(version 1)
(deny default)

(import "system.sb")
(import "com.apple.corefoundation.sb")
(corefoundation)
(system-network)

(allow file-read-metadata)

(allow mach-register
       (global-name "com.apple.noticeboard.agent"))

(allow mach-lookup
       (global-name "com.apple.ocspd")
	   (global-name "com.apple.installd.user")
       (global-name "com.apple.installd")
       (global-name "com.apple.system_installd")
       (global-name "com.apple.usernoted.daemon_client")
       (global-name "com.apple.cookied")
	   (global-name "com.apple.SecurityServer")
	   (global-name "com.apple.SystemConfiguration.configd")
	   (global-name "com.apple.storeagent-xpc")
       (global-name "com.apple.coreservices.launchservicesd")
	   (global-name "com.apple.ls.boxd")
	   (global-name "com.apple.windowserver.active")
	   (global-name "com.apple.dock.server")
	   (global-name "com.apple.pasteboard.1")
	   (global-name "com.apple.coreservices.appleevents")
	   (global-name "com.apple.window_proxies")
	   (global-name "com.apple.tsm.uiserver")
	   (global-name "com.apple.softwareupdated")
	   (global-name "com.apple.lateragent-xpc")
       (global-name "com.apple.noticeboard.state"))
	   
(allow file-read*
       (literal "/private/var/db/mds/system/mdsDirectory.db")
       (literal "/private/var/db/mds/system/mdsObject.db")
	   (literal "/private/var/db/mds/messages/se_SecurityMessages")
	   (literal "/private/var/db/DetachedSignatures")
	   (literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains")
	   (literal "/Library/Preferences/com.apple.HIToolbox.plist")
	   (subpath "/Applications/App Store.app")
	   (subpath "/private/var/db/receipts")
	   (subpath "/Library/Receipts")
	   (subpath "/System/Library/PrivateFrameworks/CommerceKit.framework")
	   (subpath "/System/Library/PrivateFrameworks/Noticeboard.framework")
       (regex #"/Library/Preferences/\.GlobalPreferences\.plist$")
       (regex #"/Library/Preferences/ByHost/\.GlobalPreferences\.")
       (regex #"/Library/Preferences/com.apple.security\.plist$")
       (regex #"/Library/Preferences/com\.apple\.appstore\.plist$")
       (regex #"/Library/Preferences/com\.apple\.storeagent\.plist$"))

(allow file-read* file-write*
       (subpath "/private/tmp")
       (literal "/Library/Caches/com.apple.DiagnosticReporting.Networks.plist")
       (literal "/Library/Caches/com.apple.DiagnosticReporting.HasBeenAppleInternal")
       (regex #"/Library/Caches/nbagent")
       (regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/mds(/|$)")
       (regex #"/Library/Preferences/com\.apple\.noticeboard\.plist$")
       (regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/PKInstallSandboxManager")
       (regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/com\.apple\.noticeboard"))

(allow ipc-posix-shm-read-data
       (ipc-posix-name "FNetwork.defaultStorageSession")
       (ipc-posix-name-regex #"ls\.[a-f0-9\.]+")
       (ipc-posix-name "apple.shm.notification_center")
       (ipc-posix-name-regex #"^/tmp/com.apple.csseed.[0-9]+$"))

(allow ipc-posix-shm-read* ipc-posix-shm-write-data
       (ipc-posix-name "com.apple.AppleDatabaseChanged"))
	   
(allow authorization-right-obtain
       (right-name "system.install.apple-software")
       (right-name "system.install.apple-software.standard-user"))
	   
(allow network-outbound)
(allow system-socket)
(allow distributed-notification-post)
(allow appleevent-send)