;;;;;; Base profile for Application Sandboxing
;;;;;;
;;;;;; Copyright (c) 2011-2019 Apple Inc.  All Rights reserved.
;;;;;;
;;;;;; WARNING: The sandbox rules in this file currently constitute
;;;;;; Apple System Private Interface and are subject to change at any time and
;;;;;; without notice. The contents of this file are also auto-generated and
;;;;;; not user editable; it may be overwritten at any time.
(version 1)
(deny default file-link)
(define entitlement-legacy-names
  '(("com.apple.security.device.microphone" "com.apple.security.microphone")
    ("com.apple.security.device.camera" "com.apple.security.camera")
    ("com.apple.security.personal-information.addressbook"
     "com.apple.security.addressbook")
    ("com.apple.security.personal-information.calendars"
     "com.apple.security.calendars")
    ("com.apple.security.personal-information.location"
     "com.apple.security.location")
    ("com.apple.security.files.user-selected.read-only"
     "com.apple.security.documents.user-selected.read"
     "com.apple.security.files.user-selected.read")
    ("com.apple.security.files.user-selected.read-write"
     "com.apple.security.documents.user-selected.read-write")))
(import "system.sb")
(import "appsandbox-common.sb")
(allow system-audit system-sched mach-task-name process-fork lsopen)
(define (select-mach-filter filter with-star without-star)
  (if (end-with-star? filter)
    (with-star (strip-last-char filter))
    (without-star filter)))
(define (bundle-id-can-register-service bundle-id service-filter)
  (if (and (param "application_bundle_id")
           (equal? (param "application_bundle_id") bundle-id))
    (let ((mach-filter
            (select-mach-filter
              service-filter
              global-name-prefix
              global-name)))
      (allow mach-register mach-filter))))
(if (and (param "application_bundle_id")
         (%string-prefix? "com.apple." (param "application_bundle_id")))
  (allow mach-register (with report) (with telemetry)))
(with-filter (process-path "/usr/sbin/screencapture")
  (allow mach-register (global-name "com.apple.screencapture.interactive")))
(allow mach-register (local-name-prefix ""))
(bundle-id-can-register-service
  "com.busymac.busycontacts"
  "BusyContacts Protocol 1.0")
(bundle-id-can-register-service "com.blackpixel.kaleidoscope" "KSDOConnection")
(bundle-id-can-register-service
  "com.amazon.Kindle"
  "com.amazon.KindleForMac-*")
(bundle-id-can-register-service
  "com.microsoft.OneDrive-mac"
  "com.microsoft.SkyDrive*")
(when (entitlement "com.apple.developer.storage.fileutil")
      (allow system-kext-query)
      (allow system-socket
             (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))
      (allow network-outbound
             (control-name "com.apple.fileutil.kext.stateful.ctl")
             (control-name "com.apple.fileutil.kext.stateless.ctl")))
(when (entitlement "com.apple.developer.storage.fsplaceholder")
      (allow system-kext-query)
      (allow system-socket
             (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))
      (allow network-outbound
             (control-name "com.apple.fsplaceholder.kauth")
             (control-name "com.apple.fsplaceholder.logging")
             (control-name "com.apple.fsplaceholder.bouncer")))
(appsandbox-process-common)
(deny nvram*)
(allow sysctl-read (sysctl-name "kern.tcsm_available"))
(allow sysctl-read sysctl-write (sysctl-name "kern.tcsm_enable"))
(when (entitlement "com.apple.security.temporary-exception.yasb")
      (read-write-and-issue-extensions (subpath "/"))
      (apply-read-and-issue-extension deny (home-subpath "/Library"))
      (apply-write-and-issue-extension deny (home-subpath "/Library")))
(allow file-read* process-exec (subpath "/Library"))
(deny file-read*
      process-exec
      (subpath "/Library/Application Support/AppStoreContent")
      (subpath "/Library/Application Support/AppStore")
      (subpath "/Library/Caches")
      (subpath "/Library/Logs")
      (subpath "/Library/Managed Preferences")
      (subpath "/Library/Preferences"))
(allow file-issue-extension
       (require-all
         (extension-class "com.apple.app-sandbox.read")
         (subpath "/Library/User Pictures")))
(allow file-read* (subpath "/Library/Preferences/Logging"))
(when (param "application_bundle")
      (allow-read-directory-contents (param "application_bundle"))
      (allow file-link (subpath (param "application_bundle")))
      (allow process-exec (subpath (param "application_bundle"))))
(allow-read-write-directory-contents (param "application_darwin_user_dir"))
(allow file-mount file-unmount (subpath (param "application_darwin_user_dir")))
(appsandbox-tmpdir)
(allow file-mount file-unmount (subpath (param "application_darwin_temp_dir")))
(allow-read-write-directory-contents (param "application_darwin_cache_dir"))
(allow file-mount
       file-unmount
       (subpath (param "application_darwin_cache_dir")))
(dyld-injection-support)
(appsandbox-container-common)
(appsandbox-container-macos)
(optical-media)
(when (entitlement "com.apple.security.network.client") (network-client))
(when (entitlement "com.apple.security.network.server") (network-server))
(when (entitlement "com.apple.network.multipath-tcp")
      (allow system-socket (socket-domain 39)))
(when (entitlement "com.apple.security.device.camera") (camera))
(when (or (entitlement "com.apple.security.device.hid")
          (entitlement "com.apple.security.device.usb"))
      (allow iokit-open-user-client
             (iokit-user-client-class "IOHIDLibUserClient")))
(when (entitlement "com.apple.security.device.usb")
      (allow iokit-open-user-client
             (iokit-user-client-class
               "IOUSBDeviceUserClientV2"
               "IOUSBInterfaceUserClientV3")))
(when (entitlement "com.apple.security.device.firewire")
      (allow iokit-open-user-client
             (iokit-user-client-class
               "IOFireWireUserClient"
               "IOFireWireAVCUserClient"
               "IOFireWireAVCProtocolUserClient"))
      (allow iokit-set-properties (iokit-property "SummonNub")))
(when (entitlement "com.apple.security.device.bluetooth") (bluetooth))
(when (entitlement "com.apple.security.device.serial")
      (allow file*
             (require-all
               (vnode-type TTY)
               (require-not
                 (require-any
                   (literal "/dev/fsevents")
                   (literal "/dev/lockstat")
                   (literal "/dev/machtrace")
                   (literal "/dev/profile")
                   (literal "/dev/ptmx")
                   (literal "/dev/sdt")
                   (literal "/dev/systrace")
                   (regex "^/dev/tty[^\\.]")
