; Copyright (C) 2013, 2014 Apple Inc. All rights reserved. ; ; Redistribution and use in source and binary forms, with or without ; modification, are permitted provided that the following conditions ; are met: ; 1. Redistributions of source code must retain the above copyright ; notice, this list of conditions and the following disclaimer. ; 2. Redistributions in binary form must reproduce the above copyright ; notice, this list of conditions and the following disclaimer in the ; documentation and/or other materials provided with the distribution. ; ; THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' ; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, ; THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR ; PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS ; BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR ; CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF ; SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS ; INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN ; CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ; ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF ; THE POSSIBILITY OF SUCH DAMAGE. (version 1) (deny default (with partial-symbolication)) (allow system-audit file-read-metadata) (import "system.sb") ;; Utility functions for home directory relative path filters (define (home-regex home-relative-regex) (regex (string-append "^" (regex-quote (param "HOME_DIR")) home-relative-regex))) (define (home-subpath home-relative-subpath) (subpath (string-append (param "HOME_DIR") home-relative-subpath))) (define (home-literal home-relative-literal) (literal (string-append (param "HOME_DIR") home-relative-literal))) ;; Read-only preferences and data (allow file-read* ;; Basic system paths (subpath "/Library/Frameworks") (subpath "/Library/Managed Preferences") ;; System and user preferences (literal "/Library/Preferences/.GlobalPreferences.plist") (regex #"^/Library/Managed Preferences/[^/]+/com\.apple\.networkConnect\.plist$") (home-literal "/Library/Preferences/.GlobalPreferences.plist") (home-regex #"/Library/Preferences/ByHost/\.GlobalPreferences\.") (home-regex #"/Library/Preferences/ByHost/com\.apple\.networkConnect\.") (home-literal "/Library/Preferences/com.apple.DownloadAssessment.plist") (home-literal "/Library/Preferences/com.apple.WebFoundation.plist") ;; On-disk WebKit2 framework location, to account for debug installations ;; outside of /System/Library/Frameworks (subpath (param "WEBKIT2_FRAMEWORK_DIR"))) ;; Sandbox extensions (define (apply-read-and-issue-extension op path-filter) (op file-read* path-filter) (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read") path-filter))) (define (apply-write-and-issue-extension op path-filter) (op file-write* path-filter) (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read-write") path-filter))) (define (read-only-and-issue-extensions path-filter) (apply-read-and-issue-extension allow path-filter)) (define (read-write-and-issue-extensions path-filter) (apply-read-and-issue-extension allow path-filter) (apply-write-and-issue-extension allow path-filter)) (read-only-and-issue-extensions (extension "com.apple.app-sandbox.read")) (read-write-and-issue-extensions (extension "com.apple.app-sandbox.read-write")) (allow file-read* file-write* (subpath (param "DARWIN_USER_CACHE_DIR"))) (allow file-read* file-write* (subpath (param "DARWIN_USER_TEMP_DIR"))) ;; IOKit user clients (allow iokit-open (iokit-user-client-class "RootDomainUserClient")) ;; cookied. ;; FIXME: Update for . (allow ipc-posix-shm-read-data (ipc-posix-name "FNetwork.defaultStorageSession") (ipc-posix-name-regex #"\.PrivateBrowsing-") (ipc-posix-name-regex #"^WebKit Test-")) ;; Various services required by CFNetwork and other frameworks (allow mach-lookup (global-name "com.apple.FileCoordination") (global-name "com.apple.PowerManagement.control") (global-name "com.apple.SystemConfiguration.configd") (global-name "com.apple.cookied") (global-name "com.apple.cfnetwork.AuthBrokerAgent")) ;; Security framework (allow mach-lookup (global-name "com.apple.ocspd") (global-name "com.apple.SecurityServer")) (allow file-read* file-write* (home-subpath "/Library/Keychains")) ;; FIXME: This should be removed when is fixed. (allow file-read* file-write* (subpath "/private/var/db/mds/system")) ;; FIXME: This should be removed when is fixed. (allow file-read* (subpath "/Library/Keychains") (subpath "/private/var/db/mds") (literal "/private/var/db/DetachedSignatures") (literal "/Library/Preferences/com.apple.crypto.plist") (literal "/Library/Preferences/com.apple.security.plist") (literal "/Library/Preferences/com.apple.security.common.plist") (literal "/Library/Preferences/com.apple.security.revocation.plist") (home-literal "/Library/Application Support/SyncServices/Local/ClientsWithChanges/com.apple.Keychain") (home-literal "/Library/Preferences/com.apple.security.plist") (home-literal "/Library/Preferences/com.apple.security.revocation.plist")) (allow ipc-posix-shm-read* ipc-posix-shm-write-data (ipc-posix-name "com.apple.AppleDatabaseChanged")) (system-network) (allow network-outbound ;; Local mDNSResponder for DNS, arbitrary outbound TCP (literal "/private/var/run/mDNSResponder") (remote tcp)) ;; FIXME should be removed when + related radar in Safari is fixed (allow mach-lookup (global-name "org.h5l.kcm") (global-name "com.apple.GSSCred") (global-name "com.apple.system.logger") (global-name "com.apple.system.notification_center")) (allow network-outbound (remote udp)) (allow file-read* (home-subpath "/Library/Preferences/com.apple.Kerberos.plist") (home-subpath "/Library/Preferences/com.apple.GSS.plist") (home-subpath "/Library/Preferences/edu.mit.Kerberos") (literal "/Library/Preferences/com.apple.Kerberos.plist") (literal "/Library/Preferences/com.apple.GSS.plist") (literal "/Library/Preferences/edu.mit.Kerberos") (literal "/private/etc/krb5.conf") (literal "/private/etc/services") (literal "/private/etc/host") (subpath "/Library/KerberosPlugins/GSSAPI") (subpath "/Library/KerberosPlugins/KerberosFrameworkPlugins")) (if (defined? 'vnode-type) (deny file-write-create (vnode-type SYMLINK))) ;; FIXME: Should be removed once is fixed. (deny file-write-xattr (xattr "com.apple.quarantine") (with no-log)) ;; Reserve a namespace for additional protected extended attributes. #if __MAC_OS_X_VERSION_MIN_REQUIRED > 1090 (deny file-read-xattr file-write-xattr (xattr-regex #"^com\.apple\.security\.private\.")) #else (deny file-read-xattr file-write-xattr (xattr #"^com\.apple\.security\.private\.")) #endif (deny file-read* file-write* (with no-log) ;; FIXME: Should be removed after is fixed. (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2") (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-journal"))