;;; Copyright (c) 2019 Apple Inc. All Rights reserved. ;;; ;;; WARNING: The sandbox rules in this file currently constitute ;;; Apple System Private Interface and are subject to change at any time and ;;; without notice. ;;; (version 1) (deny default) (deny file-map-executable process-info* nvram*) (deny dynamic-code-generation) (import "system.sb") (import "com.apple.corefoundation.sb") (corefoundation) ;;; Homedir-relative path filters (define (home-regex home-relative-regex) (regex (string-append "^" (regex-quote (param "HOME")) home-relative-regex))) (define (home-subpath home-relative-subpath) (subpath (string-append (param "HOME") home-relative-subpath))) (define (home-prefix home-relative-prefix) (prefix (string-append (param "HOME") home-relative-prefix))) (define (home-literal home-relative-literal) (literal (string-append (param "HOME") home-relative-literal))) ;; for SecCodeCopyGuestWithAttributes and other operations (mostly related to looking up client bundles identifiers) ;; we should try to narrow this down a bit - would require some changes around accepting connections on the daemon side (allow file-read*) (allow process-info-pidinfo) (allow process-info* (target self)) ;; For resolving symlinks, realpath(3), and equivalents. (allow file-read-metadata) ;; For validating the entitlements of clients. (allow process-info-codesignature) (allow user-preference-read user-preference-write (preference-domain "com.apple.nsurlsessiond")) (allow user-preference-read (preference-domain "com.apple.CFNetwork" "kCFPreferencesAnyApplication" "com.apple.security" "com.apple.bird.containers.notifications" ) ) ;; Read/write access to process local directories. (allow file-read* file-write* (subpath (param "USERDIR")) (subpath (param "TMPDIR")) (subpath (param "DARWIN_CACHE_DIR")) ) ;; Read/write cache access (let ((cache-path-filter (home-subpath "/Library/Caches/com.apple.nsurlsessiond"))) (allow file-read* file-write* cache-path-filter) (allow file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write") cache-path-filter)) ) (allow file-read* (literal "/Library/Preferences/com.apple.networkextension.uuidcache.plist") (literal "/usr/libexec") (literal "/usr/libexec/nsurlsessiond") ) (allow file-read* file-write* (home-subpath "/Library/com.apple.nsurlsessiond") (home-subpath "/Library/com.apple.nsurlsessiond-launchd") (home-subpath "/Library/Logs/com.apple.nsurlsessiond") ) (allow system-fsctl (fsctl-command APFSIOC_GET_DIR_STATS_EXT APFSIOC_MAINTAIN_DIR_STATS APFSIOC_MARK_PURGEABLE APFSIOC_PURGEABLE_LABEL_PURGEABLE)) ;;; Security.framework ; mds: mds.lock, mdsDirectory.db, mdsObject.db ; 1. extension "mds" ; uid == 0: r+w /private/var/db/mds/system ; uid > 0: r+w <_DARWIN_USER_CACHE_DIR>/mds ; 2. /private/var/db/mds/system/{mdsDirectory.db,mdsObject.db} ; uid == 0: r+w (already covered by (extension "nsurlsessiond:mds")) ; uid > 0: r (allow file-read* file-write* (extension "nsurlsessiond:mds")) (allow file-read* (literal "/private/var/db/mds/system/mdsDirectory.db") (literal "/private/var/db/mds/system/mdsObject.db")) ; 3. se_SecurityMessages: ; uid < 500: /private/var/db/mds/messages/se_SecurityMessages ; uid >= 500: /private/var/db/mds/messages//se_SecurityMessages (allow file-read* (literal (param "SECURITY_MESSAGES"))) (allow ipc-posix-shm-read-data ipc-posix-shm-write-data ipc-posix-shm-write-create (ipc-posix-name "com.apple.AppleDatabaseChanged")) (allow file-read* (literal "/Library/Preferences/com.apple.security-common.plist") (home-literal "/Library/Preferences/com.apple.security.plist") (literal "/Library/Preferences/com.apple.security.plist") (literal "/private/var/db/DetachedSignatures") ) (define (enterprise-context-subpath enterprise-context-relative-subpath) (subpath (string-append "/Volumes/${ANY_UUID}/" enterprise-context-relative-subpath)) ) ;; For background downloads. (let ((download-store (require-any (subpath "/System/Library/AssetsV2/downloadDir") (subpath "/System/Volumes/Update/MobileAsset/AssetsV2/downloadDir") (subpath "/Library/Caches/com.apple.nsurlsessiond") (home-subpath "/Library/Caches/com.apple.nsurlsessiond") (subpath "/private/var/root/Library/Caches/com.apple.nsurlsessiond") (regex #"^(/private)?/var/folders/[^/]+/[^/]+/[^/]+/com\.apple\.nsurlsessiond(.[0-9]+)?