                   (regex "^/dev/pty")
                   (regex "^/dev/fbt")
                   (regex "^/dev/io8log"))))))
(when (entitlement "com.apple.security.personal-information.location")
      (locationservices))
(when (entitlement "com.apple.security.personal-information.addressbook")
      (addressbook))
(when (entitlement "com.apple.security.personal-information.calendars")
      (calendar))
(with-filter (require-entitlement "com.apple.security.smartcard")
  (allow mach-lookup (global-name "com.apple.ctkd.watcher-client")))
(when (entitlement "com.apple.developer.automatic-assessment-configuration")
      (allow mach-lookup (global-name "com.apple.assessmentagent")))
(with-filter (require-entitlement
               "com.apple.developer.identity-document-services.web-presentment-controller")
  (web-presentment))
(with-filter (require-entitlement "com.apple.developer.declared-age-range")
  (declared-age-range))
(letrec ((itunes-subpaths
           (lambda args
             (let* ((itunes-roots
                      '("/Music/iTunes/iTunes Media"
                        "/Music/iTunes/iTunes Music"
                        "/Documents/iTunes/iTunes Music"))
                    (_subpath
                      (if (null? args) "" (string-append "/" (car args))))
                    (subfilters
                      (map (lambda (root)
                             (home-subpath (string-append root _subpath)))
                           itunes-roots)))
               (apply require-any subfilters))))
         (allow-subdirs
           (lambda (subdirs func)
             (for-each
               (lambda (subdir)
                 (func allow (home-subpath (string-append "/" subdir))))
               subdirs)
             (func allow
                   (require-any
                     (home-literal "/Music")
                     (home-subpath "/Music/iTunes")
                     (home-subpath "/Documents/iTunes")))
             (func deny (itunes-subpaths))
             (for-each
               (lambda (subdir) (func allow (itunes-subpaths subdir)))
               subdirs)))
         (read '())
         (write '())
         (assets
           (lambda (ent subdir)
             (let ((ro (string-append ent ".read-only"))
                   (rw (string-append ent ".read-write")))
               (cond ((entitlement rw)
                      (let ()
                        (set! read (cons subdir read))
                        (set! write (cons subdir write))))
                     ((entitlement ro) (set! read (cons subdir read)))))))
         (finish
           (lambda ()
             (if (positive? (length write))
               (allow-subdirs write apply-write-and-issue-extension))
             (if (positive? (length read))
               (allow-subdirs read apply-read-and-issue-extension)))))
  (assets "com.apple.security.assets.music" "Music")
  (assets "com.apple.security.assets.movies" "Movies")
  (assets "com.apple.security.assets.pictures" "Pictures")
  (finish))
(define (set-access-to-itunes-music-subdirectory
         base-entitlement
         subdir-path-filter
         access-to-containing-dir-is-read-only)
  (let ((ent-ro (string-append base-entitlement ".read-only"))
        (ent-rw (string-append base-entitlement ".read-write")))
    (if (entitlement ent-ro)
      (apply-read-and-issue-extension allow subdir-path-filter)
      (if access-to-containing-dir-is-read-only
        (apply-read-and-issue-extension deny subdir-path-filter)))
    (when (entitlement ent-rw)
          (apply-read-and-issue-extension allow subdir-path-filter)
          (apply-write-and-issue-extension allow subdir-path-filter))
    (unless
      access-to-containing-dir-is-read-only
      (apply-read-and-issue-extension deny subdir-path-filter)
      (apply-write-and-issue-extension deny subdir-path-filter))))
(when (entitlement "com.apple.security.assets.music.read-only")
      (apply-read-and-issue-extension
        allow
        (home-subpath "/Music/iTunes/iTunes Music"))
      (set-access-to-itunes-music-subdirectory
        "com.apple.security.assets.movies"
        (home-subpath "/Music/iTunes/iTunes Music/Movies")
        #t)
      (set-access-to-itunes-music-subdirectory
        "com.apple.security.assets.pictures"
        (home-subpath "/Music/iTunes/iTunes Music/Pictures")
        #t))
(when (entitlement "com.apple.security.assets.music.read-write")
      (apply-read-and-issue-extension
        allow
        (home-subpath "/Music/iTunes/iTunes Music"))
      (apply-write-and-issue-extension
        allow
        (home-subpath "/Music/iTunes/iTunes Music"))
      (set-access-to-itunes-music-subdirectory
        "com.apple.security.assets.movies"
        (home-subpath "/Music/iTunes/iTunes Music/Movies")
        #f)
      (set-access-to-itunes-music-subdirectory
        "com.apple.security.assets.pictures"
        (home-subpath "/Music/iTunes/iTunes Music/Pictures")
        #f))
(sandbox-array-entitlement
  "com.apple.developer.ubiquity-container-identifiers"
  (lambda (id) (read-write-and-issue-extensions (ubiquity-filter id))))
(sandbox-array-entitlement
  "com.apple.developer.icloud-container-identifiers"
