;;;;;; 3rd Party Format Reader / MediaExtensions Profile - AppSandbox profile
;;;;;; Extension point: com.apple.mediaextension.videodecoder.
;;;;;; Copyright (c) 2023 Apple Inc.  All Rights reserved.
;;;;;;
;;;;;; WARNING: The sandbox rules in this file currently constitute
;;;;;; Apple System Private Interface and are subject to change at any time and
;;;;;; without notice. The contents of this file are also auto-generated and
;;;;;; not user editable; it may be overwritten at any time.
(version 1)
(deny default (with telemetry) (with message "media-extension-video-decoder"))
(import "system.sb")
(import "appsandbox-common.sb")
(allow file-read-metadata)
(allow-read-directory-contents (param "application_bundle"))
(allow file-link (subpath (param "application_bundle")))
(allow file-read* (literal "/Library/Preferences/.GlobalPreferences.plist"))
(allow user-preference-read (preference-domain "kCFPreferencesAnyApplication"))
(allow-read-write-directory-contents (param "application_darwin_user_dir"))
(allow-read-write-directory-contents (param "application_darwin_temp_dir"))
(allow-read-write-directory-contents (param "application_darwin_cache_dir"))
(dyld-injection-support)
(appsandbox-container-common)
(appsandbox-container-macos)
(system-graphics)
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.iokit-user-client-class"
  (lambda (name)
    (allow iokit-open-user-client (iokit-user-client-class name))
    (allow iokit-set-properties (iokit-user-client-class name))))
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.files.home-relative-path.read-only"
  (lambda (path)
    (let ((filter (select-filter path home-subpath home-literal)))
      (read-only-and-issue-extensions filter))))
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.files.absolute-path.read-only"
  (lambda (path)
    (let ((filter (select-filter path safe-subpath literal)))
      (read-only-and-issue-extensions filter))))
(sandbox-array-entitlement
  "com.apple.security.temporary-exception.shared-preference.read-only"
  (lambda (domain) (allow user-preference-read (preference-domain domain))))
(appsandbox-quarantine-common)
(protect-redirected-paths)
(protect-redirectable-paths)