;;
;; Speech Recognition daemon - sandbox profile
;; Copyright (c) 2013-2014 Apple Inc. All Rights reserved.
;;
;; WARNING: The sandbox rules in this file currently constitute
;; Apple System Private Interface and are subject to change at any time and
;; without notice. The contents of this file are also auto-generated and not
;; user editable; it may be overwritten at any time.
;;

(version 1)
(deny default)
(import "system.sb")

(system-graphics)

;;; Home Directory
(define (home-subpath home-relative-subpath)
    (subpath (string-append (param "_HOME") home-relative-subpath)))
(define (home-literal home-relative-literal)
    (literal (string-append (param "_HOME") home-relative-literal)))
(define (home-regex home-relative-regex)
    (regex (string-append "^" (regex-quote (param "_HOME")) home-relative-regex)))
    
(allow user-preference*
    (preference-domain "com.apple.SpeechRecognitionCore")
    (preference-domain "com.apple.SpeechRecognitionCore.speechrecognitiond")
    (preference-domain "com.apple.speech.recognition.AppleSpeechRecognition.prefs")
    (preference-domain "com.apple.ironwood.support"))
    
;;; Allow reading files for which we have a read-only app-sandbox extension
(allow file-read* (extension "com.apple.app-sandbox.read"))

;;; Allow writing of files for which we have an extension
(allow file-read* file-write* (extension "com.apple.app-sandbox.read-write"))
    
;;; Audio
(allow device-microphone)
(allow ipc-posix-shm-read*
       ipc-posix-shm-write-data
       (ipc-posix-name-regex "^AudioIO"))
       
(allow iokit-set-properties
    (iokit-property "IOAudioControlValue"))
    
(allow ipc-posix-shm-read*
       (ipc-posix-name "apple.shm.notification_center"))

(allow ipc-posix-shm-read*
       ipc-posix-shm-write-data
       (ipc-posix-name "com.apple.AppleDatabaseChanged"))
       
;;; Allow IPC to standard system agents.
(allow ipc-posix-shm-read*
       (ipc-posix-name-regex #"^apple\.shm\.cfprefsd\."))

(allow file-read-metadata)
(allow mach-lookup
        (global-name "com.apple.speech.speechsynthesisd")
        (global-name "com.apple.speech.speechsynthesisd.arm64")
        (global-name "com.apple.speech.speechsynthesisd.x86_64")
        (global-name "com.apple.audio.audiohald")
        (global-name "com.apple.audio.coreaudiod")
        (global-name "com.apple.mobileassetd.v2")
        (global-name "com.apple.PowerManagement.control")
        (global-name "com.apple.CoreServices.coreservicesd")
        (global-name "com.apple.coreservices.launchservicesd")
        (global-name "com.apple.distributed_notifications@1v3")
        (global-name "com.apple.distributed_notifications@Uv3")
        (global-name "com.apple.audio.AudioComponentRegistrar")
        (global-name "com.apple.tccd")
        (global-name "com.apple.AddressBook.abd")
        (global-name "com.apple.AddressBook.AddressBookApplicationFrameworkIPC")
        (global-name "com.apple.AddressBook.ContactsAccountsService")
        (global-name "com.apple.AddressBook.SourceSync")
        (global-name "com.apple.ContactsAgent.addressbook")
        (global-name "com.apple.accountsd.accountmanager")
        (global-name "com.apple.accountsd.oauthsigner")
        (global-name "com.apple.lsd.mapdb")
        (global-name "com.apple.lsd.modifydb")
        (global-name "com.apple.lsd.open")
        (global-name "com.apple.lsd.openurl")
        (global-name "com.apple.coreservices.quarantine-resolver")
        (global-name "com.apple.system.opendirectoryd.api")
        (global-name "com.apple.pluginkit.pkd")
        (global-name "com.apple.appleneuralengine")
        (global-name "com.apple.feedbacklogger")
        (global-name "com.apple.systemstatus.publisher")
        (global-name "com.apple.windowserver.active"))

(allow iokit-open
        (iokit-user-client-class "IOAudioControlUserClient")
        (iokit-user-client-class "IOAudioEngineUserClient")
        (iokit-user-client-class "RootDomainUserClient")
        (iokit-user-client-class "H11ANEInDirectPathClient"))

(allow file-read* (home-subpath "/Library/Audio"))
(allow file-read* (subpath "/Library/Audio"))

(allow file-read* file-write*
    (home-subpath "/Library/Caches/com.apple.SpeechRecognitionCore"))

(allow file-read* file-write*
    (home-literal "/Library/Preferences/.GlobalPreferences.plist")
    (home-regex #"/Library/Preferences/ByHost/\.GlobalPreferences\."))

(allow file-read*
    (home-literal "/Library/Preferences/com.apple.SpeechRecognitionCore.speechrecognitiond.plist")
    (home-literal "/Library/Preferences/com.apple.SpeechRecognitionCore.Vocabulary.plist"))
    
(allow file-read*
    (literal "/Library/Preferences/.GlobalPreferences.plist"))

;;; Allow reading address book
(allow user-preference-read
    (preference-domain "com.apple.AddressBook")
    (preference-domain "com.apple.AddressBook.CardDAVPlugin")
    (preference-domain "com.apple.LaunchServices")
    (preference-domain "com.apple.Accessibility"))

(allow user-preference-write
    (preference-domain "com.apple.AddressBook")
    (preference-domain "com.apple.LaunchServices"))

(allow file-read* file-write*
    (subpath "/private/var/tmp")
    (regex #"^/private/var/folders/[^/]+/[^/]+/T/(assistantd/)?\.AddressBookLocks.*")
    (home-subpath "/Library/Application Support/AddressBook"))

;;; Create speech donation file
(allow file-write-create
    (regex #"^/private/var/folders/[^/]+/[^/]+/T/[^/]+/com.apple.SpeechDonation/"))
;;; Read/Write Speech profile
(allow file-read* file-write*
    (home-literal "/Library/SpeechRecognitionCore/SpeechProfile_en_US"))

;;; Temp Directory
(allow file-read* file-write*
    (subpath (string-append (param "_DARWIN_USER_BASE_DIR") "/T/com.apple.SpeechRecognitionCore.speechrecognitiond"))
    (subpath (string-append (param "_DARWIN_USER_BASE_DIR") "/T/SpeechModelCache")))

;; Allow read-only access to $HOME/Library/Trial
(allow file-read*
    (home-subpath "/Library/Trial"))

;;; Ducking Notification
(allow distributed-notification-post)

(allow system-fsctl (fsctl-command HFSIOC_SET_HOTFILE_STATE))

;; Read/write E5ML cache access
(let ((cache-path-filter (home-subpath "/Library/Caches/com.apple.e5rt.e5bundlecache")))
  (allow file-read* file-write* cache-path-filter)
  (allow file-issue-extension
    (require-all
      (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write")
      cache-path-filter)))