(version 1)

(deny default)

(import "system.sb")

(allow mach-lookup
    (global-name "com.apple.CoreAuthentication.daemon.libxpc")
    (global-name "com.apple.duetactivityscheduler")
    (global-name "com.apple.mdmclient.daemon")
    (global-name "com.apple.security.octagon")
    (global-name "com.apple.AuthenticationServices.AuthenticationServicesAgent.FileVaultRecoveryKeys")
    (global-name "com.apple.DiskArbitration.diskarbitrationd")
    (global-name "com.apple.accountsd.accountmanager")
    (global-name "com.apple.storagekitd.dm")
    (global-name "com.apple.system.opendirectoryd.api")
    (global-name "com.apple.distributed_notifications@Uv3")
    (global-name "com.apple.SystemConfiguration.configd")
    (global-name "com.apple.TapToRadarKit.service")
)

(allow authorization-right-obtain
    (right-name "com.apple.DiskManagement.internal.APFS")
)

(allow user-preference-read
    (preference-domain "kCFPreferencesAnyApplication")
)

(allow user-preference*
    (preference-domain "com.apple.filevault")
)

(allow file-read*
    (subpath "/")
)

(allow file-write*
    (subpath "/private/tmp")
)


(allow iokit-open
    (iokit-user-client-class "AppleAPFSUserClient")
)