--
application.sb
485a486,488
> (with-filter
>   (extension "com.apple.app-sandbox.read-write")
>   (allow file-link (home-subpath "/Library/Mobile Documents")))
562,563c565
<                    "\\..*\\.plist$")))
<         (%protect-preference-symlink domain)))
---
>                    "\\..*\\.plist$")))))
584,585c586
<                    "\\..*\\.plist(\\..+)?$")))
<         (%protect-preference-symlink domain)))
---
>                    "\\..*\\.plist(\\..+)?$")))))
638c639
<              (global-name "com.apple.blued"))
---
>              (global-name "com.apple.bluetoothd"))
840,843c841,845
< (read-only-and-issue-extensions
<   (require-all
<     (extension "com.apple.librarian.ubiquity-revision")
<     (mount-relative-regex "^/\\.DocumentRevisions-V100(/|$)")))
---
> (sandbox-array-entitlement
>   "com.apple.developer.icloud-container-identifiers"
>   (lambda (id)
>     (allow file-link (ubiquity-filter id))
>     (read-write-and-issue-extensions (ubiquity-filter id))))
927,929d928
<       (deny file-read*
<             file-write*
<             (group-container-subpath "/Library/Preferences"))
997a997
>   "com.apple.airplay"
1022a1023,1024
> (%protect-preference-symlink "com.apple.security_common")
> (%protect-preference-symlink "com.apple.security")
1085a1088
>        (literal "/private/etc/openldap/ldap.conf")
1090c1093
<        (literal "/private/etc/openldap/ldap.conf")
---
>        (literal "/private/etc/ssl/openssl.cnf")
1133a1137,1138
>        (global-name "com.apple.audio.AudioComponentPrefs")
>        (global-name "com.apple.audio.AudioComponentRegistrar")
1138a1144
>        (global-name "com.apple.cache_delete.public")
1139a1146
>        (global-name "com.apple.colorsync.useragent")
1144a1152,1154
>        (global-name "com.apple.coremedia.routediscoverer.xpc")
>        (global-name "com.apple.coremedia.routingcontext.xpc")
>        (global-name "com.apple.coremedia.volumecontroller.xpc")
1153d1162
<        (global-name "com.apple.decalog4.incoming")
1159a1169
>        (global-name "com.apple.FileProvider")
1177d1186
<        (global-name "com.apple.librariand")
1216a1226
>        (global-name "com.apple.tailspind")
1232a1243,1245
> (with-filter
>   (iokit-registry-entry-class "IODisplayWrangler")
>   (allow iokit-set-properties (iokit-property "IORequestIdle")))
1245d1257
< (allow mach-register (local-name "com.apple.ICA"))
1401a1414,1429
> (define (select-sysctl-filter handle with-star without-star)
>   (if (end-with-star? handle)
>     (with-star (strip-last-char handle))
>     (without-star handle)))
> (sandbox-array-entitlement
>   "com.apple.security.temporary-exception.sysctl.read-only"
>   (lambda (handle)
>     (let ((sysctl-filter
>             (select-sysctl-filter handle sysctl-name-prefix sysctl-name)))
>       (allow sysctl-read sysctl-filter))))
> (sandbox-array-entitlement
>   "com.apple.security.temporary-exception.sysctl.read-write"
>   (lambda (handle)
>     (let ((sysctl-filter
>             (select-sysctl-filter handle sysctl-name-prefix sysctl-name)))
>       (allow sysctl-read sysctl-write sysctl-filter))))
--
apsd.sb
Files /System/Library/Sandbox/Profiles/apsd.sb and apsd.sb are identical
--
bsd.sb
25c25
<     #"^/usr/share/zoneinfo/"
---
>     #"^/var/db/timezone/zoneinfo/"
--
cloudpaird.sb
138c138
<     (global-name "com.apple.blued")
---
>     (global-name "com.apple.bluetoothd")
--
colorsyncd.sb
20,21c20,26
< (allow file-read* file-write-data file-write-create file-write-unlink file-write-owner (subpath "/Library/ColorSync/Profiles"))
< (deny file-write-data file-write-create file-write-unlink file-write-owner (literal "/Library/ColorSync/Profiles"))
---
> (define (allow-create-directory . filters)
>     (allow file-read-metadata
>            (apply require-any filters))
>     (allow file-read-metadata file-write-create
>         (require-all
>             (vnode-type DIRECTORY)
>             (apply require-any filters))))
23,26c28,54
< (allow file-write-create
<    (require-all
<       (vnode-type DIRECTORY)
<       (literal "/Library/ColorSync/Profiles" "/Library/ColorSync" "/Library")))
---
> ;; Allow the creation of only a directory at these paths.
> (allow-create-directory
>     (literal "/Library/Caches")
>     (literal "/Library/Caches/ColorSync"))
> ;; Allow reading the contents of our directory
> (allow file-read*
>     (literal "/Library/Caches/ColorSync"))
> ;; Allow full access to anything below our directory.
> (allow file-read* file-write*
>     (prefix "/Library/Caches/ColorSync/"))
>
> (allow-create-directory
>     (literal "/Library/ColorSync")
>     (literal "/Library/ColorSync/Profiles"))
> (allow file-read*
>     (literal "/Library/ColorSync/Profiles"))
> (allow file-read* file-write*
>     (prefix "/Library/ColorSync/Profiles/"))
>
> ;; deny the removal of these pre-installed profiles.
> (deny file-write-unlink
>     (literal "/Library/ColorSync/Profiles/Black & White.icc")
>     (literal "/Library/ColorSync/Profiles/Blue Tone.icc")
>     (literal "/Library/ColorSync/Profiles/Lightness Decrease.icc")
>     (literal "/Library/ColorSync/Profiles/Lightness Increase.icc")
>     (literal "/Library/ColorSync/Profiles/Sepia Tone.icc")
>     (literal "/Library/ColorSync/Profiles/WebSafeColors.icc"))
--
com.apple.AirPlayXPCHelper.sb
66,69c66,74
<     (iokit-user-client-class "IOBluetoothRFCOMMConnectionUserClient")
<     (iokit-user-client-class "IOBluetoothRFCOMMChannelUserClient")
<     (iokit-user-client-class "IOBluetoothL2CAPChannelUserClient")
<     (iokit-user-client-class "IOBluetoothDeviceUserClient")
---
> 	(iokit-user-client-class "IOBluetoothRFCOMMConnectionUserClient")
> 	(iokit-user-client-class "IOBluetoothRFCOMMChannelUserClient")
> 	(iokit-user-client-class "IOBluetoothL2CAPChannelUserClient")
> 	(iokit-user-client-class "IOBluetoothDeviceUserClient")
> 	(iokit-user-client-class "IOTimeSyncUserClient")
> 	(iokit-user-client-class "IOTimeSyncClockManagerUserClient")
> 	(iokit-user-client-class "IOTimeSyncgPTPManagerUserClient")
> 	(iokit-user-client-class "IOTimeSyncDomainUserClient")
> 	(iokit-user-client-class "IOTimeSyncNetworkPortUserClient")
86a92
> 	(global-name "com.apple.analyticsd")
88a95
> 	(global-name "com.apple.audio.AudioComponentRegistrar")
105c112
< 	(global-name "com.apple.blued")
---
> 	(global-name "com.apple.bluetoothd")
108c115,118
<     (global-name "com.apple.airportd")
---
> 	(global-name "com.apple.airportd")
>
> 	(global-name "com.apple.distributed_notifications@1v3")
> 	(global-name "com.apple.distributed_notifications@Uv3")
118a129
> 	(literal "/Library/Preferences/com.apple.alf.plist")
126a138
> 	(preference-domain "com.apple.alf")
--
com.apple.AnnotationKit.MigratorService.sb
Files /System/Library/Sandbox/Profiles/com.apple.AnnotationKit.MigratorService.sb and com.apple.AnnotationKit.MigratorService.sb are identical
--
com.apple.AssetCacheLocatorService.sb
20,21d19
< (allow file-read-metadata
<        (literal "/Applications/Server.app/Contents/ServerRoot/usr/libexec/AssetCache/AssetCache"))
28d25
<        (global-name "com.apple.AssetCacheC")
--
com.apple.AssetCacheManagerService.sb
0a1,18
> (version 1)
> (deny default)
> (import "bsd.sb")
> (import "com.apple.corefoundation.sb")
> (corefoundation)
> (allow file-read* file-write*
>        (literal "/Library/Preferences/com.apple.AssetCache.plist")
>        (regex #"^(/private)?/var/folders/[^/]+/[^/]+/C($|/)")
>        (regex #"^(/private)?/var/folders/[^/]+/[^/]+/T($|/)")
>        (regex #"/Library/Application Support/Apple/AssetCache$")
>        (regex #"/Library/Application Support/Apple/AssetCache/Data$")
>        (literal "/Library/Application Support/Apple/AssetCache/.activated"))
> (allow file-write-create
>        (regex #"/Library$")
>        (regex #"/Library/Application Support$")
>        (regex #"/Library/Application Support/Apple$"))
> (allow mach-lookup
>        (global-name "com.apple.AssetCache.builtin"))
--
com.apple.AssetCacheTetheratorService.sb
12c12,14
<        (literal "/Library/Preferences/com.apple.MobileDevice.plist"))                                          ; for reading MobileDevice prefs
---
>        (literal "/Library/Preferences/com.apple.MobileDevice.plist")                                           ; for reading MobileDevice prefs
>        (literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains")                           ; for CrashReporter
>        (literal "/Library/MessageTracer/SubmitDiagInfo.default.domains.searchtree"))                           ; for MessageTracer
24c26,27
<        (global-name "com.apple.wifi.sharekit"))                                                                ; for using Internet Sharing
---
>        (global-name "com.apple.wifi.sharekit")                                                                 ; for using Internet Sharing
>        (global-name "com.apple.PowerManagement.control"))                                                      ; for power assertions
--
com.apple.AudioComponentRegistrar.sb
0a1,68
> ;;; Copyright (c) 2017 Apple Inc.  All Rights reserved.
> ;;;
> ;;; WARNING: The sandbox rules in this file currently constitute
> ;;; Apple System Private Interface and are subject to change at any time and
> ;;; without notice.
> ;;;
> (version 1)
>
> (deny default)
> (deny file-map-executable iokit-get-properties process-info* nvram*)
> (deny dynamic-code-generation)
>
> (import "system.sb")
> (import "com.apple.corefoundation.sb")
> (corefoundation)
>
> ;;; Homedir-relative path filters
> (define (home-regex home-relative-regex)
>   (regex (string-append "^" (regex-quote (param "HOME")) home-relative-regex)))
>
> (define (home-subpath home-relative-subpath)
>   (subpath (string-append (param "HOME") home-relative-subpath)))
>
> (define (home-prefix home-relative-prefix)
>   (prefix (string-append (param "HOME") home-relative-prefix)))
>
> (define (home-literal home-relative-literal)
>   (literal (string-append (param "HOME") home-relative-literal)))
>
>
> (allow process-info* (target self))
>
> ;; For resolving symlinks, realpath(3), and equivalents.
> (allow file-read-metadata)
>
> ;; For validating the entitlements of clients.
> (allow process-info-codesignature)
>
> ;; preference domains.
> (allow user-preference-read user-preference-write
>        (preference-domain "com.apple.coreaudio")
> 	   (preference-domain "com.apple.audio.ComponentRegistrationOverrides")
> 	   (preference-domain "com.apple.audio.UserComponentTags")
> 	   (preference-domain "com.apple.audio.ComponentTagHelper")
> )
>
> ;; Read/write access to a temporary directory.
> (allow file-read* file-write*
>        (subpath (param "TMPDIR"))
>        (subpath (param "DARWIN_CACHE_DIR")))
>
> ;; Above is from the template.
> ;; Below are customizations.  To debug: (trace "/tmp/Sandbox.trace")
>
> (allow file-map-executable
> 		(subpath "/System/Library/PrivateFrameworks")
> )
>
> (allow mach-lookup
> 	(global-name "com.apple.pluginkit.pkd")
> 	(global-name "com.apple.FSEvents")
> 	(global-name "com.apple.DiskArbitration.diskarbitrationd")
> )
>
> (allow file-read*
> 	(subpath "/Library/Audio/Plug-Ins/Components")
> 	(home-subpath "/Library/Audio/Plug-Ins/Components")
> )
--
com.apple.CMValidateMovieDataReferenceService.sb
Files /System/Library/Sandbox/Profiles/com.apple.CMValidateMovieDataReferenceService.sb and com.apple.CMValidateMovieDataReferenceService.sb are identical
--
com.apple.CodeSigningHelper.sb
Files /System/Library/Sandbox/Profiles/com.apple.CodeSigningHelper.sb and com.apple.CodeSigningHelper.sb are identical
--
com.apple.CommerceKit.TransactionService.sb
94a95,96
>        (global-name "com.apple.adid")
>        (global-name "com.apple.fpsd")
--
com.apple.CryptoTokenKit.ctkahp.sb
0a1,69
> ;;;
> ;;; Sandbox profile for /System/Library/Frameworks/CryptoTokenKit.framework/ctkahp.bundle
> ;;;
> ;;; Copyright (c) 2017 Apple Inc.  All Rights reserved.
> ;;;
> ;;; WARNING: The sandbox rules in this file currently constitute
> ;;; Apple System Private Interface and are subject to change at any time and
> ;;; without notice. The contents of this file are also auto-generated and
> ;;; not user editable; it may be overwritten at any time.
