;;;;;; Sandbox profile for HydraFramework Rendering Service
;;;;;;
;;;;;; Copyright (c) 2023 Apple Inc.  All Rights reserved.
;;;;;;
;;;;;; WARNING: The sandbox rules in this file currently constitute
;;;;;; Apple System Private Interface and are subject to change at any time and
;;;;;; without notice. The contents of this file are also auto-generated and
;;;;;; not user editable; it may be overwritten at any time.

(version 1)

(deny default)
(debug deny)

(import "system.sb")
(system-graphics)

(allow process-info* (target self))

(allow iokit-open
    (iokit-user-client-class "IOGPUDeviceUserClient")
    (iokit-user-client-class "IOSurfaceRootUserClient")
    (iokit-user-client-class "AGXDeviceUserClient")
    (iokit-user-client-class "AGPMClient")
    (iokit-user-client-class "IGAccelDevice")
    (iokit-user-client-class "IGAccelSharedUserClient")
    (iokit-user-client-class "IGAccelCommandQueue")
)

(allow mach-lookup
    (global-name "com.apple.windowserver.active")
    (global-name "com.apple.tccd.system")
    (global-name "com.apple.CoreServices.coreservicesd")
    (global-name "com.apple.distributed_notifications@Uv3")
)

;; Only allow USD types to be read in the filesystem.
(let ((usd-file-extensions-regex (regex #"\.(usd|usda|usdc|usdz|abc|gcl|gltf|glb|bin|jpg|jpeg|png|exr|bmp|tga|hdr|tiff|tif|heic|ptx|json|mtlx|glslfx|avif|obj|mtl|ply|stl)$/i")))
    (allow file-read* usd-file-extensions-regex)
)

;; Read/write access to the temporary and cache directories
(allow file-read* file-write*
    (subpath (param "_TMPDIR"))
    (subpath (param "_CACHEDIR"))
)

;; Read-only access to one other place in the filesystem, only inside AppleInternal, for prototyping external USD render delegates. Also requires
;; file-map-executable and file-search because plugins need to load dylibs from subfolders within that folder
(allow file-read* file-map-executable file-search
    (subpath "/AppleInternal/usd")
)

;; Read/write access to the cache directories for MTLCompilerService
(allow file-issue-extension
    (require-all
        (extension-class "com.apple.app-sandbox.read-write"
                         "com.apple.app-sandbox.read")
        (subpath (param "_CACHEDIR"))
    )
)

;; For resolving symlinks, realpath(3), and equivalents.
(allow file-read-metadata)

;; Preferences ... allow read for our own domain plus the 'Any Application' domain
(allow user-preference-read
    (preference-domain "com.apple.HydraRenderingService")
    (preference-domain "kCFPreferencesAnyApplication")
)