;;
;; Speech Synthesis daemon - sandbox profile
;; Copyright (c) 2013-2014 Apple Inc. All Rights reserved.
;;
;; WARNING: The sandbox rules in this file currently constitute
;; Apple System Private Interface and are subject to change at any time and
;; without notice. The contents of this file are also auto-generated and not
;; user editable; it may be overwritten at any time.
;;

(version 1)
(deny default)
(import "system.sb")

;;; Pluginkit for synth extensions
(allow mach-lookup
    (global-name "com.apple.pluginkit.pkd"))

;;; Home Directory
(define (home-subpath home-relative-subpath)
    (subpath (string-append (param "_HOME") home-relative-subpath)))
(define (home-literal home-relative-literal)
    (literal (string-append (param "_HOME") home-relative-literal)))
(define (home-regex home-relative-regex)
    (regex (string-append "^" (regex-quote (param "_HOME")) home-relative-regex)))
    
(allow user-preference-read
    (preference-domain "com.apple.menuextra.clock")
    (preference-domain "com.apple.voiceservices")
    (preference-domain "com.apple.Accessibility"))

(allow user-preference*
    (preference-domain "com.apple.speech.voice.prefs")
    (preference-domain "loginwindow")
    (preference-domain "com.apple.speech.synthesis.general.prefs"))
    
(allow file-read* file-write* file-read-metadata
    (home-subpath "/Library/Caches/com.apple.speech.speechsynthesisd")
    (home-subpath "/Library/Caches/com.apple.SpeechRecognitionCore"))
    
;;; Allow reading files for which we have a read-only app-sandbox extension
(allow file-read* (extension "com.apple.app-sandbox.read"))

;;; Allow writing of files for which we have an extension
(allow file-read* file-write* (extension "com.apple.app-sandbox.read-write"))
    
;;; Audio
(allow ipc-posix-shm-read*
    ipc-posix-shm-write-data
    (ipc-posix-name-regex "^AudioIO"))
    
(allow iokit-set-properties
    (iokit-property "IOAudioControlValue"))
    
(allow ipc-posix-shm-read*
    (ipc-posix-name "apple.shm.notification_center")
    (ipc-posix-name-regex #"^/tmp/com\.apple\.csseed\.")
    (ipc-posix-name-regex #"^ls\."))

(allow ipc-posix-shm-read*
    ipc-posix-shm-write-data
    (ipc-posix-name "com.apple.AppleDatabaseChanged"))

;;; Seems necessary for SecCode calls.
(allow system-audit)
(allow ipc-posix-shm-write-data (ipc-posix-name "com.apple.AppleDatabaseChanged"))

;;; Allow IPC to standard system agents.
(allow ipc-posix-shm-read*
    (ipc-posix-name-regex #"^apple\.shm\.cfprefsd\."))

(allow file-read-metadata)

(allow file-read*
    (literal "/Library/Preferences/com.apple.security-common.plist")
    (literal "/Library/Preferences/com.apple.security.plist")
    (literal "/Library/Preferences/com.apple.security.revocation.plist")
    (home-literal "/Library/Preferences/com.apple.security.plist")
    (home-literal "/Library/Preferences/com.apple.security.revocation.plist"))

(allow mach-lookup
    (global-name "com.apple.analyticsd")
    (global-name "com.apple.windowserver.active")
    (global-name "com.apple.tccd.system"))

;;; Security.framework: mds
; mds.lock, mdsDirectory.db, mdsObject.db
; 1. extension "speechsynthesisd:mds"
;    uid == 0: r+w /private/var/db/mds/system
;    uid  > 0: r+w <_DARWIN_USER_CACHE_DIR>/mds
; 2. /private/var/db/mds/system/{mdsDirectory.db,mdsObject.db}
;    uid == 0: r+w (already covered by (extension "speechsynthesisd:mds"))
;    uid  > 0: r
(allow file-read* file-write* (extension "speechsynthesisd:mds"))
(allow file-read*
       (literal "/private/var/db/mds/system/mdsDirectory.db")
       (literal "/private/var/db/mds/system/mdsObject.db"))
; 3. se_SecurityMessages:
;    uid  < 500: /private/var/db/mds/messages/se_SecurityMessages
;    uid >= 500: /private/var/db/mds/messages/<uid>/se_SecurityMessages
(allow file-read* (literal (param "SECURITY_MESSAGES_FILE")))