>
> (version 1)
>
> (deny default)
>
> (import "system.sb")
>
> (allow file-read*
>        (literal "/private/etc/SmartcardLogin.plist")
>        (literal "/private/etc/cacloginconfig.plist")
>        (subpath (param "DARWIN_USER_TEMP_DIR"))
>        (subpath (param "DARWIN_USER_CACHE_DIR"))
>        (subpath "/private/var/db/mds")
>        (subpath "/private/var/db/"))
>
> (allow file-read-data
>        (literal "/")
>        (literal "/Library/Preferences/com.apple.security.plist"))
>
> (allow file-write*
>        (subpath (param "DARWIN_USER_CACHE_DIR"))
>        (subpath "/private/var/db/mds/system/"))
>
> (allow file-read-metadata)
>
> (allow process-fork)
>
> (allow process-exec
>        (literal "/System/Library/Frameworks/CryptoTokenKit.framework/UserSelector")
>        (subpath "/Library/CryptoTokenKit"))
>
> (allow mach-lookup
>        (global-name "com.apple.distributed_notifications@1v3")
>        (global-name "com.apple.distributed_notifications@Uv3")
>        (global-name "com.apple.ctkd.token-client")
>        (global-name "com.apple.ctkd.watcher-client")
>        (global-name "com.apple.SecurityServer")
>        (global-name "com.apple.CryptoTokenKit.AuthenticationHintsProvider")
>        (global-name "com.apple.CryptoTokenKit.AuthenticationHintsProvider.agent.libxpc")
>        (global-name "com.apple.system.opendirectoryd.api")
>        (global-name "com.apple.CoreServices.coreservicesd")
>        (global-name "com.apple.CoreAuthentication.agent.libxpc")
>        (global-name "com.apple.CoreAuthentication.agent")
>        (global-name "com.apple.ocspd"))
>
> (allow user-preference-read
>     (preference-domain "kCFPreferencesAnyApplication"))
>
> (allow user-preference-read user-preference-write
>       (preference-domain "com.apple.security")
>       (preference-domain "com.apple.security.smartcard"))
>
> (allow ipc-posix-shm-read-data ipc-posix-shm-write-data
>        (ipc-posix-name "com.apple.AppleDatabaseChanged"))
>
> (allow authorization-right-obtain
>        (right-name "com.apple.ctk.pair"))
>
> (allow iokit-open
>        (iokit-user-client-class "AppleKeyStoreUserClient"))
--
com.apple.DumpGPURestart.sb
Files /System/Library/Sandbox/Profiles/com.apple.DumpGPURestart.sb and com.apple.DumpGPURestart.sb are identical
--
com.apple.IOAccelMemoryInfoCollector.sb
Files /System/Library/Sandbox/Profiles/com.apple.IOAccelMemoryInfoCollector.sb and com.apple.IOAccelMemoryInfoCollector.sb are identical
--
com.apple.ModernizerXPC.sb
0a1,230
> ;;;;;; Sandbox Profile for ModernizerXPC derived from QTKitServer
> ;;;;;;
> ;;;;;; Copyright (c) 2011-2017 Apple Inc.  All Rights reserved.
> ;;;;;;
> ;;;;;; WARNING: The sandbox rules in this file currently constitute
> ;;;;;; Apple System Private Interface and are subject to change at any time and
> ;;;;;; without notice. The contents of this file are also auto-generated and
> ;;;;;; not user editable; it may be overwritten at any time.
>
> (version 1)
> (deny default)
>
> (import "system.sb")
> (import "com.apple.corefoundation.sb")
>
> (define (home-regex home-relative-regex)
>        (regex (string-append "^" (regex-quote (param "DARWIN_QTKITSERVER_HOME_DIR")) home-relative-regex)))
> (define regex-home home-regex)
>
> (define (home-subpath home-relative-subpath)
>        (subpath (string-append (param "DARWIN_QTKITSERVER_HOME_DIR") home-relative-subpath)))
>
> (define (home-literal home-relative-literal)
>        (literal (string-append (param "DARWIN_QTKITSERVER_HOME_DIR") home-relative-literal)))
>
> (allow file-read-metadata system-audit)
>
> ;;; initialize CF sandbox actions
> (corefoundation)
>
> (define (apply-read-and-issue-extension op path-filter)
>        (op file-read* path-filter)
>        (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read") path-filter)))
>
> (define (apply-write-and-issue-extension op path-filter)
>        (op file-write* path-filter)
>        (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read-write") path-filter)))
>
> (define (read-only-and-issue-extensions path-filter)
>        (apply-read-and-issue-extension allow path-filter))
>
> (define (read-write-and-issue-extensions path-filter)
>        (apply-read-and-issue-extension allow path-filter)
>        (apply-write-and-issue-extension allow path-filter))
>
> ;;; allow reading files for which we have a read-only app-sandbox extension
> (allow file-read* (extension "com.apple.app-sandbox.read"))
>
> ;;; allow writing of files for which we have an extension
> (allow file-read* file-write* (extension "com.apple.app-sandbox.read-write"))
>
> ;;; allow issuing of extensions for paths we have an extension to
> (allow file-issue-extension
>     (require-all
>         (extension-class "com.apple.app-sandbox.read")
>             (require-any
>                 (extension  "com.apple.app-sandbox.read")
>                 (extension  "com.apple.app-sandbox.read-write"))))
>
> (allow file-issue-extension
>     (require-all
>         (extension-class "com.apple.app-sandbox.read-write")
>         (extension  "com.apple.app-sandbox.read-write")))
>
> (allow file-read*
>        (subpath "/Library/Audio/Plug-Ins")
>        (subpath "/Library/Audio/Sounds/Banks")
>        (subpath "/Library/Frameworks")
>        (subpath "/Library/Fonts")
>        (subpath "/Library/Application Support/ProApps")
>        (subpath "/Library/Preferences")
>        (subpath "/Library/QuickTime")
>        (subpath "/Library/Filesystems/NetFSPlugins"))
>
> (allow file-read-data
>        (subpath "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains")
>        (subpath "/Users/Shared/SC Info")
>        (subpath "/private/var")
>        (subpath "/private/etc"))
>
> ;;; allow reading and issuing extensions to iTunes so it can opened
> ;;; <rdar://problem/13568149>
> (read-only-and-issue-extensions
>        (subpath "/Applications/iTunes.app"))
>
> (allow file-read-xattr
>        (subpath "/Applications/iTunes.app"))
>
> (allow file-read* file-write* (subpath "/Library/Caches"))
>
> (if (param "DARWIN_QTKITSERVER_HOME_DIR")
>     (begin
>         (allow file-read*
>             (home-subpath "/.CFUserTextEncoding")
>             (home-subpath "/Library/Audio/Plug-Ins/Components")
>             (home-subpath "/Library/Audio/Plug-Ins")
>             (home-subpath "/Library/QuickTime")
>             (home-subpath "/Library/Input Methods")
>             (home-subpath "/Library/Keyboard Layouts")
>             (home-subpath "/Library/Components"))
>         (allow file-read* file-write*
>             (home-subpath "/Library/Caches/QuickTime"))
>         (deny file-read* file-write*
>             (home-literal "/Library/Caches/com.nvidia.OpenGL") (with no-report))
>         ;; we have to allow 3rd party components to read and write their own prefs,-
>         ;; but we don't know their names.
>         ;; so allow r/w access to all of ~/Library/Prefs but deny access to prefs beginning with com.apple
>         (allow file-write* file-read*
>             (home-subpath "/Library/Preferences"))
>         (deny file-read* file-write* (with no-report)
>             (home-regex #"/Library/Preferences/com\.apple\..*")
>             (home-regex #"/Library/Preferences/\.GlobalPreferences\.plist")
>             (home-regex #"/Library/Preferences/pbs\.plist")
>             (home-regex #"/Library/Preferences/loginwindow\.plist")
>             (home-regex #"/Library/Preferences/ByHost/com\.apple\..*"))
>         (allow file-read*
>             (home-literal "/Library/Preferences/QuickTime Preferences"))))
>
> (if (param "DARWIN_QTKITSERVER_CACHE_DIR")
>        (allow file-write* file-read* (subpath (param "DARWIN_QTKITSERVER_CACHE_DIR"))))
>
> (if (param "DARWIN_QTKITSERVER_TEMP_DIR")
>        (allow file-write* file-read* (subpath (param "DARWIN_QTKITSERVER_TEMP_DIR"))))
>
> (system-graphics)
>
> (allow iokit-open
>        (iokit-user-client-class "IOAudioControlUserClient")
>        (iokit-user-client-class "IOAudioEngineUserClient")
>        (iokit-user-client-class "IOHIDParamUserClient"))
>
> ;; CoreVideo CVCGDisplayLink
> (allow iokit-open
>        (iokit-user-client-class "IOFramebufferSharedUserClient"))
>
> ;; H.264 Acceleration; <rdar://problem/10348815>
> (allow iokit-open
>        (iokit-user-client-class "AppleSNBFBUserClient"))
>
> ;; QuartzCore; <rdar://problem/9065114>
> (allow iokit-open
>        (iokit-user-client-class "AppleGraphicsControlClient")
>        (iokit-user-client-class "AGPMClient"))
>
> (allow iokit-open
>        (iokit-user-client-class "AppleUpstreamUserClient")
>        (iokit-user-client-class "AudioAUUC"))
>
> ;; BlackMagic; <rdar://problem/11899349>
> (allow iokit-open
>        (iokit-user-client-class "com_blackmagic_design_iokit_DaisyCutterUserClient"))
>
> (allow ipc-posix-shm
>        (ipc-posix-name-regex #"^AudioIO")
>        (ipc-posix-name-regex #"^ls\.")
>        (ipc-posix-name-regex #"^/tmp/com\.apple\.csseed\.")
>        (ipc-posix-name "FNetwork.defaultStorageSession")
>        (ipc-posix-name "apple.shm.notification_center"))
>
> ;; ColorSync Profiles (<rdar://problem/13775802>)
> (allow ipc-posix-shm*
>        (ipc-posix-name "com.apple.ColorSync.Gen.lock")
>        (ipc-posix-name "com.apple.ColorSync.Disp.lock")
>        (ipc-posix-name "com.apple.ColorSync.Gray2.2")
>        (ipc-posix-name "com.apple.ColorSync.sRGB")
>        (ipc-posix-name "com.apple.ColorSync.GenGray")
>        (ipc-posix-name "com.apple.ColorSync.GenRGB")
>        (ipc-posix-name-regex #"^com\.apple\.cs\."))
