(version 1)
(deny default)
(debug deny)

(import "/System/Library/Sandbox/Profiles/system.sb")

(define (home-subpath home-relative-subpath)
       (subpath (string-append (param "_HOME") home-relative-subpath)))
(define (home-literal home-relative-literal)
       (literal (string-append (param "_HOME") home-relative-literal)))
(define (home-regex home-relative-regex)
       (regex (string-append "^" (regex-quote (param "_HOME")) home-relative-regex)))

(allow file-read-metadata)

(allow file-write-create
       (require-all
           (vnode-type DIRECTORY)
           (home-subpath "/Library/Logs")
       )
       (require-all
           (vnode-type DIRECTORY)
           (home-subpath "/Library/Caches")
       )
       (require-all
           (vnode-type DIRECTORY)
           (subpath "/private/var/root/Library/Logs")
       )
       (require-all
           (vnode-type DIRECTORY)
           (subpath "/private/var/root/Library/Caches")
       )
)

(allow file-read* file-write*
       (home-subpath "/Library/Caches/com.apple.CloudTelemetry/XPCService")
       (home-subpath "/Library/Logs/com.apple.CloudTelemetry/XPCService")
       
       (subpath "/private/var/root/Library/Caches/com.apple.CloudTelemetry/XPCService")
       (subpath "/private/var/root/Library/Logs/com.apple.CloudTelemetry/XPCService")
)

(allow file-read*
    (prefix "/private/var/db/mds/messages")
    
    (literal "/System/Library/PrivateFrameworks/CloudTelemetry.framework/Versions/A/XPCServices/CloudTelemetryService.xpc/Contents/MacOS/CloudTelemetryService")
    
    ;; Allow access for OSAnalaytics API
    (literal "/Library/OSAnalytics/Preferences/")
    
    ;; Allow access for network attribution.
    ;; Note: This file is located under root not ~ so cannot be listed under user-preference-read, which looks under ~/Library/Preferences
    (literal "/Library/Preferences/com.apple.networkextension.uuidcache.plist")

    ;; Allow DNU querying on macOS
    (literal "/Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist")
)

(allow user-preference-read
    (preference-domain "com.apple.c2")
    (preference-domain "com.apple.CFNetwork")
    (preference-domain "com.apple.security")
    (preference-domain "kCFPreferencesAnyApplication")
)

(allow user-preference-read user-preference-write
    (preference-domain "com.apple.CloudTelemetryService.xpc")
)

(allow mach-lookup
       (global-name
                    "com.apple.cloudd"
                    "com.apple.metadata.mds"
                    "com.apple.PowerManagement.control"
                    "com.apple.CoreServices.coreservicesd"
                    "com.apple.coreservices.quarantine-resolver"
                    "com.apple.distributed_notifications@Uv3"
                    "com.apple.tccd"
                    "com.apple.tccd.system"
                    "com.apple.osanalytics.osanalyticshelper"
       )
)

(system-network)
(allow network-outbound)
(allow lsopen)