;;; Copyright (c) 2017 Apple Inc.  All Rights reserved.
;;;
;;; WARNING: The sandbox rules in this file currently constitute
;;; Apple System Private Interface and are subject to change at any time and
;;; without notice.
;;;
(version 1)

(deny default)
(deny file-map-executable process-info* nvram*)
(deny dynamic-code-generation)

(import "system.sb")
(import "com.apple.corefoundation.sb")
(corefoundation)

;;; Homedir-relative path filters
(define (home-regex home-relative-regex)
    (regex (string-append "^" (regex-quote (param "HOME")) home-relative-regex)))

(define (home-subpath home-relative-subpath)
    (subpath (string-append (param "HOME") home-relative-subpath)))

(define (home-prefix home-relative-prefix)
    (prefix (string-append (param "HOME") home-relative-prefix)))

(define (home-literal home-relative-literal)
    (literal (string-append (param "HOME") home-relative-literal)))

(allow process-info* (target self))

;; For resolving symlinks, realpath(3), and equivalents.
(allow file-read-metadata)

;; For validating the entitlements of clients.
(allow process-info-codesignature)

(allow user-preference-read user-preference-write
       (preference-domain "com.apple.quicklook.ThumbnailsAgent"))

;; Read/write access to a temporary directory.
(allow file-read* file-write*
       (subpath (param "TMPDIR"))
       (subpath (param "DARWIN_CACHE_DIR"))
       (mount-relative-regex #"^/\.TemporaryItems(/|$)"))

;; Read/write cache access
(let ((cache-path-filter (home-subpath "/Library/Caches/com.apple.quicklook.ThumbnailsAgent")))
    (allow file-read* file-write* cache-path-filter)
    (allow file-issue-extension
           (require-all
               (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write")
               cache-path-filter)))

;; read files being thumbnailed, write to genstore for thumbnails being filed
(allow file-read* file-write* (extension "com.apple.app-sandbox.read-write"))
(allow file-read* (extension "com.apple.app-sandbox.read"))

;; issue read extensions for files being thumbnailed
(allow file-issue-extension
       (require-all
           (extension-class "com.apple.app-sandbox.read")
           (extension "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write")))

;; allow access to generators
(let ((qlgenerator-regex (regex #"\.qlgenerator(/|$)"))
      (qldisplay-regex (regex #"\.qldisplay(/|$)"))
      (app-regex (regex #"\.app(/|$)"))
      (quicklookDirectory-regex (regex #"/QuickLook(/|$)")))
        
    (allow file-read* qlgenerator-regex)
    (allow file-read* qldisplay-regex)
    (allow file-read* app-regex)
    (allow file-read* quicklookDirectory-regex)

    ;; issue extension to generator stuff to the satellites that will need to use it
    (allow file-issue-extension
           (require-all
               (extension-class "com.apple.app-sandbox.read")
               (require-any qlgenerator-regex
                            qldisplay-regex
                            app-regex
                            quicklookDirectory-regex)))
)

;; message tracing seems to want this
(allow file-read* (subpath "/Library/Application Support/CrashReporter/"))

;; read/write cloudthumbnails.db
(allow file-read* file-write* (home-subpath "/Library/Application Support/Quick Look"))

;; <rdar://problem/57343074> sandbox violation when sandboxing ThumbnailsAgent from FileProvider
(allow file-read-xattr
       (require-all
           (xattr "com.apple.icloud.desktop" "com.apple.file-provider-domain-id")
           (home-literal "/Desktop")))

(allow iokit-open (iokit-registry-entry-class "AppleAPFSUserClient"
                                              "IOSurfaceRootUserClient"))
                                              
(allow iokit-get-properties)

(allow user-preference-read
       (preference-domain "com.apple.AppleGVA")
       (preference-domain "com.apple.applejpeg")
       (preference-domain "com.apple.AppleVPA")
       (preference-domain "com.apple.coremedia")          ; checking claimed AV types
       (preference-domain "com.apple.CoreServicesInternal")
       (preference-domain "com.apple.corevideo")          ; checking claimed AV types
       (preference-domain "com.apple.diskmanagement")
       (preference-domain "com.apple.ImageIO")
       (preference-domain "com.apple.Metal")
       (preference-domain "kCFPreferencesAnyApplication"))

(allow mach-lookup
       (global-name "com.apple.bird")
       (global-name "com.apple.bird.token")
       (global-name "com.apple.CoreServices.coreservicesd")
       (global-name "com.apple.coreservices.launchservicesd")
       (global-name "com.apple.coreservices.quarantine-resolver")
       (global-name "com.apple.DiskArbitration.diskarbitrationd")
       (global-name "com.apple.diskmanagementd")
       (global-name "com.apple.storagekitd.dm")
       (global-name "com.apple.distributed_notifications@Uv3")
       (global-name "com.apple.FileProvider")
       (global-name "com.apple.lsd.mapdb")
       (global-name "com.apple.lsd.modifydb")
       (global-name "com.apple.pluginkit.pkd")
       (global-name "com.apple.quicklook.ThumbnailsAgent")
       (global-name "com.apple.revisiond")
       (global-name "com.apple.tccd.system")
       (global-name "com.apple.FileCoordination")
       (global-name "com.apple.windowserver.active")
       (global-name "com.apple.CoreGraphics.CGPDFService")
       (global-name "com.apple.mobile.usermanagerd.xpc"))

(define (revisiond-client)
    (allow mach-lookup (global-name "com.apple.revisiond"))

    ;; Individual revisions vended by revisiond (read-only access).
    (allow file-read* (require-all
        (vnode-type REGULAR-FILE DIRECTORY SYMLINK)
        (mount-relative-regex #"^/\.DocumentRevisions-V100/(AllUIDs|PerUID)/")
        (extension "com.apple.revisiond.revision"
                   "com.apple.app-sandbox.read")
    ))

    ;; Access to revisiond's staging area for adding new document revisiond (read-write access).
    (allow file-read* file-write* (require-all
         (vnode-type REGULAR-FILE DIRECTORY SYMLINK)
         (mount-relative-regex #"^/\.DocumentRevisions-V100/staging/")
         (extension "com.apple.revisiond.staging"
                    "com.apple.app-sandbox.read-write")
    ))
)
(revisiond-client)

; Image decoding may require Metal
(system-graphics)

; file-map-executable is restricted to driver handles
(allow file-map-executable
       (subpath "/System/Library/CoreServices/RawCamera.bundle")
       (regex #"^/System/Library/Extensions/[A-Za-z0-9]+\.bundle/"))

; allow access to debug frameworks
(when (param "DYLD_FRAMEWORK_PATHS")
      (let ((dyld_subpaths
              (apply subpath
                     (split-string (param "DYLD_FRAMEWORK_PATHS") ":"))))
           (allow file-read* dyld_subpaths)))

(allow system-fsctl (fsctl-command APFSIOC_DOC_ID_TO_FILE_ID))