(version 1)
(deny default)
(import "system.sb")

(allow file-read*)

; System is read only

(allow system-socket sysctl-read sysctl-write)

(allow file-read-metadata)

;; inherited by pppd
(allow file-read* file-write*
       (subpath "/etc/ppp")
       (subpath "/var/ace")
       (literal "/var/db/RSASecurID_DHParams")
       (literal "/private/var/log/ppp.log"))

;; inherited by pppd
(allow file-read*
       (literal "/dev/random")
       (literal "/etc/passwd")
       (literal "/etc/utmp")
       (subpath "/tmp")
       (subpath "/var/tmp")
       (subpath "/usr/tmp"))

(allow ipc-posix-shm-read-data  ipc-posix-shm-write-data 
       (ipc-posix-name "com.apple.AppleDatabaseChanged"))

(allow ipc-posix-shm-read-data
       (ipc-posix-name-regex #"^/tmp/com.apple.csseed.[0-9]+$"))

(allow file-read* file-write*
	(regex
		#"^/Library/Keychains/System.keychain"
		#"^/Library/Keychains/\."
		#"^(/private)?/var/db/mds/system/mds.lock$"
	)
	(regex #"^/Library/Preferences/com\.apple\.networkextension\.[_a-zA-Z0-9-]+\.plist")
	(regex #"^/Library/Preferences/SystemConfiguration/VPN-[^/]+\.plist")
	(regex #"^(/private)?/var/db/mds/system/mds.lock$")
	(subpath "/private/var/folders")
	(subpath "/private/var/run/racoon"))

(allow file-read*
	(literal "/private/var/run/racoon.pid"))

(allow file-read*
	(literal "/usr/libexec")
	(literal "/usr/libexec/neagent")
	(literal "/usr/libexec/nesessionmanager")
	(literal "/usr/sbin/mDNSResponder"))

(allow signal)

(allow file-read*
	(literal "/Library/Preferences/com.apple.networkextension.uuidcache.plist")
	(literal "/private/etc/master.passwd")
	(literal "/private/var/root/Library/Preferences/.GlobalPreferences.plist")
	(literal "/private/var/root/Library/Preferences/com.apple.networkextension.plist"))

(allow file-read* file-write*
       (subpath "/private/var/db/urlPrefilter"))

(allow network*)

(allow mach-lookup
	(global-name "com.apple.neagent")
	(global-name "com.apple.neagent.lsproxy")
	(global-name "com.apple.nehelper")
	(global-name "com.apple.system.logger")
	(global-name "com.apple.distributed_notifications@1v3")
	(global-name "com.apple.distributed_notifications@Uv3")
	(global-name "com.apple.system.notification_center")
	(global-name "com.apple.CoreServices.coreservicesd")
	(global-name "com.apple.SystemConfiguration.configd")
	(global-name "com.apple.SystemConfiguration.SCNetworkReachability")
	(global-name "com.apple.SystemConfiguration.NetworkInformation")
	(global-name "com.apple.networkd")
	(global-name "com.apple.ocspd")
	(global-name "com.apple.PowerManagement.control")
	(global-name "com.apple.pluginkit.pkd")
	(global-name "com.apple.private.corewifi-xpc")
	(global-name "com.apple.UNCUserNotification")
	(global-name "com.apple.SecurityServer")
	(global-name "com.apple.securityd.xpc")
	(global-name "com.apple.securityd.systemkeychain")
	(global-name "com.apple.ctkd.token-client")
	(global-name "com.apple.lsd.modifydb")
	(global-name "com.apple.lsd.mapdb")
	(global-name "com.apple.sysextd")
	(global-name "com.apple.xpc.smd"))

(allow process-fork)
(allow process-exec
	(literal "/usr/sbin/pppd")
	(with no-sandbox))

(allow authorization-right-obtain
	(right-name "system.keychain.modify"))

(allow iokit-open-user-client
	(iokit-user-client-class "IOUserEthernetResourceUserClient"))