> (allow file-read*
>        (subpath "/Library/ColorSync/Profiles")
>        (home-subpath "/Library/ColorSync"))
>
> (allow mach-lookup
>        (global-name "com.apple.coreservices.launchservicesd")
>        (global-name "com.apple.ls.boxd")
>        (global-name "com.apple.lsd.mapdb")
>        (global-name "com.apple.lsd.modifydb")
>        (global-name "com.apple.metadata.mds")
>        (global-name "com.apple.cookied")
>        (global-name "com.apple.cfnetwork.AuthBrokerAgent")
>        (global-name "com.apple.cfnetwork.cfnetworkagent")
>        (global-name "com.apple.SystemConfiguration.configd")
>        (global-name "com.apple.CoreServices.coreservicesd")
>        (global-name "com.apple.coreservices.appleevents")
>        (global-name "com.apple.FontObjectsServer")
>        (global-name "com.apple.FontServer")
>        (global-name "com.apple.PowerManagement.control")
>        (global-name "com.apple.audio.audiohald")
>        (global-name "com.apple.audio.coreaudiod")
>        (global-name "com.apple.audio.AudioComponentRegistrar")
>        (global-name "com.apple.dock.server")
>        (global-name "com.apple.pasteboard.1")
>        (global-name "com.apple.pbs.fetch_services")
>        (global-name "com.apple.printtool.agent")
>        (global-name "com.apple.tsm.uiserver")
>        (global-name "com.apple.UNCUserNotification")
>        (global-name "com.apple.windowserver.active")
>        (global-name "com.apple.DiskArbitration.diskarbitrationd")
>        (global-name "com.apple.window_proxies"))
>
> ;; Security framework
> (allow mach-lookup
>       (global-name "com.apple.SecurityServer")
>       (global-name "com.apple.securityd.xpc")
>       (global-name "com.apple.ocspd"))
> (if (param "DARWIN_QTKITSERVER_HOME_DIR")
>       (begin
>       (allow file-read* file-write* (home-subpath "/Library/Keychains"))))
> (allow file-read*
>        (subpath "/private/var/db/mds")
>        (literal "/private/var/db/DetachedSignatures"))
> (allow ipc-posix-shm-read* ipc-posix-shm-write-data
>        (ipc-posix-name "com.apple.AppleDatabaseChanged"))
>
> (allow appleevent-send
>        (appleevent-destination "com.apple.iTunes"))
>
> (allow system-socket
>        (socket-domain AF_ROUTE))
>
> (allow system-socket
>        (require-all (socket-domain AF_SYSTEM) (socket-protocol 2))) ; SYSPROTO_CONTROL
>
> (allow system-audit)
> (allow system-fsctl
>        (fsctl-command (_IO "h" 24))           ;; HFS_VOLUME_STATUS
>        (fsctl-command (_IO "z" 12))           ;; afpfsGetMountInfoFSCTL
>        (fsctl-command (_IO "z" 19))           ;; smbfsUniqueShareIDFSCTL
>        (fsctl-command (_IO "z" 23)))          ;; afpfsByteRangeLock2FSCTL
>
--
com.apple.PIPAgent.sb
Files /System/Library/Sandbox/Profiles/com.apple.PIPAgent.sb and com.apple.PIPAgent.sb are identical
--
com.apple.ReportGPURestart.sb
Files /System/Library/Sandbox/Profiles/com.apple.ReportGPURestart.sb and com.apple.ReportGPURestart.sb are identical
--
com.apple.ReportPanicService.sb
12,19d11
< ;;; <rdar://problem/13449326>
< (let allow-paths ((i 0))
<   (let ((path (param (string-append "HOME_" (number->string i)))))
<     (if path
<         (begin
<           (allow file-read* file-write-unlink (subpath path))
<           (allow-paths (+ i 1))))))
<
--
com.apple.SpeechRecognitionCore.brokerd.sb
Files /System/Library/Sandbox/Profiles/com.apple.SpeechRecognitionCore.brokerd.sb and com.apple.SpeechRecognitionCore.brokerd.sb are identical
--
com.apple.SpeechRecognitionCore.speechrecognitiond.sb
64c64,65
<         (global-name "com.apple.distributed_notifications@Uv3"))
---
>         (global-name "com.apple.distributed_notifications@Uv3")
>         (global-name "com.apple.audio.AudioComponentRegistrar"))
--
com.apple.XprotectFramework.AnalysisService.sb
45c45,46
<     (global-name "com.apple.CoreServices.coreservicesd"))
---
>     (global-name "com.apple.CoreServices.coreservicesd")
>     (global-name "com.apple.dz.dznd"))
--
com.apple.assistantd.sb
23a24,27
> (allow process-fork)
>
> (allow process-exec (literal "/usr/bin/bsdtar"))
>
32c36,37
< (allow file* (subpath (param "_CACHEDIR")))
---
> (allow file-read* file-write* (subpath (param "_TEMPDIR")))
> (allow file-read* file-write* (subpath (param "_CACHEDIR")))
121a127
>        (global-name "com.apple.BluetoothDOServer")
138a145
>        (global-name "com.apple.audio.AudioComponentRegistrar")
177c184,192
<        (global-name "com.apple.networkserviceproxy"))
---
>        (global-name "com.apple.networkserviceproxy")
>        (global-name "com.apple.cloudd")
>        (global-name "com.apple.apsd")
>        (global-name "com.apple.analyticsd")
>        (global-name "com.apple.symptom_analytics")
>        (global-name "com.apple.symptom_diagnostics")
>        (global-name "com.apple.siri.invoke")
>        (global-name "com.apple.remoted")
>        (global-name "com.apple.PowerManagement.control"))
--
com.apple.audio.coreaudiod.sb
31a32,33
> 	(literal "/Library/Caches/com.apple.DiagnosticReporting.HasBeenAppleInternal")
> 	(literal "/private/var/db/timezone")
33,39d34
< 	(literal "/Library/Keychains/System.keychain")
< 	(literal "/private/var/db/mds/messages/se_SecurityMessages")
< 	(literal "/private/var/db/mds/system/mdsDirectory.db")
< 	(literal "/private/var/db/mds/system/mdsObject.db")
< 	(regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsDirectory\.db$")
< 	(regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsObject\.db$")
< 	(regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mds\.lock$")
58a54
> 	(literal "/usr")
61,63c57
< 	(literal "/Library/Caches/com.apple.DiagnosticReporting.HasBeenAppleInternal")
< 	(literal "/private/var/db/disableAppleInternal")
<
---
> 	(literal "/private/var/db/disableAppleInternal")
65,73c59,60
< 	(literal "/Library/Keychains")
< 	(literal "/private")
< 	(literal "/private/var")
< 	(literal "/private/var/folders")
< 	(regex "^/private/var/folders/[^/]+")
< 	(regex "^/private/var/folders/[^/]+/[^/]+")
< 	(literal "/private/var/run/systemkeychaincheck.done")
< 	(regex "^/private/var/folders/[^/]+/[^/]+/C$")
< 	(regex "^/private/var/folders/[^/]+/[^/]+/C/mds$")
---
> 	(literal "/Library/Audio")
> 	(literal "/Library/Audio/Plug-Ins")
79,91d65
<
< 	(regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsDirectory\.db$")
< 	(regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsDirectory\.db_$")
< 	(regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsObject\.db$")
< 	(regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mdsObject\.db_$")
< 	(regex #"^/private/var/tmp/mds/[0-9]+(/|$)")
< 	(regex #"^/private/var/db/mds/[0-9]+(/|$)")
< 	(regex #"^/private/var/folders/[^/]+/[^/]+/C/mds(/|$)")
< 	(regex #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds(/|$)")
< )
<
< (allow file-write-data
< 	(regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mds\.lock$")
108,109c82,83
< 	(global-name "com.apple.SecurityServer")
< 	(global-name "com.apple.ocspd")
---
> 	(global-name "com.apple.audio.AudioComponentRegistrar")
> 	(global-name "com.apple.audio.AudioComponentRegistrar.daemon")
--
com.apple.audio.systemsoundserverd.sb
15c15,16
< (subpath "/usr/share"))
---
> (subpath "/usr/share")
> (subpath "/private/var/db/timezone"))
39a41
> (global-name "com.apple.audio.AudioComponentRegistrar")
--
com.apple.authd.sb
17a18,19
>        (global-name "com.apple.CoreAuthentication.agent.libxpc")
>        (global-name "com.apple.CoreAuthentication.daemon.libxpc")
--
com.apple.avconferenced.sb
38a39
>     (subpath "/private/tmp/vp/inject")
50c51,52
<     (subpath "/private/tmp/vp")
---
>     (subpath "/private/tmp/AudioCapture")
>     (subpath "/private/tmp/AudioCapture/VP")
56c58
<     (extension-class "com.apple.app-sandbox.read-write")
---
>     (extension-class "com.apple.rtcreporting.upload")
101c103,106
<     (global-name "com.apple.WirelessCoexManager"))
---
>     (global-name "com.apple.WirelessCoexManager")
>     (global-name "com.apple.audio.AudioComponentRegistrar")
>     (global-name "com.apple.distributed_notifications@1v3")
>     (global-name "com.apple.distributed_notifications@Uv3"))
--
com.apple.captiveagent.sb
Files /System/Library/Sandbox/Profiles/com.apple.captiveagent.sb and com.apple.captiveagent.sb are identical
--
com.apple.cf.appsleepd.sb
Files /System/Library/Sandbox/Profiles/com.apple.cf.appsleepd.sb and com.apple.cf.appsleepd.sb are identical
--
com.apple.cmio.AVCAssistant.sb
0a1,57
> ;; Copyright (c) 2017 Apple Inc.  All Rights reserved.
> ;;
> ;; WARNING: The sandbox rules in this file currently constitute
> ;; Apple System Private Interface and are subject to change at any time and
> ;; without notice.
> ;;
>
> (version 1)
> (deny default)
>
> (import "system.sb")
>
> (import "com.apple.corefoundation.sb")
>
> ;;; initialize CF sandbox actions
> (corefoundation)
>
> ;; For resolving symlinks, realpath(3), and equivalents.
> (allow file-read-metadata)
>
> (allow process-info* (target self))
>
> (allow mach-lookup
> 	(global-name "com.apple.CoreServices.coreservicesd")
> 	(global-name "com.apple.coreservices.launchservicesd")
> 	(global-name "com.apple.windowserver.active")
> 	(global-name "com.apple.analyticsd")
> )
>
> (allow file-map-executable
> 	(path "/System/Library/PrivateFrameworks/CoreServicesInternal.framework/Versions/A/CoreServicesInternal")
> 	(subpath "/System/Library/Extensions")
> )
>
> ;; Preferences
> (allow file-read*
> 	(literal "/private/var/db/cmiodalassistants/Library/Preferences/com.apple.cmio.plist")
> 	(literal "/private/var/db/cmiodalassistants/Library/Preferences/.GlobalPreferences.plist")
> 	(literal "/Library/Preferences/.GlobalPreferences.plist")
> 	(regex #"^/private/var/db/cmiodalassistants/Library/Preferences/ByHost/\.GlobalPreferences\..*\.plist$")
> )
>
> ;; Preference domain.
> (allow user-preference-read
> 	(preference-domain "com.apple.cmio")
> 	(preference-domain "com.apple.coremedia")
> )
>
> ;; Camera
> (allow device-camera)
> (allow iokit-open
> 	(iokit-user-client-class "IOFireWireAVCUserClient")
> 	(iokit-user-client-class "IOFireWireUserClient")
> )
>
> ;;(allow iokit-get-properties)
>
--
com.apple.cmio.IIDCVideoAssistant.sb
0a1,61
> ;; Copyright (c) 2017 Apple Inc.  All Rights reserved.
> ;;
> ;; WARNING: The sandbox rules in this file currently constitute
> ;; Apple System Private Interface and are subject to change at any time and
> ;; without notice.
> ;;
>
> (version 1)
> (deny default)
>
> (import "system.sb")
>
> (import "com.apple.corefoundation.sb")
>
> ;;; initialize CF sandbox actions
> (corefoundation)
>
> ;; For resolving symlinks, realpath(3), and equivalents.
> (allow file-read-metadata)
>
> (allow process-info* (target self))
>
> (allow mach-lookup
> 	(global-name "com.apple.CoreServices.coreservicesd")
> 	(global-name "com.apple.coreservices.launchservicesd")
> 	(global-name "com.apple.windowserver.active")
> 	(global-name "com.apple.analyticsd")
> )
>
> (allow file-map-executable
> 	(path "/System/Library/PrivateFrameworks/CoreServicesInternal.framework/Versions/A/CoreServicesInternal")
> 	(subpath "/System/Library/Extensions")
> )
>
> ;; Preferences
> (allow file-read*
> 	(literal "/private/var/db/cmiodalassistants/Library/Preferences/com.apple.cmio.plist")
> 	(literal "/private/var/db/cmiodalassistants/Library/Preferences/.GlobalPreferences.plist")
> 	(literal "/Library/Preferences/.GlobalPreferences.plist")
> 	(regex #"^/private/var/db/cmiodalassistants/Library/Preferences/ByHost/\.GlobalPreferences\..*\.plist$")
> )
>
> ;; Preference domain.
> (allow user-preference-read
> 	(preference-domain "com.apple.cmio")
> 	(preference-domain "com.apple.coremedia")
> )
>
> ;; Camera
> (allow iokit-open
> 	(iokit-user-client-class "IOFireWireUserClient")
> 	(iokit-user-client-class "RootDomainUserClient")
> )
>
> (allow iokit-open
> 	(iokit-registry-entry-class "RootDomainUserClient")
> )
>
> ;;(allow iokit-get-properties)
>
>
--
com.apple.cmio.VDCAssistant.sb
0a1,74
> ;; Copyright (c) 2017 Apple Inc.  All Rights reserved.
> ;;
> ;; WARNING: The sandbox rules in this file currently constitute
> ;; Apple System Private Interface and are subject to change at any time and
> ;; without notice.
> ;;
>
> (version 1)
> (deny default)
>
> (import "system.sb")
> (system-graphics)
>
> (import "com.apple.corefoundation.sb")
>
> ;;; initialize CF sandbox actions
> (corefoundation)
>
> ;; For resolving symlinks, realpath(3), and equivalents.
> (allow file-read-metadata)
>
> (allow process-info* (target self))
>
> ;; For validating the entitlements of clients.
> (allow process-info-codesignature)
>
> (allow mach-lookup
> 	(global-name "com.apple.CoreServices.coreservicesd")
> 	(global-name "com.apple.coreservices.launchservicesd")
> 	(global-name "com.apple.windowserver.active")
> 	(global-name "com.apple.analyticsd")
> 	(subpath "/Library/Video/Plug-Ins")
> )
>
> (allow file-map-executable
> 	(path "/System/Library/PrivateFrameworks/CoreServicesInternal.framework/Versions/A/CoreServicesInternal")
> 	(subpath "/System/Library/Extensions")
> 	(subpath "/Library/Video/Plug-Ins")
> )
>
> ;; Preferences
> (allow file-read*
> 	(subpath "/Library/Video/Plug-Ins")
> 	(literal "/private/var/db/cmiodalassistants/Library/Preferences/com.apple.cmio.plist")
> 	(literal "/private/var/db/cmiodalassistants/Library/Preferences/.GlobalPreferences.plist")
> 	(literal "/Library/Preferences/.GlobalPreferences.plist")
> 	(regex #"^/private/var/db/cmiodalassistant/Library/Preferences/ByHost/\.GlobalPreferences\..*\.plist$")
> )
>
> ;; Preference domain.
> (allow user-preference-read
> 	(preference-domain "com.apple.cmio")
> 	(preference-domain "com.apple.coremedia")
> )
>
> ;; Camera
> (allow device-camera)
> (allow iokit-open
> 	(iokit-user-client-class "IOUSBDeviceUserClientV2")
> 	(iokit-user-client-class "IOUSBInterfaceUserClientV3")
> 	(iokit-user-client-class "RootDomainUserClient")
> )
>
> (allow iokit-open
> 	(iokit-registry-entry-class "IGAccelDevice")
> 	(iokit-registry-entry-class "IGAccelSharedUserClient")
> 	(iokit-registry-entry-class "IGAccelVideoContextMain")
> 	(iokit-registry-entry-class "IGAccelVideoContextMedia")
> 	(iokit-registry-entry-class "IGAccelVideoContextVEBox")
> 	(iokit-registry-entry-class "RootDomainUserClient")
> )
>
> (allow iokit-get-properties)
>
--
com.apple.cmio.iOSScreenCaptureAssistant.sb
0a1,161
> ;; Copyright (c) 2017 Apple Inc.  All Rights reserved.
> ;;
> ;; WARNING: The sandbox rules in this file currently constitute
> ;; Apple System Private Interface and are subject to change at any time and
> ;; without notice.
> ;;
>
> (version 1)
> (deny default)
>
> (import "system.sb")
> (system-graphics)
>
> (import "com.apple.corefoundation.sb")
>
> ;;; initialize CF sandbox actions
> (corefoundation)
>
> (system-network)
> (allow network-outbound
> 	(literal "/private/var/run/usbmuxd")
> 	(literal "/private/var/run/mDNSResponder")
> 	(control-name "com.apple.network.statistics")
> 	(control-name "com.apple.netsrc")
> 	(remote ip)
> )
>
> (allow network-inbound )
> (allow network-bind (remote ip))
>
> ;; For resolving symlinks, realpath(3), and equivalents.
