;;;
;;; Sandbox profile for /System/Library/Frameworks/CryptoTokenKit.framework/ctkahp.bundle
;;;
;;; Copyright (c) 2017 Apple Inc.  All Rights reserved.
;;;
;;; WARNING: The sandbox rules in this file currently constitute
;;; Apple System Private Interface and are subject to change at any time and
;;; without notice. The contents of this file are also auto-generated and
;;; not user editable; it may be overwritten at any time.

(version 1)

(deny default)

(import "system.sb")

(define (home-subpath home-relative-subpath)
        (subpath (string-append (param "HOME_DIR") home-relative-subpath)))

(define (home-literal home-relative-literal)
        (literal (string-append (param "HOME_DIR") home-relative-literal)))

(allow file-read*
       (literal "/private/etc/SmartcardLogin.plist")
       (subpath (param "DARWIN_USER_TEMP_DIR"))
       (subpath (param "DARWIN_USER_CACHE_DIR"))
       (subpath "/Library/KerberosPlugins/")
       (subpath "/Library/Application Support/CrashReporter/")
       (subpath "/private/var/db/")
       (subpath "/private/var/db/mds"))

(allow file-read-data file-read-xattr
       (literal "/")
       (literal "/Library/Preferences/com.apple.security.plist")
       (literal "/Library/Managed Preferences/.GlobalPreferences.plist")
       (literal "/Library/Keychains/System.keychain"))

(allow file-write*
       (subpath (param "DARWIN_USER_CACHE_DIR"))
       (subpath "/private/var/db/mds/system/"))

(allow file-read* file-write*
    (literal "/System/Volumes/Preboot/IntermediateKey.dat")
    (literal "/Volumes/Preboot/IntermediateKey.dat")
    (literal "/Library/IntermediateKey.dat")
    (home-subpath "/Library/Keychains/"))

(allow file-read-metadata)

(allow file-read*
       (literal "/private/var/db/ExtensibleSSO/Configuration/PlatformSSO/psso.configured"))

(allow process-fork)
(allow signal)

(allow process-exec
       (literal "/System/Library/Frameworks/CryptoTokenKit.framework/UserSelector")
       (subpath "/Library/CryptoTokenKit"))

(allow file-read* process-exec (subpath "/Library/Frameworks/"))

(allow mach-lookup
       (global-name "com.apple.distributed_notifications@1v3")
       (global-name "com.apple.distributed_notifications@Uv3")
       (global-name "com.apple.ctkd.token-client")
       (global-name "com.apple.SecurityServer")
       (global-name "com.apple.CryptoTokenKit.AuthenticationHintsProvider")
       (global-name "com.apple.CryptoTokenKit.AuthenticationHintsProvider.agent.libxpc")
       (global-name "com.apple.CryptoTokenKit.AuthenticationHintsProvider.daemon.libxpc")
       (global-name "com.apple.system.opendirectoryd.api")
       (global-name "com.apple.CoreServices.coreservicesd")
       (global-name "com.apple.CoreAuthentication.agent")
       (global-name "com.apple.CoreAuthentication.daemon")
       (global-name "com.apple.ocspd")
       (global-name "com.apple.DiskArbitration.diskarbitrationd")
       (global-name "com.apple.diskmanagementd")
       (global-name "com.apple.storagekitd.dm")
       (global-name "com.apple.securityd.xpc")
       (global-name "com.apple.securityd.general")
       (global-name "com.apple.GSSCred")
       (global-name "com.apple.PlatformSSO.login.service-xpc")
       (global-name "com.apple.SystemConfiguration.configd")
       (global-name "com.apple.coreservices.quarantine-resolver")
       (global-name "com.apple.lsd.modifydb")
       (global-name "com.apple.lsd.mapdb")
)

(allow user-preference-read
    (preference-domain "kCFPreferencesAnyApplication"))

(allow user-preference-read user-preference-write
      (preference-domain "com.apple.security")
      (preference-domain "com.apple.security.smartcard")
      (preference-domain "com.apple.security.tokenlogin"))

(allow ipc-posix-shm-read-data ipc-posix-shm-write-data ipc-posix-shm-write-create
       (ipc-posix-name "com.apple.AppleDatabaseChanged"))

(allow authorization-right-obtain
       (right-name "com.apple.ctk.pair"))

(allow iokit-open
       (iokit-user-client-class "AppleAPFSUserClient")
       (iokit-user-client-class "AppleKeyStoreUserClient")
       (iokit-user-client-class "AppleCredentialManagerUserClient"))
       
(allow network-outbound (remote ip))
(allow mach-lookup
       (global-name "com.apple.cfnetwork.AuthBrokerAgent")
       (global-name "com.apple.cfnetwork.cfnetworkagent")
       (global-name "com.apple.nesessionmanager")
       (global-name "com.apple.nsurlsessiond")
       (global-name "com.apple.NetworkDiagnostic.agent")
       (global-name "com.apple.WebKit.PluginAgent"))
(system-network)

(allow mach-lookup (global-name "org.h5l.kcm"))
(allow authorization-right-obtain (right-name "com.apple.KerberosAgent"))
(allow file-read*
       (literal "/Library/Preferences/edu.mit.Kerberos")
       (literal "/Library/Preferences/com.apple.Kerberos.plist")
       (literal "/private/etc/krb5.conf")
       (regex #"^/Library/Preferences/com\.apple\.GSS\..*\.plist$"))

(allow network-outbound (subpath "/private/var/run"))

(allow mach-priv-host-port)