001ff" { X0 = fs "10001fd" null null; } null;
-      } null;
-      usr = fs "800001c0" { bin = fs "800001ed" { env = fs "80001ff" null null; } null; } null;
-      var = fs "800001c0" {
-        tmp = fs "801001ff" null null;
-        lib = fs "800001c0" {
-          hakurei = fs "800001c0" {
-            u0 = fs "800001c0" {
-              a4 = fs "800001c0" {
-                ".cache" = fs "800001ed" { ".keep" = fs "80001ff" null ""; } null;
-                ".config" = fs "800001ed" {
-                  "environment.d" = fs "800001ed" { "10-home-manager.conf" = fs "80001ff" null null; } null;
-                  systemd = fs "800001ed" {
-                    user = fs "800001ed" { "tray.target" = fs "80001ff" null null; } null;
-                  } null;
-                } null;
-                ".local" = fs "800001ed" {
-                  state = fs "800001ed" {
-                    ".keep" = fs "80001ff" null "";
-                    home-manager = fs "800001ed" { gcroots = fs "800001ed" { current-home = fs "80001ff" null null; } null; } null;
-                    nix = fs "800001ed" {
-                      profiles = fs "800001ed" {
-                        profile = fs "80001ff" null null;
-                        profile-1-link = fs "80001ff" null null;
-                      } null;
-                    } null;
-                  } null;
-                } null;
-                ".nix-defexpr" = fs "800001ed" {
-                  channels = fs "80001ff" null null;
-                  channels_root = fs "80001ff" null null;
-                } null;
-                ".nix-profile" = fs "80001ff" null null;
-              } null;
-            } null;
-          } null;
-        } null;
-        cache = fs "800001ed" { private = fs "800001c0" null null; } null;
-      } null;
-    } null;
-
-    mount = [
-      (ent "/sysroot" "/" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10004,gid=10004")
-      (ent "/" "/proc" "rw,nosuid,nodev,noexec,relatime" "proc" "proc" "rw")
-      (ent "/" "/.hakurei" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=4k,mode=755,uid=10004,gid=10004")
-      (ent "/" "/dev" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/" "/dev/pts" "rw,nosuid,noexec,relatime" "devpts" "devpts" "rw,gid=3,mode=620,ptmxmode=666")
-      (ent "/" ignore ignore ignore ignore ignore) # not deterministic
-      (ent "/" ignore ignore ignore ignore ignore)
-      (ent "/" ignore ignore ignore ignore ignore)
-      (ent "/" "/dev/shm" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,uid=10004,gid=10004")
-      (ent "/" "/run/user" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=16384k,mode=755,uid=10004,gid=10004")
-      (ent "/tmp/hakurei.0/tmpdir/4" "/tmp" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent ignore "/etc/passwd" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10004,gid=10004")
-      (ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10004,gid=10004")
-      (ent ignore "/run/user/65534/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/tmp/.X11-unix" "/tmp/.X11-unix" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent ignore "/run/user/65534/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/usr/bin" "/usr/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/" "/nix/store" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/sysroot/nix/.ro-store,upperdir=/sysroot/nix/.rw-store/upper,workdir=/sysroot/nix/.rw-store/work,uuid=on")
-      (ent "/block" "/sys/block" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/bus" "/sys/bus" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/class" "/sys/class" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/dev" "/sys/dev" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/devices" "/sys/devices" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/dri" "/dev/dri" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/var/tmp" "/var/tmp" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/var/cache" "/var/cache" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/" "/.hakurei/.ro-store" "rw,relatime" "overlay" "overlay" "ro,lowerdir+=/host/nix/.ro-store,lowerdir+=/host/nix/.rw-store/upper,redirect_dir=nofollow,userxattr")
-      (ent "/" "/.hakurei/store" "rw,relatime" "overlay" "overlay" "rw,lowerdir+=/host/nix/.ro-store,lowerdir+=/host/nix/.rw-store/upper,upperdir=/host/tmp/.hakurei-store-rw/upper,workdir=/host/tmp/.hakurei-store-rw/work,redirect_dir=nofollow,userxattr")
-      (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/var/lib/hakurei/u0/a4" "/var/lib/hakurei/u0/a4" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent ignore "/run/user/65534/pulse/native" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-    ];
-
-    seccomp = true;
-
-    try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = false;
-    socket_pathname = true;
-  };
-}
diff --git a/test/sandbox/case/mapuid.nix b/test/sandbox/case/mapuid.nix
deleted file mode 100644
index 1b6ef0e7..00000000
--- a/test/sandbox/case/mapuid.nix
+++ /dev/null
@@ -1,282 +0,0 @@
-{
-  fs,
-  ent,
-  ignore,
-  system,
-}:
-let
-  extraPaths = {
-    x86_64-linux = {
-      fd = "fd0";
-      "/dev/dri" = {
-        by-path = fs "800001ed" {
-          "pci-0000:00:09.0-card" = fs "80001ff" null null;
-          "pci-0000:00:09.0-render" = fs "80001ff" null null;
-        } null;
-        card0 = fs "42001b0" null null;
-        renderD128 = fs "42001b6" null null;
-      };
-      sr = {
-        sr0 = fs "80001ff" null null;
-      };
-    };
-    aarch64-linux = {
-      fd = "mtdblock0";
-      "/dev/dri" = null;
-      sr = { };
-    };
-  };
-in
-{
-  name = "mapuid";
-  tty = false;
-  device = false;
-  mapRealUid = true;
-  useCommonPaths = true;
-  userns = false;
-  x11 = false;
-  hostAbstract = false;
-  shareRuntime = true;
-  shareTmpdir = true;
-
-  # 0, PresetStrict
-  expectedFilter = {
-    x86_64-linux = "e880298df2bd6751d0040fc21bc0ed4c00f95dc0d7ba506c244d8b8cf6866dba8ef4a33296f287b66cccc1d78e97026597f84cc7dec1573e148960fbd35cd735";
-    aarch64-linux = "79318538a3dc851314b6bd96f10d5861acb2aa7e13cb8de0619d0f6a76709d67f01ef3fd67e195862b02f9711e5b769bc4d1eb4fc0dfc41a723c89c968a93297";
-  };
-
-  want = {
-    env = [
-      "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus"
-      "HOME=/var/lib/hakurei/u0/a3"
-      "SHELL=/run/current-system/sw/bin/bash"
-      "TERM=linux"
-      "USER=u0_a3"
-      "WAYLAND_DISPLAY=wayland-0"
-      "XDG_RUNTIME_DIR=/run/user/1000"
-      "XDG_SESSION_CLASS=user"
-      "XDG_SESSION_TYPE=wayland"
-      "PULSE_SERVER=unix:/run/user/1000/pulse/native"
-    ];
-
-    fs = fs "dead" {
-      ".hakurei" = fs "800001ed" {
-        ".ro-store" = fs "801001fd" null null;
-        store = fs "800001ff" null null;
-      } null;
-      bin = fs "800001ed" { sh = fs "80001ff" null null; } null;
-      dev = fs "800001ed" {
-        core = fs "80001ff" null null;
-        dri = fs "800001ed" extraPaths.${system}."/dev/dri" null;
-        fd = fs "80001ff" null null;
-        full = fs "42001b6" null null;
-        mqueue = fs "801001ff" { } null;
-        null = fs "42001b6" null "";
-        ptmx = fs "80001ff" null null;
-        pts = fs "800001ed" { ptmx = fs "42001b6" null null; } null;
-        random = fs "42001b6" null null;
-        shm = fs "801001ff" { } null;
-        stderr = fs "80001ff" null null;
-        stdin = fs "80001ff" null null;
-        stdout = fs "80001ff" null null;
-        tty = fs "42001b6" null null;
-        urandom = fs "42001b6" null null;
-        zero = fs "42001b6" null null;
-      } null;
-      etc = fs "800001ed" {
-        ".clean" = fs "80001ff" null null;
-        ".host" = fs "800001c0" null null;
-        ".updated" = fs "80001ff" null null;
-        "NIXOS" = fs "80001ff" null null;
-        "X11" = fs "80001ff" null null;
-        "alsa" = fs "80001ff" null null;
-        "bash_logout" = fs "80001ff" null null;
-        "bashrc" = fs "80001ff" null null;
-        "binfmt.d" = fs "80001ff" null null;
-        "dbus-1" = fs "80001ff" null null;
-        "default" = fs "80001ff" null null;
-        "dhcpcd.exit-hook" = fs "80001ff" null null;
-        "environment.d" = fs "80001ff" null null;
-        "fonts" = fs "80001ff" null null;
-        "fstab" = fs "80001ff" null null;
-        "hsurc" = fs "80001ff" null null;
-        "fuse.conf" = fs "80001ff" null null;
-        "gai.conf" = fs "80001ff" null null;
-        "group" = fs "180" null "hakurei:x:100:\n";
-        "host.conf" = fs "80001ff" null null;
-        "hostname" = fs "80001ff" null null;
-        "hosts" = fs "80001ff" null null;
-        "inputrc" = fs "80001ff" null null;
-        "issue" = fs "80001ff" null null;
-        "kbd" = fs "80001ff" null null;
-        "locale.conf" = fs "80001ff" null null;
-        "login.defs" = fs "80001ff" null null;
-        "lsb-release" = fs "80001ff" null null;
