;;; Copyright (c) 2017 Apple Inc. All Rights reserved. ;;; ;;; WARNING: The sandbox rules in this file currently constitute ;;; Apple System Private Interface and are subject to change at any time and ;;; without notice. ;;; (version 1) (deny default) (deny file-map-executable process-info* nvram*) (deny dynamic-code-generation) (deny mach-priv-host-port) (import "system.sb") (import "com.apple.corefoundation.sb") (corefoundation) ;;; Homedir-relative path filters (define (home-regex home-relative-regex) (regex (string-append "^" (regex-quote (param "HOME")) home-relative-regex))) (define (home-subpath home-relative-subpath) (subpath (string-append (param "HOME") home-relative-subpath))) (define (home-prefix home-relative-prefix) (prefix (string-append (param "HOME") home-relative-prefix))) (define (home-literal home-relative-literal) (literal (string-append (param "HOME") home-relative-literal))) (allow process-info* (target self)) ;; For resolving symlinks, realpath(3), and equivalents. (allow file-read-metadata) ;; For validating the entitlements of clients. (allow process-info-codesignature) ;; Your preference domain ;; We read/write from com.apple.powerlogd ;; In future we can add more preference domains here based on violation reports (allow user-preference-read user-preference-write (preference-domain "com.apple.powerlogd")) (allow user-preference-write (preference-domain "com.apple.da")) ;; To resolve bundles of clients (allow process-info-pidinfo) ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; FILE OPERATIONS ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; Read/write access to a temporary directory. (allow file-read* file-write* (subpath (param "TMPDIR")) (subpath (param "DARWIN_CACHE_DIR"))) ;; Read/write cache access (let ((cache-path-filter (home-subpath "/Library/Caches/com.apple.PerfPowerServices"))) (allow file-read* file-write* cache-path-filter) (allow file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write") cache-path-filter))) ;; Allow to issue file extensions for tasking file (let ((tasking-dir (subpath "/private/tmp/powerlog"))) (allow file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write") tasking-dir))) ;; If PerfPowerServices db directory for Tasking and BDC OTA submissions in cloud dir ;; need it for write-data, write-create, write-xattr, write-unlink (allow file-write* file-read-data file-read-xattr (subpath "/private/tmp/powerlog")) ;; PerfPowerServices db location on macOS (allow file-read-data file-write* (subpath "/private/var/db/powerlog")) ;; Text Microstackshots path (allow file-write-create (subpath "/private/var/db/dscsym/")) ;; Preferences write (allow file-write-data (literal "/Library/Preferences/com.apple.powerlogd.plist")) ;; APFS purgeability (allow system-fsctl (fsctl-command APFSIOC_MARK_PURGEABLE APFSIOC_PURGEABLE_GET_FILE_INFO APFSIOC_PURGEABLE_LABEL_PURGEABLE)) ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; BUNDLE ID READ ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; We call CFBundle API in PLUtilties to resolve which bundle id maps to a pid. Furthermore, apps can exist anywhere on the filesystem on a Mac. Hence, this is necessary. ;; After talking to Conor H from Launch Services, SEAR Team, Richard Cooper from Sandbox Team we have not found a generic entitlement to read the bundle ids ;; For now we are giving read permission to all the paths ;; macOS has sandcastle which protects ~/Documents directory. (allow file-read*) ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; MISC FILE OPERATIONS ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; OTA submission (allow file-write* (subpath "/Library/Logs/DiagnosticReports/")) ;; DEPowerlog (allow file-write* (subpath "/private/var/log/")) ;; PerfPowerServices needs to verify that we're on an xcpm platform (allow file-read* file-write* file-ioctl (literal "/dev/xcpm")) ;; Provide access to symptomsd preferences.These are outside cfprefsd's sandbox so we need to be able to issue sandbox extensions. ;; Error allow file-issue-extension target:/private/var/networkd/Library/Preferences/ByHost/com.apple.symptomsd.DA9D5850-1880-57AA-AB47-A4C2C38F1EC5.plist class:com.apple.cfprefsd.read (allow file-issue-extension (require-any (extension-class "com.apple.cfprefsd.read"))) ;; IOHIDLib for Battery and Button Agent (allow file-map-executable (literal "/System/Library/Extensions/IOHIDFamily.kext/Contents/PlugIns/IOHIDLib.plugin/Contents/MacOS/IOHIDLib")) ;; ManagedConfiguration for Config Agent (allow file-map-executable (literal "/System/Library/CoreServices/ManagedClient.app/Contents/PlugIns/MCXToolsInterface.bundle/Contents/MacOS/MCXToolsInterface") ) ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; CAMERA ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; PerfPowerServices needs to monitor whether the camera is on/off. Apparently the same entitlement needed as enabling the camera (allow device-camera) ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; PROCESS INFO ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; PerfPowerServices lists pids to find out which ones to log about, or which of our dependencies are alive (allow process-info-listpids) ;; PerfPowerServices uses pidinfo to resolve bundle identifiers (allow process-info-pidinfo (target others)) (allow process-info-rusage (target others)) (allow process-info-ledger (target others)) (allow mach-task-name (target others)) ;; For proc_set_cpumon_params to provide CPU Safeguards (allow system-sched) ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; MallocStackLogging ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; (with-filter (system-attribute apple-internal) (allow sysctl-write (sysctl-name "vm.task_no_footprint_for_debug"))) ; MallocStackLogging ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; MACH LOOKUP ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; Enlist mach lookup for extensions (allow mach-lookup (extension "com.apple.app-sandbox.mach")) ;; Enlist mach lookups for global names alphabetically (allow mach-lookup (global-name "com.apple.airportd") (global-name "com.apple.appstoreagent.xpc") (global-name "com.apple.audio.audiohald") (global-name "com.apple.backlightd") (global-name "com.apple.biome.access.user") (global-name "com.apple.biome.access.system") (global-name "com.apple.CARenderServer") (global-name "com.apple.CarPlayApp.non-launching-service") (global-name "com.apple.cloudd.system") (global-name "com.apple.cmio.registerassistantservice") (global-name "com.apple.cmio.registerassistantservice.system-extensions") (global-name "com.apple.cmio.VDCAssistant") (global-name "com.apple.coreservices.launchservicesd") (global-name "com.apple.diagnosticpipeline.service") (global-name "com.apple.diagnosticpipeline.tasking.service") (global-name "com.apple.duetactivityscheduler") (global-name "com.apple.gamepolicyd.app") (global-name "com.apple.FSEvents") (global-name "com.apple.frontboard.systemappservices") (global-name "com.apple.iohideventsystem") (global-name "com.apple.iokit.powerdxpc") (global-name "com.apple.locationd.desktop.synchronous") (global-name "com.apple.lsd.mapdb") (global-name "com.apple.mdmclient.agent") (global-name "com.apple.mdmclient.daemon") (global-name "com.apple.mdmclient.agent.unrestricted") (global-name "com.apple.mdmclient.daemon.unrestricted") (global-name "com.apple.metadata.mds") (global-name "com.apple.PPSFeatureFlagReader") (global-name "com.apple.PowerManagement.control") (global-name "com.apple.powerdatad") (global-name "com.apple.powerlogd.XPCService.xpc") (global-name "com.apple.powerlogHelperd.XPCService.xpc") (global-name "com.apple.private.clpc.reporting") (global-name "com.apple.private.corewifi-xpc") (global-name "com.apple.private.ioreporting.access") (global-name "com.apple.SystemConfiguration.configd") (global-name "com.apple.server.bluetooth.classic.xpc") (global-name "com.apple.server.bluetooth.le.att.xpc") (global-name "com.apple.symptom_analytics") (global-name "com.apple.system.opendirectoryd.api") (global-name "com.apple.tccd") (global-name "com.apple.tccd.system") (global-name "com.apple.wifip2pd") (global-name "com.apple.windowserver.active")) ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; IOKIT ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; IOHIDLibUserClient for Process Monitor Kernel Task Monitor ;; AppleKeyStoreUserClient storageLocked in Core ;; Enlist iokit client class alphabetically (allow iokit-open-user-client (iokit-user-client-class "AFKEndpointInterfaceUserClient") (iokit-user-client-class "AppleGraphicsControlClient") (iokit-user-client-class "AppleGraphicsDeviceControlClient") (iokit-user-client-class "AppleKeyStoreUserClient") (iokit-user-client-class "ApplePPMUserClient") (iokit-user-client-class "AppleSMCClient") (iokit-user-client-class "IOGPUMemoryInfoUserClient") (iokit-user-client-class "IOHIDLibUserClient") (iokit-user-client-class "IOMobileFramebufferUserClient") (iokit-user-client-class "IOReportUserClient") (iokit-user-client-class "RootDomainUserClient") (iokit-user-client-class "AppleCLPCUserClient")) ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; Network Wakes ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; PerfPowerServices needs to log Inband Wake packet attribution (allow network-inbound (socket-domain AF_SYSTEM)) (allow network-outbound) (allow system-socket)