(allow mach-lookup
    (global-name "com.apple.audio.audiohald")
    (global-name "com.apple.audio.coreaudiod")
    (global-name "com.apple.audio.AudioComponentRegistrar")
    (global-name "com.apple.CoreServices.coreservicesd")
    (global-name "com.apple.coreservices.launchservicesd")
    (global-name "com.apple.distributed_notifications@1v3")
    (global-name "com.apple.distributed_notifications@Uv3")
    (global-name "com.apple.mobileassetd")
    (global-name "com.apple.audio.AudioConverterService")
    (global-name "com.apple.mobileassetd.v2")
    (global-name "com.apple.ocspd")
    (global-name "com.apple.speechArbitrationServer")
    (global-name "com.apple.speech.speechdatainstallerd")
    (global-name "com.apple.speech.speechdatainstallerd.isavailable")
    (global-name "com.apple.speech.synthesis.console")
    (global-name "com.apple.speech.speechsynthesisd")
    (global-name "com.apple.speech.speechsynthesisd.arm64")
    (global-name "com.apple.speech.speechsynthesisd.x86_64")
    (global-name "com.apple.triald.namespace-management")
    (global-name "com.apple.siri.uaf.subscription.service"))

(allow iokit-open
    (iokit-user-client-class "IOAudioControlUserClient")
    (iokit-user-client-class "IOAudioEngineUserClient")
    (iokit-user-client-class "RootDomainUserClient"))

(allow file-read*
    (subpath "/Library/Speech/Synthesizers")
    (subpath "/Library/Speech/Voices")
    (subpath "/Library/Audio")
    (subpath "/Library/Application Support/CrashReporter")
    (subpath "/System/Volumes/macOS/Library/Speech/Synthesizers")
    (subpath "/System/Volumes/macOS/Library/Speech/Voices")
    (subpath "/System/Volumes/macOS/Library/Audio")
    (home-subpath "/Library/Speech/Synthesizers")
    (home-subpath "/Library/Speech/Voices")
    (home-subpath "/Library/Audio")
    (home-subpath "/Library/Trial"))
    
(allow file-read*
    (home-literal "/Library/Preferences/.GlobalPreferences.plist")
    (home-regex #"/Library/Preferences/ByHost/\.GlobalPreferences\.")
    (literal "/Library/Preferences/.GlobalPreferences.plist"))

;;; Allow issuing sandbox extensions for clients
(allow file-issue-extension (extension-class "com.apple.app-sandbox.read"))

;;; Temp Directory
(allow file-read* file-write* (subpath (param "_TEMPDIR")))

;;; Third Party Support
(allow file-read* (subpath "/Library/Frameworks"))
(allow process-exec 
    (subpath "/Library/Speech/Synthesizers")
    (subpath "/System/Volumes/macOS/Library/Speech/Synthesizers")
    (home-subpath "/Library/Speech/Synthesizers"))
(allow process-fork)

;; DTalker
(allow file-read* file-write* (home-subpath "/Library/Preferences/Createsystem"))

;; Acapela Synthesizers (Infovox iVox / Acapela TTS)
(allow file-read* file-write* (home-subpath "/Library/Application Support/Acapela Group"))
(allow file-read* file-write* (subpath "/Library/Application Support/Infovox_iVox"))

(allow file-read*
    (literal "/")
    (literal "/private/var/db/mds/messages/se_SecurityMessages")
    (subpath "/Applications/Infovox iVox Voice Manager.app")
    (subpath "/Library/Application Support")
    (subpath "/Applications/Acapela TTS for Mac"))

(deny file-read*
      (subpath "/Library/Application Support/AppStoreContent")
      (subpath "/Library/Application Support/AppStore"))

(allow mach-lookup
    (global-name "com.apple.SecurityServer")
    (global-name "com.apple.cookied")
    (global-name "com.apple.SystemConfiguration.configd")
    (global-name "com.apple.PowerManagement.control"))
    
(allow network-outbound
    (literal "/private/var/run/mDNSResponder")
    (remote tcp))
    
(allow ipc-posix-shm-read-data (ipc-posix-name "FNetwork.defaultStorageSession"))

;;; (system-network) - Allow access to the network.
(define (system-network)
    (allow file-read*
        (literal "/Library/Preferences/com.apple.networkd.plist"))
    (allow mach-lookup
        (global-name "com.apple.SystemConfiguration.PPPController")
        (global-name "com.apple.SystemConfiguration.SCNetworkReachability")
        (global-name "com.apple.networkd")
        (global-name "com.apple.symptomsd")
        (global-name "com.apple.usymptomsd"))
    (allow network-outbound
        (control-name "com.apple.netsrc")
        (control-name "com.apple.network.statistics"))
    (allow system-socket
        (require-all (socket-domain AF_SYSTEM)
            (socket-protocol 2)) ; SYSPROTO_CONTROL
            (socket-domain AF_ROUTE)))
(system-network)

;; Cepstral
(allow file-read*
    (home-literal "/.CFUserTextEncoding")
    (subpath "/Library/Application Support/Cepstral")
    (literal "/Library/Preferences/com.cepstral.swift"))
(allow file-read* file-write*
    (literal "/private/tmp/swift.lock"))
(allow user-preference-read (preference-domain "com.cepstral.swift"))