> (allow file-read-metadata)
>
> (allow nvram-get (nvram-variable "BSD Name"))
> (allow process-info* (target self))
>
> ;; For validating the entitlements of clients.
> (allow process-info-codesignature)
>
> (allow file-read*
> 	(subpath "/System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/iOSScreenCapture.plugin/Contents/Resources")
> 	(subpath "/Library/CoreMediaIO/Plug-Ins/FCP-DAL/iOSScreenCapture.plugin/Contents/Resources")
>     (subpath "/private/var/db/mds")
> 	(subpath "/Library/Audio/Plug-Ins/HAL")
> )
>
> (allow file-write*
>     (literal "/private/var/db/mds/system/mds.lock")
>     (subpath "/private/tmp")
> )
>
> ;; From com.apple.AirPlayXPCHelper
> (allow iokit-open
>     (iokit-user-client-class "IOAudioControlUserClient")
>     (iokit-user-client-class "IOAudioEngineUserClient")
>     (iokit-user-client-class "IOAudio2DeviceUserClient")
>     (iokit-user-client-class "RootDomainUserClient")
>     (iokit-user-client-class "IOReportUserClient")
>     (iokit-user-client-class "IOBluetoothHCIUserClient")
>     (iokit-user-client-class "IOBluetoothRFCOMMConnectionUserClient")
>     (iokit-user-client-class "IOBluetoothRFCOMMChannelUserClient")
>     (iokit-user-client-class "IOBluetoothL2CAPChannelUserClient")
>     (iokit-user-client-class "IOBluetoothDeviceUserClient")
> )
>
> ;; From com.apple.AirPlayXPCHelper
> (allow mach-lookup
> 	(global-name "com.apple.SecurityServer")
> 	(global-name "com.apple.SystemConfiguration.DNSConfiguration")
> 	(global-name "com.apple.SystemConfiguration.configd")
> 	(global-name "com.apple.metadata.mds")
> 	(global-name "com.apple.ocspd")
> 	(global-name "com.apple.pluginkit.pkd")
> 	(global-name "com.apple.spindump")
> 	(global-name "com.apple.PairingManager")
>
> 	(global-name "com.apple.audio.audiohald")
> 	(global-name "com.apple.audio.AudioComponentRegistrar")
> 	(global-name "com.apple.audio.AudioComponentRegistrar.daemon")
>
> 	(global-name "com.apple.wirelessproxd")
> 	(global-name "com.apple.windowserver.active")
>
> 	(global-name "com.apple.AirPlayXPCHelper")
> 	(global-name "com.apple.coremedia.endpoint.xpc")
> 	(global-name "com.apple.coremedia.endpointstream.xpc")
> 	(global-name "com.apple.coremedia.endpointplaybacksession.xpc")
> 	(global-name "com.apple.coremedia.endpointpicker.xpc")
> 	(global-name "com.apple.coremedia.endpointmanager.xpc")
> 	(global-name "com.apple.AirPlayAgent.xpc")
> 	(global-name "com.apple.AirPlayUIAgent.xpc")
>
> 	(global-name "com.apple.coresymbolicationd")
> 	(global-name "com.apple.awdd")
> 	(global-name "com.apple.SharingServices")
> 	(global-name "com.apple.bluetoothd")
> 	(global-name "com.apple.bluetoothaudiod")
> 	(global-name "com.apple.BluetoothDOServer")
> 	(global-name "com.apple.airportd")
>
> 	(global-name "com.apple.PowerManagement.control")
> 	(global-name "com.apple.audio.coreaudiod")
> 	(global-name "com.apple.securityd.xpc")
> 	(global-name "com.apple.lsd.mapdb")
> 	(global-name "com.apple.lsd.modifydb")
> 	(global-name "com.apple.coremedia.routediscoverer.xpc")
> 	(global-name "com.apple.coremedia.routingcontext.xpc")
> 	(global-name "com.apple.analyticsd")
> )
>
> ;; Preferences
> (allow file-read*
> 	(literal "/private/var/root/Library/Preferences/com.apple.cmio.plist")
> 	(literal "/private/var/root/Library/Preferences/.GlobalPreferences.plist")
> 	(literal "/Library/Preferences/.GlobalPreferences.plist")
> 	(literal "/Library/Preferences/com.apple.security.plist")
> 	(regex #"^/private/var/root/Library/Preferences/ByHost/\.GlobalPreferences\..*\.plist$")
> )
>
> ;; Preference domain.
> (allow user-preference-read
> 	(preference-domain "com.apple.airplay")
> 	(preference-domain "com.apple.coremedia")
> 	(preference-domain "com.apple.security")
> 	(preference-domain "com.apple.cmio")
> )
>
> (allow ipc-posix-shm-read-data
> 	(ipc-posix-name-regex #"^/tmp/com\.apple\.csseed\.[0-9]+$")
> 	(ipc-posix-name-regex #"^AudioIO")
> 	(ipc-posix-name "FNetwork.defaultStorageSession")
> 	(ipc-posix-name "com.apple.AppleDatabaseChanged")
> )
>
> (allow ipc-posix-shm-write-data
> 	(ipc-posix-name-regex #"^AudioIO")
> 	(ipc-posix-name "com.apple.AppleDatabaseChanged")
> )
>
> (allow ipc-posix-shm-read-metadata
> 	(ipc-posix-name-regex #"^AudioIO")
> )
>
> (allow file-map-executable
> 	(path "/System/Library/PrivateFrameworks/CoreServicesInternal.framework/Versions/A/CoreServicesInternal")
> 	(subpath "/System/Library/Extensions")
> )
>
> ;; USB screen capture
> (allow iokit-open
> 	(iokit-user-client-class "IOUSBDeviceUserClientV2")
> 	(iokit-user-client-class "IOUSBInterfaceUserClientV3")
> )
>
> (allow iokit-open
> 	(iokit-registry-entry-class "RootDomainUserClient")
> )
>
> (allow iokit-get-properties)
>
>
--
com.apple.colorsync.displayservices.sb
0a1,40
> (version 1)
>
> (import "system.sb")
>
> (deny default iokit-get-properties process-info*)
>
> (deny process-info*)
> (allow process-info-pidinfo)
> (allow process-info-pidfdinfo (target self))
> (allow process-info-pidfileportinfo (target self))
> (allow process-info-setcontrol (target self))
> (allow process-info-dirtycontrol (target self))
> (allow process-info-rusage (target self))
>
> (allow file-read-metadata file-read-data (literal "/"))
> (allow file-read-metadata)
>
> (allow authorization-right-obtain (right-name "system.colorsync.install.profile"))
> (allow authorization-right-obtain (right-name "com.apple.private.AmbientDisplay.messaging"))
>
> (allow-create-directory
>     (literal "/Library/ColorSync")
>     (literal "/Library/ColorSync/Profiles"))
> (allow file-read*
>     (literal "/Library/ColorSync/Profiles"))
> (allow file-read* file-write*
>     (prefix "/Library/ColorSync/Profiles/"))
>
> ;; deny the removal of these pre-installed profiles.
> (deny file-write-unlink
>     (literal "/Library/ColorSync/Profiles/Black & White.icc")
>     (literal "/Library/ColorSync/Profiles/Blue Tone.icc")
>     (literal "/Library/ColorSync/Profiles/Lightness Decrease.icc")
>     (literal "/Library/ColorSync/Profiles/Lightness Increase.icc")
>     (literal "/Library/ColorSync/Profiles/Sepia Tone.icc")
>     (literal "/Library/ColorSync/Profiles/WebSafeColors.icc"))
>
> (allow mach-lookup
>     (global-name "com.apple.CoreServices.coreservicesd"))
>
--
com.apple.colorsync.useragent.sb
0a1,48
> ;;
> ;; ColorSync User Agent - sandbox profile
> ;; Copyright (c) 2016 Apple Inc. All Rights reserved.
> ;;
> ;; WARNING: The sandbox rules in this file currently constitute
> ;; Apple System Private Interface and are subject to change at any time and
> ;; without notice. The contents of this file are also auto-generated and not
> ;; user editable; it may be overwritten at any time.
> ;;
>
> (version 1)
> (deny default)
> (import "system.sb")
>
> ;;; Home Directory
> (define (home-subpath home-relative-subpath)
>     (subpath (string-append (param "_HOME") home-relative-subpath)))
> (define (home-literal home-relative-literal)
>     (literal (string-append (param "_HOME") home-relative-literal)))
> (define (home-regex home-relative-regex)
>     (regex (string-append "^" (regex-quote (param "_HOME")) home-relative-regex)))
>
> (allow file-read-metadata)
>
> (allow file-read* file-write*
>     (subpath (param "DARWIN_USER_DIR"))
>     (subpath (param "DARWIN_USER_TEMP_DIR"))
>     (subpath (param "DARWIN_USER_CACHE_DIR")))
>
> (allow file-read*
>     (literal "/Volumes")
>     (literal "/Library/Preferences/.GlobalPreferences.plist")
>     (subpath "/Library/Printers")
>     (subpath "/Library/ImageCapture/Devices")
>     (subpath "/Library/ColorSync/Profiles")
>     (subpath "System/Library/ColorSync/Profiles"))
>
> (allow file-read*
>     (home-literal ".CFUserTextEncoding")
>     (home-subpath "/Library/Printers")
>     (home-subpath "/Library/ImageCapture/Devices")
>     (home-subpath "/Library/ColorSync/Profiles"))
>
>
>
> (allow mach-lookup
>     (global-name "com.apple.CoreServices.coreservicesd"))
>
--
com.apple.commerce.sb
0a1,162
> (version 1)
> (deny default)
>
> (import "system.sb")
> (import "com.apple.corefoundation.sb")
> (corefoundation)
>
> (allow file-read-metadata)
>
> (allow file-issue-extension
> (subpath "/Library/Documentation/Help/MacHelp.help")
> (regex #"/Library/Caches/com\.apple\.(appstore|iBooksX|iTunes|configurator\.ui)(/CommerceRequestCache/?)?")
> (regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/com\.apple\.(appstore|iBooksX|iTunes|configurator\.ui)")
> (regex #"/Library/Caches/storeassetd")
> (regex #"[a-z0-9]+\.app(/|$)"))
>
> (allow file-read*
> (regex #"\.app(/|$)")
> (regex #"/CommerceKit\.framework")
> (literal "/private/etc/hosts")
> (literal "/private/var/db/mds/system/mdsDirectory.db")
> (literal "/private/var/db/mds/system/mdsObject.db")
> (literal "/Library/Preferences/com.apple.AECT.plist")
> (literal "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist")
> (literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains")
> (literal "/Library/Preferences/com.apple.loginwindow.plist")
> (literal "/private/var/db/PreviousSystemVersion.plist")
> (subpath "/Applications")
> (subpath "/Library/Documentation/Help/MacHelp.help")
> (subpath "/Users/Shared")
> (regex "/Library/Bundles/[^/]+.bundle")
> (regex #"/Library/Preferences/com\.apple\.appstore\.plist$")
> (regex #"/Library/Preferences/com.apple.LaunchServices.plist$")
> (regex #"/Library/Preferences/(ByHost/)?\.GlobalPreferences\.plist$")
> (regex #"/Library/Preferences/com.apple.security\.plist$")
> (regex #"/\.CFUserTextEncoding$")
> (regex "/private/var/db/mds/messages/([A-Za-z0-9]+/)?se_SecurityMessages"))
>
> (allow file-read* file-write*
> (literal "/Library/Caches/com.apple.DiagnosticReporting.Networks.plist")
> (literal "/Library/Caches/com.apple.DiagnosticReporting.HasBeenAppleInternal")
> (literal "/private/var/db/mds/system/mds.lock")
> (subpath "/private/var/root/Library/Caches/com.apple.commerce")
> (subpath "/private/var/tmp")
> (subpath "/private/var/folders")
> (subpath "/private/tmp")
> (subpath "/Users/Shared/adi")
> (subpath "/Users/Shared/SC Info")
> (regex #"/Library/Caches/com\.apple\.commerce")
> (regex #"/Library/Caches/com\.apple\.(appstore|iBooksX|iTunes|configurator\.ui)(/CommerceRequestCache/?)?")
