;;;;;; Copyright (c) 2023 Apple Inc.  All Rights reserved.
;;;;;;
;;;;;; WARNING: The sandbox rules in this file currently constitute
;;;;;; Apple System Private Interface and are subject to change at any time and
;;;;;; without notice. The contents of this file are also auto-generated and
;;;;;; not user editable; it may be overwritten at any time.

(version 1)
(deny default)

(import "system.sb")
(import "com.apple.corefoundation.sb")

;; initialize CF sandbox actions
(corefoundation)

;; for resolving symlinks, realpath(3), and equivalents
(allow file-read-metadata)

;; for sandbox_init_with_parameters()
(allow mach-priv-host-port)

;; we can read everything
(allow file-read*)

;; allow access to security daemon
(allow mach-lookup
	(global-name "com.apple.security.syspolicy")
	(global-name "com.apple.lsd.mapdb")
	(global-name "com.apple.lsd.modifydb")
	(global-name "com.apple.CoreServices.coreservicesd")
)

;; allow reading and writing of our temp and cache directories
(if (positive? (string-length (param "DARWIN_COREMEDIA_CACHE_DIR")))
        (allow file-write* file-read* (subpath (param "DARWIN_COREMEDIA_CACHE_DIR"))))

(if (positive? (string-length (param "DARWIN_COREMEDIA_TEMP_DIR")))
        (allow file-write* file-read* (subpath (param "DARWIN_COREMEDIA_TEMP_DIR"))))