;;; Copyright (c) 2020 Apple Inc. All Rights reserved.
;;;
;;; WARNING: The sandbox rules in this file currently constitute
;;; Apple System Private Interface and are subject to change at any time and
;;; without notice.
;;;
(version 1)

(deny default)
;;(allow (with report) default)

(deny mach-priv-host-port)

(import "system.sb")
(system-graphics)
(system-network)

(import "com.apple.corefoundation.sb")
(corefoundation)

;;; Homedir-relative path filters
(define (home-subpath home-relative-subpath)
	(subpath (string-append (param "HOME") home-relative-subpath)))

(define (home-literal home-relative-literal)
	(literal (string-append (param "HOME") home-relative-literal)))

(allow process-info* (target self))

;; For resolving symlinks, realpath(3), and equivalents.
(allow file-read-metadata)

;; For validating the entitlements of clients.
(allow process-info-codesignature)

;; Your preference domain
(allow user-preference-read user-preference-write
	(preference-domain "cgpdftops")
	(preference-domain "com.apple.CoreGraphics")
	(preference-domain "com.apple.CoreServicesInternal")	;; codesign_allocate
	(preference-domain "com.apple.LaunchServices")		;; codesign_allocate
	(preference-domain "com.apple.mcxprinting")
	(preference-domain "cupsfilter")
	(preference-domain "kCFPreferencesAnyApplication")
	(preference-domain "org.cups.PrintingPrefs")
	(preference-domain "pstops")
	(preference-domain-prefix "com.apple.print")
    (preference-domain "com.apple.HIToolbox")
)

;; Read/write access to a temporary directory.
(allow file-read* file-write*
	(literal "/Library/Preferences/.GlobalPreferences.plist")
	(subpath "/private/tmp")
	(subpath "/private/var/folders")
	(subpath (param "DARWIN_CACHE_DIR"))
	(subpath (param "TMPDIR"))
    (mount-relative-regex "^/\\.TemporaryItems(/|$)") ;; NSData
)

;; Read/write cache access
(let ((cache-path-filter (home-subpath "/Library/Caches/com.apple.printtool")))
  (allow file-read* file-write* cache-path-filter)
  (allow file-issue-extension
	(require-all
	  (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write")
	  cache-path-filter)))

(allow authorization-right-obtain
	(right-name "system.print.admin")
)

;; Misc
(allow file-read*
	(home-literal "/.CFUserTextEncoding")
	(literal "/private/var/db/DetachedSignatures")
	(literal "/private/var/run/cupsd")
	(subpath "/private/etc")
	(subpath "/private/var/db/dyld")
	(subpath "/private/var/db/mds")
	(subpath "/usr")					;; codesign_allocate
	(home-subpath "/Library/Input Methods")
	(home-subpath "/Library/Keyboard Layouts")
	(subpath "/Library/Input Methods")
	(subpath "/Library/Keyboard Layouts")
)

;; libcups
(allow file-read* file-write* (home-subpath "/.cups"))

(allow mach-lookup
	(global-name "com.apple.coreservices.launchservicesd")
	(global-name "com.apple.lsd.modifydb")
	(global-name "com.apple.printtool.agent")
	(global-name "com.apple.SystemConfiguration.configd")
	(global-name "com.apple.colorsyncd")
	(global-name "com.apple.CARenderServer")
	(global-name "com.apple.coreservices.appleevents")
	(global-name "com.apple.dock.fullscreen")
	(global-name "com.apple.dock.server")
	(global-name "com.apple.fonts")
	(global-name "com.apple.iconservices.store")
	(global-name "com.apple.iconservices")
	(global-name "com.apple.pasteboard.1")
	(global-name "com.apple.tccd.system")
	(global-name "com.apple.tccd")
	(global-name "com.apple.window_proxies")
	(global-name "com.apple.windowserver.active")
	(global-name "com.apple.windowmanager.server")
	(global-name "com.apple.uiintelligencesupport.agent")
	(global-name "com.apple.metadata.mds")
	(global-name "com.apple.metadata.mdwrite")
)

(allow user-preference-read (preference-domain "com.apple.HIToolbox"))

(allow iokit-open
    (iokit-user-client-class
        "IOSurfaceRootUserClient"
        "IGAccelDevice"
        "IGAccelSharedUserClient"
        "IGAccelCommandQueue"
    )
)

(allow network-outbound
	(literal "/private/var/run/cupsd")
	(literal "/private/var/run/mDNSResponder")
	(remote tcp)
)

(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))
(allow process-fork)
(allow file-read* process-exec*
    (home-subpath "/Library/PDF Services")
	(subpath "/Applications")
	(subpath "/bin")
	(subpath "/Library")
	(subpath "/Library/PDF Services")
	(subpath "/private/tmp")
	(subpath "/sbin")
	(subpath "/System/Library/Frameworks/Python.framework")
	(subpath "/System/Library/PDF Services")
	(subpath "/System/Library/Printers/Libraries")
	(subpath "/usr/bin")
	(subpath "/usr/libexec")
	(subpath "/usr/sbin")
)

(allow lsopen)

(allow mach-lookup
	(global-name "com.apple.coreservices.quarantine-resolver")
	(global-name "com.apple.lsd.mapdb")
	(global-name "com.apple.SecurityServer")
)

(allow file-read* file-write*
	(home-subpath "/Library/Preferences")
	(home-subpath "/Library/Printers")
)

; PDF Workflows
(allow file-read* file-write*
	(home-subpath "/Desktop")
	(home-subpath "/Documents")
	(home-subpath "/Library/Mobile Documents")
)

; Some PDF Workflows use Python
(allow process-exec-interpreter (subpath "/System/Library/Frameworks/Python.framework"))
(allow file-read*
	(subpath "/AppleInternal/Library/Python")
    (subpath "/Library/Python")
    (home-subpath "/Library/Python")
)
(allow user-preference-read (preference-domain "org.python.python"))

(allow ipc-posix-shm-read*
       ipc-posix-shm-write-create
       ipc-posix-shm-write-data
	(ipc-posix-name "com.apple.AppleDatabaseChanged")
)

(allow file-issue-extension (extension-class "com.apple.app-sandbox.read"))

;; net-snmp (snmpInk)
(allow file-read* file-write* (literal "/private/var/db/net-snmp"))
(allow network-outbound)
(allow network-inbound)

;; Read/write access to the legacy CalendarAgent container so that we can delete it
(allow file-read* file-write* (home-subpath "/Library/Group Containers/group.com.apple.printtool"))

;; make sandbox extension from container manager work
(allow file-read* file-write* (extension "com.apple.sandbox.application-group"))

;; allow xpc to container manager
(allow mach-lookup (global-name "com.apple.containermanagerd"))