;;; Copyright (c) 2025 Apple Inc.  All Rights reserved.
;;;
;;; WARNING: The sandbox rules in this file currently constitute
;;; Apple System Private Interface and are subject to change at any time and
;;; without notice.
;;;
(version 1)

(deny default)
(deny file-map-executable process-info* nvram*)
(deny dynamic-code-generation)

(deny mach-priv-host-port)

(import "system.sb")
(import "com.apple.corefoundation.sb")
(corefoundation)

(import "contacts.sb")
(contacts-client (param "HOME") (param "TMPDIR"))

;;; Homedir-relative path filters
(define (home-regex home-relative-regex)
    (regex (string-append "^" (regex-quote (param "HOME")) home-relative-regex)))

(define (home-subpath home-relative-subpath)
    (subpath (string-append (param "HOME") home-relative-subpath)))

(define (home-prefix home-relative-prefix)
    (prefix (string-append (param "HOME") home-relative-prefix)))

(define (home-literal home-relative-literal)
    (literal (string-append (param "HOME") home-relative-literal)))


(allow process-info* (target self))

;; For resolving symlinks, realpath(3), and equivalents.
(allow file-read-metadata)
(allow file-read-xattr)
(allow file-read-data
    (subpath "/private/var/mobile/Library/ContactsMetadata/CNContactMetadata.db")
    (subpath "/Library/Caches/")
    (subpath "/Library/Preferences/FeatureFlags/")
    (subpath "/Library/Preferences/")
    (subpath "/AppleInternal/Library/Jet/")
    (subpath "/private/var/db/nsurlstoraged")
    (subpath "/private/var/db/mds/messages")
    (home-subpath "/Library/Daemon Containers/")
    (home-subpath "/Library/Keyboard Layouts")
    (home-subpath "/Library/Input Methods")
)

(allow file-read* (home-subpath "/Library/Application Support/CallHistoryDB"))

;; For validating the entitlements of clients.
(allow process-info-codesignature)

;; Your preference domain
(allow user-preference-read user-preference-write
       (preference-domain "com.apple.GameOverlayUI")
       (preference-domain "com.apple.applemediaservices")
       (preference-domain "com.apple.GameController")
       (preference-domain "com.apple.addressbook")
       (preference-domain "com.apple.accessibility")
       (preference-domain "com.apple.coregraphics")
       (preference-domain "com.apple.speech.recognition.applespeechrecognition.prefs")
       (preference-domain "com.apple.itunesstored")
       (preference-domain "com.apple.preferences.extensions.ShareMenu")
       (preference-domain "com.apple.gamecenter")
       (preference-domain "com.apple.appstore")
       (preference-domain "com.apple.commerce")
)

;; Read/write access to a temporary directory.
(allow file-read* file-write*
       (subpath (param "TMPDIR"))
       (subpath (param "DARWIN_CACHE_DIR")))
       
(allow file-read* file-write* (home-subpath "/Library/HTTPStorages/com.apple.GameOverlayUI/"))
       
;; Read/write cache access
(let ((cache-path-filter (home-subpath "/Library/Caches/com.apple.GameOverlayUI")))
  (allow file-read* file-write* cache-path-filter)
  (allow file-issue-extension
    (require-all
      (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write")
      cache-path-filter)))

(allow file-issue-extension
  (require-all
    (subpath "/System/Applications/GameOverlayUI.app")
    (extension-class "com.apple.app-sandbox.read")))
      
(let ((cache-path-filter (home-subpath "/Library/Caches/JetPackCache")))
  (allow file-read* file-write* cache-path-filter)
  (allow file-issue-extension
    (require-all
      (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write")
      cache-path-filter)))
      
(let ((cache-path-filter (home-subpath "/Library/Caches/com.apple.AppleMediaServices")))
  (allow file-read* file-write* cache-path-filter)
  (allow file-issue-extension
    (require-all
      (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write")
      cache-path-filter)))