-        "lvm" = fs "80001ff" null null;
-        "machine-id" = fs "80001ff" null null;
-        "man_db.conf" = fs "80001ff" null null;
-        "modprobe.d" = fs "80001ff" null null;
-        "modules-load.d" = fs "80001ff" null null;
-        "mtab" = fs "80001ff" null null;
-        "nanorc" = fs "80001ff" null null;
-        "netgroup" = fs "80001ff" null null;
-        "nix" = fs "80001ff" null null;
-        "nixos" = fs "80001ff" null null;
-        "nscd.conf" = fs "80001ff" null null;
-        "nsswitch.conf" = fs "80001ff" null null;
-        "os-release" = fs "80001ff" null null;
-        "pam" = fs "80001ff" null null;
-        "pam.d" = fs "80001ff" null null;
-        "passwd" = fs "180" null "u0_a3:x:1000:100:Hakurei:/var/lib/hakurei/u0/a3:/run/current-system/sw/bin/bash\n";
-        "pipewire" = fs "80001ff" null null;
-        "pki" = fs "80001ff" null null;
-        "polkit-1" = fs "80001ff" null null;
-        "profile" = fs "80001ff" null null;
-        "protocols" = fs "80001ff" null null;
-        "resolv.conf" = fs "80001ff" null null;
-        "resolvconf.conf" = fs "80001ff" null null;
-        "rpc" = fs "80001ff" null null;
-        "services" = fs "80001ff" null null;
-        "set-environment" = fs "80001ff" null null;
-        "shadow" = fs "80001ff" null null;
-        "shells" = fs "80001ff" null null;
-        "speech-dispatcher" = fs "80001ff" null null;
-        "ssh" = fs "80001ff" null null;
-        "ssl" = fs "80001ff" null null;
-        "static" = fs "80001ff" null null;
-        "subgid" = fs "80001ff" null null;
-        "subuid" = fs "80001ff" null null;
-        "sudoers" = fs "80001ff" null null;
-        "sway" = fs "80001ff" null null;
-        "sysctl.d" = fs "80001ff" null null;
-        "systemd" = fs "80001ff" null null;
-        "terminfo" = fs "80001ff" null null;
-        "tmpfiles.d" = fs "80001ff" null null;
-        "udev" = fs "80001ff" null null;
-        "vconsole.conf" = fs "80001ff" null null;
-        "xdg" = fs "80001ff" null null;
-        "zoneinfo" = fs "80001ff" null null;
-      } null;
-      nix = fs "800001c0" { store = fs "801001fd" null null; } null;
-      proc = fs "8000016d" null null;
-      run = fs "800001ed" {
-        current-system = fs "80001ff" null null;
-        opengl-driver = fs "80001ff" null null;
-        user = fs "800001ed" {
-          "1000" = fs "800001f8" {
-            bus = fs "10001fd" null null;
-            pulse = fs "800001c0" { native = fs "10001ff" null null; } null;
-            wayland-0 = fs "1000038" null null;
-          } null;
-        } null;
-      } null;
-      sys = fs "800001c0" {
-        block = fs "800001ed" (
-          {
-            ${extraPaths.${system}.fd} = fs "80001ff" null null;
-            loop0 = fs "80001ff" null null;
-            loop1 = fs "80001ff" null null;
-            loop2 = fs "80001ff" null null;
-            loop3 = fs "80001ff" null null;
-            loop4 = fs "80001ff" null null;
-            loop5 = fs "80001ff" null null;
-            loop6 = fs "80001ff" null null;
-            loop7 = fs "80001ff" null null;
-            vda = fs "80001ff" null null;
-          }
-          // extraPaths.${system}.sr
-        ) null;
-        bus = fs "800001ed" null null;
-        class = fs "800001ed" null null;
-        dev = fs "800001ed" {
-          block = fs "800001ed" null null;
-          char = fs "800001ed" null null;
-        } null;
-        devices = fs "800001ed" null null;
-      } null;
-      tmp = fs "800001f8" { } null;
-      usr = fs "800001c0" { bin = fs "800001ed" { env = fs "80001ff" null null; } null; } null;
-      var = fs "800001c0" {
-        tmp = fs "801001ff" null null;
-        lib = fs "800001c0" {
-          hakurei = fs "800001c0" {
-            u0 = fs "800001c0" {
-              a3 = fs "800001c0" {
-                ".cache" = fs "800001ed" { ".keep" = fs "80001ff" null ""; } null;
-                ".config" = fs "800001ed" {
-                  "environment.d" = fs "800001ed" { "10-home-manager.conf" = fs "80001ff" null null; } null;
-                  systemd = fs "800001ed" {
-                    user = fs "800001ed" { "tray.target" = fs "80001ff" null null; } null;
-                  } null;
-                } null;
-                ".local" = fs "800001ed" {
-                  state = fs "800001ed" {
-                    ".keep" = fs "80001ff" null "";
-                    home-manager = fs "800001ed" { gcroots = fs "800001ed" { current-home = fs "80001ff" null null; } null; } null;
-                    nix = fs "800001ed" {
-                      profiles = fs "800001ed" {
-                        profile = fs "80001ff" null null;
-                        profile-1-link = fs "80001ff" null null;
-                      } null;
-                    } null;
-                  } null;
-                } null;
-                ".nix-defexpr" = fs "800001ed" {
-                  channels = fs "80001ff" null null;
-                  channels_root = fs "80001ff" null null;
-                } null;
-                ".nix-profile" = fs "80001ff" null null;
-              } null;
-            } null;
-          } null;
-        } null;
-        cache = fs "800001ed" { private = fs "800001c0" null null; } null;
-      } null;
-    } null;
-
-    mount = [
-      (ent "/sysroot" "/" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10003,gid=10003")
-      (ent "/" "/proc" "rw,nosuid,nodev,noexec,relatime" "proc" "proc" "rw")
-      (ent "/" "/.hakurei" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=4k,mode=755,uid=10003,gid=10003")
-      (ent "/" "/dev" "ro,nosuid,nodev,relatime" "tmpfs" "devtmpfs" "rw,mode=755,uid=10003,gid=10003")
-      (ent "/null" "/dev/null" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/zero" "/dev/zero" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/full" "/dev/full" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/random" "/dev/random" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/urandom" "/dev/urandom" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/tty" "/dev/tty" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/" "/dev/pts" "rw,nosuid,noexec,relatime" "devpts" "devpts" "rw,mode=620,ptmxmode=666")
-      (ent "/" "/dev/mqueue" "rw,nosuid,nodev,noexec,relatime" "mqueue" "mqueue" "rw")
-      (ent "/" "/dev/shm" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,uid=10003,gid=10003")
-      (ent "/" "/run/user" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=16384k,mode=755,uid=10003,gid=10003")
-      (ent "/tmp/hakurei.0/runtime/3" "/run/user/1000" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/tmp/hakurei.0/tmpdir/3" "/tmp" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent ignore "/etc/passwd" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10003,gid=10003")
-      (ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10003,gid=10003")
-      (ent ignore "/run/user/1000/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent ignore "/run/user/1000/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/usr/bin" "/usr/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/" "/nix/store" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/sysroot/nix/.ro-store,upperdir=/sysroot/nix/.rw-store/upper,workdir=/sysroot/nix/.rw-store/work,uuid=on")
-      (ent "/block" "/sys/block" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/bus" "/sys/bus" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/class" "/sys/class" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/dev" "/sys/dev" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/devices" "/sys/devices" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/dri" "/dev/dri" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/var/tmp" "/var/tmp" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/var/cache" "/var/cache" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/" "/.hakurei/.ro-store" "rw,relatime" "overlay" "overlay" "ro,lowerdir+=/host/nix/.ro-store,lowerdir+=/host/nix/.rw-store/upper,redirect_dir=nofollow,userxattr")
-      (ent "/" "/.hakurei/store" "rw,relatime" "overlay" "overlay" "rw,lowerdir+=/host/nix/.ro-store,lowerdir+=/host/nix/.rw-store/upper,upperdir=/host/tmp/.hakurei-store-rw/upper,workdir=/host/tmp/.hakurei-store-rw/work,redirect_dir=nofollow,userxattr")
-      (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/var/lib/hakurei/u0/a3" "/var/lib/hakurei/u0/a3" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent ignore "/run/user/1000/pulse/native" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-    ];
-
-    seccomp = true;
-
-    try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = false;
-    socket_pathname = false;
-  };
-}
diff --git a/test/sandbox/case/pd.nix b/test/sandbox/case/pd.nix
deleted file mode 100644
index 25f42979..00000000
--- a/test/sandbox/case/pd.nix
+++ /dev/null
@@ -1,206 +0,0 @@
-{
-  fs,
-  ent,
-  ignore,
-  ...