  (lambda (id) (read-write-and-issue-extensions (ubiquity-filter id))))
(allow file-read-data
       (require-all
         (file-attribute fileprovider-owned)
         (extension-path-ancestor)))
(allow file-read-xattr
       (require-all
         (require-any
           (xattr "com.apple.file-provider-domain-id")
           (xattr "com.apple.file-provider-domain-id#PN"))
         (file-attribute fileprovider-owned)
         (extension-path-ancestor)))
(clouddocs)
(when (entitlement "com.apple.developer.fskit.fsmodule")
      (allow iokit-open (iokit-user-client-class "AppleLIFSUserClient")))
(when (entitlement "com.apple.developer.game-center") (gamecenter))
(homekit)
(when (or (entitlement "com.apple.private.logging.admin")
          (entitlement "com.apple.private.logging.diagnostic"))
      (allow mach-lookup (global-name "com.apple.logd.admin")))
(when (entitlement "com.apple.private.logging.diagnostic")
      (with-filter (extension "com.apple.logd.read-only")
        (allow file-read*
               (subpath "/private/var/db/diagnostics")
               (subpath "/private/var/db/uuidtext"))))
(when (entitlement "com.apple.security.print") (printing))
(when (entitlement "com.apple.security.files.downloads.read-only")
      (read-only-and-issue-extensions (home-subpath "/Downloads")))
(when (entitlement "com.apple.security.files.downloads.read-write")
      (read-write-and-issue-extensions (home-subpath "/Downloads")))
(when (or (entitlement "com.apple.security.files.downloads.read-only")
          (entitlement "com.apple.security.files.downloads.read-write"))
      (allow process-exec (home-subpath "/Downloads")))
(when (or (entitlement "com.apple.security.files.bookmarks.app-scope")
          (entitlement "com.apple.security.files.bookmarks.document-scope")
          (entitlement "com.apple.security.files.bookmarks.collection-scope")
          (entitlement "com.apple.security.files.user-selected.read-only")
          (entitlement "com.apple.security.files.user-selected.read-write"))
      (allow mach-lookup (global-name "com.apple.scopedbookmarksagent.xpc")))
(allow qtn-user (extension "com.apple.app-sandbox.read-write"))
(sandbox-array-entitlement
  "com.apple.security.application-groups"
  (lambda (suite)
    (allow file-read-data (application-group-literal suite ""))
    (allow file-ioctl
           file-mknod
           file-revoke
           file-search
           file-mount
           file-unmount
           network-bind
           network-outbound
           (application-group-regex suite "/"))
    (read-write-and-issue-extensions (application-group-regex suite "/"))
    (allow file-read*
           process-exec
           (subpath
             (string-append
               "/Library/Application Support/AppStore/GroupContent/"
               suite)))
    (deny file-write-create
          (require-all
            (require-not (vnode-type DIRECTORY))
            (application-group-literal suite "/Library")))
    (allow mach-lookup
           mach-register
           (global-name-prefix (string-append suite ".")))
    (allow ipc-posix* (ipc-posix-name-prefix (string-append suite "/")))))
(appsandbox-extensions)
(webkit-support)
(when (entitlement "com.apple.security.device.camera") (webkit-camera-support))
(when (or (entitlement "com.apple.security.device.audio-input")
          (entitlement "com.apple.security.device.microphone"))
      (webkit-microphone-support))
(webkit-xpc-services)
(allow authorization-right-obtain
       (right-name "system.burn")
       (right-name-regex
         "^system\\.volume\\.(external|optical|removable)\\.unmount$")
       (right-name "system.volume.optical.mount"))
(allow iokit-open-user-client (iokit-user-client-class "SCSITaskUserClient"))
(allow mach-lookup
       (global-name "com.apple.DiscRecording:registrar")
       (global-name "com.apple.SUISMessaging"))
(allow file-read*
       (require-all
         (require-not (vnode-type SYMLINK))
         (require-any
           (home-subpath "/Library/Colors")
           (home-subpath "/Library/FontCollections")
           (home-subpath "/Library/Spelling"))))
(allow file-write*
       (with telemetry)
       (with message "124470244")
       (require-all
         (require-not (vnode-type SYMLINK))
         (require-any
           (home-subpath "/Library/Colors")
           (home-subpath "/Library/FontCollections")
           (home-subpath "/Library/Spelling"))))
(when (entitlement "com.apple.security.assets.music.read-write")
      (allow file-read* file-write* (home-subpath "/Library/Audio/Presets")))
(read-only-and-issue-extensions (subpath "/System"))
(allow process-exec (subpath "/System"))
(with-filter (system-attribute apple-internal)
  (read-only-and-issue-extensions (subpath "/AppleInternal/System")))
(allow file-read*
       process-exec
       (home-subpath "/Library/Audio")
       (home-subpath "/Library/Compositions")
       (home-subpath "/Library/Input Methods")
       (home-subpath "/Library/PDF Services")
       (home-subpath "/Library/QuickLook"))
(allow file-read*
       (home-literal "/.CFUserTextEncoding")
       (home-subpath "/Library/ColorPickers")
       (home-subpath "/Library/Filters")
