(version 1)

;;(trace "/tmp/useractivityd.sandbox.sb")

(deny default)

(import "system.sb")

;; We call LaunchServies to resolve which app can open a given activity type.  LaunchServices reads the filesystem to make sure that app still exists.  Furthermore, apps can exist anywhere on the filesystem on a Mac.  Hence, this is necessary. 
(allow file-read*)

;;(allow file-issue-extension
;;       (extension "com.apple.app-sandbox.read-write"))

(if (param "TMP_DIR")
    (allow file-issue-extension
           (regex (string-append "^" (param "TMP_DIR") "/*"))))

(if (param "TMP_DIR")
    (allow file-write*
           (regex (string-append "^" (param "TMP_DIR") "/*"))))

(allow system-fsctl)

(allow user-preference*
      (preference-domain-regex #"^com\.apple\.coreservices\.useractivityd"))

(allow sysctl-read)

(allow iokit-open
       (iokit-user-client-class "IOBluetoothHCIUserClient"))

(allow ipc-posix-shm-read-data
       (ipc-posix-name "apple.shm.cfprefsd.daemon")
       (ipc-posix-name-prefix "apple.cfprefs.")
       (ipc-posix-name-prefix "apple.shm.cfprefsd.")
       (ipc-posix-name-regex #"/tmp/com\.apple\.csseed\."))

(allow mach-lookup
       (global-name "com.apple.CoreServices.coreservicesd")
       (global-name "com.apple.coreservices.launchservicesd")
       (global-name "com.apple.distributed_notifications@Uv3")
       (global-name "com.apple.lsd.mapdb")
       (global-name "com.apple.lsd.modifydb")
       (global-name "com.apple.marco")
       (global-name "com.apple.sharingd.nsxpc")
       (global-name "com.apple.windowserver.active")
       (global-name "com.apple.system.logger")
       (global-name "com.apple.cfprefsd.daemon")
       (global-name "com.apple.diagnosticd")
       (global-name "com.apple.cfprefsd.agent")
       (global-name "com.apple.bird")
       (global-name "com.apple.networkd")
       (global-name "com.apple.awdd")
       (global-name "com.apple.DiskArbitration.diskarbitrationd")
       (global-name "com.apple.coreservices.uauseractivitypasteboardclient.xpc")
       (global-name "com.apple.coreservices.uasharedpasteboardprogressui.xpc")
       (global-name "com.apple.ProgressReporting")
       (global-name "com.apple.iokit.powerdxpc")
       (global-name "com.apple.PowerManagement.control")
       (global-name "com.apple.BluetoothDOServer")
       (global-name "com.apple.FileCoordination")
       (global-name "com.apple.analyticsd")
       (global-name "com.apple.sharing.handoff.advertising")
       (global-name "com.apple.sharing.handoff.scanning")
	   (global-name "com.apple.server.bluetooth.classic.xpc")
	   (global-name "com.apple.server.bluetooth.general.xpc")
	   (global-name "com.apple.server.bluetooth.le.att.xpc")
	   (global-name "com.apple.server.bluetooth.le.pipe.xpc")
	   (global-name "com.apple.airportd")
	   (global-name "com.apple.tccd")
	   (global-name "com.apple.tccd.system")
)

;; Things needed for debugging, only if it's a debug server
(if (param "ALLOW_NETWORK_ACCESS")
    (allow network-outbound network-inbound)
)

(allow file-read* file-write*
	(extension "com.apple.app-sandbox.read-write")
    (extension "com.apple.sandbox.application-group"))

(allow file-issue-extension
    (require-all
        (extension-class "com.apple.app-sandbox.read-write")
        (subpath "/")))

(allow file-issue-extension (extension-class "com.apple.sandbox.application-group"))

(allow mach-lookup (global-name "com.apple.containermanagerd"))