> (regex #"/Library/Caches/com\.apple\.WebKit2\.WebProcessService$")
> (regex #"/Library/Cookies/com\.apple\.(appstore|iBooksX|ibooks|iTunes|configurator(\.ui)?)\.(binary)?cookies")
> (regex #"/Library/Cookies/Cookies\.binarycookies")
>
> (regex #"Library/Preferences/com\.apple\.security\.revocation\.plist")
> (regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/com\.apple\.(appstore|iBooksX|iTunes|configurator\.ui)")
> (regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/TemporaryItems(/|$)")
> (regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/mds(/|$)")
> (regex #"/\.TemporaryItems(/|$)")
> (regex #"/Library/Keychains/")
> (regex #"^/etilqs_"))
>
> (allow user-preference-read
>     (preference-domain "kCFPreferencesAnyApplication"))
>
> (allow user-preference*
>     (preference-domain "com.apple.bookstoreagent")
>     (preference-domain "com.apple.storeagent")
>     (preference-domain "com.apple.iTunes")
>     (preference-domain "com.apple.appstore")
>     (preference-domain "com.apple.ibooks")
>     (preference-domain "com.apple.commerce")
>     (preference-domain "com.apple.commerce.configurator")
>     (preference-domain "com.apple.appstore.commerce")
>     (preference-domain "com.apple.iBooksX.commerce")
>     (preference-domain "com.apple.configurator.ui.commerce"))
>
> (allow ipc-posix-shm-read-data
> (ipc-posix-name "FNetwork.defaultStorageSession")
> (ipc-posix-name-regex #"ls\.[a-f0-9\.]+")
> (ipc-posix-name "apple.shm.notification_center")
> (ipc-posix-name-regex #"^/tmp/com.apple.csseed.[0-9]+$"))
>
> (allow ipc-posix-shm-read* ipc-posix-shm-write-data
> (ipc-posix-name "com.apple.AppleDatabaseChanged"))
>
> (allow mach-register (global-name "com.apple.commerce"))
>
> (allow mach-lookup
> (global-name "com.apple.apsd")
> (global-name "com.apple.adid")
> (global-name "com.apple.fpsd")
> (global-name "com.apple.askpermissiond")
> (global-name "com.apple.AssetCacheLocatorService")
> (global-name "com.apple.accountsd.accountmanager")
> (global-name "com.apple.backupd.sandbox.xpc")
> (global-name "com.apple.ctkd.token-client")
> (global-name "com.apple.CoreAuthentication.agent.libxpc")
> (global-name "com.apple.CoreAuthentication.agent")
> (global-name "com.apple.securityd.xpc")
> (global-name "com.apple.UNCUserNotification")
> (global-name "com.apple.coreservices.launcherror-handler")
> (global-name "com.apple.SystemConfiguration.configd")
> (global-name "com.apple.SystemConfiguration.SCNetworkReachability")
> (global-name "com.apple.networkd")
> (global-name "com.apple.storehelper")
> (global-name "com.apple.SecurityServer")
> (global-name "com.apple.PowerManagement.control")
> (global-name "com.apple.distributed_notifications@Uv3")
> (global-name "com.apple.usernoted.daemon_client")
> (global-name "com.apple.metadata.mds")
> (global-name "com.apple.CoreServices.coreservicesd")
> (global-name "com.apple.ls.boxd")
> (global-name "com.apple.FileCoordination")
> (global-name "com.apple.ocspd")
> (global-name "com.apple.installd")
> (global-name "com.apple.ProgressReporting")
> (global-name "com.apple.windowserver.active")
> (global-name "com.apple.lsd.mapdb")
> (global-name "com.apple.coreservices.launchservicesd")
> (global-name "com.apple.coreservices.appleevents")
> (global-name "com.apple.cookied")
> (global-name "com.apple.FontServer")
> (global-name "com.apple.fonts")
> (global-name "com.apple.FontObjectsServer")
> (global-name "com.apple.DiskArbitration.diskarbitrationd")
> (global-name "com.apple.cvmsServ")
> (global-name "com.apple.logind")
> (global-name "com.apple.coreservices.quarantine-resolver")
> (global-name "com.apple.familycontrols")
> (global-name "com.apple.pluginkit.pkd")
> (global-name "com.apple.nsurlstorage-cache")
> (global-name "com.apple.system.opendirectoryd.api")
> (global-name "com.apple.CrashReporterSupportHelper")
> (global-name "com.apple.cache_delete")
> (global-name "com.apple.ManagedClient.agent")
> (global-name "com.apple.cfnetwork.AuthBrokerAgent")
> (global-name "com.apple.pasteboard.1"))
>
> (allow authorization-right-obtain
> (right-name "system.install.app-store-software")
> (right-name "system.install.apple-software")
> (right-name "system.install.app-store-software.standard-user")
> (right-name "system.install.apple-software.standard-user")
> (right-name "system.install.apple-config-data")
> (right-name "system.install.software")
> (right-name "system.install.software.iap")
> (right-name "system.install.software.mdm-provided")
> (right-name "com.apple.SoftwareUpdate.modify-settings"))
>
> (allow iokit-open
> (iokit-user-client-class "IOFramebufferSharedUserClient")
> (iokit-user-client-class "RootDomainUserClient")
> (iokit-user-client-class-regex #"AccelDevice$")
> (iokit-user-client-class-regex #"SharedUserClient$")
> (iokit-user-client-class-regex #"GLContext$"))
>
> (allow network-outbound)
> (allow system-socket)
> (allow distributed-notification-post)
> (allow appleevent-send)
> (allow lsopen)
--
com.apple.commerced.sb
0a1,161
> (version 1)
> (deny default)
>
> (import "system.sb")
> (import "com.apple.corefoundation.sb")
> (corefoundation)
>
> (allow file-read-metadata)
>
> (allow file-issue-extension
> (subpath "/Library/Documentation/Help/MacHelp.help")
> (regex #"/Library/Caches/com\.apple\.(appstore|iBooksX|iTunes|configurator\.ui)(/CommerceRequestCache/?)?")
> (regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/com\.apple\.(appstore|iBooksX|iTunes|configurator\.ui)")
> (regex #"/Library/Caches/storeassetd")
> (regex #"[a-z0-9]+\.app(/|$)"))
>
> (allow file-read*
> (regex #"\.app(/|$)")
> (regex #"/CommerceKit\.framework")
> (literal "/private/etc/hosts")
> (literal "/private/var/db/mds/system/mdsDirectory.db")
> (literal "/private/var/db/mds/system/mdsObject.db")
> (literal "/Library/Preferences/com.apple.AECT.plist")
> (literal "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist")
> (literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains")
> (literal "/Library/Preferences/com.apple.loginwindow.plist")
> (literal "/private/var/db/PreviousSystemVersion.plist")
> (subpath "/Applications")
> (subpath "/Library/Documentation/Help/MacHelp.help")
> (subpath "/Users/Shared")
> (regex "/Library/Bundles/[^/]+.bundle")
> (regex #"/Library/Preferences/com\.apple\.appstore\.plist$")
> (regex #"/Library/Preferences/com.apple.LaunchServices.plist$")
> (regex #"/Library/Preferences/(ByHost/)?\.GlobalPreferences\.plist$")
> (regex #"/Library/Preferences/com.apple.security\.plist$")
> (regex #"/\.CFUserTextEncoding$")
> (regex "/private/var/db/mds/messages/([A-Za-z0-9]+/)?se_SecurityMessages"))
>
> (allow file-read* file-write*
> (literal "/Library/Caches/com.apple.DiagnosticReporting.Networks.plist")
> (literal "/Library/Caches/com.apple.DiagnosticReporting.HasBeenAppleInternal")
> (literal "/private/var/db/mds/system/mds.lock")
> (subpath "/private/var/root/Library/Caches/com.apple.commerce")
> (subpath "/private/var/tmp")
> (subpath "/private/var/folders")
> (subpath "/private/tmp")
> (subpath "/Users/Shared/adi")
> (subpath "/Users/Shared/SC Info")
> (regex #"/Library/Caches/com\.apple\.commerce")
> (regex #"/Library/Caches/com\.apple\.(appstore|iBooksX|iTunes|configurator\.ui)(/CommerceRequestCache/?)?")
> (regex #"/Library/Caches/com\.apple\.WebKit2\.WebProcessService$")
> (regex #"/Library/Cookies/com\.apple\.(appstore|iBooksX|ibooks|iTunes|configurator(\.ui)?)\.(binary)?cookies")
> (regex #"/Library/Cookies/Cookies\.binarycookies")
>
> (regex #"Library/Preferences/com\.apple\.security\.revocation\.plist")
> (regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/com\.apple\.(appstore|iBooksX|iTunes|configurator\.ui)")
> (regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/TemporaryItems(/|$)")
> (regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/mds(/|$)")
> (regex #"/\.TemporaryItems(/|$)")
> (regex #"/Library/Keychains/")
> (regex #"^/etilqs_"))
>
> (allow user-preference-read
>     (preference-domain "kCFPreferencesAnyApplication"))
>
> (allow user-preference*
>     (preference-domain "com.apple.bookstoreagent")
>     (preference-domain "com.apple.storeagent")
>     (preference-domain "com.apple.iTunes")
>     (preference-domain "com.apple.appstore")
>     (preference-domain "com.apple.commerce")
>     (preference-domain "com.apple.commerce.configurator")
>     (preference-domain "com.apple.appstore.commerce")
>     (preference-domain "com.apple.iBooksX.commerce")
>     (preference-domain "com.apple.configurator.ui.commerce"))
>
> (allow ipc-posix-shm-read-data
> (ipc-posix-name "FNetwork.defaultStorageSession")
> (ipc-posix-name-regex #"ls\.[a-f0-9\.]+")
> (ipc-posix-name "apple.shm.notification_center")
> (ipc-posix-name-regex #"^/tmp/com.apple.csseed.[0-9]+$"))
>
> (allow ipc-posix-shm-read* ipc-posix-shm-write-data
> (ipc-posix-name "com.apple.AppleDatabaseChanged"))
>
> (allow mach-register (global-name "com.apple.commerced"))
>
> (allow mach-lookup
> (global-name "com.apple.apsd")
> (global-name "com.apple.adid")
> (global-name "com.apple.fpsd")
> (global-name "com.apple.askpermissiond")
> (global-name "com.apple.AssetCacheLocatorService")
> (global-name "com.apple.accountsd.accountmanager")
> (global-name "com.apple.backupd.sandbox.xpc")
> (global-name "com.apple.ctkd.token-client")
> (global-name "com.apple.CoreAuthentication.agent.libxpc")
> (global-name "com.apple.CoreAuthentication.agent")
> (global-name "com.apple.securityd.xpc")
> (global-name "com.apple.UNCUserNotification")
> (global-name "com.apple.coreservices.launcherror-handler")
> (global-name "com.apple.SystemConfiguration.configd")
> (global-name "com.apple.SystemConfiguration.SCNetworkReachability")
> (global-name "com.apple.networkd")
> (global-name "com.apple.storehelper")
> (global-name "com.apple.SecurityServer")
> (global-name "com.apple.PowerManagement.control")
> (global-name "com.apple.distributed_notifications@Uv3")
> (global-name "com.apple.usernoted.daemon_client")
> (global-name "com.apple.metadata.mds")
> (global-name "com.apple.CoreServices.coreservicesd")
> (global-name "com.apple.ls.boxd")
> (global-name "com.apple.FileCoordination")
> (global-name "com.apple.ocspd")
> (global-name "com.apple.installd")
> (global-name "com.apple.ProgressReporting")
> (global-name "com.apple.windowserver.active")
> (global-name "com.apple.lsd.mapdb")
> (global-name "com.apple.coreservices.launchservicesd")
> (global-name "com.apple.coreservices.appleevents")
> (global-name "com.apple.cookied")
> (global-name "com.apple.FontServer")
> (global-name "com.apple.fonts")
> (global-name "com.apple.FontObjectsServer")
> (global-name "com.apple.DiskArbitration.diskarbitrationd")
> (global-name "com.apple.cvmsServ")
> (global-name "com.apple.logind")
> (global-name "com.apple.coreservices.quarantine-resolver")
> (global-name "com.apple.familycontrols")
> (global-name "com.apple.pluginkit.pkd")
> (global-name "com.apple.nsurlstorage-cache")
> (global-name "com.apple.system.opendirectoryd.api")
> (global-name "com.apple.CrashReporterSupportHelper")
> (global-name "com.apple.cache_delete")
> (global-name "com.apple.ManagedClient.agent")
> (global-name "com.apple.cfnetwork.AuthBrokerAgent")
> (global-name "com.apple.pasteboard.1"))
>
> (allow authorization-right-obtain
> (right-name "system.install.app-store-software")
> (right-name "system.install.apple-software")
> (right-name "system.install.app-store-software.standard-user")
> (right-name "system.install.apple-software.standard-user")
> (right-name "system.install.apple-config-data")
> (right-name "system.install.software")
> (right-name "system.install.software.iap")
> (right-name "system.install.software.mdm-provided")
> (right-name "com.apple.SoftwareUpdate.modify-settings"))
>
> (allow iokit-open
> (iokit-user-client-class "IOFramebufferSharedUserClient")
> (iokit-user-client-class "RootDomainUserClient")
> (iokit-user-client-class-regex #"AccelDevice$")
> (iokit-user-client-class-regex #"SharedUserClient$")
> (iokit-user-client-class-regex #"GLContext$"))
>
> (allow network-outbound)
> (allow system-socket)
> (allow distributed-notification-post)
> (allow appleevent-send)
> (allow lsopen)
--
com.apple.controlstrip.sb
Files /System/Library/Sandbox/Profiles/com.apple.controlstrip.sb and com.apple.controlstrip.sb are identical
--
com.apple.corebrightnessd.sb
Files /System/Library/Sandbox/Profiles/com.apple.corebrightnessd.sb and com.apple.corebrightnessd.sb are identical
--
com.apple.coreduetd.sb
5a6
> (import "bsd.sb")
7a9
> (system-network)
40a43
>         (global-name "com.apple.cookied")
44a48
>         (global-name "com.apple.coreservices.quarantine-resolver")
54c58,59
<         (global-name "com.apple.locationd.desktop.synchronous"))
---
>         (global-name "com.apple.locationd.desktop.synchronous")
>         (global-name "com.apple.SharingServices"))
59a65,74
>
> (allow network-outbound
>     (literal "/private/var/run/mDNSResponder"))                                                ; to resolve host names
>
> (allow ipc-posix-shm-read-data
>     (ipc-posix-name "FNetwork.defaultStorageSession"))
>
> (allow network-outbound
>        (remote ip))
>
--
com.apple.corefoundation.sb
Files /System/Library/Sandbox/Profiles/com.apple.corefoundation.sb and com.apple.corefoundation.sb are identical
--
com.apple.coreservices.appleevents.appleeventsd.sb
Files /System/Library/Sandbox/Profiles/com.apple.coreservices.appleevents.appleeventsd.sb and com.apple.coreservices.appleevents.appleeventsd.sb are identical
--
com.apple.coreservices.launchservices.launchservicesd.sb
Files /System/Library/Sandbox/Profiles/com.apple.coreservices.launchservices.launchservicesd.sb and com.apple.coreservices.launchservices.launchservicesd.sb are identical
--
com.apple.coreservicesd.sb
0a1,63
> ;;; Copyright (c) 2017 Apple Inc.  All Rights reserved.
