(version 1)
(deny default)

(import "system.sb")
(import "com.apple.corefoundation.sb")
(corefoundation)
(system-graphics)

(define (home-subpath home-relative-subpath)
    (subpath (string-append (param "_HOME") home-relative-subpath)))
(define (home-literal home-relative-literal)
    (literal (string-append (param "_HOME") home-relative-literal)))
(define (home-regex home-relative-regex)
    (regex (string-append "^" (regex-quote (param "_HOME")) home-relative-regex)))

(allow lsopen)
(allow network-outbound)
(allow system-socket)

(allow authorization-right-obtain
    (right-name "system.install.apple-config-data")
    (right-name "system.install.apple-software")
    (right-name "system.install.apple-software.standard-user")
    (right-name "system.install.app-store-software")
    (right-name "system.install.app-store-software.standard-user")
    (right-name "system.install.software")
    (right-name "system.install.software.iap")
    (right-name "system.install.software.mdm-provided"))

(allow file-read-metadata)

(allow file-read*
    (literal "/usr/local/bin/skclient")
    (literal "/private/var/db/nsurlstoraged/dafsaData.bin")
    (literal "/private/var/db/os_eligibility/eligibility.plist")
    (literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains")
    (regex #"/Library/Preferences/com\.apple\.networkd\.plist")
    (regex #"/Library/Preferences/com\.apple\.security\.plist")
    (regex #"\.app(/|$)"))

(allow file-read* file-write*
    (extension "com.apple.app-sandbox.read-write")
    (home-subpath "/Library/Group Containers/group.com.apple.storekit")
    (regex #"/Library/Application Support(/|$)")
    (regex #"/Library/Caches/com\.apple\.AppleMediaServices")
    (regex #"/Library/Caches/(com\.apple\.)?storekitagent")
    (regex #"/Library/HTTPStorages/(com\.apple\.)?storekitagent")
    (home-regex #"/Library/Containers/[^/]+/Data(/Library/Caches)?/StoreKit(/|$)")
    (subpath (param "_DARWIN_CACHE_DIR"))
    (subpath (param "_DARWIN_TEMP_DIR")))

(allow file-issue-extension
    (regex #"/Library/Caches/com\.apple\.AppleMediaServices")
    (regex #"/Library/Caches/com\.apple\.StoreKit\.xpc"))

(allow user-preference-read
    (preference-domain "com.apple.CloudKit")
    (preference-domain "kCFPreferencesAnyApplication")
    (preference-domain "com.apple.networkd")
    (preference-domain "com.apple.security"))

(allow user-preference*
    (preference-domain "com.apple.AppleMediaServices")
    (preference-domain "com.apple.StoreKit"))

(allow mach-lookup
    (global-name "com.apple.accountsd.accountmanager")
    (global-name "com.apple.adid")
    (global-name "com.apple.ak.anisette.xpc")
    (global-name "com.apple.ak.authorizationservices.xpc")
    (global-name "com.apple.xpc.amsaccountsd")
    (global-name "com.apple.xpc.amstoold")
    (global-name "com.apple.AppSSO.service-xpc")
    (global-name "com.apple.appstoreagent.xpc")
    (global-name "com.apple.apsd")
    (global-name "com.apple.askpermissiond")
    (global-name "com.apple.cfnetwork.cfnetworkagent")
    (global-name "com.apple.containermanagerd")
    (global-name "com.apple.CoreAuthentication.agent")
    (global-name "com.apple.CoreAuthentication.agent.libxpc")
    (global-name "com.apple.coreservices.launchservicesd")
    (global-name "com.apple.coreservices.quarantine-resolver")
    (global-name "com.apple.ctkd.token-client")
    (global-name "com.apple.fairplaydeviceidentityd")
    (global-name "com.apple.fpsd")
    (global-name "com.apple.installd")
    (global-name "com.apple.lsd.encryption")
    (global-name "com.apple.lsd.advertisingidentifiers")
    (global-name "com.apple.metadata.mds")
    (global-name "com.apple.nehelper")
    (global-name "com.apple.nesessionmanager.content-filter")
    (global-name "com.apple.PowerManagement.control")
    (global-name "com.apple.securityd.xpc")
    (global-name "com.apple.SecurityServer")
    (global-name "com.apple.storekitservice")
    (global-name "com.apple.storeuid")
    (global-name "com.apple.system_installd")
    (global-name "com.apple.system.opendirectoryd.api")
    (global-name "com.apple.SystemConfiguration.configd")
    (global-name "com.apple.SystemConfiguration.DNSConfiguration")
    (global-name "com.apple.tccd")
    (global-name "com.apple.tccd.system")
    (global-name "com.apple.usymptomsd")
    (global-name "com.apple.windowserver.active")
    (global-name "com.apple.xpc.amsaccountsd")
    (global-name "com.apple.xpc.amsengagementd")
    (global-name "com.apple.kvsd"))

(allow mach-register
    (global-name "com.apple.aps.storekitservice")
    (global-name "com.apple.storekit.configuration.xpc")
    (global-name "com.apple.storekitagent")
    (global-name "com.apple.storekitservice.sim2host"))

(allow ipc-posix-shm-read* ipc-posix-shm-write*
    (ipc-posix-name "com.apple.AppleDatabaseChanged"))

;; mds: mds.lock, mdsDirectory.db, mdsObject.db
;; 1. extension "appstoreagent:mds"
;;    uid == 0: r+w /private/var/db/mds/system
;;    uid  > 0: r+w <_DARWIN_USER_CACHE_DIR>/mds
;; 2. /private/var/db/mds/system/{mdsDirectory.db,mdsObject.db}
;;    uid == 0: r+w (already covered by (extension "storekitagent:mds"))
;;    uid  > 0: r
(allow file-read* file-write* (extension "storekitagent:mds"))
(allow file-read*
    (literal "/private/var/db/mds/system/mdsDirectory.db")
    (literal "/private/var/db/mds/system/mdsObject.db"))
;; 3. se_SecurityMessages:
;;    uid  < 500: /private/var/db/mds/messages/se_SecurityMessages
;;    uid >= 500: /private/var/db/mds/messages/<uid>/se_SecurityMessages
(allow file-read*
    (literal (param "_SECURITY_MESSAGES_FILE")))

;;
;; FairPlay DLL Support. See rdar://problem/54211948
;; Please do not append to this section unless it is specifically for FairPlay
(allow file-read*
    (subpath "/bin")
    (subpath "/etc")
    (subpath "/private/etc")
    (subpath "/private/tmp")
    (subpath "/private/var/log")
    (subpath "/private/var/run")
    (subpath "/Library/Updates")
    (subpath "/sbin")
    (subpath "/System/Library/Caches")
    (subpath "/tmp")
    (subpath "/usr/lib")
    (subpath "/var/log")
    (subpath "/var/run")
    (subpath (param "_HOME")))