       (home-subpath "/Library/Fonts")
       (home-subpath "/Library/KeyBindings")
       (home-subpath "/Library/Keyboard Layouts")
       (home-literal "/Library/Preferences/com.apple.DownloadAssessment.plist")
       (home-subpath "/Library/Sounds"))
(deny file-map-executable (home-subpath "/Library/ColorPickers"))
(allow user-preference-read
       (preference-domain
         "com.apple.Accessibility"
         "com.apple.Accessibility.speech"
         "com.apple.AdLib"
         "com.apple.AppleMultitouchTrackpad"
         "com.apple.SpeakSelection"
         "com.apple.airplay"
         "com.apple.assistant.support"
         "com.apple.avfoundation"
         "com.apple.avfoundation.videoperformancehud"
         "com.apple.cmio"
         "com.apple.coreanimation"
         "com.apple.CoreGraphics"
         "com.apple.coremedia"
         "com.apple.coremediaio.support"
         "com.apple.corevideo"
         "com.apple.DictionaryServices"
         "com.apple.driver.AppleBluetoothMultitouch.mouse"
         "com.apple.driver.AppleBluetoothMultitouch.trackpad"
         "com.apple.driver.AppleHIDMouse"
         "com.apple.HIToolbox"
         "com.apple.inputmethodkit"
         "com.apple.inputsources"
         "com.apple.LaunchServices"
         "com.apple.lookup.shared"
         "com.apple.MultitouchSupport"
         "com.apple.security_common"
         "com.apple.security"
         "com.apple.ServicesMenu.Services"
         "com.apple.speech.recognition.AppleSpeechRecognition.prefs"
         "com.apple.speech.synthesis.general.prefs"
         "com.apple.speech.voice.prefs"
         "com.apple.SwiftUI"
         "com.apple.systemsound"
         "com.apple.TelephonyUtilities"
         "com.apple.universalaccess"
         "kCFPreferencesAnyApplication"
         "pbs"))
(allow user-preference-read
       user-preference-write
       (preference-domain "com.apple.AppKit.TextFavorites"))
(%protect-preference-symlink "com.apple.security_common")
(%protect-preference-symlink "com.apple.security")
(allow user-preference-read (preference-domain "com.apple.mediaaccessibility"))
(allow user-preference-read
       user-preference-write
       (preference-domain
         "com.apple.preferences.extensions.ServicesWithUI"
         "com.apple.preferences.extensions.ShareMenu"))
(allow file-read*
       (home-literal
         "/Library/Preferences/com.apple.LaunchServices/com.apple.LaunchServices.plist")
       (home-literal "/Library/Preferences/com.apple.security_common.plist")
       (home-literal "/Library/Preferences/com.apple.security.plist"))
(read-only-and-issue-extensions
  (require-any
    (home-subpath "/Library/Sounds")
    (home-subpath "/Library/Audio/Sounds")
    (home-subpath "/Library/Components")
    (home-subpath "/Library/QuickTime")))
(allow process-exec
       (home-subpath "/Library/Components")
       (home-subpath "/Library/QuickTime"))
(read-only-and-issue-extensions
  (home-subpath
    (string-append
      "/Library/Application Scripts/"
      (param "application_container_id"))))
(allow process-exec
       (home-subpath
         (string-append
           "/Library/Application Scripts/"
           (param "application_container_id"))))
(sandbox-array-entitlement
  "com.apple.security.application-groups"
  (lambda (suite)
    (let ((scripts-directory
            (home-subpath
              (string-append "/Library/Application Scripts/" suite))))
      (read-only-and-issue-extensions scripts-directory)
      (allow process-exec scripts-directory))))
(when (param "application_bundle_id")
      (allow file-read*
             (literal
               (string-append
                 "/Library/Managed Preferences/"
                 (param "application_bundle_id")
                 ".plist"))
             (literal
               (string-append
                 "/Library/Managed Preferences/"
                 (param "_USER")
                 "/"
                 (param "application_bundle_id")
                 ".plist"))
             (literal
               (string-append
                 "/Library/Preferences/"
                 (param "application_bundle_id")
                 ".plist"))
             (subpath
               (string-append
                 "/Library/Application Support/AppStore/Content/"
                 (param "application_bundle_id"))))
      (allow mach-register
             (global-name (param "application_bundle_id"))
             (global-name
               (string-append
                 (param "application_bundle_id")
                 ".ServiceProvider"))))
(allow file-read-metadata)
(allow file-read*
       (literal "/Library/Caches/com.apple.DiagnosticReporting.Networks.plist")
       (subpath "/Library/PDF Services")
       (literal "/Library/Preferences/.GlobalPreferences.plist")
       (literal "/Library/Preferences/com.apple.AppleShareClient.plist")
       (literal "/Library/Preferences/com.apple.HIToolbox.plist")
       (literal "/Library/Preferences/com.apple.loginwindow.plist")
       (prefix "/Library/Preferences/com.apple.security.")
       (subpath "/Library/Preferences/Logging/Subsystems")
       (prefix "/Library/Preferences/com.apple.PowerManagement.")
