;;; Copyright (c) 2020 Apple Inc.  All Rights reserved.
;;;
;;; WARNING: The sandbox rules in this file currently constitute
;;; Apple System Private Interface and are subject to change at any time and
;;; without notice.
;;;
(version 1)

;; (allow (with report) default)
;; (allow (with report) file-map-executable process-info* nvram*)
;; (allow (with report) dynamic-code-generation)

(deny mach-priv-host-port)

(import "system.sb")
(import "com.apple.corefoundation.sb")
(corefoundation)

;;; Homedir-relative path filters
(define (home-regex home-relative-regex)
  (regex (string-append "^" (regex-quote (param "HOME")) home-relative-regex)))

(define (home-subpath home-relative-subpath)
  (subpath (string-append (param "HOME") home-relative-subpath)))

(define (home-prefix home-relative-prefix)
  (prefix (string-append (param "HOME") home-relative-prefix)))

(define (home-literal home-relative-literal)
  (literal (string-append (param "HOME") home-relative-literal)))


(allow process-info* (target self))

;; For resolving symlinks, realpath(3), and equivalents.
(allow file-read-metadata)

;; rdar://139999236 UAF
(allow file-read-data
  (subpath "/private/var/db/assetsubscriptiond"))

;; For validating the entitlements of clients.
(allow process-info-codesignature)

;; Your preference domain
(allow user-preference-read user-preference-write
  (preference-domain "com.apple.remindd"))

;; Read/write access to a temporary directory.
(allow file-read* file-write*
  (subpath (param "TMPDIR"))
  (subpath (param "DARWIN_CACHE_DIR")))

;; For Contacts
(import "contacts.sb")
(contacts-client (param "HOME") (param "TMPDIR"))

;; Read/write cache access
(let ((cache-path-filter (home-subpath "/Library/Caches/com.apple.remindd")))
  (allow file-read* file-write* cache-path-filter)
  (allow file-issue-extension
    (require-all
      (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write")
      cache-path-filter)))