-}:
-{
-  # 0, PresetExt | PresetDenyDevel
-  expectedFilter = {
-    x86_64-linux = "c698b081ff957afe17a6d94374537d37f2a63f6f9dd75da7546542407a9e32476ebda3312ba7785d7f618542bcfaf27ca27dcc2dddba852069d28bcfe8cad39a";
-    aarch64-linux = "433ce9b911282d6dcc8029319fb79b816b60d5a795ec8fc94344dd027614d68f023166a91bb881faaeeedd26e3d89474e141e5a69a97e93b8984ca8f14999980";
-  };
-
-  want = {
-    env = [
-      "HOME=/var/lib/hakurei/u0/a0"
-      "SHELL=/run/current-system/sw/bin/bash"
-      "TERM=linux"
-      "USER=u0_a0"
-      "XDG_RUNTIME_DIR=/run/user/65534"
-      "XDG_SESSION_CLASS=user"
-      "XDG_SESSION_TYPE=tty"
-    ];
-
-    fs = fs "dead" {
-      ".hakurei" = fs "800001ed" { } null;
-      bin = fs "800001ed" { sh = fs "80001ff" null null; } null;
-      dev = fs "800001ed" {
-        console = fs "4200190" null null;
-        core = fs "80001ff" null null;
-        fd = fs "80001ff" null null;
-        full = fs "42001b6" null null;
-        kvm = fs "42001b6" null null;
-        mqueue = fs "801001ff" { } null;
-        null = fs "42001b6" null "";
-        ptmx = fs "80001ff" null null;
-        pts = fs "800001ed" { ptmx = fs "42001b6" null null; } null;
-        random = fs "42001b6" null null;
-        shm = fs "801001ff" { } null;
-        stderr = fs "80001ff" null null;
-        stdin = fs "80001ff" null null;
-        stdout = fs "80001ff" null null;
-        tty = fs "42001b6" null null;
-        urandom = fs "42001b6" null null;
-        zero = fs "42001b6" null null;
-      } null;
-      etc = fs "800001ed" {
-        ".clean" = fs "80001ff" null null;
-        ".host" = fs "800001c0" null null;
-        ".updated" = fs "80001ff" null null;
-        "NIXOS" = fs "80001ff" null null;
-        "X11" = fs "80001ff" null null;
-        "alsa" = fs "80001ff" null null;
-        "bash_logout" = fs "80001ff" null null;
-        "bashrc" = fs "80001ff" null null;
-        "binfmt.d" = fs "80001ff" null null;
-        "dbus-1" = fs "80001ff" null null;
-        "default" = fs "80001ff" null null;
-        "dhcpcd.exit-hook" = fs "80001ff" null null;
-        "environment.d" = fs "80001ff" null null;
-        "fonts" = fs "80001ff" null null;
-        "fstab" = fs "80001ff" null null;
-        "hsurc" = fs "80001ff" null null;
-        "fuse.conf" = fs "80001ff" null null;
-        "gai.conf" = fs "80001ff" null null;
-        "group" = fs "180" null "hakurei:x:65534:\n";
-        "host.conf" = fs "80001ff" null null;
-        "hostname" = fs "80001ff" null null;
-        "hosts" = fs "80001ff" null null;
-        "inputrc" = fs "80001ff" null null;
-        "issue" = fs "80001ff" null null;
-        "kbd" = fs "80001ff" null null;
-        "locale.conf" = fs "80001ff" null null;
-        "login.defs" = fs "80001ff" null null;
-        "lsb-release" = fs "80001ff" null null;
-        "lvm" = fs "80001ff" null null;
-        "machine-id" = fs "80001ff" null null;
-        "man_db.conf" = fs "80001ff" null null;
-        "modprobe.d" = fs "80001ff" null null;
-        "modules-load.d" = fs "80001ff" null null;
-        "mtab" = fs "80001ff" null null;
-        "nanorc" = fs "80001ff" null null;
-        "netgroup" = fs "80001ff" null null;
-        "nix" = fs "80001ff" null null;
-        "nixos" = fs "80001ff" null null;
-        "nscd.conf" = fs "80001ff" null null;
-        "nsswitch.conf" = fs "80001ff" null null;
-        "os-release" = fs "80001ff" null null;
-        "pam" = fs "80001ff" null null;
-        "pam.d" = fs "80001ff" null null;
-        "passwd" = fs "180" null "u0_a0:x:65534:65534:Hakurei:/var/lib/hakurei/u0/a0:/run/current-system/sw/bin/bash\n";
-        "pipewire" = fs "80001ff" null null;
-        "pki" = fs "80001ff" null null;
-        "polkit-1" = fs "80001ff" null null;
-        "profile" = fs "80001ff" null null;
-        "protocols" = fs "80001ff" null null;
-        "resolv.conf" = fs "80001ff" null null;
-        "resolvconf.conf" = fs "80001ff" null null;
-        "rpc" = fs "80001ff" null null;
-        "services" = fs "80001ff" null null;
-        "set-environment" = fs "80001ff" null null;
-        "shadow" = fs "80001ff" null null;
-        "shells" = fs "80001ff" null null;
-        "speech-dispatcher" = fs "80001ff" null null;
-        "ssh" = fs "80001ff" null null;
-        "ssl" = fs "80001ff" null null;
-        "static" = fs "80001ff" null null;
-        "subgid" = fs "80001ff" null null;
-        "subuid" = fs "80001ff" null null;
-        "sudoers" = fs "80001ff" null null;
-        "sway" = fs "80001ff" null null;
-        "sysctl.d" = fs "80001ff" null null;
-        "systemd" = fs "80001ff" null null;
-        "terminfo" = fs "80001ff" null null;
-        "tmpfiles.d" = fs "80001ff" null null;
-        "udev" = fs "80001ff" null null;
-        "vconsole.conf" = fs "80001ff" null null;
-        "xdg" = fs "80001ff" null null;
-        "zoneinfo" = fs "80001ff" null null;
-      } null;
-      home = fs "800001ed" { alice = fs "800001c0" null null; } null;
-      lib64 = fs "800001ed" { "ld-linux-x86-64.so.2" = fs "80001ff" null null; } null;
-      "lost+found" = fs "800001c0" null null;
-      nix = fs "800001ed" {
-        ".ro-store" = fs "801001fd" null null;
-        ".rw-store" = fs "800001ed" null null;
-        store = fs "801001fd" null null;
-        var = fs "800001ed" {
-          log = fs "800001ed" null null;
-          nix = fs "800001ed" null null;
-        } null;
-      } null;
-      proc = fs "8000016d" null null;
-      root = fs "800001c0" null null;
-      run = fs "800001ed" null null;
-      srv = fs "800001ed" { } null;
-      sys = fs "8000016d" null null;
-      tmp = fs "800001f8" { } null;
-      usr = fs "800001ed" { bin = fs "800001ed" { env = fs "80001ff" null null; } null; } null;
-      var = fs "800001ed" null null;
-    } null;
-
-    mount = [
-      (ent "/sysroot" "/" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10000,gid=10000")
-      (ent "/bin" "/bin" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/home" "/home" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/lib64" "/lib64" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/lost+found" "/lost+found" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/nix" "/nix" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      # systemd nondeterminism: ro-store rw-store
-      (ent "/" ignore "rw,nosuid,nodev,relatime" ignore ignore ignore)
-      (ent "/" ignore "rw,nosuid,nodev,relatime" ignore ignore ignore)
-      (ent "/" "/nix/store" "rw,relatime" "overlay" "overlay" "rw,lowerdir=/sysroot/nix/.ro-store,upperdir=/sysroot/nix/.rw-store/upper,workdir=/sysroot/nix/.rw-store/work,uuid=on")
-      (ent "/" "/nix/store" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/sysroot/nix/.ro-store,upperdir=/sysroot/nix/.rw-store/upper,workdir=/sysroot/nix/.rw-store/work,uuid=on")
-      (ent "/root" "/root" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/" "/run" "rw,nosuid,nodev" "tmpfs" "tmpfs" ignore)
-      (ent "/" "/run/keys" "rw,nosuid,nodev,relatime" "ramfs" "ramfs" "rw,mode=750")
-      (ent "/" "/run/credentials/systemd-journald.service" "rw,nosuid,nodev,noexec,relatime,nosymfollow" "tmpfs" "none" "ro,size=1024k,nr_inodes=1024,mode=700,noswap")
-      (ent "/" "/run/wrappers" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" ignore)
-      (ent "/" "/run/credentials/getty@tty1.service" "rw,nosuid,nodev,noexec,relatime,nosymfollow" "tmpfs" "none" "ro,size=1024k,nr_inodes=1024,mode=700,noswap")
-      (ent "/" "/run/user/1000" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" ignore)
-      (ent "/srv" "/srv" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/" "/sys" "rw,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/" "/sys/kernel/security" "rw,nosuid,nodev,noexec,relatime" "securityfs" "securityfs" "rw")
-      (ent "/../../.." "/sys/fs/cgroup" "rw,nosuid,nodev,noexec,relatime" "cgroup2" "cgroup2" "rw,nsdelegate,memory_recursiveprot,memory_hugetlb_accounting")
-      (ent "/" "/sys/fs/pstore" "rw,nosuid,nodev,noexec,relatime" "pstore" "none" "rw")
