;; Copyright (c) 2012 Apple Inc.  All Rights reserved.
;;
;; WARNING: The sandbox rules in this file currently constitute
;; Apple System Private Interface and are subject to change at any time and
;; without notice. The contents of this file are also auto-generated and not
;; user editable; it may be overwritten at any time.
;;

(version 1)
(deny default)

(import "system.sb")
(import "com.apple.corefoundation.sb")

(allow system-fsctl
       (fsctl-command HFSIOC_SET_HOTFILE_STATE)
)
       
(allow file-read* file-write*
    (literal "/private/var/root/Library/Logs")
    (regex   "/private/var/root/Library/Logs/Bluetooth/*")
    (regex   "/var/*")
)

(allow file-read-data
    (subpath "/System/Library/CoreServices")
    (literal "/Library/Managed Preferences/local/.GlobalPreferences.plist")
)

(allow file-issue-extension
  (extension-class "com.apple.cfprefsd.read")
  (extension-class "com.apple.cfprefsd.read-write")
  (subpath "/Library/Bluetooth/Library/Preferences")
)

(allow mach-per-user-lookup)
(allow mach-lookup
(global-name "com.apple.AppSSO.service-xpc")
(global-name "com.apple.CoreServices.coreservicesd")
(global-name "com.apple.bluetoothd")
(global-name "com.apple.bluetooth.nsxpc")
(global-name "com.apple.server.bluetooth.le.pipe.xpc")
(global-name "com.apple.server.bluetooth.le.att.xpc")
(global-name "com.apple.server.bluetooth.general.xpc")
(global-name "com.apple.iohideventsystem")
(global-name "com.apple.tccd.system")
(global-name "com.apple.PowerManagement.control")
(global-name "com.apple.ocspd")
(global-name "com.apple.tccd")
(global-name "com.apple.corespeech.corespeechd.activation.xpc")
(global-name "com.apple.assistant.analytics")
(global-name "com.apple.accessoryupdater.uarp")
(global-name "com.apple.lsd.modifydb")
(global-name "com.apple.siri.activation")
(global-name "com.apple.SecurityServer")
(global-name "com.apple.corespeech.corespeechservices")
(global-name "com.apple.accessories.transport-server")
(global-name "com.apple.uarp.endpoint.transport")
)

(allow iokit-open
(iokit-user-client-class "IOHIDResourceDeviceUserClient")
(iokit-user-client-class "IOHIDLibUserClient")
(iokit-user-client-class "RootDomainUserClient")
(iokit-user-client-class "AppleConvergedIPCUserClient")
(iokit-user-client-class "AppleKeyStoreUserClient")
(iokit-user-client-class "AppleUSBHostDeviceUserClient")
(iokit-user-client-class "IOUSBDeviceUserClientV2")
)

(allow file-read-data
(literal "/private/var/root/Library/Preferences/.GlobalPreferences.plist")
(literal "/Library/Preferences/.GlobalPreferences.plist")
(literal "/Library/Preferences/com.apple.security.plist")
(literal "/Library/Bluetooth")
(literal "/Library/Bluetooth/Library")
(literal "/Library/Bluetooth/Library/Preferences")
(literal "/private/var/db")
(regex #"^/Library/Application Support/BTServer/.*")
)

(allow file-read-data
       (literal "/usr/")
       (literal "/usr/sbin")
       (literal "/usr/sbin/BTLEServer")
       (subpath "/System")
       (regex   "/AppleInternal/usr/local/misc/*")
)

(allow file-read-metadata
       (literal "/Library/Preferences")
       (literal "/private/var")
       (literal "/private/var/root")
       (literal "/usr")
       (literal "/usr/sbin")
       (literal "/usr/sbin/BTLEServer")
       (literal "/usr/sbin/BTLEServerAgent")
       (regex   "/AppleInternal/usr/local/misc")
       (regex   "/AppleInternal/usr/local/misc/*")
)