(allow mach-lookup
    (global-name    "com.apple.frontboard.systemappservices"
                    "com.apple.coreservices.launchservicesd"
                    "com.apple.pasteboard.1"
                    "com.apple.tccd.system"
                    "com.apple.windowserver.active"
                    "com.apple.CARenderServer"
                    "com.apple.lsd.modifydb"
                    "com.apple.lsd.mapdb"
                    "com.apple.dock.server"
                    "com.apple.touchbarserver.mig"
                    "com.apple.coreservices.appleevents"
                    "com.apple.window_proxies"
                    "com.apple.windowmanager.server"
                    "com.apple.gamed"
                    "com.apple.dock.fullscreen"
                    "com.apple.fonts"
                    "com.apple.uiintelligencesupport.agent"
                    "com.apple.accountsd.accountmanager"
                    "com.apple.AppSSO.service"
                    "com.apple.symptom_analytics"
                    "com.apple.xpc.amstoold"
                    "com.apple.commerce"
                    "com.apple.system.opendirectoryd.api"
                    "com.apple.appstoreagent.xpc"
                    "com.apple.dnssd.service"
                    "com.apple.usernotifications.listener"
                    "com.apple.webinspector"
                    "com.apple.tccd"
                    "com.apple.securityd.xpc"
                    "com.apple.AddressBook.ContactsAccountsService"
                    "com.apple.ak.anisette.xpc"
                    "com.apple.xpc.amsaccountsd"
                    "com.apple.contactsd.persistence"
                    "com.apple.contacts.account-caching"
                    "com.apple.AppSSO.service-xpc"
                    "com.apple.DiskArbitration.diskarbitrationd"
                    "com.apple.xpc.amsengagementd"
                    "com.apple.suggestd.contacts"
                    "com.apple.AddressBook.abd"
                    "com.apple.iohideventsystem"
                    "com.apple.PowerManagement.control"
                    "com.apple.backlightd"
                    "com.apple.cmio.registerassistantservice.system-extensions"
                    "com.apple.audio.audiohald"
                    "com.apple.GameController.gamecontrollerd.app"
                    "com.apple.spindump"
                    "com.apple.usymptomsd"
                    "com.apple.appstorecomponentsd.xpc"
                    "com.apple.corerecents.recentsd"
                    "com.apple.coreduetd.knowledge"
                    "com.apple.coreduetd.people"
                    "com.apple.coreduetd.people.user"
                    "com.apple.familycircle.agent"
                    "com.apple.inputmethodkit.launchagent"
                    "com.apple.inputmethodkit.launcher"
                    "com.apple.inputmethodkit.getxpcendpoint"
                    "com.apple.telephonyutilities.callservicesdaemon.callcapabilities"
                    "com.apple.telephonyutilities.callservicesdaemon.callstatecontroller"
                    "com.apple.telephonyutilities.callservicesdaemon.callprovidermanager"
                    "com.apple.telephonyutilities.callservicesdaemon.conversationmanager"
                    "com.apple.telephonyutilities.callservicesdaemon.conversationprovidermanager"
                    "com.apple.tsm.uiserver"
                    "com.apple.coreduetd.context"
                    "com.apple.linkd.autoShortcut"
                    "com.apple.intelligenceplatform.View"
                    "com.apple.SystemConfiguration.configd"
                    "com.apple.proactive.app-client.donation"
                    "com.apple.powerlog.plxpclogger.xpc"
                    "com.apple.adid"
                    "com.apple.coreservices.quarantine-resolver"
                    "com.apple.metadata.mds.legacy"
                    "com.apple.coreservices.sharedfilelistd.xpc"
                    "com.apple.mediaremoted.xpc"
                    "com.apple.iconservices"
                    "com.apple.iconservices.store"
                    "com.apple.jetpackassetd.xpc"
                    "com.apple.spotlight.IndexAgent"
                    "com.apple.sidecar-relay"
                    "com.apple.pbs.fetch_services"
                    "com.apple.siri.VoiceShortcuts.xpc"
                    "com.apple.aps.jetpackassetd"
                    "com.apple.biome.access.user"
                    "com.apple.CallHistorySyncHelper"
                    "com.apple.callhistoryd.service"
                    "com.apple.appprotectiond.read"
                    "com.apple.pluginkit.pkd"
                    "com.apple.sharing.sharesheet"
                    "com.apple.gamepolicyd.app.privileged"
                    "com.apple.GameController.system-button-service"
                    "com.apple.webprivacyd"
                    "com.apple.imagent.desktop.auth"
                    "com.apple.amsprivateidentifiers"
                    "com.apple.ctkd.token-client"
    )
)

(allow iokit-open-user-client
       (iokit-user-client-class "IOSurfaceRootUserClient"
                                "AGXDeviceUserClient"
                                "AppleKeyStoreUserClient"
                                "IOMobileFramebufferUserClient"
                                "AppleSMCClient"
                                "AppleNVMeEANUC"
                                "IOHIDParamUserClient"
                                "IOSurfaceAcceleratorClient"
       )
)

(allow process-info-pidinfo)
(allow mach-task-name)

(allow mach-issue-extension
           (extension-class "com.apple.webkit.extension.mach"))

(allow mach-lookup
        (xpc-service-name "com.apple.WebKit.GPU"
                          "com.apple.WebKit.Networking"
                          "com.apple.WebKit.WebContent"))

(allow user-preference-read
       (preference-domain "com.apple.hitoolbox")
       (preference-domain "com.apple.voiceservices")
       (preference-domain "com.apple.telephonyutilities")
       (preference-domain "com.apple.gamestorekit")
       (preference-domain "com.apple.universalaccess")
       (preference-domain "com.apple.gms.availability")
       (preference-domain "com.apple.suggestions")
       (preference-domain "pbs")
       (preference-domain "com.apple.applemultitouchtrackpad")
       (preference-domain "kcfpreferencesanyapplication")
)


(allow appleevent-send)
(allow system-socket)
(allow network-outbound)
(allow network-outbound
    (remote tcp "*:443")
    (remote udp "*:443")
)

(allow file-map-executable
       (subpath "/System/Library/Address Book Plug-Ins/")
)

(allow file-map-executable
    (prefix "/System/Library/Extensions/AGXMetal")
)

(allow lsopen)