;; ;; kcm - sandbox profile ;; Copyright (c) 2010 - 2011 Apple Inc. All Rights reserved. ;; ;; WARNING: The sandbox rules in this file currently constitute ;; Apple System Private Interface and are subject to change at any time and ;; without notice. The contents of this file are also auto-generated and not ;; user editable; it may be overwritten at any time. ;; (version 1) (deny default (with no-callout)) (import "com.apple.corefoundation.sb") (import "opendirectory.sb") (import "system.sb") (corefoundation) (system-network) (allow file-ioctl (literal "/dev/dtracehelper")) (deny file* (subpath "/var/root") (subpath "/private/var/root") (with no-log)) (allow file-read* (literal "/") (literal "/usr/sbin") (literal "/usr/sbin/gssd") (literal "/etc/krb5.conf") (subpath "/Library/Preferences") (literal "/dev/dtracehelper") (literal "/dev/null") (literal "/private/etc") (literal "/private/var") (literal "/private/etc/hosts") (literal "/private/etc/resolv.conf") (literal "/private/etc/krb5.conf") (literal "/private/etc/services") (literal "/private/etc/localtime") (literal "/private/var/run/resolv.conf") (subpath "/private/var/db/mds") (subpath "/Library/KerberosPlugins") (subpath "/Library/Frameworks") (subpath "/Library/Security")) ;; needed for code signature checks (allow file-read-metadata (literal "/private") (literal "/usr/sbin") (literal "/usr/sbin/gssd") (literal "/private/var/db") (subpath "/Library/Security/") (literal "/private/var/root/systemkeychaincheck.done") (literal "/private/var/run/systemkeychaincheck.done")) (allow file-write* file-read* (literal "/private/var/db/kcm-dump.bin") (literal "/private/var/db/kcm-dump.uuid") (literal "/private/var/run/kcm.pid")) (allow file-write-data (literal "/dev/dtracehelper") (literal "/private/var/db/mds/system/mds.lock")) (allow ipc-posix-shm) (allow mach-lookup (global-name "com.apple.SecurityServer") (global-name "com.apple.SystemConfiguration.DNSConfiguration") (global-name "com.apple.SystemConfiguration.configd") (global-name "com.apple.TrustEvaluationAgent") (global-name "com.apple.ocspd") (global-name "com.apple.networkd")) (allow network-outbound (literal "/private/var/run/mDNSResponder") (remote udp) (remote tcp) (literal "/private/var/run/systemkeychaincheck.socket")) (allow sysctl-read) (allow iokit-open (iokit-user-client-class "AppleFDEKeyStoreUserClient")) (allow network-outbound (control-name "com.apple.network.statistics") (control-name "com.apple.netsrc"))