;;
;;  framework.sb
;;  SoftwareUpdateCoreSupport
;;
;;  Sandbox Profile for the SoftwareUpdateCoreSupport Framework
;;
;;  Created by Erik Phillips on 11/15/19.
;;  Copyright © 2019 Apple Inc. All rights reserved.
;;
;;  WARNING: The sandbox rules in this file currently constitute
;;  Apple System Private Interface and are subject to change at
;;  any time and without notice.
;;
;; MacOS Install location:
;;   /System/Library/PrivateFrameworks/SoftwareUpdateCoreSupport.framework/Versions/A/Resources/framework.sb
;;

(version 1)

(import "system.sb")
(import "com.apple.corefoundation.sb")
(corefoundation)

(allow process-info* (target self))

;; For resolving symlinks, realpath(3), and equivalents.
(allow file-read-metadata)

;; For validating the entitlements of clients.
(allow process-info-codesignature)

;; Allow access to read the NVRAM variables
(allow nvram*)

;; BootPolicy (SUCoreDevice) access to iBoot System Container
(allow file-read* file-write*
    (subpath "/System/Volumes/iSCPreboot"))

;; BootPolicy (SUCoreDevice) access to BootPolicy
(allow iokit-open
    (iokit-user-client-class "BootPolicyUserClient"))