-      (ent "/" "/sys/fs/bpf" "rw,nosuid,nodev,noexec,relatime" "bpf" "bpf" "rw,mode=700")
-      # systemd nondeterminism: tracefs debugfs configfs fusectl
-      (ent "/" ignore "rw,nosuid,nodev,noexec,relatime" ignore ignore "rw")
-      (ent "/" ignore "rw,nosuid,nodev,noexec,relatime" ignore ignore "rw")
-      (ent "/" ignore "rw,nosuid,nodev,noexec,relatime" ignore ignore "rw")
-      (ent "/" ignore "rw,nosuid,nodev,noexec,relatime" ignore ignore "rw")
-      (ent "/usr" "/usr" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/var" "/var" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/" "/proc" "rw,nosuid,nodev,noexec,relatime" "proc" "proc" "rw")
-      (ent "/" "/.hakurei" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=4k,mode=755,uid=10000,gid=10000")
-      (ent "/" "/dev" "ro,nosuid,nodev,relatime" "tmpfs" "devtmpfs" "rw,mode=755,uid=10000,gid=10000")
-      (ent "/null" "/dev/null" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/zero" "/dev/zero" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/full" "/dev/full" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/random" "/dev/random" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/urandom" "/dev/urandom" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/tty" "/dev/tty" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/" "/dev/pts" "rw,nosuid,noexec,relatime" "devpts" "devpts" "rw,mode=620,ptmxmode=666")
-      (ent ignore "/dev/console" "rw,nosuid,noexec,relatime" "devpts" "devpts" "rw,gid=3,mode=620,ptmxmode=666")
-      (ent "/" "/dev/mqueue" "rw,nosuid,nodev,noexec,relatime" "mqueue" "mqueue" "rw")
-      (ent "/" "/dev/shm" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,uid=10000,gid=10000")
-      (ent "/" "/run/user" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=16384k,mode=755,uid=10000,gid=10000")
-      (ent "/tmp/hakurei.0/runtime/0" "/run/user/65534" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/tmp/hakurei.0/tmpdir/0" "/tmp" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent ignore "/etc/passwd" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10000,gid=10000")
-      (ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10000,gid=10000")
-      (ent "/kvm" "/dev/kvm" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/" "/run/user/1000" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=8k,mode=755,uid=10000,gid=10000")
-      (ent "/" "/run/nscd" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=8k,mode=755,uid=10000,gid=10000")
-      (ent "/" "/run/dbus" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=8k,mode=755,uid=10000,gid=10000")
-    ];
-
-    seccomp = true;
-
-    try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
-    socket_pathname = false;
-  };
-}
diff --git a/test/sandbox/case/pdlike.nix b/test/sandbox/case/pdlike.nix
deleted file mode 100644
index 7f0716fb..00000000
--- a/test/sandbox/case/pdlike.nix
+++ /dev/null
@@ -1,277 +0,0 @@
-{
-  fs,
-  ent,
-  ignore,
-  system,
-}:
-let
-  extraPaths = {
-    x86_64-linux = {
-      fd = "fd0";
-      "/dev/dri" = {
-        by-path = fs "800001ed" {
-          "pci-0000:00:09.0-card" = fs "80001ff" null null;
-          "pci-0000:00:09.0-render" = fs "80001ff" null null;
-        } null;
-        card0 = fs "42001b0" null null;
-        renderD128 = fs "42001b6" null null;
-      };
-      sr = {
-        sr0 = fs "80001ff" null null;
-      };
-    };
-    aarch64-linux = {
-      fd = "mtdblock0";
-      "/dev/dri" = null;
-      sr = { };
-    };
-  };
-in
-{
-  name = "pdlike";
-  tty = true;
-  device = false;
-  mapRealUid = false;
-  useCommonPaths = false;
-  userns = true;
-  x11 = false;
-  hostAbstract = false;
-  shareRuntime = true;
-  shareTmpdir = true;
-
-  # 0, PresetExt | PresetDenyDevel
-  expectedFilter = {
-    x86_64-linux = "c698b081ff957afe17a6d94374537d37f2a63f6f9dd75da7546542407a9e32476ebda3312ba7785d7f618542bcfaf27ca27dcc2dddba852069d28bcfe8cad39a";
-    aarch64-linux = "433ce9b911282d6dcc8029319fb79b816b60d5a795ec8fc94344dd027614d68f023166a91bb881faaeeedd26e3d89474e141e5a69a97e93b8984ca8f14999980";
-  };
-
-  want = {
-    env = [
-      "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/65534/bus"
-      "HOME=/var/lib/hakurei/u0/a5"
-      "SHELL=/run/current-system/sw/bin/bash"
-      "TERM=linux"
-      "USER=u0_a5"
-      "WAYLAND_DISPLAY=wayland-0"
-      "XDG_RUNTIME_DIR=/run/user/65534"
-      "XDG_SESSION_CLASS=user"
-      "XDG_SESSION_TYPE=wayland"
-      "PULSE_SERVER=unix:/run/user/65534/pulse/native"
-    ];
-
-    fs = fs "dead" {
-      ".hakurei" = fs "800001ed" { } null;
-      bin = fs "800001ed" { sh = fs "80001ff" null null; } null;
-      dev = fs "800001ed" {
-        console = fs "4200190" null null;
-        core = fs "80001ff" null null;
-        dri = fs "800001ed" extraPaths.${system}."/dev/dri" null;
-        fd = fs "80001ff" null null;
-        full = fs "42001b6" null null;
-        mqueue = fs "801001ff" { } null;
-        null = fs "42001b6" null "";
-        ptmx = fs "80001ff" null null;
-        pts = fs "800001ed" { ptmx = fs "42001b6" null null; } null;
-        random = fs "42001b6" null null;
-        shm = fs "801001ff" { } null;
-        stderr = fs "80001ff" null null;
-        stdin = fs "80001ff" null null;
-        stdout = fs "80001ff" null null;
-        tty = fs "42001b6" null null;
-        urandom = fs "42001b6" null null;
-        zero = fs "42001b6" null null;
-      } null;
-      etc = fs "800001ed" {
-        ".clean" = fs "80001ff" null null;
-        ".host" = fs "800001c0" null null;
-        ".updated" = fs "80001ff" null null;
-        "NIXOS" = fs "80001ff" null null;
-        "X11" = fs "80001ff" null null;
-        "alsa" = fs "80001ff" null null;
-        "bash_logout" = fs "80001ff" null null;
-        "bashrc" = fs "80001ff" null null;
-        "binfmt.d" = fs "80001ff" null null;
-        "dbus-1" = fs "80001ff" null null;
-        "default" = fs "80001ff" null null;
-        "dhcpcd.exit-hook" = fs "80001ff" null null;
-        "environment.d" = fs "80001ff" null null;
-        "fonts" = fs "80001ff" null null;
-        "fstab" = fs "80001ff" null null;
-        "hsurc" = fs "80001ff" null null;
-        "fuse.conf" = fs "80001ff" null null;
-        "gai.conf" = fs "80001ff" null null;
-        "group" = fs "180" null "hakurei:x:65534:\n";
-        "host.conf" = fs "80001ff" null null;
-        "hostname" = fs "80001ff" null null;
-        "hosts" = fs "80001ff" null null;
-        "inputrc" = fs "80001ff" null null;
-        "issue" = fs "80001ff" null null;
-        "kbd" = fs "80001ff" null null;
-        "locale.conf" = fs "80001ff" null null;
-        "login.defs" = fs "80001ff" null null;
-        "lsb-release" = fs "80001ff" null null;
-        "lvm" = fs "80001ff" null null;
-        "machine-id" = fs "80001ff" null null;
-        "man_db.conf" = fs "80001ff" null null;
-        "modprobe.d" = fs "80001ff" null null;
-        "modules-load.d" = fs "80001ff" null null;
-        "mtab" = fs "80001ff" null null;
-        "nanorc" = fs "80001ff" null null;
-        "netgroup" = fs "80001ff" null null;
-        "nix" = fs "80001ff" null null;
-        "nixos" = fs "80001ff" null null;
-        "nscd.conf" = fs "80001ff" null null;
-        "nsswitch.conf" = fs "80001ff" null null;
-        "os-release" = fs "80001ff" null null;
-        "pam" = fs "80001ff" null null;
-        "pam.d" = fs "80001ff" null null;
-        "passwd" = fs "180" null "u0_a5:x:65534:65534:Hakurei:/var/lib/hakurei/u0/a5:/run/current-system/sw/bin/bash\n";
-        "pipewire" = fs "80001ff" null null;
-        "pki" = fs "80001ff" null null;
-        "polkit-1" = fs "80001ff" null null;
-        "profile" = fs "80001ff" null null;
-        "protocols" = fs "80001ff" null null;
-        "resolv.conf" = fs "80001ff" null null;
-        "resolvconf.conf" = fs "80001ff" null null;
-        "rpc" = fs "80001ff" null null;
-        "services" = fs "80001ff" null null;