       (literal "/Library/Preferences/SystemConfiguration/preferences.plist")
       (subpath "/Users/Shared/SC Info")
       (literal "/Volumes")
       (literal "/private/etc/group")
       (literal "/private/etc/hosts")
       (literal "/private/etc/openldap/ldap.conf")
       (literal "/private/etc/passwd")
       (literal "/private/etc/protocols")
       (literal "/private/etc/resolv.conf")
       (literal "/private/etc/services")
       (literal "/private/etc/ssl/cert.pem")
       (literal "/private/etc/ssl/openssl.cnf")
       (literal "/private/var/run/resolv.conf"))
(allow file-read*
       process-exec
       (subpath
         (string-append
           "/Library/Application Support/AppStoreContent/"
           (param "application_container_id")))
       (subpath "/Library/PDF Services")
       (subpath "/Developer")
       (subpath "/Applications"))
(with-filter (system-attribute apple-internal)
  (allow file-read* process-exec (subpath "/AppleInternal/Applications")))
(with-filter (extension-class
               "com.apple.app-sandbox.read"
               "com.apple.cfprefsd.read")
  (allow file-issue-extension (subpath "/Applications"))
  (with-filter (system-attribute apple-internal)
    (allow file-issue-extension (subpath "/AppleInternal/Applications"))))
(allow mach-lookup (global-name "com.apple.ocspd"))
(allow file-read* (home-subpath "/Library/Keychains"))
(allow file-write*
       (with telemetry)
       (with message "124470244")
       (home-prefix "/Library/Keychains/"))
(deny file-read* file-write* (home-subpath "/Library/Keychains/${ANY_UUID}"))
(allow file-read* (subpath "/private/var/db/mds"))
(when (equal? (param "_UID") "0")
      (allow file-write* (subpath "/private/var/db/mds")))
(allow file-read* (literal "/private/var/db/DetachedSignatures"))
(allow ipc-posix-shm-read*
       ipc-posix-shm-write-create
       ipc-posix-shm-write-data
       (ipc-posix-name "com.apple.AppleDatabaseChanged"))
(allow file-read*
       process-exec
       (subpath "/bin")
       (subpath "/sbin")
       (subpath "/usr/bin")
       (subpath "/usr/sbin"))
(allow mach-lookup
       (local-name "com.apple.CFPasteboardClient")
       (local-name "com.apple.coredrag")
       (global-name "com.apple.accessibility.voices")
       (global-name "com.apple.ap.adprivacyd.trackingtransparency")
       (global-name "com.apple.appkit.restoration_storage")
       (global-name "com.apple.apsd")
       (global-name "com.apple.arkit.service.streamingPrediction")
       (global-name "com.apple.assistant.analytics")
       (global-name "com.apple.assistant.dictation")
       (global-name "com.apple.audio.isolated.micactivityd")
       (global-name
         "com.apple.AuthenticationServices.AuthenticationServicesAgent.CredentialUpdate")
       (global-name
         "com.apple.AuthenticationServicesCore.AuthenticationServicesAgent")
       (global-name
         "com.apple.AuthenticationServicesCore.AuthenticationServicesAgent.CredentialExchange")
       (global-name "com.apple.backboard.hid-services.xpc")
       (global-name "com.apple.backupd.sandbox.xpc")
       (global-name "com.apple.bird")
       (global-name "com.apple.bird.token")
       (global-name "com.apple.BluetoothServices")
       (global-name "com.apple.cache_delete.public")
       (global-name "com.apple.callkit.callcontrollerhost")
       (global-name "com.apple.chrono.controlcenter")
       (global-name "com.apple.chrono.widgetcenterconnection")
       (global-name "com.apple.chronoservices")
       (global-name "com.apple.colorsyncd")
       (global-name "com.apple.colorsync.useragent")
       (global-name "com.apple.containermanagerd")
       (global-name "com.apple.controlcenter.statusitems")
       (global-name "com.apple.controlcenter.toggle")
       (global-name "com.apple.coreservices.appleevents")
       (global-name "com.apple.CoreServices.coreservicesd")
       (global-name "com.apple.coreservices.launcherror-handler")
       (global-name "com.apple.coreservices.quarantine-resolver")
       (global-name "com.apple.cvmsServ")
       (global-name "com.apple.devicecheckd")
       (global-name "com.apple.DiskArbitration.diskarbitrationd")
       (global-name "com.apple.distributed_notifications@1v3")
       (global-name "com.apple.distributed_notifications@Uv3")
       (global-name "com.apple.dock.fullscreen")
       (global-name "com.apple.dock.server")
       (global-name "com.apple.donotdisturb.appconfiguration.service")
       (global-name "com.apple.donotdisturb.availability.service")
       (global-name "com.apple.dt.testmanagerd.appintentsservices")
       (global-name "com.apple.ensemble.dragserver")
       (global-name "com.apple.FileCoordination")
       (global-name "com.apple.FileProvider")
       (global-name "com.apple.FontObjectsServer")
       (global-name "com.apple.FontRegistry.FontRegistryUIAgent")
       (global-name "com.apple.fonts")
       (global-name "com.apple.FSEvents")
       (global-name "com.apple.gamepolicyd.app")
       (global-name "com.apple.gamesaved")
       (global-name "com.apple.gputools.service")
       (global-name "com.apple.GSSCred")