> ;;;
> ;;; WARNING: The sandbox rules in this file currently constitute
> ;;; Apple System Private Interface and are subject to change at any time and
> ;;; without notice.
> ;;;
> (version 1)
>
> (deny default)
>
> (import "system.sb")
> (import "com.apple.corefoundation.sb")
> (corefoundation)
>
> (deny file-map-executable iokit-get-properties process-info* nvram*)
> (deny dynamic-code-generation)
>
> (allow process-info* (target self))
>
> (allow process-info-codesignature)
>
> (allow user-preference-read user-preference-write
> 	(preference-domain "com.apple.coreservicesd"))
>
> (allow file-read*)
> (allow file-read-metadata)
>
> (allow file-write*
> 	(subpath (param "DARWIN_USER_TEMP_DIR"))
> 	(subpath (param "DARWIN_USER_CACHE_DIR")))
>
> (allow file-ioctl
> 	(path "/dev/fsevents"))
>
> (allow ipc-posix-shm-write-create
> 	(ipc-posix-name-regex #"^/tmp/com.apple.csseed.[0-9]+$"))
> (allow ipc-posix-shm-write-data
> 	(ipc-posix-name-regex #"^/tmp/com.apple.csseed.[0-9]+$"))
>
> (allow mach-lookup
> 	(global-name "com.apple.DiskArbitration.diskarbitrationd"))
>
> (allow file-write*
> 	(path "/System/Library/Caches/com.apple.Components2.SystemCache.Components"))
> (allow file-write*
> 	(path "/System/Library/Caches/com.apple.Components2.SystemCache.QuickTimeComponents"))
> (allow file-write*
> 	(path "/System/Library/Caches/com.apple.Components2.SystemCache.AudioComponents"))
>
> (allow file-map-executable (path "/System/Library/PrivateFrameworks/CoreServicesInternal.framework/Versions/A/CoreServicesInternal"))
>
> (allow distributed-notification-post)
>
> (allow iokit-get-properties (iokit-property "Protocol Characteristics"))
> (allow iokit-get-properties (iokit-property "IOMediaIcon"))
> (allow iokit-get-properties (iokit-property "Ejectable"))
> (allow iokit-get-properties (iokit-property "Removable"))
> (allow iokit-get-properties (iokit-property "CoreStorage Encrypted"))
> (allow iokit-get-properties (iokit-property "IOClassNameOverride"))
> (allow iokit-get-properties (iokit-property "od-server-name"))
> (allow iokit-get-properties (iokit-property "image-path"))
> (allow iokit-get-properties (iokit-property "filevault-image"))
> (allow iokit-get-properties (iokit-property "Product Identification"))
--
com.apple.ctkbind.sb
0a1,100
> ;;;
> ;;; Sandbox profile for /System/Library/Frameworks/CryptoTokenKit.framework/ctkbind.bundle/Contents/MacOS/ctkbind
> ;;;
> ;;; Copyright (c) 2016 Apple Inc.  All Rights reserved.
> ;;;
> ;;; WARNING: The sandbox rules in this file currently constitute
> ;;; Apple System Private Interface and are subject to change at any time and
> ;;; without notice. The contents of this file are also auto-generated and
> ;;; not user editable; it may be overwritten at any time.
>
> (version 1)
>
> (deny default)
>
> (import "system.sb")
>
> (define (home-subpath home-relative-subpath)
>         (subpath (string-append (param "HOME_DIR") home-relative-subpath)))
>
> (define (home-literal home-relative-literal)
>         (literal (string-append (param "HOME_DIR") home-relative-literal)))
>
> (allow file-read-data)
>
> (allow file-read-metadata)
>
> (allow file-read*
>         (subpath (param "DARWIN_USER_TEMP_DIR"))
>         (subpath (param "DARWIN_USER_CACHE_DIR"))
>         (subpath "/Library/Caches/com.apple.iconservices.store")
>         (subpath "/Library/Keyboard Layouts")
>         (subpath "/private/var/db")
>         (home-subpath "/Library/Keyboard Layouts")
>         (literal "/Library/Preferences/com.apple.security.plist")
>         (home-literal "/Library/Keychains/login.keychain-db")
>         (home-literal "/.CFUserTextEncoding"))
>
> (allow file-write*
>         (subpath (param "DARWIN_USER_CACHE_DIR"))
>         (subpath "/private/var/db/mds/system"))
>
> (allow mach-lookup
>         (global-name "com.apple.audio.SystemSoundServer-OSX")
>         (global-name "com.apple.coreservices.appleevents")
>         (global-name "com.apple.coreservices.launchservicesd")
>         (global-name "com.apple.CoreServices.coreservicesd")
>         (global-name "com.apple.CryptoTokenKit.AuthenticationHintsProvider.agent.libxpc")
>         (global-name "com.apple.CryptoTokenKit.AuthenticationHintsProvider.daemon.libxpc")
>         (global-name "com.apple.ctkd.token-client")
>         (global-name "com.apple.ctkd.watcher-client")
>         (global-name "com.apple.cvmsServ")
>         (global-name "com.apple.decalog4.incoming")
>         (global-name "com.apple.distributed_notifications@Uv3")
>         (global-name "com.apple.dock.fullscreen")
>         (global-name "com.apple.dock.server")
>         (global-name "com.apple.fonts")
>         (global-name "com.apple.FSEvents")
>         (global-name "com.apple.iconservices")
>         (global-name "com.apple.iconservices.store")
>         (global-name "com.apple.inputmethodkit.getxpcendpoint")
>         (global-name "com.apple.inputmethodkit.launchagent")
>         (global-name "com.apple.inputmethodkit.launcher")
>         (global-name "com.apple.lsd.mapdb")
>         (global-name "com.apple.pasteboard.1")
>         (global-name "com.apple.quicklook.ui.helper.active")
>         (global-name "com.apple.SecurityServer")
>         (global-name "com.apple.system.opendirectoryd.api")
>         (global-name "com.apple.SystemConfiguration.configd")
>         (global-name "com.apple.touchbar.agent")
>         (global-name "com.apple.tsm.uiserver")
>         (global-name "com.apple.window_proxies")
>         (global-name "com.apple.tccd.system")
>         (global-name "com.apple.ocspd")
>         (global-name "com.apple.windowserver.active"))
>
> (allow ipc-posix-shm-read-data ipc-posix-shm-write-data
>         (ipc-posix-name "com.apple.AppleDatabaseChanged"))
>
> (allow authorization-right-obtain
>         (right-name "com.apple.ctk.pair")
>         (right-name "com.apple.ctkbind.admin"))
>
> (allow user-preference-read
>         (preference-domain "com.apple.AppleMultitouchTrackpad")
>         (preference-domain "com.apple.ctkbind")
>         (preference-domain "com.apple.HIToolbox")
>         (preference-domain "com.apple.universalaccess")
>         (preference-domain "kCFPreferencesAnyApplication"))
>
> (allow user-preference-read user-preference-write
>         (preference-domain "com.apple.ctkbind")
>         (preference-domain "com.apple.security.smartcard")
>         (preference-domain "com.apple.security.tokenlogin"))
>
> (allow iokit-open
>         (iokit-registry-entry-class "IGAccelCommandQueue")
>         (iokit-registry-entry-class "IGAccelDevice")
>         (iokit-user-client-class "AppleKeyStoreUserClient")
>         (iokit-user-client-class "IGAccelSharedUserClient")
>         (iokit-user-client-class "IOSurfaceRootUserClient"))
--
com.apple.ctkd.sb
Files /System/Library/Sandbox/Profiles/com.apple.ctkd.sb and com.apple.ctkd.sb are identical
--
com.apple.datadetectors.sourceaccess.sb
Files /System/Library/Sandbox/Profiles/com.apple.datadetectors.sourceaccess.sb and com.apple.datadetectors.sourceaccess.sb are identical
--
com.apple.deleted.sb
38c38
<     (regex "/private/var/folders/.*/mds/mds.lock"))
---
>     (regex #"/private/var/folders/[^/]+/[^/]+/C/[^/]+/mds/mds\.lock$"))
44,52c44,51
<     (regex "/Users/.*/Library/Preferences/.GlobalPreferences.plist")
<     (regex "/Users/.*/Library/Preferences/ByHost/.GlobalPreferences\..*\.plist")
<     (regex "/AppleInternal/Library/CacheDelete")
<     (regex "/AppleInternal/Library/CacheDelete/.*")
<     (regex "/Applications/.*")
<     (regex "/private/var/folders/.*/mds/mds.lock")
<     (regex "/private/var/folders/.*/com.apple.LaunchServices-.*\.csstore")
<     (regex "*\.appex")
< 	(subpath "/System/Library/CacheDelete"))
---
>     (regex "^/Users/[^/]+/Library/Preferences/\.GlobalPreferences\.plist$")
>     (regex "^/Users/[^/]+/Library/Preferences/ByHost/\.GlobalPreferences\..*\.plist$")
>     (regex "^/Applications/.*$")
>     (regex "^/private/var/folders/.*/mds/mds\.lock$")
>     (regex "^/private/var/folders/.*/com.apple.LaunchServices-.*\.csstore$")
>     (regex "^.*/[^/]*\.appex$")
>     (subpath "/System/Library/CacheDelete")
>     (subpath "/AppleInternal/Library/CacheDelete"))
63a63,64
>     (global-name "com.apple.DiskArbitration.diskarbitrationd")
>     (global-name "com.apple.diskmanagementd")
66a68,69
> (allow iokit-open (iokit-user-client-class "AppleAPFSUserClient"))
>
--
com.apple.diagnosticd.sb
Files /System/Library/Sandbox/Profiles/com.apple.diagnosticd.sb and com.apple.diagnosticd.sb are identical
--
com.apple.distnoted.sb
0a1,11
> (version 1)
> (deny default)
>
> (import "system.sb")
> (allow mach-lookup
>     (global-name "com.apple.distributed_notifications@1v3")
>     (global-name "com.apple.distributed_notifications@Uv3")
>     (global-name "com.apple.distributed_notifications@0v3")
>     (local-name "com.apple.distributed_notifications@1v3")
>     (local-name "com.apple.distributed_notifications@Uv3")
>     (local-name "com.apple.distributed_notifications@0v3"))
--
com.apple.dprivacyd.sb
28c28,29
<     (subpath "/Library/Application\ Support"))
---
>     (subpath "/Library/Application\ Support")
>     (subpath "/usr"))
--
com.apple.dyld.closured.sb
0a1,22
> ;;; Copyright (c) 2017 Apple Inc.  All Rights reserved.
> ;;;
> ;;; WARNING: The sandbox rules in this file currently constitute
> ;;; Apple System Private Interface and are subject to change at any time and
> ;;; without notice.
> ;;;
> (version 1)
>
> (deny default)
> (deny file-map-executable iokit-get-properties process-info* nvram*)
> (deny dynamic-code-generation)
>
> (import "system.sb")
>
> ;; For reading dylibs
> (allow file-read*)
>
> ;; For resolving symlinks, realpath(3), and equivalents.
> (allow file-read-metadata)
>
> ;; for logging name of client
> (allow process-info-pidinfo)
--
com.apple.efilogin-helper.sb
Files /System/Library/Sandbox/Profiles/com.apple.efilogin-helper.sb and com.apple.efilogin-helper.sb are identical
--
com.apple.eosauthagent.sb
11,12c11,12
<     (subpath "/System/Library/PrivateFrameworks/SSOClient.framework")
<     (subpath "/System/Library/Frameworks/SSOClient.framework")
---
>     (subpath "/System/Library/PrivateFrameworks")
>     (subpath "/System/Library/Frameworks")
15a16
>     (subpath "/Library/Frameworks/SplunkKit.framework")
--
com.apple.icloud.findmydeviced.findmydevice-user-agent.sb
Files /System/Library/Sandbox/Profiles/com.apple.icloud.findmydeviced.findmydevice-user-agent.sb and com.apple.icloud.findmydeviced.findmydevice-user-agent.sb are identical
--
com.apple.iconservicesagent.sb
Files /System/Library/Sandbox/Profiles/com.apple.iconservicesagent.sb and com.apple.iconservicesagent.sb are identical
--
com.apple.iconservicesd.sb
Files /System/Library/Sandbox/Profiles/com.apple.iconservicesd.sb and com.apple.iconservicesd.sb are identical
--
com.apple.knowledge-agent.sb
0a1,61
> (version 1)
> (deny default)
>
> (import "system.sb")
> (import "com.apple.corefoundation.sb")
> (import "bsd.sb")
>
> (system-network)
> (corefoundation)
>
> (allow mach-lookup
>     (global-name "com.apple.bird.token")
>     (global-name "com.apple.cloudd")
>     (global-name "com.apple.cookied")
>     (global-name "com.apple.CoreServices.coreservicesd")
>     (global-name "com.apple.coreservices.quarantine-resolver")
>     (global-name "com.apple.coreduetd.knowledge.user")
>     (global-name "com.apple.lsd.mapdb"))
>
> (allow file*
>     (subpath (param "_USER_TEMP_DIR"))
>     (subpath (string-append (param "_HOME") "/Library/Caches/knowledge-agent"))
>     (literal (string-append (param "_HOME") "/Library/Preferences/knowledge-agent.plist"))
>     (literal (string-append (param "_HOME") "/Library/Preferences/com.apple.CoreDuet.plist"))
>     (subpath (string-append (param "_HOME") "/Library/Application Support/Knowledge")))
>
> (allow file-read* file-write*
>     (subpath (string-append (param "_HOME") "/Library/Caches/CloudKit/com.apple.knowledge-agent")))
>
> (allow file-read-metadata
>     (subpath (string-append (param "_HOME") "/Library"))
>     (subpath "/usr"))
>
> (allow file-read-data
>     (literal "/usr/libexec")
>     (subpath "/usr/libexec/knowledge-agent")
>     (literal "/Library/Preferences/.GlobalPreferences.plist")
>     (literal (string-append (param "_HOME") "/Library/Preferences/.GlobalPreferences.plist"))
>     (literal (string-append (param "_HOME") "/Library/Preferences/knowledge-agent.plist"))
>     (literal (string-append (param "_HOME") "/Library/Preferences/com.apple.CoreDuet.plist"))
>     (regex (string-append "^" (regex-quote (param "_HOME")) #"/Library/Preferences/ByHost/\.GlobalPreferences\.[^/]*\.plist$"))
>     (regex (string-append "^" (regex-quote (param "_HOME")) #"/Library/Preferences/ByHost/knowledge-agent\.[^/]*\.plist$"))
>     (regex (string-append "^" (regex-quote (param "_HOME")) #"/Library/Preferences/ByHost/com.apple.CoreDuet.plist\.[^/]*\.plist$")))
>
> (allow file-read-metadata
>     (literal "/AppleInternal")
>     (literal (param "_HOME")))
>
> (allow file-read*
>     (literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains")              ; for CrashReporter
>     (literal "/Library/MessageTracer/SubmitDiagInfo.default.domains.searchtree"))              ; for MessageTracer
>
> (allow network-outbound
>     (literal "/private/var/run/mDNSResponder"))                                                ; to resolve host names
>
> (allow ipc-posix-shm-read-data
>        (ipc-posix-name "FNetwork.defaultStorageSession"))
>
> (allow network-outbound
>        (remote ip))                                                                            ; to download policy updates
>
--
com.apple.logd.sb
1c1
< ;; Copyright (c) 2015 Apple Inc.  All Rights reserved.