-        "set-environment" = fs "80001ff" null null;
-        "shadow" = fs "80001ff" null null;
-        "shells" = fs "80001ff" null null;
-        "speech-dispatcher" = fs "80001ff" null null;
-        "ssh" = fs "80001ff" null null;
-        "ssl" = fs "80001ff" null null;
-        "static" = fs "80001ff" null null;
-        "subgid" = fs "80001ff" null null;
-        "subuid" = fs "80001ff" null null;
-        "sudoers" = fs "80001ff" null null;
-        "sway" = fs "80001ff" null null;
-        "sysctl.d" = fs "80001ff" null null;
-        "systemd" = fs "80001ff" null null;
-        "terminfo" = fs "80001ff" null null;
-        "tmpfiles.d" = fs "80001ff" null null;
-        "udev" = fs "80001ff" null null;
-        "vconsole.conf" = fs "80001ff" null null;
-        "xdg" = fs "80001ff" null null;
-        "zoneinfo" = fs "80001ff" null null;
-      } null;
-      nix = fs "800001c0" { store = fs "801001fd" null null; } null;
-      proc = fs "8000016d" null null;
-      run = fs "800001ed" {
-        current-system = fs "80001ff" null null;
-        opengl-driver = fs "80001ff" null null;
-        user = fs "800001ed" {
-          "65534" = fs "800001f8" {
-            bus = fs "10001fd" null null;
-            pulse = fs "800001c0" { native = fs "10001ff" null null; } null;
-            wayland-0 = fs "1000038" null null;
-          } null;
-        } null;
-      } null;
-      sys = fs "800001c0" {
-        block = fs "800001ed" (
-          {
-            ${extraPaths.${system}.fd} = fs "80001ff" null null;
-            loop0 = fs "80001ff" null null;
-            loop1 = fs "80001ff" null null;
-            loop2 = fs "80001ff" null null;
-            loop3 = fs "80001ff" null null;
-            loop4 = fs "80001ff" null null;
-            loop5 = fs "80001ff" null null;
-            loop6 = fs "80001ff" null null;
-            loop7 = fs "80001ff" null null;
-            vda = fs "80001ff" null null;
-          }
-          // extraPaths.${system}.sr
-        ) null;
-        bus = fs "800001ed" null null;
-        class = fs "800001ed" null null;
-        dev = fs "800001ed" {
-          block = fs "800001ed" null null;
-          char = fs "800001ed" null null;
-        } null;
-        devices = fs "800001ed" null null;
-      } null;
-      tmp = fs "800001f8" { } null;
-      usr = fs "800001c0" { bin = fs "800001ed" { env = fs "80001ff" null null; } null; } null;
-      var = fs "800001c0" {
-        tmp = fs "801001ff" null null;
-        lib = fs "800001c0" {
-          hakurei = fs "800001c0" {
-            u0 = fs "800001c0" {
-              a5 = fs "800001c0" {
-                ".cache" = fs "800001ed" { ".keep" = fs "80001ff" null ""; } null;
-                ".config" = fs "800001ed" {
-                  "environment.d" = fs "800001ed" { "10-home-manager.conf" = fs "80001ff" null null; } null;
-                  systemd = fs "800001ed" {
-                    user = fs "800001ed" { "tray.target" = fs "80001ff" null null; } null;
-                  } null;
-                } null;
-                ".local" = fs "800001ed" {
-                  state = fs "800001ed" {
-                    ".keep" = fs "80001ff" null "";
-                    home-manager = fs "800001ed" { gcroots = fs "800001ed" { current-home = fs "80001ff" null null; } null; } null;
-                    nix = fs "800001ed" {
-                      profiles = fs "800001ed" {
-                        profile = fs "80001ff" null null;
-                        profile-1-link = fs "80001ff" null null;
-                      } null;
-                    } null;
-                  } null;
-                } null;
-                ".nix-defexpr" = fs "800001ed" {
-                  channels = fs "80001ff" null null;
-                  channels_root = fs "80001ff" null null;
-                } null;
-                ".nix-profile" = fs "80001ff" null null;
-              } null;
-            } null;
-          } null;
-        } null;
-      } null;
-    } null;
-
-    mount = [
-      (ent "/sysroot" "/" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10005,gid=10005")
-      (ent "/" "/proc" "rw,nosuid,nodev,noexec,relatime" "proc" "proc" "rw")
-      (ent "/" "/.hakurei" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=4k,mode=755,uid=10005,gid=10005")
-      (ent "/" "/dev" "ro,nosuid,nodev,relatime" "tmpfs" "devtmpfs" "rw,mode=755,uid=10005,gid=10005")
-      (ent "/null" "/dev/null" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/zero" "/dev/zero" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/full" "/dev/full" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/random" "/dev/random" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/urandom" "/dev/urandom" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/tty" "/dev/tty" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/" "/dev/pts" "rw,nosuid,noexec,relatime" "devpts" "devpts" "rw,mode=620,ptmxmode=666")
-      (ent ignore "/dev/console" "rw,nosuid,noexec,relatime" "devpts" "devpts" "rw,gid=3,mode=620,ptmxmode=666")
-      (ent "/" "/dev/mqueue" "rw,nosuid,nodev,noexec,relatime" "mqueue" "mqueue" "rw")
-      (ent "/" "/dev/shm" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,uid=10005,gid=10005")
-      (ent "/" "/run/user" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=16384k,mode=755,uid=10005,gid=10005")
-      (ent "/tmp/hakurei.0/runtime/5" "/run/user/65534" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/tmp/hakurei.0/tmpdir/5" "/tmp" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent ignore "/etc/passwd" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10005,gid=10005")
-      (ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10005,gid=10005")
-      (ent ignore "/run/user/65534/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent ignore "/run/user/65534/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/usr/bin" "/usr/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/" "/nix/store" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/sysroot/nix/.ro-store,upperdir=/sysroot/nix/.rw-store/upper,workdir=/sysroot/nix/.rw-store/work,uuid=on")
-      (ent "/block" "/sys/block" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/bus" "/sys/bus" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/class" "/sys/class" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/dev" "/sys/dev" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/devices" "/sys/devices" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/dri" "/dev/dri" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/var/tmp" "/var/tmp" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/var/lib/hakurei/u0/a5" "/var/lib/hakurei/u0/a5" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent ignore "/run/user/65534/pulse/native" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-    ];
-
-    seccomp = true;
-
-    try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = false;
-    socket_pathname = false;
-  };
-}
diff --git a/test/sandbox/case/preset.nix b/test/sandbox/case/preset.nix
deleted file mode 100644
index 33cc3b8b..00000000
--- a/test/sandbox/case/preset.nix
+++ /dev/null
@@ -1,274 +0,0 @@
-{
-  fs,
-  ent,
-  ignore,
-  system,
-}:
-let
-  extraPaths = {
-    x86_64-linux = {
-      fd = "fd0";
-      "/dev/dri" = {
-        by-path = fs "800001ed" {
-          "pci-0000:00:09.0-card" = fs "80001ff" null null;
-          "pci-0000:00:09.0-render" = fs "80001ff" null null;
-        } null;
-        card0 = fs "42001b0" null null;
-        renderD128 = fs "42001b6" null null;
-      };
-      sr = {
-        sr0 = fs "80001ff" null null;
-      };
-    };
-    aarch64-linux = {
-      fd = "mtdblock0";
-      "/dev/dri" = null;
-      sr = { };
-    };
-  };
-in
-{
-  name = "preset";
-  tty = false;
-  device = false;
-  mapRealUid = false;
-  useCommonPaths = false;
-  userns = false;
-  x11 = false;
-  hostAbstract = false;
-  shareRuntime = false;
-  shareTmpdir = false;
-
-  # 0, PresetStrict
-  expectedFilter = {