       (global-name "com.apple.helpd")
       (global-name "com.apple.icdd")
       (global-name "com.apple.iconservices")
       (global-name "com.apple.iconservices.store")
       (global-name "com.apple.iiod")
       (global-name "com.apple.ink.private")
       (global-name "com.apple.inputanalyticsd")
       (global-name "com.apple.inputmethodkit.getxpcendpoint")
       (global-name "com.apple.inputmethodkit.launchagent")
       (global-name "com.apple.inputmethodkit.launcher")
       (global-name "com.apple.inputmethodkit.setxpcendpoint")
       (global-name "com.apple.iohideventsystem")
       (global-name "com.apple.itunescloudd.tcchelper")
       (global-name "com.apple.itunescloudd.xpc")
       (global-name "com.apple.KerberosHelper.LKDCHelper")
       (global-name "com.apple.KeyboardServices.TextReplacementService")
       (global-name "com.apple.kvsd")
       (global-name "com.apple.lookupd")
       (global-name "com.apple.ls.boxd")
       (global-name "com.apple.managedappdistributionagent.xpc")
       (global-name "com.apple.mediaremoted.xpc")
       (global-name "com.apple.metadata.mds")
       (global-name "com.apple.midiserver")
       (global-name "com.apple.midiserver.io")
       (global-name "com.apple.modelmanager")
       (global-name "com.apple.naturallanguaged")
       (global-name "com.apple.netauth.user.auth")
       (global-name "com.apple.pasteboard.1")
       (global-name "com.apple.pbs.fetch_services")
       (global-name "com.apple.pluginkit.pkd")
       (global-name "com.apple.ProgressReporting")
       (global-name "com.apple.quicklook")
       (global-name "com.apple.quicklook.config")
       (global-name "com.apple.quicklook.ThumbnailsAgent")
       (global-name "com.apple.quicklook.ui.helper")
       (global-name "com.apple.quicklook.ui.helper.active")
       (global-name "com.apple.revisiond")
       (global-name "com.apple.rtcreportingd")
       (global-name "com.apple.rti-autofill")
       (global-name "com.apple.security.pboxd")
       (global-name "com.apple.securityd.xpc")
       (global-name "com.apple.SecurityServer")
       (global-name "com.apple.sharingd.nsxpc")
       (global-name "com.apple.SleepServices")
       (global-name "com.apple.speech.recognitionserver")
       (global-name "com.apple.speech.synthesis.console")
       (global-name "com.apple.speechArbitrationServer")
       (global-name "com.apple.spindump")
       (global-name "com.apple.swiftuitracingsupport.xpc")
       (global-name "com.apple.syncdefaultsd")
       (global-name "com.apple.system.DirectoryService.membership_v1")
       (global-name "com.apple.system.opendirectoryd.api")
       (global-name "com.apple.SystemConfiguration.configd")
       (global-name "com.apple.SystemConfiguration.DNSConfiguration")
       (global-name "com.apple.SystemConfiguration.NetworkInformation")
       (global-name "com.apple.tailspind")
       (global-name "com.apple.tccd")
       (global-name "com.apple.tccd.system")
       (global-name
         "com.apple.telephonyutilities.callservicesdaemon.callcapabilities")
       (global-name
         "com.apple.telephonyutilities.callservicesdaemon.voip.push.development")
       (global-name
         "com.apple.telephonyutilities.callservicesdaemon.voip.push")
       (global-name "com.apple.telephonyutilities.callservicesdaemon.voip")
       (global-name "com.apple.testmanagerd.appintentsservices")
       (global-name "com.apple.TrustEvaluationAgent")
       (global-name "com.apple.tsm.uiserver")
       (global-name "com.apple.uiintelligencesupport.agent")
       (global-name "com.apple.UNCUserNotification")
       (global-name "com.apple.VirtualDisplay")
       (global-name "com.apple.VoiceOver.running")
       (global-name "com.apple.wallpaper.hiservices")
       (global-name "com.apple.webprivacyd")
       (global-name "com.apple.window_proxies")
       (global-name "com.apple.windowmanager.dragserver")
       (global-name "com.apple.windowmanager.server")
       (global-name "com.apple.windowserver.active")
       (global-name "com.apple.WorkflowServiceRunner")
       (global-name "com.apple.xpc.loginitemregisterd")
       (global-name "com.apple.xpc.smd")
       (global-name-regex "_OpenStep$"))
(airplay)
(app-prediction)
(appleinternal-diagnostics)
(coreaudio-services)
(link-services)
(passkit-services)
(siri-actions)
(spotlight)
(storekit)
(usernotifications)
(allow mach-lookup
       (global-name "PurplePPTServer")
       (global-name "PurpleSystemEventPort")
       (global-name "com.apple.awdd")
       (global-name "com.apple.corerecents.recentsd")
       (global-name "com.apple.itunesstored.xpc")
       (global-name "com.apple.lskdd"))
(with-filter (require-not (process-attribute is-plugin))
  (allow mach-lookup (global-name "com.apple.replayd")))
(allow mach-lookup
       (global-name "com.apple.CARenderServer")
       (global-name "com.apple.frontboard.systemappservices")
       (global-name "com.apple.frontboard.workspace")
       (global-name "com.apple.iphone.axserver-systemwide")
       (global-name "com.apple.powerlog.plxpclogger.xpc")
       (global-name "com.apple.remote-text-editing")
