;;;;;; Common system sandbox rules
;;;;;;
;;;;;; Copyright (c) 2008-2009 Apple Inc.  All Rights reserved.
;;;;;;
;;;;;; WARNING: The sandbox rules in this file currently constitute
;;;;;; Apple System Private Interface and are subject to change at any time and
;;;;;; without notice. The contents of this file are also auto-generated and
;;;;;; not user editable; it may be overwritten at any time.

(version 1)

;;; Allow registration of per-pid services.
(allow mach-register
       (local-name-regex #""))

;;; Allow read access to standard system paths.
(allow file-read*
       (require-all (file-mode #o0004)
                    (require-any (subpath "/Library/Filesystems/NetFSPlugins")
                                 (subpath "/System")
                                 (subpath "/private/var/db/dyld")
                                 (subpath "/usr/lib")
                                 (subpath "/usr/share"))))

(allow file-read-metadata
       (literal "/etc")
       (literal "/tmp")
       (literal "/var")
       (literal "/private/etc/localtime"))


;;; Allow access to standard special files.
(allow file-read*
       (literal "/dev/autofs_nowait")
       (literal "/dev/random")
       (literal "/dev/urandom")
       (literal "/private/etc/master.passwd")
       (literal "/private/etc/passwd"))

(allow file-read*
       file-write-data
       (literal "/dev/null")
       (literal "/dev/zero"))

(allow file-read*
       file-write-data
       file-ioctl
       (literal "/dev/dtracehelper"))

(allow network-outbound
       (literal "/private/var/run/asl_input")
       (literal "/private/var/run/syslog"))


;;; Allow creation of core dumps.
(allow file-write-create
       (require-all (regex #"^/cores/")
                    (vnode-type REGULAR-FILE)))


;;; Allow IPC to standard system agents.
(allow ipc-posix-shm-read*
       (ipc-posix-name #"apple.shm.notification_center")
       (ipc-posix-name-regex #"^apple\.shm\.cfprefsd\."))

(allow mach-lookup
       (global-name "com.apple.appsleep")
       (global-name "com.apple.bsd.dirhelper")
       (global-name "com.apple.cfprefsd.agent")
       (global-name "com.apple.cfprefsd.daemon")
       (global-name "com.apple.diagnosticd")
       (global-name "com.apple.system.logger")
       (global-name "com.apple.system.notification_center")
       (global-name "com.apple.system.opendirectoryd.libinfo")
       (global-name "com.apple.system.DirectoryService.libinfo_v1")
       (global-name "com.apple.system.opendirectoryd.membership")
       (global-name "com.apple.xpc.activity.unmanaged")
       (global-name "com.apple.xpcd")
       (global-name "com.apple.secinitd")
       (global-name "com.apple.espd")
       (global-name "com.apple.gkbisd")
       (local-name "com.apple.cfprefsd.agent"))


;;; Allow mostly harmless operations.
(allow sysctl-read)


;;; (system-graphics) - Allow access to graphics hardware.
(define (system-graphics)
  ;; Preferences
  (allow user-preference-read
         (preference-domain "com.apple.opengl")
         (preference-domain "com.nvidia.OpenGL"))
  ;; OpenGL memory debugging
  (allow mach-lookup
         (global-name "com.apple.gpumemd.source"))
  ;; CVMS
  (allow mach-lookup
         (global-name "com.apple.cvmsServ"))
  ;; OpenCL
  (allow iokit-open
         (iokit-connection "IOAccelerator")
         (iokit-user-client-class "IOAccelerationUserClient")
         (iokit-user-client-class "IOSurfaceRootUserClient")
         (iokit-user-client-class "IOSurfaceSendRight"))
  ;; CoreVideo CVCGDisplayLink
  (allow iokit-open
         (iokit-user-client-class "IOFramebufferSharedUserClient"))
  ;; H.264 Acceleration
  (allow iokit-open
         (iokit-user-client-class "AppleSNBFBUserClient"))
  ;; QuartzCore
  (allow iokit-open
         (iokit-user-client-class "AGPMClient")
         (iokit-user-client-class "AppleGraphicsControlClient")
         (iokit-user-client-class "AppleGraphicsPolicyClient"))
  ;; OpenGL
  (allow iokit-open
         (iokit-user-client-class "AppleMGPUPowerControlClient"))
  ;; DisplayServices
  (allow iokit-set-properties
         (require-all (iokit-connection "IODisplay")
                      (require-any (iokit-property "brightness")
                                   (iokit-property "linear-brightness")
                                   (iokit-property "commit")
                                   (iokit-property "rgcs")
                                   (iokit-property "ggcs")
                                   (iokit-property "bgcs")))))


;;; (system-network) - Allow access to the network.
(define (system-network)
  (allow file-read*
         (literal "/Library/Preferences/com.apple.networkd.plist"))
  (allow mach-lookup
         (global-name "com.apple.SystemConfiguration.PPPController")
         (global-name "com.apple.SystemConfiguration.SCNetworkReachability")
         (global-name "com.apple.networkd")
         (global-name "com.apple.nsurlstorage-cache")
         (global-name "com.apple.symptomsd")
         (global-name "com.apple.usymptomsd"))
  (allow network-outbound
         (control-name "com.apple.netsrc")
         (control-name "com.apple.network.statistics"))
  (allow system-socket
         (require-all (socket-domain AF_SYSTEM)
                      (socket-protocol 2)) ; SYSPROTO_CONTROL
         (socket-domain AF_ROUTE)))