-    x86_64-linux = "e880298df2bd6751d0040fc21bc0ed4c00f95dc0d7ba506c244d8b8cf6866dba8ef4a33296f287b66cccc1d78e97026597f84cc7dec1573e148960fbd35cd735";
-    aarch64-linux = "79318538a3dc851314b6bd96f10d5861acb2aa7e13cb8de0619d0f6a76709d67f01ef3fd67e195862b02f9711e5b769bc4d1eb4fc0dfc41a723c89c968a93297";
-  };
-
-  want = {
-    env = [
-      "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/65534/bus"
-      "HOME=/var/lib/hakurei/u0/a1"
-      "SHELL=/run/current-system/sw/bin/bash"
-      "TERM=linux"
-      "USER=u0_a1"
-      "WAYLAND_DISPLAY=wayland-0"
-      "XDG_RUNTIME_DIR=/run/user/65534"
-      "XDG_SESSION_CLASS=user"
-      "XDG_SESSION_TYPE=wayland"
-      "PULSE_SERVER=unix:/run/user/65534/pulse/native"
-    ];
-
-    fs = fs "dead" {
-      ".hakurei" = fs "800001ed" { } null;
-      bin = fs "800001ed" { sh = fs "80001ff" null null; } null;
-      dev = fs "800001ed" {
-        core = fs "80001ff" null null;
-        dri = fs "800001ed" extraPaths.${system}."/dev/dri" null;
-        fd = fs "80001ff" null null;
-        full = fs "42001b6" null null;
-        mqueue = fs "801001ff" { } null;
-        null = fs "42001b6" null "";
-        ptmx = fs "80001ff" null null;
-        pts = fs "800001ed" { ptmx = fs "42001b6" null null; } null;
-        random = fs "42001b6" null null;
-        shm = fs "801001ff" { } null;
-        stderr = fs "80001ff" null null;
-        stdin = fs "80001ff" null null;
-        stdout = fs "80001ff" null null;
-        tty = fs "42001b6" null null;
-        urandom = fs "42001b6" null null;
-        zero = fs "42001b6" null null;
-      } null;
-      etc = fs "800001ed" {
-        ".clean" = fs "80001ff" null null;
-        ".host" = fs "800001c0" null null;
-        ".updated" = fs "80001ff" null null;
-        "NIXOS" = fs "80001ff" null null;
-        "X11" = fs "80001ff" null null;
-        "alsa" = fs "80001ff" null null;
-        "bash_logout" = fs "80001ff" null null;
-        "bashrc" = fs "80001ff" null null;
-        "binfmt.d" = fs "80001ff" null null;
-        "dbus-1" = fs "80001ff" null null;
-        "default" = fs "80001ff" null null;
-        "dhcpcd.exit-hook" = fs "80001ff" null null;
-        "environment.d" = fs "80001ff" null null;
-        "fonts" = fs "80001ff" null null;
-        "fstab" = fs "80001ff" null null;
-        "hsurc" = fs "80001ff" null null;
-        "fuse.conf" = fs "80001ff" null null;
-        "gai.conf" = fs "80001ff" null null;
-        "group" = fs "180" null "hakurei:x:65534:\n";
-        "host.conf" = fs "80001ff" null null;
-        "hostname" = fs "80001ff" null null;
-        "hosts" = fs "80001ff" null null;
-        "inputrc" = fs "80001ff" null null;
-        "issue" = fs "80001ff" null null;
-        "kbd" = fs "80001ff" null null;
-        "locale.conf" = fs "80001ff" null null;
-        "login.defs" = fs "80001ff" null null;
-        "lsb-release" = fs "80001ff" null null;
-        "lvm" = fs "80001ff" null null;
-        "machine-id" = fs "80001ff" null null;
-        "man_db.conf" = fs "80001ff" null null;
-        "modprobe.d" = fs "80001ff" null null;
-        "modules-load.d" = fs "80001ff" null null;
-        "mtab" = fs "80001ff" null null;
-        "nanorc" = fs "80001ff" null null;
-        "netgroup" = fs "80001ff" null null;
-        "nix" = fs "80001ff" null null;
-        "nixos" = fs "80001ff" null null;
-        "nscd.conf" = fs "80001ff" null null;
-        "nsswitch.conf" = fs "80001ff" null null;
-        "os-release" = fs "80001ff" null null;
-        "pam" = fs "80001ff" null null;
-        "pam.d" = fs "80001ff" null null;
-        "passwd" = fs "180" null "u0_a1:x:65534:65534:Hakurei:/var/lib/hakurei/u0/a1:/run/current-system/sw/bin/bash\n";
-        "pipewire" = fs "80001ff" null null;
-        "pki" = fs "80001ff" null null;
-        "polkit-1" = fs "80001ff" null null;
-        "profile" = fs "80001ff" null null;
-        "protocols" = fs "80001ff" null null;
-        "resolv.conf" = fs "80001ff" null null;
-        "resolvconf.conf" = fs "80001ff" null null;
-        "rpc" = fs "80001ff" null null;
-        "services" = fs "80001ff" null null;
-        "set-environment" = fs "80001ff" null null;
-        "shadow" = fs "80001ff" null null;
-        "shells" = fs "80001ff" null null;
-        "speech-dispatcher" = fs "80001ff" null null;
-        "ssh" = fs "80001ff" null null;
-        "ssl" = fs "80001ff" null null;
-        "static" = fs "80001ff" null null;
-        "subgid" = fs "80001ff" null null;
-        "subuid" = fs "80001ff" null null;
-        "sudoers" = fs "80001ff" null null;
-        "sway" = fs "80001ff" null null;
-        "sysctl.d" = fs "80001ff" null null;
-        "systemd" = fs "80001ff" null null;
-        "terminfo" = fs "80001ff" null null;
-        "tmpfiles.d" = fs "80001ff" null null;
-        "udev" = fs "80001ff" null null;
-        "vconsole.conf" = fs "80001ff" null null;
-        "xdg" = fs "80001ff" null null;
-        "zoneinfo" = fs "80001ff" null null;
-      } null;
-      nix = fs "800001c0" { store = fs "801001fd" null null; } null;
-      proc = fs "8000016d" null null;
-      run = fs "800001ed" {
-        current-system = fs "80001ff" null null;
-        opengl-driver = fs "80001ff" null null;
-        user = fs "800001ed" {
-          "65534" = fs "800001c0" {
-            bus = fs "10001fd" null null;
-            pulse = fs "800001c0" { native = fs "10001ff" null null; } null;
-            wayland-0 = fs "1000038" null null;
-          } null;
-        } null;
-      } null;
-      sys = fs "800001c0" {
-        block = fs "800001ed" (
-          {
-            ${extraPaths.${system}.fd} = fs "80001ff" null null;
-            loop0 = fs "80001ff" null null;
-            loop1 = fs "80001ff" null null;
-            loop2 = fs "80001ff" null null;
-            loop3 = fs "80001ff" null null;
-            loop4 = fs "80001ff" null null;
-            loop5 = fs "80001ff" null null;
-            loop6 = fs "80001ff" null null;
-            loop7 = fs "80001ff" null null;
-            vda = fs "80001ff" null null;
-          }
-          // extraPaths.${system}.sr
-        ) null;
-        bus = fs "800001ed" null null;
-        class = fs "800001ed" null null;
-        dev = fs "800001ed" {
-          block = fs "800001ed" null null;
-          char = fs "800001ed" null null;
-        } null;
-        devices = fs "800001ed" null null;
-      } null;
-      tmp = fs "801001ff" { } null;
-      usr = fs "800001c0" { bin = fs "800001ed" { env = fs "80001ff" null null; } null; } null;
-      var = fs "800001c0" {
-        tmp = fs "801001ff" null null;
-        lib = fs "800001c0" {
-          hakurei = fs "800001c0" {
-            u0 = fs "800001c0" {
-              a1 = fs "800001c0" {
-                ".cache" = fs "800001ed" { ".keep" = fs "80001ff" null ""; } null;
-                ".config" = fs "800001ed" {
-                  "environment.d" = fs "800001ed" { "10-home-manager.conf" = fs "80001ff" null null; } null;
-                  systemd = fs "800001ed" {
-                    user = fs "800001ed" { "tray.target" = fs "80001ff" null null; } null;
-                  } null;
-                } null;
-                ".local" = fs "800001ed" {
-                  state = fs "800001ed" {
-                    ".keep" = fs "80001ff" null "";
-                    home-manager = fs "800001ed" { gcroots = fs "800001ed" { current-home = fs "80001ff" null null; } null; } null;
-                    nix = fs "800001ed" {
-                      profiles = fs "800001ed" {
-                        profile = fs "80001ff" null null;
-                        profile-1-link = fs "80001ff" null null;
-                      } null;
-                    } null;
-                  } null;
-                } null;
-                ".nix-defexpr" = fs "800001ed" {
-                  channels = fs "80001ff" null null;
-                  channels_root = fs "80001ff" null null;
-                } null;
-                ".nix-profile" = fs "80001ff" null null;
-              } null;