       (global-name "com.apple.remote-text-editing-legacy")
       (global-name "com.apple.runningboard")
       (global-name "com.apple.sharing.remote-text-editing"))
(allow user-preference-read (preference-domain "com.apple.UIKit"))
(allow mach-lookup
       (global-name "com.apple.CoreDisplay.master")
       (global-name "com.apple.iosmac.remote-text-editing")
       (global-name "com.apple.logind")
       (global-name "com.apple.rapport.remote-text-input")
       (global-name "com.apple.statskit")
       (global-name "com.apple.uikitsystemapp.services"))
(allow file-read-data
       (literal "/Library/Preferences/com.apple.ViewBridge.plist"))
(power-assertions)
(with-filter (iokit-registry-entry-class "IODisplayWrangler")
  (allow iokit-set-properties (iokit-property "IORequestIdle")))
(allow iokit-open-user-client (iokit-user-client-class "IOHIDParamUserClient"))
(system-graphics)
(with-filter (iokit-registry-entry-class "IOHIDEventDriver")
  (allow iokit-set-properties (iokit-property "CapsLockDelayOverride")))
(allow iokit-open-user-client
       (iokit-user-client-class
         "AppleSATLSMARTUserClient"
         "AHCISMARTUserClient"
         "ATASMARTUserClient"))
(allow authorization-right-obtain (right-name "system.hdd.smart"))
(allow iokit-open-user-client (iokit-user-client-class "IOUserUserClient"))
(imagecapture)
(allow network-outbound (subpath "/private/var/run"))
(deny network-outbound (literal "/private/var/run/usbmuxd"))
(allow network-bind
       network-outbound
       (resolving-subpath (param "application_container")))
(unless
  (entitlement "com.apple.security.print")
  (deny network-outbound (literal "/private/var/run/cupsd")))
(unless
  (or (entitlement "com.apple.security.network.client")
      (entitlement "com.apple.security.network.server"))
  (deny network-outbound (literal "/private/var/run/mDNSResponder")))
(deny network-outbound (remote ip "localhost:631"))
(unless
  (entitlement "com.apple.private.app-sandbox.unquarantine")
  (deny file-write-xattr (xattr "com.apple.quarantine") (with no-log)))
(deny file-read-xattr
      file-write-xattr
      (xattr-prefix "com.apple.security.private."))
(notification-center)
(allow signal (target same-sandbox))
(if (or (entitlement "com.apple.security.library-repair.extensions")
        (entitlement "com.apple.security.library-repair.ostype"))
  (allow authorization-right-obtain (right-name "com.apple.library-repair")))
(when (or (entitlement "com.apple.networking.vpn.configuration")
          (entitlement "com.apple.developer.networking.vpn.api")
          (entitlement "com.apple.developer.networking.networkextension"))
      (allow file-read* (literal "/usr/libexec"))
      (allow file-read*
             process-exec
             (literal "/usr/libexec/neagent")
             (literal "/usr/libexec/nehelper")
             (literal "/usr/libexec/nesessionmanager"))
      (allow mach-lookup
             (global-name "com.apple.nehelper")
             (global-name "com.apple.nesessionmanager")
             (global-name "com.apple.SystemConfiguration.helper")
             (global-name "com.apple.SystemConfiguration.PPPController-priv"))
      (allow authorization-right-obtain
             (right-name "system.preferences")
             (right-name "system.services.systemconfiguration.network")))
(when (entitlement "com.apple.developer.networking.networkextension")
      (allow file-read* file-write* (subpath "/Library/Keychains")))
(with-filter (require-entitlement "com.apple.vm.hypervisor")
  (allow iokit-open-user-client (iokit-user-client-class "AppleHVClient")))
(with-filter (require-entitlement "com.apple.vm.networking")
  (allow mach-lookup (global-name "com.apple.NetworkSharing")))
(allow network* (extension "com.apple.OpenGLProfiler"))
(allow file-read*
       file-write*
       file-clone
       file-link
       (mount-relative-regex "^/\\.Trashes(/|$)")
       (home-subpath "/.Trash"))
(when (or (entitlement "com.apple.security.device.microphone")
          (entitlement "com.apple.security.device.audio-input"))
      (audio-input))
(audio-output)
(allow iokit-open-user-client
       (iokit-user-client-class "AppleUpstreamUserClient" "AudioAUUC"))
(mediaplayback)
(ane-client)
(read-write-and-issue-extensions
  (mount-relative-regex "^/\\.TemporaryItems(/|$)"))
(allow authorization-right-obtain (right-name "com.apple.trust-settings.user"))
(geoservices)
(allow file-read-data file-write-data (literal "/dev/tty"))
(allow file-read-data (literal "/dev"))
(appsandbox-fsctl)
(allow ipc-posix-shm-read*
       ipc-posix-shm-write-data
       (ipc-posix-name-prefix "CFPBS:"))
(allow ipc-posix-shm-read*
       ipc-posix-shm-write-data
       (ipc-posix-name-prefix "AudioIO"))
(allow ipc-posix-shm*
       (ipc-posix-name "com.apple.ColorSync.Gen.lock")
       (ipc-posix-name "com.apple.ColorSync.Disp.lock")
       (ipc-posix-name "com.apple.ColorSync.Gray2.2")
       (ipc-posix-name "com.apple.ColorSync.sRGB")
       (ipc-posix-name "com.apple.ColorSync.GenGray")
       (ipc-posix-name "com.apple.ColorSync.GenRGB")
       (ipc-posix-name-prefix "com.apple.cs."))
