;;; Copyright (c) 2017 Apple Inc.  All Rights reserved.
;;;
;;; WARNING: The sandbox rules in this file currently constitute
;;; Apple System Private Interface and are subject to change at any time and
;;; without notice.
;;;
(version 1)

(deny default)
(deny file-map-executable iokit-get-properties process-info* nvram*)
(deny dynamic-code-generation)

(import "system.sb")
(import "com.apple.corefoundation.sb")
(corefoundation)

;;; Homedir-relative path filters
(define (home-regex home-relative-regex)
    (regex (string-append "^" (regex-quote (param "HOME")) home-relative-regex)))

(define (home-subpath home-relative-subpath)
    (subpath (string-append (param "HOME") home-relative-subpath)))

(define (home-prefix home-relative-prefix)
    (prefix (string-append (param "HOME") home-relative-prefix)))

(define (home-literal home-relative-literal)
    (literal (string-append (param "HOME") home-relative-literal)))

(allow authorization-right-obtain
    (right-name "system.preferences.nvram"))

(allow process-info* (target self))
(allow process-info-pidinfo)

(allow iokit-get-properties)

(allow sysctl-read
   (sysctl-name "kern.wake_abs_time"))

(allow nvram-get
   (nvram-variable "LocationServicesEnabled"))

(allow iokit-open
   (iokit-user-client-class
	   "AppleBasebandUserClient"
	   "AppleSPUHIDDriverUserClient"
	   "IOHIDEventServiceFastPathUserClient"
	   "IOUserUserClient"
	   "IO80211APIUserClient"
	   "RootDomainUserClient"))

(with-filter (iokit-registry-entry-class "IOHIDEventServiceFastPathUserClient")
    (allow iokit-set-properties
           (iokit-property "interval")))

(allow mach-lookup
       (global-name "com.apple.SBUserNotification"
                    "com.apple.apsd"
                    "com.apple.assertiond.applicationstateconnection"
                    "com.apple.backboard.hid.services"
                    "com.apple.carkit.dnd.service"
                    "com.apple.commcenter.ari.rt.xpc"
                    "com.apple.commcenter.atcs.xpc"
                    "com.apple.commcenter.coretelephony.xpc"
                    "com.apple.aonsensed.xpc"
                    "com.apple.countryd.update"
                    "com.apple.fairplayd.versioned"
                    "com.apple.frontboard.systemappservices"
                    "com.apple.gpsd"
                    "com.apple.healthd.server"
                    "com.apple.iohideventsystem"
                    "com.apple.locationd.registration"
                    "com.apple.locationd.synchronous"
                    "com.apple.lsd.xpc"
                    "com.apple.system.opendirectoryd.api"
                    "com.apple.mobileactivationd"
                    "com.apple.navigationListener"
                    "com.apple.passd.usage"
                    "com.apple.pipelined"
                    "com.apple.pipelined.maintenance"
                    "com.apple.routined.registration"
                    "com.apple.server.bluetooth"
                    "com.apple.server.bluetooth.le.att.xpc"
                    "com.apple.bluetooth.xpc"
                    "com.apple.timed.xpc"
					"com.apple.xpc.amsaccountsd"
                    "com.apple.wifi.manager"
                    "com.apple.airportd"
                    "com.apple.locationd.desktop.registration"
                    "com.apple.wirelessproxd"
                    "com.apple.cookied"
                    "com.apple.securityd.xpc"
                    "com.apple.SecurityServer"
                    "com.apple.ocspd"
                    "com.apple.coreservices.launchservicesd"
                    "com.apple.locationd.desktop.synchronous"
                    "com.apple.icloud.searchpartyd.finderstatemanager"
                    "com.apple.lsd.mapdb"
                    "com.apple.SystemConfiguration.configd"
                    "com.apple.AppSSO.service-xpc"
                    "com.apple.nsurlstorage-cache"
                    "com.apple.idsremoteurlconnectionagent.embedded.auth"
                    "com.apple.icloud.searchpartyd.advertisementcache"
                    "com.apple.callkit.callcontrollerhost"
                    "com.apple.dnssd.service"
                    "com.apple.CompanionLink"
                    "com.apple.systemstatus.publisher"
                    "com.apple.windowserver.active"
                    "com.apple.powerlog.plxpclogger.xpc"))

(allow mach-priv-host-port)

(allow system-socket
	(socket-domain AF_SYSTEM)
)

;; For resolving symlinks, realpath(3), and equivalents.
(allow file-read-metadata)

;; For validating the entitlements of clients.
(allow process-info-codesignature)

(allow user-preference-read user-preference-write
       (preference-domain "com.apple.locationd"
                          "com.apple.CFNetwork"
                          "com.apple.nsurlcache"
                          "com.apple.GEO"
                          "com.apple.security"
                          "com.apple.locationd.notbackedup"))

;; <rdar://problem/61860334> and <rdar://problem/60339044>
(allow user-preference-read user-preference-write
	(preference-domain "com.apple.facetime.bag"
	                   "com.apple.imessage.bag"))

(allow user-preference-read (preference-domain "kCFPreferencesAnyApplication"))

;; Read/write access to a temporary directory.
(allow file-read* file-write*
       (subpath (param "TMPDIR"))
       (subpath (param "DARWIN_CACHE_DIR")))

;; Read/write access to locationd’s cache.
(let ((cache-path-filter
  (home-subpath "/"))) ;; <rdar://problem/58161093>
  (allow file-read* file-write* cache-path-filter)
  (allow file-issue-extension
    (require-all
      (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write")
      cache-path-filter)))

(let ((cache-path-filter
  (subpath "/var/db/locationd"))) ;; <rdar://problem/58161093>
  (allow file-read* file-write* cache-path-filter)
  (allow file-issue-extension
    (require-all
      (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write" "com.apple.cfprefsd.read-write")
      cache-path-filter)))

(let ((cache-path-filter
  (subpath "/private/var/db/locationd"))) ;; <rdar://problem/58161093>
  (allow file-read* file-write* cache-path-filter)
  (allow file-issue-extension
    (require-all
      (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write" "com.apple.cfprefsd.read-write")
      cache-path-filter)))

(allow file-read* file-write*
    (subpath "/private/var/folders/zz")
    (subpath "/var/folders/zz")
    (subpath "/tmp/com.apple.locationd")
    (subpath "/Library/Preferences")
    (subpath "/AppleInternal/Library/LocationBundles/LocationMonitor.bundle")
)

(allow file-issue-extension
    (extension-class "com.apple.cfprefsd.read")
    (extension-class "com.apple.cfprefsd.read-write")
    (subpath "/private/var/db/locationd/Library/Preferences/")
)

;; Investigate if locationd really needs read access to /usr : <rdar://problem/58160547>
(allow file-read*
    (subpath "/usr")
)

(allow file-read*
	(subpath "/Library/Keychains/System.keychain")
	(subpath "/private/var/db/mds"))

(when (param "application_bundle")
      (allow-read-directory-contents (param "application_bundle")))

(with-filter (system-attribute apple-internal)
  (allow file-read*
         (literal "/usr/local/bin")))

(system-network)
(allow network-outbound)

(allow ipc-posix-shm-read-data ipc-posix-shm-write-create ipc-posix-shm-write-data
	(ipc-posix-name "com.apple.AppleDatabaseChanged")
)

;; make sandbox extension from container manager work
(allow file-read* file-write*
    (extension "com.apple.sandbox.container"))

;; allow xpc to container manager and eligibility engine
(allow mach-lookup
    (global-name "com.apple.containermanagerd")
    (global-name "com.apple.eligibilityd"))