;;; Copyright (c) 2017 Apple Inc. All Rights reserved. ;;; ;;; WARNING: The sandbox rules in this file currently constitute ;;; Apple System Private Interface and are subject to change at any time and ;;; without notice. ;;; (version 1) ;;; (trace "/tmp/com.apple.imagentTrace.sb") (deny default) (deny file-map-executable process-info* nvram*) (import "com.apple.iMessage.shared.sb") (allow user-preference-read (preference-domain "com.apple.iChat") (preference-domain "com.apple.MobileSMS") (preference-domain "com.apple.iChat.SubNet") (preference-domain "com.apple.iChat.Jabber") (preference-domain "com.apple.iChat.AIM") (preference-domain "com.apple.iChatAgent") (preference-domain "com.apple.imagent") (preference-domain "com.apple.operator") (preference-domain "com.apple.carrier") (preference-domain "com.apple.messages") (preference-domain "com.apple.messages.AttachmentsAutomation") (preference-domain "com.apple.conference") (preference-domain "com.apple.imservice") (preference-domain "com.apple.imservice.ids") (preference-domain "com.apple.imservice.SMS") (preference-domain "com.apple.imservice.ids.Madrid") (preference-domain "com.apple.imservice.ids.FaceTime") (preference-domain "com.apple.imservice.ids.Madrid") (preference-domain "com.apple.imservice.ids.iMessage") (preference-domain "com.apple.imdsmsrecordstore") (preference-domain "com.apple.messages") (preference-domain "com.apple.registration") (preference-domain "com.apple.AddressBook") (preference-domain "com.apple.AddressBook.CardDAVPlugin") (preference-domain "com.apple.statistics") (preference-domain "com.apple.messageshelper.AlertsController") (preference-domain "com.apple.imservice") (preference-domain "com.apple.messages.nicknames") (preference-domain "com.apple.messages.downtime") (preference-domain "com.apple.messages.critical-messaging.storage") (preference-domain "com.apple.facetime.bag") (preference-domain "com.apple.MobileSMSPreview") (preference-domain "com.apple.CloudKit") (preference-domain "com.apple.coreaudio") (preference-domain "com.apple.Messages") (preference-domain "com.apple.com.apple.ScreenTimeAgent") (preference-domain "com.apple.mobileslideshow") (preference-domain "com.apple.SocialLayer") (preference-domain "com.apple.NanoSettings") (preference-domain "com.apple.IMCoreSpotlight") (preference-domain "com.apple.onetimepasscodes") ) (allow user-preference-write (preference-domain "com.apple.onetimepasscodes") (preference-domain "com.apple.iChat") (preference-domain "com.apple.MobileSMS") (preference-domain "com.apple.iChat.SubNet") (preference-domain "com.apple.iChat.Jabber") (preference-domain "com.apple.iChat.AIM") (preference-domain "com.apple.iChatAgent") (preference-domain "com.apple.imagent") (preference-domain "com.apple.IMCoreSpotlight") (preference-domain "com.apple.imservice.ids.iMessage") (preference-domain "com.apple.imservice.ids.FaceTime") (preference-domain "com.apple.imservice.SMS") (preference-domain "com.apple.messages.IMCoreAutomation") (preference-domain "com.apple.madrid") (preference-domain "com.apple.imservice.SMS") (preference-domain "com.apple.sms") (preference-domain "com.apple.AddressBook") (preference-domain "com.apple.Messages") (preference-domain "com.apple.imessage") (preference-domain "com.apple.messages.nicknames") (preference-domain "com.apple.facetime.bag") (preference-domain "com.apple.messages.critical-messaging.storage") ) ;; Read/write cache access for imagent's cache folder (let ((cache-path-filter-imagent (home-subpath "/Library/Caches/com.apple.imagent"))) (allow file-read* file-write* cache-path-filter-imagent) (allow file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write") cache-path-filter-imagent))) ;; Read/write cache access for MobileSMS's cache folder (let ((cache-path-filter-MobileSMS (home-subpath "/Library/Caches/com.apple.MobileSMS"))) (allow file-read* file-write* cache-path-filter-MobileSMS) (allow file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write") cache-path-filter-MobileSMS))) ;; Read cache access for Share Sheet (let ((cache-path-filter-share-sheet (temp-subpath "/com.apple.messages.ShareExtension"))) (allow file-read* file-write* cache-path-filter-share-sheet) (allow file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read") cache-path-filter-share-sheet))) (allow file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read") ; If I'm holding this extension on the path (extension "com.apple.app-sandbox.read"))) ; Allow me to issue it on the path (allow file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read-write") ; If I'm holding this extension on the path (extension "com.apple.app-sandbox.read-write"))) ; Allow me to issue it on the path (allow file-map-executable (subpath "/System/Library/Messages/PlugIns") (subpath "/System/Library/Address Book Plug-Ins/LDAP.sourcebundle/Contents/MacOS/LDAP") (subpath temp-directory) (darwin-user-root-subpath "/T/com.apple.imtranscoding.IMTranscoderAgent") (home-subpath "/Library/Messages") ) ;; these are ALL the file permissions, including write (allow file-read* file-write* (subpath temp-directory) (darwin-user-root-subpath "/T/com.apple.iChat") (darwin-user-root-subpath "/T/com.apple.imtranscoding.IMTranscoderAgent") (darwin-user-root-subpath "/T/.AddressBookLocks") (home-subpath "/Library/Messages") (home-subpath "/Library/Caches/com.apple.MobileSMS") (home-subpath "/Library/Caches/CloudKit/com.apple.imagent") (home-subpath "/Library/Application Support/AddressBook") (home-subpath "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2") (home-subpath "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-journal") (home-subpath "/Library/Preferences/com.apple.imessage.bag.plist") (extension "com.apple.sandbox.application-group") ) (allow file-write* (subpath "/System/Volumes/Data/.TemporaryItems") ) ;; only reading files (allow file-read* (subpath "/Library/Keychains/System.keychain") (home-subpath "/Pictures") (darwin-user-root-subpath "/T/com.apple.Photos") (subpath "/Applications/Messages.app") (subpath "/System/Volumes/Data/.TemporaryItems/") ) ;; Allow imagent to accept read-only sandbox extensions. (allow file-read* (extension "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write")) (allow mach-lookup (global-name "com.apple.accountsd.accountmanager") (global-name "com.apple.AddressBook.abd") (global-name "com.apple.analyticsd") (global-name "com.apple.apsd") (global-name "com.apple.audio.SystemSoundServer-OSX") (global-name "com.apple.awdd") (global-name "com.apple.cache_delete") (global-name "com.apple.cache_delete.public") (global-name "com.apple.cloudd") (global-name "com.apple.cmfsyncagent.auth") (global-name "com.apple.containermanagerd") (global-name "com.apple.coreservices.quarantine-resolver") (global-name "com.apple.DiskArbitration.diskarbitrationd") (global-name "com.apple.dmd.policy") (global-name "com.apple.donotdisturb.service") (global-name "com.apple.donotdisturb.service.non-launching") (global-name "com.apple.donotdisturb.appconfiguration.service") (global-name "com.apple.FileCoordination") (global-name "com.apple.familycircle.agent") (global-name "com.apple.icloud.fmfd") (global-name "com.apple.identityservicesd.desktop.auth") (global-name "com.apple.identityservicesd.idquery.desktop.auth") (global-name "com.apple.identityservicesd.nsxpc") (global-name "com.apple.imtransferservices.IMTransferAgent") (global-name "com.apple.itunesstored.xpc") (global-name "com.apple.logind") (global-name "com.apple.lsd.mapdb") (global-name "com.apple.metadata.mds") (global-name "com.apple.metadata.mdwrite") (global-name "com.apple.PowerManagement.control") (global-name "com.apple.ProgressReporting") (global-name "com.apple.protectedcloudstorage.protectedcloudkeysyncing") (global-name "com.apple.securityd.xpc") (global-name "com.apple.securityd.xpc") (global-name "com.apple.SecurityServer") (global-name "com.apple.siri.vocabularyupdates") (global-name "com.apple.siri.vocabularyupdates") (global-name "com.apple.spotlight.IndexAgent") (global-name "com.apple.spotlight.IndexAgent") (global-name "com.apple.symptom_diagnostics") (global-name "com.apple.SystemConfiguration.configd") (global-name "com.apple.tccd.system") (global-name "com.apple.telephonyutilities.callservicesdaemon.conversationmanager") (global-name "com.apple.usernoted.daemon_client") (global-name "com.apple.usernotifications.usernotificationservice") (global-name "com.apple.usernotifications.listener") (global-name "com.apple.windowserver.active") (global-name "com.apple.screensharing.ShareScreenInvitation") (global-name "com.apple.screensharing.MessagesAgent") (global-name "com.apple.private.dmd.policy") (global-name "com.apple.private.dmd.emergency-mode") (global-name "com.apple.ScreenTimeAgent.private") (global-name "com.apple.accountsd.accountmanager") (global-name "com.apple.private.screen-time") (global-name "com.apple.private.contacts") (global-name "com.apple.Contacts.database-allow") (global-name "com.apple.private.accounts.allaccounts") (global-name "com.apple.dmd.emergency-mode") (global-name "com.apple.photos.service") (global-name "com.apple.mediaanalysisd.analysis") (global-name "com.apple.ScreenTimeAgent.communication") (global-name "com.apple.StatusKit.subscribe") (global-name "com.apple.StatusKit.publish") (global-name "com.apple.tccd") (global-name "com.apple.rtcreportingd") (global-name "com.apple.ScreenTimeAgent.ask") (global-name "com.apple.askpermissiond") (global-name "com.apple.proactive.PersonalizationPortrait.SocialHighlight") (global-name "com.apple.SharedWebCredentials") (global-name "com.apple.usymptomsd") (global-name "com.apple.coreduetd.context") (global-name "com.apple.kvsd") (global-name "com.apple.aps.kvsd") (global-name "com.apple.UNCUserNotification") (global-name "com.apple.telephonyutilities.callservicesdaemon.callcapabilities") (global-name "com.apple.routined.safetyMonitor") (global-name "com.apple.CoreRoutine.SafetyMonitor") (global-name "com.apple.findmy.findmylocate.locationservice") (global-name "com.apple.findmy.findmylocate.friendshipservice") (global-name "com.apple.findmy.findmylocate.settings") (global-name "com.apple.findmy.findmylocate.fenceservice") (global-name "com.apple.biome.access.user") (global-name "com.apple.biome.compute.source.user") (global-name "com.apple.biome.compute.source") (global-name "com.apple.iconservices") (global-name "com.apple.ManagedSettingsAgent") (global-name "com.apple.ManagedSettingsAgent.publisher") (global-name "com.apple.timed.xpc") (global-name "com.apple.transparencyd") (global-name "com.apple.SocialLayer") (global-name "com.apple.sociallayerd") (global-name "com.apple.spotlight.SearchAgent") (global-name "com.apple.sysdiagnose.service.xpc") (global-name "com.apple.translationd") (global-name "com.apple.duetactivityscheduler") (global-name "com.apple.communicationtrustd.service") (global-name "com.apple.frauddefensed") (global-name "com.apple.mobile.usermanagerd.xpc") (global-name "com.apple.mobile.keybagd.xpc") (global-name "com.apple.mobile.keybagd.UserManager.xpc") (global-name "com.apple.FileProvider") ) ;; imagent should not be able to launch WebKit services (deny mach-lookup (with send-signal SIGKILL)(with telemetry)(with message "Unexpected WebKit Usage") (xpc-service-name-prefix "com.apple.WebKit")) (allow mach-register (global-name "com.apple.imagent.desktop.auth") (global-name "com.apple.aps.imagent") ) (allow network-bind ) (allow iokit-open (iokit-registry-entry-class "RootDomainUserClient") (iokit-user-client-class "AppleKeyStoreUserClient") ) (allow ipc-posix-shm-read-data ipc-posix-shm-write-create ipc-posix-shm-write-data (global-name "com.apple.AppleDatabaseChanged") ) (deny syscall-unix (with telemetry)(with message "syscall-unix-denied")) (allow syscall-unix (syscall-group-bsdthread) (syscall-group-close) (syscall-group-fcntl) (syscall-group-getfsstat) (syscall-group-kevent) (syscall-group-kqueue) (syscall-group-mkdir) (syscall-group-necp-client) (syscall-group-network-channel) (syscall-group-open-dprotected) (syscall-group-open) (syscall-group-pthread) (syscall-group-read) (syscall-group-rlimit) (syscall-group-select) (syscall-group-send) (syscall-group-signal) (syscall-group-sockopt) (syscall-group-stat) (syscall-group-statfs) (syscall-group-ulock) (syscall-group-write) (syscall-number SYS___disable_threadsignal SYS___mac_syscall SYS___semwait_signal SYS___semwait_signal_nocancel SYS_abort_with_payload SYS_access SYS_access_extended SYS_change_fdguard_np SYS_csrctl SYS_debug_syscall_reject SYS_exit SYS_faccessat SYS_fgetattrlist SYS_fgetxattr SYS_fileport_makefd SYS_fileport_makeport SYS_flistxattr SYS_flock SYS_fpathconf SYS_fsetattrlist SYS_fsgetpath SYS_fsync SYS_ftruncate SYS_getattrlist SYS_getattrlistbulk SYS_getaudit_addr SYS_getdirentries64 SYS_getegid SYS_getentropy SYS_geteuid SYS_getgid SYS_getgroups SYS_getpid SYS_getppid SYS_gettid SYS_gettimeofday SYS_getuid SYS_getxattr SYS_iopolicysys SYS_issetugid SYS_kdebug_trace_string SYS_kdebug_trace64 SYS_kdebug_typefilter SYS_kevent_id SYS_kevent_qos SYS_listxattr SYS_lseek SYS_madvise SYS_mmap SYS_mprotect SYS_mremap_encrypted SYS_munmap SYS_openbyid_np SYS_os_fault_with_payload SYS_pathconf SYS_persona SYS_proc_info_extended_id SYS_psynch_mutexdrop SYS_psynch_mutexwait SYS_quotactl SYS_readlink SYS_rename SYS_renameatx_np SYS_rmdir SYS_setattrlist SYS_shared_region_check_np SYS_socket SYS_symlink SYS_terminate_with_payload SYS_thread_selfid SYS_workq_kernreturn SYS_workq_open) )