;; vvv start custom sandbox rules below vv

(allow mach-lookup
  (global-name "com.apple.accountsd.accountmanager")
  (global-name "com.apple.triald.namespace-management") ;; rdar://110128498 For trial on-demand factor download
  (global-name "com.apple.siri.uaf.service") ;; rdar://114728629 For UAF Siri Bert download
  (global-name "com.apple.siri.uaf.subscription.service") ;; rdar://139999236 UAF
  (global-name "com.apple.assistant.cdm") ;; Siri embedding
  (global-name "com.apple.ak.anisette.xpc") ;; DA: via AuthKit/CFNetwork
  (global-name "com.apple.AppSSO.service-xpc") ;; DA: via AuthKit/CFNetwork
  (global-name "com.apple.apsd")
  (global-name "com.apple.chronoservices")
  (global-name "com.apple.cloudd")
  (global-name "com.apple.containermanagerd") ;; rdar://104397495 (TLF: Data Separation)
  (global-name "com.apple.CoreLocation.agent")
  (global-name "com.apple.coreservices.launchservicesd") ;; DA: DADBuddyStateObserver
  (global-name "com.apple.coreservices.lsuseractivitymanager.xpc") ;; rdar://problem/69018185
  (global-name "com.apple.coreservices.quarantine-resolver") ;; NSFileManager
  (global-name "com.apple.dnssd.service") ;; DA: via CFNetowrk/libnetwork
  (global-name "com.apple.dock.server") ;; rdar://problem/69018185
  (global-name "com.apple.suggestd.reminders") ;; FoundInApp and dp title collection rdar://94741960
  (global-name "com.apple.iconservices") ;; rdar://problem/69018185
  (global-name "com.apple.iconservices.store") ;; rdar://problem/69018185
  (global-name "com.apple.kvsd") ;; to use NSUbiquitousKeyValueStore
  (global-name "com.apple.lsd.mapdb")
  (global-name "com.apple.locationd.desktop.registration") ;; CoreLocation
  (global-name "com.apple.locationd.desktop.synchronous") ;; CoreLocation
  (global-name "com.apple.mobile.keybagd.xpc") ;; rdar://83947369
  (global-name "com.apple.mobile.keybagd.UserManager.xpc") ;; rdar://83947369
  (global-name "com.apple.mobile.usermanagerd.xpc") ;; rdar://88407312
  (global-name "com.apple.mobileassetd.autoasset") ;; rdar://123768881
  (global-name "com.apple.mobileassetd.v2") ;; MobileAssets
  (global-name "com.apple.nehelper") ;; DA: via CFNetowrk/libnetwork
  (global-name "com.apple.powerlog.plxpclogger.xpc") ;; PowerLog (not sure where does this come from)
  (global-name "com.apple.remindd") ;; <rdar://problem/62524719>
  (global-name "com.apple.securityd.xpc") ;; DA: CFNetwork
  (global-name "com.apple.SecurityServer") ;; DA: CFNetwork/AOSKit
  (global-name "com.apple.nesessionmanager.content-filter") ;; rdar://74540523
  (global-name "com.apple.spotlight.IndexAgent")
  (global-name "com.apple.spotlight.IndexDelegateAgent") ;; rdar://146056997
  (global-name "com.apple.SystemConfiguration.configd") ;; SystemConfiguration (e.g. Reachability)
  (global-name "com.apple.system.opendirectoryd.api") ;; DA: via AuthKit/CFNetwork
  (global-name "com.apple.symptom_diagnostics")
  (global-name "com.apple.tccd")
  (global-name "com.apple.tccd.system") ;; rdar://problem/69018185
  (global-name "com.apple.usernotifications.listener") ;; rdar://104395099
  (global-name "com.apple.usernotifications.usernotificationservice")
  (global-name "com.apple.usymptomsd")
  (global-name "com.apple.windowserver.active")
  (global-name "com.apple.xpc.amsaccountsd") ;; rdar://88386483
  (global-name "com.apple.TextInput.rdt") ;; rdar://115184879
  (global-name "com.apple.intelligenceplatform.View") ;; rdar://120377856
  (global-name "com.apple.private.assets.bypass-asset-types-check") ;; rdar://123768881
  (global-name "com.apple.SBUserNotification") ;; rdar://127836096 For Tap-to-Radar notification in iOS
  (global-name "com.apple.UNCUserNotification") ;; rdar://127836096 For Tap-to-Radar notification in macOS
  (global-name "com.apple.biome.access.user")
  (global-name "com.apple.modelcatalog.catalog") ;; rdar://135957393
  (global-name "com.apple.mobileasset.autoasset") ;; rdar://135957393
  (global-name "com.apple.modelmanager") ;; rdar://135957393
  (global-name "com.apple.generativeexperiences.availabilityService") ;; rdar://135957393
  (global-name "com.apple.alarmkitservices") ;; rdar://132923208 (TLF: Urgent Alerts (iOS))
  (global-name "com.apple.findmy.findmylocate.settings") ;; rdar://132923208 (TLF: Urgent Alerts (iOS))
  (global-name "mul-xpc (Apple)_OpenStep") ;; rdar://156550309
  (global-name "com.apple.naturallanguaged") ;; rdar://173388040
)

(allow distributed-notification-post) ;; Contacts/AddressBook: ABDefaultAccountDidChangeDistributedNotification

(allow file-read*
  (home-literal "/Library/Preferences/.GlobalPreferences.plist") ;; DA: +[DABehaviorOptions DAManagedDefaults]
  (home-literal "/Library/Preferences/com.apple.security.plist") ;; DA: CFNetwork (this is needed in addition to user-preference-read)
  (home-subpath "/Library/Keychains") ;; DA
  (literal "/usr/libexec")
  (literal "/usr/libexec/remindd") ;; <rdar://problem/62524719>
  (subpath "/usr/libexec/Recipe.mlmodelc") ;; rdar://146961019 CoreML Recipe Classifier
  (subpath "/usr/libexec/Recipe_CJK.mlmodelc") ;; apply same fix for CJK recipe classifier
  (subpath "/Library/Application Support/CrashReporter") ;; CrashReporterSupport
  (subpath "/Library/Keychains") ;; DA
  (subpath "/System/Library/AssetsV2/com_apple_MobileAsset_UAF_Siri_Understanding") ;; rdar://126881204
  (subpath "/System/Library/AssetsV2/locks/com.apple.UnifiedAssetFramework") ;; rdar://123768881
  (subpath "/private/var/db/mds"))

;; rdar://104397495 (TLF: Data Separation)
(allow file-read* file-write*
  (extension "com.apple.sandbox.application-group"))

(allow file-read* file-write*
  (home-subpath "/Library/Reminders")
  (home-literal "/Library/Logs/CrashReporter") ;; DA: DACPLogging
  (home-subpath "/Library/Logs/CrashReporter/Reminders")) ;; DA: DACPLogging

