1(version 1) 2(deny default (with partial-symbolication)) 3(allow ipc-posix-shm system-audit system-socket file-read-metadata) 4 5(import "system.sb") 6(import "com.apple.corefoundation.sb") 7 8;; Distributed notifications, local pasteboard client 9(corefoundation) 10 11;; Read-only preferences and data 12(allow file-read* 13 ;; Basic system paths 14 (subpath "/Library/Dictionaries") 15 (subpath "/Library/Fonts") 16 (subpath "/Library/Frameworks") 17 (subpath "/Library/Keychains") 18 (subpath "/private/var/db/mds") 19 (subpath "/private/var/db/DetachedSignatures") 20 (regex #"^/private/etc/(hosts|group|passwd)$") 21 22 ;; Plugins 23 (subpath "/Library/Internet Plug-Ins") 24 (subpath (string-append (param "HOME_DIR") "/Library/Internet Plug-Ins")) 25 26 ;; System and user preferences 27 (literal "/Library/Preferences/.GlobalPreferences.plist") 28 (literal "/Library/Preferences/com.apple.crypto.plist") 29 (literal "/Library/Preferences/com.apple.security.plist") 30 (literal "/Library/Preferences/com.apple.security.common.plist") 31 (literal "/Library/Preferences/com.apple.security.revocation.plist") 32 (literal (string-append (param "HOME_DIR") "/Library/Preferences/.GlobalPreferences.plist")) 33 (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/ByHost/\.GlobalPreferences\.")) 34 (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.ATS.plist")) 35 (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.HIToolbox.plist")) 36 (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.LaunchServices.plist")) 37 (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.WebFoundation.plist")) 38 (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.security.plist")) 39 (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.security.revocation.plist")) 40 (literal (string-append (param "HOME_DIR") "/Library/Application Support/SyncServices/Local/ClientsWithChanges/com.apple.Keychain")) 41 (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/com\.apple\.driver\.(AppleBluetoothMultitouch\.mouse|AppleBluetoothMultitouch\.trackpad|AppleHIDMouse)\.plist$")) 42 43 ;; On-disk WebKit2 framework location, to account for debug installations 44 ;; outside of /System/Library/Frameworks 45 (subpath (param "WEBKIT2_FRAMEWORK_DIR")) 46 47 ;; FIXME: This should be removed when <rdar://problem/8957845> is fixed. 48 (subpath (string-append (param "HOME_DIR") "/Library/Fonts")) 49 50 ;; FIXME: These should be removed when <rdar://problem/9217757> is fixed. 51 (subpath (string-append (param "HOME_DIR") "/Library/Audio/Plug-Ins/Components")) 52 (subpath (string-append (param "HOME_DIR") "/Library/Preferences/QuickTime Preferences")) 53 (subpath "/Library/Audio/Plug-Ins/Components") 54 (subpath "/Library/Audio/Plug-Ins/HAL") 55 (subpath "/Library/Video/Plug-Ins") 56 (subpath "/Library/QuickTime") 57 58 ;; FIXME: This should be removed when <rdar://problem/9237619> is fixed. 59 (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.universalaccess.plist")) 60 61 ;; FIXME: This should be removed when <rdar://problem/9276253> is fixed. 62 (subpath (string-append (param "HOME_DIR") "/Library/Keyboard Layouts")) 63 64 ;; FIXME: This should be removed when <rdar://problem/9276268> is fixed. 65 (subpath (string-append (param "HOME_DIR") "/Library/Input Methods")) 66 67 ;; FIXME: This should be removed when <rdar://problem/9276430> is fixed. 68 (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2")) 69 70 (subpath (string-append (param "HOME_DIR") "/Library/Dictionaries")) 71 72 ;; Extensions from UIProcess 73 (extension) 74) 75 76(allow file-write* 77 ;; Extensions from UIProcess 78 (extension) 79) 80 81;; Writable preferences and temporary files 82(allow file* 83 (subpath (string-append (param "HOME_DIR") "/Library/Caches/com.apple.WebProcess")) 84 (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/ByHost/com\.apple\.HIToolbox\.")) 