---
> ;; Copyright (c) 2015-2017 Apple Inc.  All Rights reserved.
17,19c17,19
<     (regex #"^(/private)?/var/db/diagnostics(/|$)")
<     (regex #"^(/private)?/var/db/uuidtext(/|$)")
< )
---
>     (regex #"^/private/var/db/diagnostics(/|$)")
>     (regex #"^/private/var/db/timesync(/|$)")
>     (regex #"^/private/var/db/uuidtext(/|$)"))
22,24c22,24
<     (regex #"^(/private)?/var/db/diagnostics(/|$)")
<     (regex #"^/private/var/db/timezone(/|$)")
< )
---
>     (regex #"^/private/var/db/diagnostics(/|$)")
>     (regex #"^/private/var/db/timesync(/|$)")
>     (regex #"^/private/var/db/timezone(/|$)"))
30a31
>             (subpath "/private/var/db/timesync")
35,36c36
<     (remote unix-socket (path-literal "/private/var/run/syslog"))
< )
---
>     (remote unix-socket (path-literal "/private/var/run/syslog")))
--
com.apple.mtlcompilerservice.sb
8,10c8
< (allow file-read-data)
< (allow file-read-metadata)
<
---
> (allow file-read-metadata (path "/"))
--
com.apple.navd.sb
Files /System/Library/Sandbox/Profiles/com.apple.navd.sb and com.apple.navd.sb are identical
--
com.apple.neagent.sb
Files /System/Library/Sandbox/Profiles/com.apple.neagent.sb and com.apple.neagent.sb are identical
--
com.apple.nehelper.sb
20,21c20,21
< 	(regex #"^/Library/Preferences/com\.apple\.networkextension(\.necp|\.control|\.cache)?\.plist")
< 	(regex #"^/Library/Preferences/com\.apple\.networkd(\.sysctl)?\.plist")
---
> 	(regex #"^/Library/Preferences/com\.apple\.networkextension(\.[_a-zA-Z0-9-]+)?\.plist")
> 	(regex #"^/Library/Preferences/com\.apple\.networkd(\.[_a-zA-Z0-9-]+)?\.plist")
26c26
< 	(regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/TemporaryItems(/|$)"))
---
> 	(subpath (param "TEMPDIR")))
67a68,69
> 	(global-name "com.apple.mobileassetd")
> 	(global-name "com.apple.mobileassetd.v2")
69a72,75
> ;;; MobileAsset
> (allow user-preference-read (preference-domain "com.apple.MobileAsset"))
> (allow user-preference-read (preference-domain "com.apple.SoftwareUpdate"))
>
--
com.apple.nesessionmanager.sb
48d47
< 	(literal "/usr/libexec/discoveryd")
--
com.apple.networkserviceproxy.sb
33,34c33
< 	(literal "/private/var/mobile/Library/Logs/awd/awd-NetworkServiceProxy.log")
< 	(regex "/private/var/folders/.*"))
---
> 	(literal "/private/var/mobile/Library/Logs/awd/awd-NetworkServiceProxy.log"))
--
com.apple.nlcd.sb
Files /System/Library/Sandbox/Profiles/com.apple.nlcd.sb and com.apple.nlcd.sb are identical
--
com.apple.noticeboard.agent.sb
Files /System/Library/Sandbox/Profiles/com.apple.noticeboard.agent.sb and com.apple.noticeboard.agent.sb are identical
--
com.apple.noticeboard.state.sb
Files /System/Library/Sandbox/Profiles/com.apple.noticeboard.state.sb and com.apple.noticeboard.state.sb are identical
--
com.apple.notifyd.sb
Files /System/Library/Sandbox/Profiles/com.apple.notifyd.sb and com.apple.notifyd.sb are identical
--
com.apple.opendirectoryd.sb
Files /System/Library/Sandbox/Profiles/com.apple.opendirectoryd.sb and com.apple.opendirectoryd.sb are identical
--
com.apple.pboard.sb
5c5,20
< (allow ipc-posix-shm (ipc-posix-name-regex #"^CFPBS:"))
---
>
> ; Enable pboard to call realpath() and re-issue sandbox extensions for file promises.
> (allow file-read-metadata)
> (allow file-issue-extension
>     (require-all
>         (extension-class "com.apple.app-sandbox.read")
>         (extension "com.apple.app-sandbox.read")))
> (allow file-issue-extension
>     (require-all
>         (extension-class "com.apple.app-sandbox.read")
>         (extension "com.apple.app-sandbox.read-write")))
> (allow file-issue-extension
>     (require-all
>         (extension-class "com.apple.app-sandbox.read-write")
>         (extension "com.apple.app-sandbox.read-write")))
>
8,9c23
<     (global-name "com.apple.lsd.mapdb")
<     (local-name "com.apple.CFPasteboardClient"))
---
>     (global-name "com.apple.lsd.mapdb"))
--
com.apple.pictd.sb
Files /System/Library/Sandbox/Profiles/com.apple.pictd.sb and com.apple.pictd.sb are identical
--
com.apple.qtkitserver.sb
189a190
>        (global-name "com.apple.audio.AudioComponentRegistrar")
--
com.apple.qtkittrustedmoviesservice.sb
144a145
>        (global-name "com.apple.audio.AudioComponentRegistrar")
--
com.apple.rapportd.sb
0a1,47
> ;
> ;	Copyright (C) 2017 Apple Inc. All Rights Reserved.
> ;
> ;	Sandbox profile for rapportd.
> ;
>
> (version 1)
> (deny default)
>
> (import "com.apple.corefoundation.sb")
> (import "system.sb")
>
> (allow distributed-notification-post)
> (allow file-read*
> 	(subpath "/"))
> (allow file-write*
> 	(subpath "/Library/Application Support/Rapport")
> 	(regex #"^/Library/Keychains/System.keychain")
> 	(literal "/private/var/db/mds/system/mds.lock")
> 	(regex #"^/private/var/folders/[^/]+/[^/]+/C/mds/mds\.lock$")
> 	(regex #"^(/private)?/var/folders/[^/]+/[^/]+/C($|/)")
> 	(regex #"^(/private)?/var/folders/[^/]+/[^/]+/T($|/)")
> )
> (allow mach-lookup
> 	(global-name "com.apple.analyticsd")
> 	(global-name "com.apple.AutoUnlock.AuthenticationHintsProvider")
> 	(global-name "com.apple.awdd")
> 	(global-name "com.apple.bluetoothd")
> 	(global-name "com.apple.cloudd")
> 	(global-name "com.apple.coreduetd.context")
> 	(global-name "com.apple.coreduetd.knowledgebase")
> 	(global-name "com.apple.coresymbolicationd")
> 	(global-name "com.apple.distributed_notifications@1v3")
> 	(global-name "com.apple.managedconfiguration.profiled")
> 	(global-name "com.apple.networkd")
> 	(global-name "com.apple.ocspd")
> 	(global-name "com.apple.PairingManager")
> 	(global-name "com.apple.securityd.xpc")
> 	(global-name "com.apple.SecurityServer")
> 	(global-name "com.apple.server.bluetooth")
> 	(global-name "com.apple.wifi.manager")
> 	(global-name "com.apple.wirelessproxd"))
> (allow network*)
> (allow system-socket)
> (allow user-preference-read user-preference-write
> 	(preference-domain "com.apple.rapport")
> )
--
com.apple.reversetemplated.sb
12a13
>     (global-name "com.apple.parsecd") ;; to get flight information from Parsec (for flight template-less)
--
com.apple.revisiond.sb
Files /System/Library/Sandbox/Profiles/com.apple.revisiond.sb and com.apple.revisiond.sb are identical
--
com.apple.rtcreportingd.sb
27a28
>        (literal "/private/var/db/mds/system/mds.lock")
31,36d31
< (allow file-issue-extension
<        (home-literal "/Library/Caches/rtcreportingd")
<        (require-all
<            (extension-class "com.apple.rtcreporting.upload")
<            (home-subpath "/Library/Containers/com.apple.FaceTime/Data/logs/mediaserverd")))
<
53c48
<        (subpath "/usr/libexec/rtcreportingd"))
---
>        (literal "/usr/libexec/rtcreportingd"))
67a63
>        (global-name "com.apple.awdd")
68a65
>        (global-name "com.apple.distributed_notifications@1v3")
70a68,70
> (allow system-fsctl
>        (fsctl-command (_IO "h" 47)))  ; HFSIOC_SET_HOTFILE_STATE
>
72,76c72,73
< (allow network-outbound
<        (literal "/private/var/run/mDNSResponder")
<        (remote tcp "*:443")
<        (remote udp "*:16384")
<        (remote udp "*:16387"))
\ No newline at end of file
---
> (allow network-outbound)
> (allow network-inbound (local udp))
--
com.apple.secd.sb
0a1,46
> (version 1)
>
> (deny default)
>
> (import "system.sb")
>
> (allow file-read* file-write*
>     (subpath "/private/var/db/mds")
>     (regex #"^/private/var/folders/[^/]+/[^/]+/T(/|$)")
>     (regex (string-append "^" (regex-quote (param "_HOME")) #"/Library/Keychains(/|$)")))
>
>
> ;;;;;; will be fully fixed in 29465717
> (allow file-read* (subpath "/"))
>
> (allow user-preference-read
>     (preference-domain ".GlobalPreferences"))
> (allow user-preference-read
>     (preference-domain "com.apple.security"))
>
> (allow file-read*
>     (literal "/usr/libexec/secd")
>     (literal "/Library/Preferences/com.apple.security.plist")
>     (literal "/Library/Preferences/.GlobalPreferences.plist")
>     (literal "/AppleInternal")
>     (literal "/usr/libexec"))
>
>
> (allow mach-lookup
>         (global-name "com.apple.SystemConfiguration.configd")
>         (global-name "com.apple.security.cloudkeychainproxy3")
>         (global-name "com.apple.security.keychainsyncingoveridsproxy")
>         (global-name "com.apple.cloudd")
>         (global-name "com.apple.apsd")
>         (global-name "com.apple.windowserver.active"))
>
> (allow iokit-open
>     (iokit-user-client-class "AppleKeyStoreUserClient"))
>
> (allow iokit-get-properties (iokit-registry-entry-class "IOPlatformExpertDevice"))
>
> (allow ipc-posix-shm
>     (ipc-posix-name "com.apple.AppleDatabaseChanged"))
>
> (allow network-outbound)
> (allow system-socket)
--
com.apple.secinitd.sb
Files /System/Library/Sandbox/Profiles/com.apple.secinitd.sb and com.apple.secinitd.sb are identical
--
com.apple.securitydservice.sb
22c22,23
<        (global-name "com.apple.ocspd"))
---
>        (global-name "com.apple.ocspd")
>        (global-name "com.apple.mobile.keybagd.xpc"))
--
com.apple.siri.ClientFlow.ClientScripter.sb
27a28,30
> ;; For mapping process path to CFScripter instance
> (allow process-info-pidinfo)
>
--
com.apple.speech.speechsynthesisd.sb
92c92
< ;;; rdar://problem/26620973 & rdar://problem/31070724
---
> ;;; rdar://problem/26620973 & rdar://problem/31560540
100a101
>     (global-name "com.apple.audio.AudioComponentRegistrar")
104a106
>     (global-name "com.apple.mobileassetd")
--
com.apple.storeaccountd.sb
105a106,107
>        (global-name "com.apple.adid")
>        (global-name "com.apple.fpsd")
109a112,113
>        (global-name "com.apple.commerce")
>        (global-name "com.apple.commerced")
--
com.apple.storeassetd.sb
95a96,97
>        (global-name "com.apple.adid")
>        (global-name "com.apple.fpsd")
--
com.apple.storedownloadd.sb
39a40
>        (regex #"/Library/Preferences/com\.apple\.seeding\.plist$")
98a100,101
>        (global-name "com.apple.adid")
>        (global-name "com.apple.fpsd")
--
com.apple.storelegacy.sb
Files /System/Library/Sandbox/Profiles/com.apple.storelegacy.sb and com.apple.storelegacy.sb are identical
--
com.apple.storereceiptinstaller.sb
11a12
> 	   (regex #"^/private/var/root/Library/Preferences/ByHost/\.GlobalPreferences\..*\.plist$")
42a44,45
>        (global-name "com.apple.lsd.mapdb")
>        (global-name "com.apple.lsd.modifydb")
--
com.apple.storeuid.sb
87a88,94
> (allow user-preference-read
>     (preference-domain "com.apple.AppleMultitouchTrackpad")
>     (preference-domain "com.apple.ServicesMenu.Services"))
>
> (allow user-preference*
>     (preference-domain "com.apple.storeuid"))
>
98c105,106
<        (global-name "com.apple.storeuid"))
---
>        (global-name "com.apple.storeuid")
>        (global-name "com.apple.storeagent.storekit"))
100a109,113
>        (global-name "com.apple.iohideventsystem")
>        (global-name "com.apple.tsm.uiserver")
>        (global-name "com.apple.touchbarserver.mig")
>        (global-name "com.apple.touchbar.agent")
>        (global-name "com.apple.pbs.fetch_services")
104a118
>        (global-name "com.apple.commerce")
168a183,185
>        (iokit-user-client-class "IOSurfaceRootUserClient")
>        (iokit-user-client-class "IGAccelCommandQueue")
>        (iokit-user-client-class "AppleMultitouchDeviceUserClient")
--
com.apple.suggestd.sb
18a19,20
>     (home-subpath "/Library/Caches/com.apple.parsecd/CustomFeedback/") ;; Parsec feedback (Trystero uploads) <rdar://problem/33038387> Sandbox exception for Parsec feedback (macOS)
>
33a36
>     (home-subpath "/Library/Application Support/Knowledge") ;; _DKKnowledgeStore
39a43,51
> ;; <rdar://problem/31989235> Lobo: SGOrigin app name unlocalized - need sandbox rule for InfoPlist.strings
> (allow file-read* (home-literal "/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist"))
> (allow file-read* (regex #"\.app$"))
> (allow file-read* (regex #"\.app/Contents$"))
> (allow file-read* (regex #"\.app/Contents/Resources$"))
> (allow file-read* (regex #"/InfoPlist\.strings$"))
> (allow file-read* (regex #"/Info.plist$"))
> (allow file-read* (regex #"\.lproj$"))
>
41a54
>     (global-name "com.apple.apsd") ;; SGDCloudKitSync (APNS)
50a64
>     (global-name "com.apple.cloudd") ;; SGDCloudKitSync (CloudKit)
52c66,67
<     (global-name "com.apple.coreduetd.people") ;; SGDuetBridge
---
>     (global-name "com.apple.coreduetd.knowledge.user") ;; PersonalizationPortrait
>     (global-name "com.apple.coreduetd.context") ;; SGDPowerBudget
54a70,71
>     (global-name "com.apple.spotlight.SearchAgent")
>     (global-name "com.apple.spotlight.IndexAgent")
58a76
>     (global-name "com.apple.metadata.mds") ;; <rdar://problem/28957199>
66c84,87
<     (global-name "com.apple.tccd"))
---
>     (global-name "com.apple.SystemConfiguration.configd") ;; SGDCloudKitSync (APNS)
>     (global-name "com.apple.tccd")
>     (global-name "com.apple.windowserver.active") ;; AGDCloudKitSync (APNS)
>     (global-name "com.apple.FileCoordination")) ;; MailServices for reimport
--
com.apple.swcd.sb
Files /System/Library/Sandbox/Profiles/com.apple.swcd.sb and com.apple.swcd.sb are identical
--
com.apple.tccd.sb
Files /System/Library/Sandbox/Profiles/com.apple.tccd.sb and com.apple.tccd.sb are identical
--
com.apple.touristd.sb
0a1,106
> ;;; Copyright (c) 2017 Apple Inc.  All Rights reserved.
