;;; Copyright (c) 2018 Apple Inc. All Rights reserved. ;;; ;;; WARNING: The sandbox rules in this file currently constitute ;;; Apple System Private Interface and are subject to change at any time and ;;; without notice. ;;; (version 1) (deny default) (deny file-map-executable process-info* nvram*) (deny dynamic-code-generation) (import "system.sb") (import "com.apple.corefoundation.sb") (corefoundation) ;;; Homedir-relative path filters (define (home-regex home-relative-regex) (regex (string-append "^" (regex-quote (param "HOME")) home-relative-regex))) (define (home-subpath home-relative-subpath) (subpath (string-append (param "HOME") home-relative-subpath))) (define (home-prefix home-relative-prefix) (prefix (string-append (param "HOME") home-relative-prefix))) (define (home-literal home-relative-literal) (literal (string-append (param "HOME") home-relative-literal))) (allow process-info* (target self)) ;; For resolving symlinks, realpath(3), and equivalents. (allow file-read-metadata) ;; For validating the entitlements of clients. (allow process-info-codesignature) ;; passd’s preference domain. (allow user-preference-read user-preference-write (preference-domain "com.apple.passd") (preference-domain-prefix "com.apple.passd.")) ;; Read/write access to temporary directories. (allow file-read* file-write* (subpath (param "TMPDIR")) (subpath (param "DARWIN_CACHE_DIR"))) (allow file-read* file-write* (mount-relative-regex #"^/\.TemporaryItems(/|$)")) ;; Read/write access to passd’s cache. (let ((cache-path-filter (home-subpath "/Library/Caches/com.apple.passd"))) (allow file-read* file-write* cache-path-filter) (allow file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write") cache-path-filter))) ;; Custom access (allow distributed-notification-post) (allow file-read* (literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains") (literal (param "SECURITY_MESSAGES_DIR")) (literal "/private/var/db/mds/system/mdsObject.db") (literal "/private/var/db/mds/system/mdsDirectory.db") (subpath (param "ICON_SERVICES_CACHE_DIR")) (home-literal "/Library/Preferences/com.apple.security.plist") (literal "/Library/Preferences/com.apple.security.plist")) (allow file-read* file-write* (home-subpath "/Library/Passes") (home-subpath "/Library/Caches/PassKit") (home-subpath "/Library/Caches/com.apple.Wallet/Notifications/com.apple.wallet") (home-subpath "/Library/Caches/com.apple.nsurlsessiond/Downloads/com.apple.passd") (home-subpath "/Library/Caches/CloudKit")) (deny (with no-report) file-write* (literal "/Library/Logs/AppleSSE.log")) (allow user-preference-read (preference-domain "com.apple.CFNetwork") (preference-domain "com.apple.CoreGraphics") (preference-domain "com.apple.ImageIO") (preference-domain "com.apple.logging") (preference-domain "com.apple.loginwindow") (preference-domain "com.apple.nsurlcache") (preference-domain "com.apple.security") (preference-domain "com.apple.universalaccess")) (allow user-preference-read user-preference-write (preference-domain "com.apple.PassKit.passes") (preference-domain "com.apple.stockholm") (preference-domain "kCFPreferencesAnyApplication") (preference-domain "com.apple.Wallet") (preference-domain "com.apple.Wallet.public") (preference-domain "com.apple.CloudKit")) (allow iokit-open (iokit-user-client-class "RootDomainUserClient") (iokit-user-client-class "AppleKeyStoreUserClient" ) (iokit-user-client-class "AppleSSEUserClient")) (with-filter (iokit-registry-entry-class "RootDomainUserClient") (allow iokit-get-properties (iokit-property "AppleClamshellState") (iokit-property "Protocol Characteristics") (iokit-property "device-colors"))) (allow ipc-posix-shm-read-data (ipc-posix-name "FNetwork.defaultStorageSession") (ipc-posix-name "com.apple.AppleDatabaseChanged")) (allow ipc-posix-shm-write-data (ipc-posix-name "com.apple.AppleDatabaseChanged")) (allow mach-lookup (global-name "com.apple.AppSSOAgent.XPC") (global-name "com.apple.CoreAuthentication.agent") (global-name "com.apple.CoreServices.coreservicesd") (global-name "com.apple.PowerManagement.control") (global-name "com.apple.SecurityServer") (global-name "com.apple.SharingServices") (global-name "com.apple.SystemConfiguration.configd") (global-name "com.apple.VoiceOver.running") (global-name "com.apple.accountsd.accountmanager") (global-name "com.apple.ak.anisette.xpc") (global-name "com.apple.apsd") (global-name "com.apple.bird.token") (global-name "com.apple.cfnetwork.cfnetworkagent") (global-name "com.apple.cloudd") (global-name "com.apple.cookied") (global-name "com.apple.corerecents.recentsd") (global-name "com.apple.coreservices.launchservicesd") (global-name "com.apple.coreservices.quarantine-resolver") (global-name "com.apple.distributed_notifications@Uv3") (global-name "com.apple.dock.server") (global-name "com.apple.fonts") (global-name "com.apple.icloud.findmydeviced") (global-name "com.apple.icloud.findmydeviced.findmydevice-user-agent") (global-name "com.apple.iconservices") (global-name "com.apple.iconservices.store") (global-name "com.apple.identityservicesd.desktop.auth") (global-name "com.apple.locationd.desktop.registration") (global-name "com.apple.locationd.desktop.synchronous") (global-name "com.apple.logind") (global-name "com.apple.lsd.mapdb") (global-name "com.apple.lsd.modifydb") (global-name "com.apple.metadata.mds") (global-name "com.apple.nehelper") (global-name "com.apple.nfcd.hwmanager") (global-name "com.apple.nsurlsessiond") (global-name "com.apple.nsurlstorage-cache") (global-name "com.apple.PassKitCoreXPCService") (global-name "com.apple.remoted") (global-name "com.apple.securityd.xpc") (global-name "com.apple.seld.tsmmanager") (global-name "com.apple.softwareupdated") (global-name "com.apple.system.opendirectoryd.api") (global-name "com.apple.touchbarserver.mig") (global-name "com.apple.usernoted.multi_client") (global-name "com.apple.usymptomsd") (global-name "com.apple.windowserver.active") (global-name "com.apple.mobileactivationd") (global-name "com.apple.usernotifications.usernotificationservice") (global-name "com.apple.usernotifications.listener") (global-name "com.apple.ap.adservicesd.statusconditionservice") (global-name "com.apple.familycircle.agent") (global-name "com.apple.biome.access.user") (global-name "com.apple.biometrickitd") (global-name "com.apple.seserviced") (global-name "com.apple.seserviced.sereservation.client") (global-name "com.apple.financed.service.coredatastore") (global-name "com.apple.security.octagon") (global-name "com.apple.coreidvd.identity-proofing-ui.xpc")) (allow mach-register (global-name "com.apple.passd.usage") (global-name "com.apple.passd.peer-payment") (global-name "com.apple.passd.cloud-store") (global-name "com.apple.passd.device-registration") (global-name "com.apple.passd.account") (global-name-prefix "com.apple.usernotifications.")) (allow network-outbound (remote tcp "*:443") (path "/private/var/run/mDNSResponder")) (allow nvram-get (nvram-variable "4D1EDE05-38C7-4a6a-9CC6-4BCCA8B38C14:MLB") (nvram-variable "4D1EDE05-38C7-4a6a-9CC6-4BCCA8B38C14:ROM") (nvram-variable "4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:BridgeOSGestaltKeys")) (allow lsopen)