CONFIG_PROTECT_MASK="/etc/sandbox.d"