85 (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/com\.apple\.WebProcess\.")) 86 (subpath (string-append (param "HOME_DIR") "/Library/Keychains")) 87 88 ;; FIXME: This should be removed when <rdar://problem/9217757> is fixed. 89 (literal (string-append (param "HOME_DIR") "/Library/Caches/com.apple.coreaudio.components.plist")) 90) 91 92;; Darwin temporary files and caches, if present 93(if (positive? (string-length (param "DARWIN_USER_CACHE_DIR"))) 94 (allow file* (subpath (param "DARWIN_USER_CACHE_DIR")))) 95(if (positive? (string-length (param "DARWIN_USER_TEMP_DIR"))) 96 (allow file* (subpath (param "DARWIN_USER_TEMP_DIR")))) 97 98;; Database dir 99(if (positive? (string-length (param "WEBKIT_DATABASE_DIR"))) 100 (allow file* (subpath (param "WEBKIT_DATABASE_DIR")))) 101 102;; LocalStorage dir 103(if (positive? (string-length (param "WEBKIT_LOCALSTORAGE_DIR"))) 104 (allow file* (subpath (param "WEBKIT_LOCALSTORAGE_DIR")))) 105 106;; The NSURLCache directory. 107(if (positive? (string-length (param "NSURL_CACHE_DIR"))) 108 (allow file* (subpath (param "NSURL_CACHE_DIR")))) 109 110;; The bundle resource path of the UI process. 111(if (positive? (string-length (param "UI_PROCESS_BUNDLE_RESOURCE_DIR"))) 112 (allow file-read* (subpath (param "UI_PROCESS_BUNDLE_RESOURCE_DIR")))) 113 114;; FIXME: overly permissive since we can't pre-enumerate the client 115;; classes for graphics cards 116(allow iokit-open 117 ;;(iokit-user-client-class "IOHIDParamUserClient") 118 ;;(iokit-user-client-class "RootDomainUserClient") 119) 120 121;; Various services required by AppKit and other frameworks 122(allow mach-lookup 123 (global-name "com.apple.CoreServices.coreservicesd") 124 (global-name "com.apple.DiskArbitration.diskarbitrationd") 125 (global-name "com.apple.FileCoordination") 126 (global-name "com.apple.FontObjectsServer") 127 (global-name "com.apple.FontServer") 128 (global-name "com.apple.SecurityServer") 129 (global-name "com.apple.SystemConfiguration.configd") 130 (global-name "com.apple.audio.VDCAssistant") 131 (global-name "com.apple.audio.audiohald") 132 (global-name "com.apple.audio.coreaudiod") 133 (global-name "com.apple.cookied") 134 (global-name "com.apple.cvmsServ") 135 (global-name "com.apple.networkd") 136 (global-name "com.apple.dock.server") 137 (global-name "com.apple.ocspd") 138 (global-name "com.apple.pasteboard.1") 139 (global-name "com.apple.system.opendirectoryd.api") 140 (global-name "com.apple.window_proxies") 141 (global-name "com.apple.windowserver.active") 142 (global-name-regex #"^com\.apple\.WebKit\.WebProcess-") 143 (global-name-regex #"^com\.apple\.qtkitserver\.") 144 145 ;; FIXME: This should be removed when <rdar://problem/9276393> is fixed. 146 (global-name "com.apple.metadata.mds") 147) 148 149;; FIXME: <rdar://problem/9263428> These rules are required to avoid 150;; sandbox violation spam, but some narrower rule should be 151;; sufficient. 152(allow network-outbound) 153(deny network-outbound (regex "")) 154(deny network-outbound (local ip)) 155 156(allow network-outbound 157 ;; Local mDNSResponder for DNS, arbitrary outbound TCP 158 (literal "/private/var/run/mDNSResponder") 159 (remote tcp) 160) 161 162;; FIXME: Once <rdar://problem/8900275> has been fixed, these rules can be removed. 163(allow mach-lookup (global-name "com.apple.pubsub.ipc")) 164(allow network-outbound (regex #"^/private/tmp/launch-[^/]+/Render")) 165(allow file-read* 166 (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.Safari.RSS.plist")) 167 (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.Syndication.plist")) 168) 169 170;; FIXME: Investigate these. 171(allow appleevent-send (appleevent-destination "com.apple.WebProcess")) 172(allow mach-lookup (global-name-regex #"^EPPC-")) 173