(allow file-read*
       (subpath "/Library/ColorSync/Profiles")
       (home-subpath "/Library/ColorSync"))
(allow authorization-right-obtain
       (right-name "system.colorsync.install.profile"))
(allow ipc-posix-shm-read*
       (ipc-posix-name "apple.shm.notification_center")
       (ipc-posix-name-prefix "/tmp/com.apple.csseed.")
       (ipc-posix-name-prefix "ls."))
(allow ipc-posix-shm-read*
       ipc-posix-shm-write-data
       ipc-posix-shm-write-unlink
       (ipc-posix-name-regex "^gdt-[A-Za-z0-9]+-(c|s)$"))
(allow ipc-posix-shm-read*
       ipc-posix-shm-write-data
       (ipc-posix-name-regex "^Apple MIDI (in|out) [0-9]+$"))
(when (or (entitlement "com.apple.security.network.client")
          (entitlement "com.apple.security.network.server"))
      (allow mach-lookup (global-name "org.h5l.kcm"))
      (allow authorization-right-obtain (right-name "com.apple.KerberosAgent"))
      (allow file-read*
             (literal "/Library/Preferences/edu.mit.Kerberos")
             (literal "/Library/Preferences/com.apple.Kerberos.plist")
             (literal "/private/etc/krb5.conf")
             (regex "^/Library/Preferences/com\\.apple\\.GSS\\..*\\.plist$")
             (home-literal "/Library/Preferences/edu.mit.Kerberos")
             (home-literal "/Library/Preferences/com.apple.Kerberos.plist")))
(allow file-read* (subpath "/private/var/db/datadetectors/sys"))
(allow mach-lookup (global-name "com.apple.DataDetectorsSourceAccess"))
(foundation)
(when (entitlement "com.apple.developer.hid.virtual.device")
      (allow iokit-open-user-client
             (iokit-user-client-class "IOHIDResourceDeviceUserClient")))
(mobileasset)
(naturallanguage)
(allow file-read*
       (home-subpath "/Library/Dictionaries")
       (subpath "/Library/Dictionaries")
       (subpath "/Network/Library/Dictionaries"))
(when (entitlement "com.apple.developer.security.privileged-file-operations")
      (privileged-file-operations))
(shareplay)
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.apple-events"
  (lambda (name) (allow appleevent-send (appleevent-destination name))))
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.iokit-user-client-class"
  (lambda (name)
    (allow iokit-open-user-client
           iokit-set-properties
           (iokit-user-client-class name))))
(let ((entitlement-value (entitlement "com.apple.security.scripting-targets")))
  (cond ((not (list? entitlement-value)) #t)
        ((assoc "*" entitlement-value) (allow appleevent-send))
        (else
         (for-each
           (lambda (value)
             (if (and (pair? value) (string? (car value)))
               (allow appleevent-send (appleevent-destination (car value)))))
           entitlement-value))))
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.mach-lookup.global-name"
  (lambda (name) (allow mach-lookup (global-name name))))
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.mach-lookup.global-name"
  (lambda (name)
    (if (equal? name "com.apple.photolibraryd")
      (allow mach-lookup (global-name "com.apple.photos.service")))))
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.mach-lookup.local-name"
  (lambda (name) (allow mach-lookup (local-name name))))
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.mach-register.global-name"
  (lambda (name)
    (when (and (param "application_bundle_id")
               (or (%string-prefix?
                     "com.apple."
                     (param "application_bundle_id"))
                   (not (%string-prefix? "com.apple." name))))
          (let ((mach-filter
                  (select-mach-filter name global-name-prefix global-name)))
            (allow mach-register mach-filter)))))
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.mach-register.local-name"
  (lambda (name) (allow mach-register (local-name name))))
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.files.home-relative-path.read-only"
  (lambda (path)
    (let ((filter (select-filter path home-subpath home-literal)))
      (read-only-and-issue-extensions filter)
      (allow process-exec filter))))
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.files.home-relative-path.read-write"
  (lambda (path)
    (let ((filter (select-filter path home-subpath home-literal)))
      (allow process-exec filter)
      (read-write-and-issue-extensions filter))))
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.files.absolute-path.read-only"
  (lambda (path)
    (let ((filter (select-filter path safe-subpath literal)))
      (allow process-exec filter)
      (read-only-and-issue-extensions filter))))
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.files.absolute-path.read-write"
  (lambda (path)
    (let ((filter (select-filter path safe-subpath literal)))
      (allow process-exec filter)
      (read-write-and-issue-extensions filter))))
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.shared-preference.read-only"
  (lambda (domain) (allow user-preference-read (preference-domain domain))))
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.shared-preference.read-write"
  (lambda (domain)
    (allow user-preference-read
           user-preference-write
           (preference-domain domain))))
(allow pseudo-tty)
(allow file-read* file-write* file-ioctl (literal "/dev/ptmx"))
(allow file-read*
       file-write*
       (require-all
         (regex "^/dev/ttys[0-9]*")
         (extension "com.apple.sandbox.pty")))
(sandbox-array-entitlement
  "com.apple.private.oop-jit.loader"
  (lambda (type)
    (with-filter (subpath (string-append "/private/var/OOPJit/" type))
      (allow file-read* file-write*)
      (allow file-issue-extension
             (extension-class "com.apple.sandbox.oopjit")))))
(oopjit-runner)
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.sbpl"
  (lambda (string)
    (let* ((port (open-input-string string)) (sbpl (read port)))
      (with-transparent-redirection (eval sbpl)))))
(appsandbox-quarantine-common)
(protect-redirected-paths)
(protect-redirectable-paths)