;; support consuming com.apple.app-sandbox.read and com.apple.app-sandbox.read-write extensions from clients (e.g. attachments)
(allow file-read* (extension "com.apple.app-sandbox.read"))
(allow file-read* file-write* (extension "com.apple.app-sandbox.read-write"))

;; allow insuring extension to clients (e.g. attachments)
(allow file-issue-extension
  (require-all
    (extension-class "com.apple.app-sandbox.read")
    (require-any
        (home-subpath "/Library/Reminders/")
        (extension "com.apple.sandbox.application-group") ;; rdar://110081688 (for attachments in data separated volumes)
    )))

;; for ABGetSharedAddressBook on OS X (see <rdar://problem/19965241>) - from com.apple.cloudd.sb
(allow file-read* file-write*
  (home-subpath "/Library/Application Support/AddressBook")
  (regex #"^/private/var/folders/[^/]+/[^/]+/T/\.AddressBookLocks($|/)"))

;; -[DACPLogShared _logData:UUID:startNewFile:sizeCheck:wantsCompressed:maxFileCount:outDidCreateNewFile:outNewFilePath:]
(allow file-read* file-write*
  (literal "/Library/Preferences/com.apple.networkextension.uuidcache.plist"))

(allow iokit-open
  (iokit-user-client-class "RootDomainUserClient")) ;; DA: -[DADAgentManager init]

(allow ipc-posix-shm-read* ipc-posix-shm-write*
  (ipc-posix-name "com.apple.AppleDatabaseChanged")) ;; DA: CFNetwork/AOSKit

(allow mach-task-name) ;; BoardServices (from NotificationCenter)

(allow network-outbound) ;; DA: network

(allow process-info-pidinfo) ;; BoardServices (from NotificationCenter)

(allow system-socket) ;; DA: socket

(allow user-preference-read
  (preference-domain "com.apple.CloudKit")
  (preference-domain "com.apple.security") ;; DA: CFNetwork
  (preference-domain "com.apple.universalaccess") ;; rdar://problem/69018185
  (preference-domain "kCFPreferencesAnyApplication")
  (preference-domain "com.apple.UnifiedAssetFramework") ;; rdar://114728629
  (preference-domain "com.apple.modelcatalog.ajax") ;; rdar://135957393
  (preference-domain "com.apple.GenerativeFunctions.GenerativeFunctionsInstrumentation") ;; rdar://135957393
  (preference-domain "com.apple.gms.availability")) ;; rdar://135957393


(allow user-preference-read user-preference-write
  (preference-domain "com.apple.remindd.babysitter")
  (preference-domain "group.com.apple.reminders"))

(define (home-subpath home-relative-subpath)
    (subpath (string-append (param "HOME") home-relative-subpath)))

(allow file-read*
    (home-subpath "/Library/Trial") ;; rdar://101085570
    (home-subpath "/Library/UnifiedAssetFramework") ;; rdar://114728629
    (subpath "/private/var/db/com.apple.modelcatalog/sideload/") ;; rdar://114728629
    (subpath "/System/Library/AssetsV2/locks/com.apple.UnifiedAssetFramework/") ;; rdar://114728629
    (subpath "/System/Library/AssetsV2/com_apple_MobileAsset_UAF_FM_GenerativeModels/purpose_auto/") ;; rdar://114728629
    (subpath "/System/Library/AssetsV2/com_apple_MobileAsset_UAF_FM_Overrides/purpose_auto/") ;; rdar://114728629
    (subpath "/System/Library/PreinstalledAssetsV2/RequiredByOs/com_apple_MobileAsset_UAF_FM_GenerativeModels/") ;; rdar://114728629
    (subpath "/System/Library/PreinstalledAssetsV2/RequiredByOs/com_apple_MobileAsset_UAF_FM_Overrides/")) ;; rdar://114728629

;; Allow usage of ANE. Neural Network models need this
(allow iokit-open
    (iokit-user-client-class
        "IOSurfaceRootUserClient"
        "AGXDeviceUserClient"
        "H11ANEInDirectPathClient"
        "IOSurfaceAcceleratorClient"))

;; Consume sandbox extensions 
(with-filter (extension "com.apple.app-sandbox.read") 
    (allow file-read*) ;; rdar://114728629
    (allow file-issue-extension (extension-class "com.apple.app-sandbox.read"))) ;; rdar://114728629
(with-filter (extension "com.apple.app-sandbox.read-write") 
    (allow file-read* file-write*) ;; rdar://114728629
    (allow file-issue-extension (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write"))) ;; rdar://114728629