> ;;;
> ;;; WARNING: The sandbox rules in this file currently constitute
> ;;; Apple System Private Interface and are subject to change at any time and
> ;;; without notice.
> ;;;
> (version 1)
>
> (deny default)
> (deny file-map-executable iokit-get-properties process-info* nvram*)
> (deny dynamic-code-generation)
>
> (import "system.sb")
> (import "com.apple.corefoundation.sb")
> (corefoundation)
>
> ;;; Homedir-relative path filters
> (define (home-regex home-relative-regex)
> (regex (string-append "^" (regex-quote (param "HOME")) home-relative-regex)))
>
> (define (home-subpath home-relative-subpath)
> (subpath (string-append (param "HOME") home-relative-subpath)))
>
> (define (home-prefix home-relative-prefix)
> (prefix (string-append (param "HOME") home-relative-prefix)))
>
> (define (home-literal home-relative-literal)
> (literal (string-append (param "HOME") home-relative-literal)))
>
> (allow process-info* (target self))
>
> ;; For resolving symlinks, realpath(3), and equivalents.
> (allow file-read-metadata)
>
> ;; For validating the entitlements of clients.
> (allow process-info-codesignature)
>
> ;;allow safari to open the url
> (allow lsopen)
>
> ;; preference domain.
> (allow user-preference-read user-preference-write
> (preference-domain "com.apple.touristd"))
> (allow user-preference-read user-preference-write
> (preference-domain "NSGlobalDomain"))
> (allow file-read* file-write* (home-subpath "/Library/Preferences/"))
> (allow file-read* file-write* (literal "/Library/Preferences/.GlobalPreferences.plist"))
>
> ;; private frameworks.
> (allow file-map-executable (subpath "/System/Library/PrivateFrameworks/"))
> (allow file-map-executable (subpath "/System/Library/Frameworks/"))
>
> ;;allow outbound network connections.
> (system-network)
> (allow network-outbound)
> (allow ipc-posix-shm-read-data)
>
> ;;allow mach lookup.
> (allow mach-lookup
> (global-name "com.apple.cookied")
> (global-name "com.apple.coreservices.launchservicesd")
> (global-name "com.apple.dock.server")
> (global-name "com.apple.lsd.mapdb")
> (global-name "com.apple.lsd.modifydb")
> (global-name "com.apple.syncdefaultsd")
> (global-name "com.apple.usernoted.daemon_client")
> (global-name "com.apple.coreservices.quarantine-resolver")
> (global-name "com.apple.SecurityServer")
> (global-name "com.apple.windowserver.active"))
>
> ;;allow get properties.
> (allow iokit-get-properties
> (require-all
> (iokit-registry-entry-class "IOPlatformExpertDevice")
> (iokit-registry-entry-class "IORegisterForSystemPower")
> (iokit-registry-entry-class "IORegistryEntryCreateCFProperty")))
>
> (allow iokit-open (iokit-user-client-class "RootDomainUserClient"))
> (allow iokit-get-properties (iokit-property "board-id"))
> (allow iokit-get-properties)
>
> ;; Read/write access to a temporary directory.
> (allow file-read* file-write*
> (subpath (param "TMPDIR"))
> (subpath (param "DARWIN_CACHE_DIR"))
> (subpath "/Library/Application Support/CrashReporter/"))
>
>
> (allow file-read*
> (subpath "/Library/Application Support/CrashReporter/")
> (subpath "/private/var/db/mds/messages")
> (literal "/Library/Preferences/com.apple.security.plist"))
>
>
> ;; Read/write access to the previous system version.
> (allow file-read-data (literal "/private/var/db/PreviousSystemVersion.plist"))
> (allow file-read-data (home-literal "/.CFUserTextEncoding"))
>
> ;; Read/write access to com.apple.touristd’s cache.
> (let ((cache-path-filter (home-prefix "/Library/Caches/com.apple.touristd")))
> (allow file-read* file-write* cache-path-filter)
> (allow file-issue-extension
> (require-all
> (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write")
> cache-path-filter)))
>
--
com.apple.trustd.sb
0a1,70
> (version 1)
>
> (deny default)
> (deny file-map-executable iokit-get-properties process-info* nvram*)
> (deny dynamic-code-generation)
>
> (import "system.sb")
> (import "com.apple.corefoundation.sb")
> (corefoundation)
>
> (allow process-info* (target self))
>
> ;; For resolving symlinks, realpath(3), and equivalents.
> (allow file-read-metadata)
>
> ;; For validating the entitlements of clients (for keychain and trust settings)
> ;; see 31353815
> (allow process-info-codesignature)
> (allow process-info-pidinfo)
> (allow file-read*)
>
> ;; ${PRODUCT_NAME}’s preference domain.
> (allow user-preference-read user-preference-write
>     (preference-domain "com.apple.trustd"))
>
> ;; Global and security preferences
> (allow user-preference-read
> 	(preference-domain "com.apple.security")
> 	(preference-domain "com.apple.Security")
> 	(preference-domain ".GlobalPreferences")
> 	(preference-domain "com.apple.MobileAsset"))
>
> ;; Read/write access to a temporary directory.
> (allow file-read* file-write*
>     (subpath (param "_TMPDIR"))
>     (subpath (param "_DARWIN_CACHE_DIR")))
>
> ;; Read/write access to keychains and caches
> (allow file-read* file-write*
> 	(subpath "/private/var/db/mds/")
> 	(subpath "/private/var/db/crls/")
> 	(subpath "/System/Library/Security/")
> 	(subpath "/Library/Keychains/")
> 	(subpath "/private/var/root/Library/Caches/com.apple.nsurlsessiond/"))
>
> (allow file-read*
> 	(literal "/usr/libexec")
> 	(literal "/usr/libexec/trustd")
> 	(literal "/Library/Preferences/com.apple.security.plist")
> 	(regex #"/.GlobalPreferences[^/]*\.plist")
> 	(literal "/Library/Preferences/com.apple.SoftwareUpdate.plist")
>     (literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains"))
>
> (allow file-map-executable
>     (regex #"/CoreServicesInternal")
>     (regex #"/csparser"))
>
> (allow mach-lookup
> 	(global-name "com.apple.ocspd")
> 	(global-name "com.apple.SecurityServer")
> 	(global-name "com.apple.SystemConfiguration.configd")
> 	(global-name "com.apple.mobileassetd")
>     (global-name "com.apple.securityd.xpc")
>     (global-name "com.apple.nsurlsessiond"))
>
> (allow ipc-posix-shm
> 	(ipc-posix-name "com.apple.AppleDatabaseChanged"))
>
> (allow network-outbound)
> (allow system-socket)
--
com.apple.useractivityd.sb
14a15,21
> ;;(allow file-issue-extension
> ;;       (extension "com.apple.app-sandbox.read-write"))
>
> (if (param "TMP_DIR")
>     (allow file-issue-extension
>            (regex (string-append "^" (param "TMP_DIR") "/*"))))
>
56a64,66
>        (global-name "com.apple.BluetoothDOServer")
>        (global-name "com.apple.FileCoordination")
>        (global-name "com.apple.analyticsd")
--
com.apple.writeconfig.sb
Files /System/Library/Sandbox/Profiles/com.apple.writeconfig.sb and com.apple.writeconfig.sb are identical
--
com.apple.xpchelper.sb
Files /System/Library/Sandbox/Profiles/com.apple.xpchelper.sb and com.apple.xpchelper.sb are identical
--
com.openssh.sshd.sb
Files /System/Library/Sandbox/Profiles/com.openssh.sshd.sb and com.openssh.sshd.sb are identical
--
coresymbolicationd.sb
Files /System/Library/Sandbox/Profiles/coresymbolicationd.sb and coresymbolicationd.sb are identical
--
directoryserver.sb
Files /System/Library/Sandbox/Profiles/directoryserver.sb and directoryserver.sb are identical
--
fmfd.sb
Files /System/Library/Sandbox/Profiles/fmfd.sb and fmfd.sb are identical
--
iWorkXPC.sb
0a1,28
> (version 1)
>
> (deny default)
> (deny dynamic-code-generation file-map-executable nvram* process-info*)
>
> (import "system.sb")
>
> ;;; <rdar://problem/32252235> MAC: XPC: Sandbox violations on export
> (define (home-subpath home-relative-subpath)
>   (subpath (string-append (param "_HOME") home-relative-subpath)))
> (define (home-literal home-relative-literal)
>   (literal (string-append (param "_HOME") home-relative-literal)))
> (define (home-regex home-relative-regex)
>   (regex (string-append "^" (regex-quote (param "_HOME")) home-relative-regex)))
>
> (allow file-read* (home-literal "/Library/Preferences/.CFUserTextEncoding"))
>
> (allow file-read-metadata)
>
> (allow mach-lookup (global-name "com.apple.CoreServices.coreservicesd"))
>
> (allow file-read* (extension "com.apple.app-sandbox.read"))
> (allow file-read* file-write* (extension "com.apple.app-sandbox.read-write"))
>
> (allow process-info-dirtycontrol (target self))
>
> (allow file-map-executable (subpath "/System/Library/Frameworks")
>                            (subpath "/System/Library/PrivateFrameworks"))
--
opendirectory.sb
Files /System/Library/Sandbox/Profiles/opendirectory.sb and opendirectory.sb are identical
--
racoon.sb
Files /System/Library/Sandbox/Profiles/racoon.sb and racoon.sb are identical
--
system.sb
13,14c13,16
< (allow mach-register
<        (local-name-prefix ""))
---
> (allow mach-register (local-name-prefix ""))
>
> ;;; Allow lookup of XPC services for backward-compatibility.
> (allow mach-lookup (xpc-service-name-prefix ""))
22a25
>                                  (subpath "/private/var/db/timezone")
78a82
>        (global-name "com.apple.dyld.closured")
121a126
>          (iokit-registry-entry-class "AppleIntelMEUserClient")