-            } null;
-          } null;
-        } null;
-      } null;
-    } null;
-
-    mount = [
-      (ent "/sysroot" "/" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10001,gid=10001")
-      (ent "/" "/proc" "rw,nosuid,nodev,noexec,relatime" "proc" "proc" "rw")
-      (ent "/" "/.hakurei" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=4k,mode=755,uid=10001,gid=10001")
-      (ent "/" "/dev" "ro,nosuid,nodev,relatime" "tmpfs" "devtmpfs" "rw,mode=755,uid=10001,gid=10001")
-      (ent "/null" "/dev/null" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/zero" "/dev/zero" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/full" "/dev/full" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/random" "/dev/random" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/urandom" "/dev/urandom" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/tty" "/dev/tty" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/" "/dev/pts" "rw,nosuid,noexec,relatime" "devpts" "devpts" "rw,mode=620,ptmxmode=666")
-      (ent "/" "/dev/mqueue" "rw,nosuid,nodev,noexec,relatime" "mqueue" "mqueue" "rw")
-      (ent "/" "/dev/shm" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,uid=10001,gid=10001")
-      (ent "/" "/run/user" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=16384k,mode=755,uid=10001,gid=10001")
-      (ent "/" "/tmp" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,uid=10001,gid=10001")
-      (ent ignore "/etc/passwd" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10001,gid=10001")
-      (ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10001,gid=10001")
-      (ent ignore "/run/user/65534/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent ignore "/run/user/65534/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/usr/bin" "/usr/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/" "/nix/store" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/sysroot/nix/.ro-store,upperdir=/sysroot/nix/.rw-store/upper,workdir=/sysroot/nix/.rw-store/work,uuid=on")
-      (ent "/block" "/sys/block" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/bus" "/sys/bus" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/class" "/sys/class" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/dev" "/sys/dev" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/devices" "/sys/devices" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/dri" "/dev/dri" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/var/tmp" "/var/tmp" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/var/lib/hakurei/u0/a1" "/var/lib/hakurei/u0/a1" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent ignore "/run/user/65534/pulse/native" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-    ];
-
-    seccomp = true;
-
-    try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = false;
-    socket_pathname = false;
-  };
-}
diff --git a/test/sandbox/case/tty.nix b/test/sandbox/case/tty.nix
deleted file mode 100644
index 4ba9360e..00000000
--- a/test/sandbox/case/tty.nix
+++ /dev/null
@@ -1,288 +0,0 @@
-{
-  fs,
-  ent,
-  ignore,
-  system,
-}:
-let
-  extraPaths = {
-    x86_64-linux = {
-      fd = "fd0";
-      "/dev/dri" = {
-        by-path = fs "800001ed" {
-          "pci-0000:00:09.0-card" = fs "80001ff" null null;
-          "pci-0000:00:09.0-render" = fs "80001ff" null null;
-        } null;
-        card0 = fs "42001b0" null null;
-        renderD128 = fs "42001b6" null null;
-      };
-      sr = {
-        sr0 = fs "80001ff" null null;
-      };
-    };
-    aarch64-linux = {
-      fd = "mtdblock0";
-      "/dev/dri" = null;
-      sr = { };
-    };
-  };
-in
-{
-  name = "tty";
-  tty = true;
-  device = false;
-  mapRealUid = false;
-  useCommonPaths = true;
-  userns = false;
-  x11 = true;
-  hostAbstract = true;
-  shareRuntime = true;
-  shareTmpdir = false;
-
-  # 0, PresetExt | PresetDenyNS | PresetDenyDevel
-  expectedFilter = {
-    x86_64-linux = "0b76007476c1c9e25dbf674c29fdf609a1656a70063e49327654e1b5360ad3da06e1a3e32bf80e961c5516ad83d4b9e7e9bde876a93797e27627d2555c25858b";
-    aarch64-linux = "cf1f4dc87436ba8ec95d268b663a6397bb0b4a5ac64d8557e6cc529d8b0f6f65dad3a92b62ed29d85eee9c6dde1267757a4d0f86032e8a45ca1bceadfa34cf5e";
-  };
-
-  want = {
-    env = [
-      "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/65534/bus"
-      "DISPLAY=:0"
-      "HOME=/var/lib/hakurei/u0/a2"
-      "SHELL=/run/current-system/sw/bin/bash"
-      "TERM=linux"
-      "USER=u0_a2"
-      "WAYLAND_DISPLAY=wayland-0"
-      "XDG_RUNTIME_DIR=/run/user/65534"
-      "XDG_SESSION_CLASS=user"
-      "XDG_SESSION_TYPE=wayland"
-      "PULSE_SERVER=unix:/run/user/65534/pulse/native"
-    ];
-
-    fs = fs "dead" {
-      ".hakurei" = fs "800001ed" {
-        ".ro-store" = fs "801001fd" null null;
-        store = fs "800001ff" null null;
-      } null;
-      bin = fs "800001ed" { sh = fs "80001ff" null null; } null;
-      dev = fs "800001ed" {
-        console = fs "4200190" null null;
-        core = fs "80001ff" null null;
-        dri = fs "800001ed" extraPaths.${system}."/dev/dri" null;
-        fd = fs "80001ff" null null;
-        full = fs "42001b6" null null;
-        mqueue = fs "801001ff" { } null;
-        null = fs "42001b6" null "";
-        ptmx = fs "80001ff" null null;
-        pts = fs "800001ed" { ptmx = fs "42001b6" null null; } null;
-        random = fs "42001b6" null null;
-        shm = fs "801001ff" { } null;
-        stderr = fs "80001ff" null null;
-        stdin = fs "80001ff" null null;
-        stdout = fs "80001ff" null null;
-        tty = fs "42001b6" null null;
-        urandom = fs "42001b6" null null;
-        zero = fs "42001b6" null null;
-      } null;
-      etc = fs "800001ed" {
-        ".clean" = fs "80001ff" null null;
-        ".host" = fs "800001c0" null null;
-        ".updated" = fs "80001ff" null null;
-        "NIXOS" = fs "80001ff" null null;
-        "X11" = fs "80001ff" null null;
-        "alsa" = fs "80001ff" null null;
-        "bash_logout" = fs "80001ff" null null;
-        "bashrc" = fs "80001ff" null null;
-        "binfmt.d" = fs "80001ff" null null;
-        "dbus-1" = fs "80001ff" null null;
-        "default" = fs "80001ff" null null;
-        "dhcpcd.exit-hook" = fs "80001ff" null null;
-        "environment.d" = fs "80001ff" null null;
-        "fonts" = fs "80001ff" null null;
-        "fstab" = fs "80001ff" null null;
-        "hsurc" = fs "80001ff" null null;
-        "fuse.conf" = fs "80001ff" null null;
-        "gai.conf" = fs "80001ff" null null;
-        "group" = fs "180" null "hakurei:x:65534:\n";
-        "host.conf" = fs "80001ff" null null;
-        "hostname" = fs "80001ff" null null;
-        "hosts" = fs "80001ff" null null;
-        "inputrc" = fs "80001ff" null null;
-        "issue" = fs "80001ff" null null;
-        "kbd" = fs "80001ff" null null;
-        "locale.conf" = fs "80001ff" null null;
-        "login.defs" = fs "80001ff" null null;
-        "lsb-release" = fs "80001ff" null null;
-        "lvm" = fs "80001ff" null null;
-        "machine-id" = fs "80001ff" null null;
-        "man_db.conf" = fs "80001ff" null null;
-        "modprobe.d" = fs "80001ff" null null;
-        "modules-load.d" = fs "80001ff" null null;
-        "mtab" = fs "80001ff" null null;
-        "nanorc" = fs "80001ff" null null;
-        "netgroup" = fs "80001ff" null null;
-        "nix" = fs "80001ff" null null;
-        "nixos" = fs "80001ff" null null;
-        "nscd.conf" = fs "80001ff" null null;
-        "nsswitch.conf" = fs "80001ff" null null;
-        "os-release" = fs "80001ff" null null;
-        "pam" = fs "80001ff" null null;
-        "pam.d" = fs "80001ff" null null;
-        "passwd" = fs "180" null "u0_a2:x:65534:65534:Hakurei:/var/lib/hakurei/u0/a2:/run/current-system/sw/bin/bash\n";
-        "pipewire" = fs "80001ff" null null;
-        "pki" = fs "80001ff" null null;
-        "polkit-1" = fs "80001ff" null null;
-        "profile" = fs "80001ff" null null;
-        "protocols" = fs "80001ff" null null;