($|/)") (home-regex "/Library/Containers/[^/]+/Data/Library/Caches/com\.apple\.nsurlsessiond") (home-regex "/Library/Group Containers/[^/]+/Library/Caches/com\.apple\.nsurlsessiond") (home-regex "/Library/Containers/[^/]+/Data/Library/com\.apple\.UserManagedAssets") (home-regex "/Library/Group Containers/[^/]+/Data/Library/com\.apple\.UserManagedAssets") (enterprise-context-subpath "/Library/Caches/com\.apple\.nsurlsessiond") ))) (allow file-read* file-write* qtn-user download-store) ;; For AVAssetDownloadSession to pass along downloaded assets to mediaserverd. (allow file-issue-extension (require-all (require-any (extension-class "com.apple.StreamingUnzipService") (extension-class "com.apple.STExtractionService") (extension-class "com.apple.mediaserverd.read-write")) download-store))) ;; For background uploads. (allow file-read* (require-all (vnode-type REGULAR-FILE) (extension "com.apple.app-sandbox.read"))) ;; Support for cookies in background sessions (let ((relative-regex #"/Library/Cookies/[^/]+\.binarycookies([^/]*\.dat)?$")) (allow file-read* file-write* (home-regex relative-regex))) ;; For AVAsset downloads. (allow file-read* file-write* (home-subpath "/Media/Downloads") (home-subpath "/Media/Purchases") ) ;; For TLD (allow file-read* file-write* (subpath "/private/var/db/nsurlstoraged") ) (allow mach-lookup (global-name "com.apple.PowerManagement.control") (global-name "com.apple.ProgressReporting") (global-name "com.apple.awdd") (global-name "com.apple.cache_delete.public") (global-name "com.apple.coremedia.admin") (global-name "com.apple.coremedia.asset.xpc") (global-name "com.apple.coremedia.assetdownloader") (global-name "com.apple.coremedia.customurlloader.xpc") (global-name "com.apple.coremedia.figcontentkeysession.xpc") (global-name "com.apple.coremedia.player.xpc") (global-name "com.apple.coremedia.sandboxserver") (global-name "com.apple.coremedia.sandboxserver.xpc") (global-name "com.apple.coremedia.sts") (global-name "com.apple.coremedia.visualcontext.xpc") (global-name "com.apple.coremedia.cpeprotector.xpc") (global-name "com.apple.coremedia.formatreader.xpc") (global-name "com.apple.duetactivityscheduler") (global-name "com.apple.installcoordinationd") (global-name "com.apple.lsd.xpc") (global-name "com.apple.mobile.keybagd.xpc") (global-name "com.apple.mobile.keybagd.UserManager.xpc") (global-name "com.apple.mobile.usermanagerd.xpc") (global-name "com.apple.nano.nanoregistry.paireddeviceregistry") (global-name "com.apple.ocspd") (global-name "com.apple.powerlog.plxpclogger.xpc") (global-name "com.apple.securityd") (global-name "com.apple.trustd") (global-name "com.apple.lsd.mapdb") (global-name "com.apple.lsd.modifydb") (global-name "com.apple.cfnetwork.cfnetworkagent") (global-name "com.apple.SystemConfiguration.configd") (global-name "com.apple.wifi.manager") (global-name "com.apple.coreservices.launchservicesd") (global-name "com.apple.runningboard") (global-name "com.apple.coreservices.quarantine-resolver") (global-name "com.apple.CoreServices.coreservicesd") (global-name "com.apple.SecurityServer") (global-name "com.apple.usymptomsd") (global-name "com.apple.nehelper") (global-name "com.apple.distributed_notifications@1v3") (global-name "com.apple.distributed_notifications@Uv3") (global-name "com.apple.chronoservices") (global-name "com.apple.containermanagerd") (global-name "com.apple.mobileassetd.v2") (global-name "com.apple.GSSCred") ) (system-network) ;; OS X only (allow network-outbound (literal "/private/var/run/mDNSResponder") (remote tcp) (remote udp) ) (allow system-info (info-type "net.link.addr") ) (allow file-read* (literal "/private/etc/hosts") ) (allow system-socket (socket-domain AF_SYSTEM) ) (allow lsopen) ;; for the AVAsset functionality nsurlsessiond performs on behald of Catalyst applications (which happens in mediaserverd on other platforms) (allow mach-lookup (global-name "com.apple.rtcreportingd") (global-name "com.apple.tccd.system") (global-name "com.apple.windowserver.active") (global-name "com.apple.lskdd") (global-name "com.apple.metadata.mds") ) (allow user-preference-read (preference-domain "com.apple.coremedia" "com.apple.avfoundation" "com.apple.mediaaccessibility" "com.apple.nsurlcache" ) ) (allow ipc-posix-shm-read-data (ipc-posix-name "FNetwork.defaultStorageSession")) ;; from the trace files attached to that are not covered by anything above (allow socket-ioctl (ioctl-command CTLIOCGINFO) (ioctl-command SIOCGCONNINFO) (ioctl-command SIOCGIFCONSTRAINED) (ioctl-command SIOCGIFDELEGATE) (ioctl-command SIOCGIFEXPENSIVE) (ioctl-command SIOCGIFFUNCTIONALTYPE) (ioctl-command SIOCGIFMEDIA) (ioctl-command SIOCGIFMTU) )