-        "resolv.conf" = fs "80001ff" null null;
-        "resolvconf.conf" = fs "80001ff" null null;
-        "rpc" = fs "80001ff" null null;
-        "services" = fs "80001ff" null null;
-        "set-environment" = fs "80001ff" null null;
-        "shadow" = fs "80001ff" null null;
-        "shells" = fs "80001ff" null null;
-        "speech-dispatcher" = fs "80001ff" null null;
-        "ssh" = fs "80001ff" null null;
-        "ssl" = fs "80001ff" null null;
-        "static" = fs "80001ff" null null;
-        "subgid" = fs "80001ff" null null;
-        "subuid" = fs "80001ff" null null;
-        "sudoers" = fs "80001ff" null null;
-        "sway" = fs "80001ff" null null;
-        "sysctl.d" = fs "80001ff" null null;
-        "systemd" = fs "80001ff" null null;
-        "terminfo" = fs "80001ff" null null;
-        "tmpfiles.d" = fs "80001ff" null null;
-        "udev" = fs "80001ff" null null;
-        "vconsole.conf" = fs "80001ff" null null;
-        "xdg" = fs "80001ff" null null;
-        "zoneinfo" = fs "80001ff" null null;
-      } null;
-      nix = fs "800001c0" { store = fs "801001fd" null null; } null;
-      proc = fs "8000016d" null null;
-      run = fs "800001ed" {
-        current-system = fs "80001ff" null null;
-        opengl-driver = fs "80001ff" null null;
-        user = fs "800001ed" {
-          "65534" = fs "800001f8" {
-            bus = fs "10001fd" null null;
-            pulse = fs "800001c0" { native = fs "10001ff" null null; } null;
-            wayland-0 = fs "1000038" null null;
-          } null;
-        } null;
-      } null;
-      sys = fs "800001c0" {
-        block = fs "800001ed" (
-          {
-            ${extraPaths.${system}.fd} = fs "80001ff" null null;
-            loop0 = fs "80001ff" null null;
-            loop1 = fs "80001ff" null null;
-            loop2 = fs "80001ff" null null;
-            loop3 = fs "80001ff" null null;
-            loop4 = fs "80001ff" null null;
-            loop5 = fs "80001ff" null null;
-            loop6 = fs "80001ff" null null;
-            loop7 = fs "80001ff" null null;
-            vda = fs "80001ff" null null;
-          }
-          // extraPaths.${system}.sr
-        ) null;
-        bus = fs "800001ed" null null;
-        class = fs "800001ed" null null;
-        dev = fs "800001ed" {
-          block = fs "800001ed" null null;
-          char = fs "800001ed" null null;
-        } null;
-        devices = fs "800001ed" null null;
-      } null;
-      tmp = fs "801001ff" {
-        ".X11-unix" = fs "801001ff" { X0 = fs "10001fd" null null; } null;
-      } null;
-      usr = fs "800001c0" { bin = fs "800001ed" { env = fs "80001ff" null null; } null; } null;
-      var = fs "800001c0" {
-        tmp = fs "801001ff" null null;
-        lib = fs "800001c0" {
-          hakurei = fs "800001c0" {
-            u0 = fs "800001c0" {
-              a2 = fs "800001c0" {
-                ".cache" = fs "800001ed" { ".keep" = fs "80001ff" null ""; } null;
-                ".config" = fs "800001ed" {
-                  "environment.d" = fs "800001ed" { "10-home-manager.conf" = fs "80001ff" null null; } null;
-                  systemd = fs "800001ed" {
-                    user = fs "800001ed" { "tray.target" = fs "80001ff" null null; } null;
-                  } null;
-                } null;
-                ".local" = fs "800001ed" {
-                  state = fs "800001ed" {
-                    ".keep" = fs "80001ff" null "";
-                    home-manager = fs "800001ed" { gcroots = fs "800001ed" { current-home = fs "80001ff" null null; } null; } null;
-                    nix = fs "800001ed" {
-                      profiles = fs "800001ed" {
-                        profile = fs "80001ff" null null;
-                        profile-1-link = fs "80001ff" null null;
-                      } null;
-                    } null;
-                  } null;
-                } null;
-                ".nix-defexpr" = fs "800001ed" {
-                  channels = fs "80001ff" null null;
-                  channels_root = fs "80001ff" null null;
-                } null;
-                ".nix-profile" = fs "80001ff" null null;
-              } null;
-            } null;
-          } null;
-        } null;
-        cache = fs "800001ed" { private = fs "800001c0" null null; } null;
-      } null;
-    } null;
-
-    mount = [
-      (ent "/sysroot" "/" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10002,gid=10002")
-      (ent "/" "/proc" "rw,nosuid,nodev,noexec,relatime" "proc" "proc" "rw")
-      (ent "/" "/.hakurei" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=4k,mode=755,uid=10002,gid=10002")
-      (ent "/" "/dev" "ro,nosuid,nodev,relatime" "tmpfs" "devtmpfs" "rw,mode=755,uid=10002,gid=10002")
-      (ent "/null" "/dev/null" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/zero" "/dev/zero" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/full" "/dev/full" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/random" "/dev/random" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/urandom" "/dev/urandom" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/tty" "/dev/tty" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/" "/dev/pts" "rw,nosuid,noexec,relatime" "devpts" "devpts" "rw,mode=620,ptmxmode=666")
-      (ent ignore "/dev/console" "rw,nosuid,noexec,relatime" "devpts" "devpts" "rw,gid=3,mode=620,ptmxmode=666")
-      (ent "/" "/dev/mqueue" "rw,nosuid,nodev,noexec,relatime" "mqueue" "mqueue" "rw")
-      (ent "/" "/dev/shm" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,uid=10002,gid=10002")
-      (ent "/" "/run/user" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,size=16384k,mode=755,uid=10002,gid=10002")
-      (ent "/tmp/hakurei.0/runtime/2" "/run/user/65534" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/" "/tmp" "rw,nosuid,nodev,relatime" "tmpfs" "ephemeral" "rw,uid=10002,gid=10002")
-      (ent ignore "/etc/passwd" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10002,gid=10002")
-      (ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10002,gid=10002")
-      (ent ignore "/run/user/65534/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/tmp/.X11-unix" "/tmp/.X11-unix" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent ignore "/run/user/65534/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/usr/bin" "/usr/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/" "/nix/store" "ro,nosuid,nodev,relatime" "overlay" "overlay" "rw,lowerdir=/sysroot/nix/.ro-store,upperdir=/sysroot/nix/.rw-store/upper,workdir=/sysroot/nix/.rw-store/work,uuid=on")
-      (ent "/block" "/sys/block" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/bus" "/sys/bus" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/class" "/sys/class" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/dev" "/sys/dev" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/devices" "/sys/devices" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
-      (ent "/dri" "/dev/dri" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/var/tmp" "/var/tmp" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/var/cache" "/var/cache" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/" "/.hakurei/.ro-store" "rw,relatime" "overlay" "overlay" "ro,lowerdir+=/host/nix/.ro-store,lowerdir+=/host/nix/.rw-store/upper,redirect_dir=nofollow,userxattr")
-      (ent "/" "/.hakurei/store" "rw,relatime" "overlay" "overlay" "rw,lowerdir+=/host/nix/.ro-store,lowerdir+=/host/nix/.rw-store/upper,upperdir=/host/tmp/.hakurei-store-rw/upper,workdir=/host/tmp/.hakurei-store-rw/work,redirect_dir=nofollow,uuid=on,userxattr")
-      (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent "/var/lib/hakurei/u0/a2" "/var/lib/hakurei/u0/a2" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent ignore "/run/user/65534/pulse/native" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-    ];
-
-    seccomp = true;
-
-    try_socket = "/tmp/.X11-unix/X0";
-    socket_abstract = true;
-    socket_pathname = true;
-  };
-}