; Copyright (C) 2014-2016 Apple Inc. All rights reserved. ; ; Redistribution and use in source and binary forms, with or without ; modification, are permitted provided that the following conditions ; are met: ; 1. Redistributions of source code must retain the above copyright ; notice, this list of conditions and the following disclaimer. ; 2. Redistributions in binary form must reproduce the above copyright ; notice, this list of conditions and the following disclaimer in the ; documentation and/or other materials provided with the distribution. ; ; THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' ; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, ; THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR ; PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS ; BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR ; CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF ; SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS ; INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN ; CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ; ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF ; THE POSSIBILITY OF SUCH DAMAGE. (version 1) (deny default (with partial-symbolication)) (allow system-audit file-read-metadata) (import "system.sb") ;;; process-info* defaults to allow; deny it and then allow operations we actually need. (deny process-info*) (allow process-info-pidinfo) (allow process-info-setcontrol (target self)) (deny sysctl*) (allow sysctl-read (sysctl-name "hw.availcpu" "hw.ncpu" "hw.model" "kern.memorystatus_level" "vm.footprint_suspend")) (deny iokit-get-properties) #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300 (deny mach-lookup (xpc-service-name-prefix "")) #endif ;; Utility functions for home directory relative path filters (define (home-regex home-relative-regex) (regex (string-append "^" (regex-quote (param "HOME_DIR")) home-relative-regex))) (define (home-subpath home-relative-subpath) (subpath (string-append (param "HOME_DIR") home-relative-subpath))) (define (home-literal home-relative-literal) (literal (string-append (param "HOME_DIR") home-relative-literal))) (define (allow-read-write-directory-and-issue-read-write-extensions path) (if path (begin (allow file-read* file-write* (subpath path)) (allow file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read") (subpath path))) (allow file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read-write") (subpath path)))))) ;; IOKit user clients (allow iokit-open (iokit-user-client-class "RootDomainUserClient")) ;; Security framework (allow mach-lookup (global-name "com.apple.SecurityServer")) (allow user-preference-read (preference-domain "com.apple.security" "com.apple.security.revocation")) (allow file-read* (subpath "/private/var/db/mds") (literal "/private/var/db/DetachedSignatures") ; The following are needed until is resolved. (literal "/Library/Preferences/com.apple.security.plist") (literal "/Library/Preferences/com.apple.security.revocation.plist") (home-literal "/Library/Preferences/com.apple.security.plist") (home-literal "/Library/Preferences/com.apple.security.revocation.plist")) (allow ipc-posix-shm-read* ipc-posix-shm-write-data (ipc-posix-name "com.apple.AppleDatabaseChanged")) (if (positive? (string-length (param "DARWIN_USER_CACHE_DIR"))) (allow-read-write-directory-and-issue-read-write-extensions (param "DARWIN_USER_CACHE_DIR"))) (if (positive? (string-length (param "DARWIN_USER_TEMP_DIR"))) (allow-read-write-directory-and-issue-read-write-extensions (param "DARWIN_USER_TEMP_DIR"))) ;; Read-only preferences and data (allow user-preference-read (preference-domain "kCFPreferencesAnyApplication")) (allow file-read* ;; Basic system paths (subpath "/Library/Frameworks") (subpath "/Library/Managed Preferences") ;; On-disk WebKit2 framework location, to account for debug installations ;; outside of /System/Library/Frameworks (subpath (param "WEBKIT2_FRAMEWORK_DIR"))) (allow system-fsctl (fsctl-command (_IO "h" 47))) ;; Various services required by CFNetwork and other frameworks (allow mach-lookup #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300 (global-name "com.apple.analyticsd") #endif (global-name "com.apple.lsd.mapdb") ) ;; Sandbox extensions (define (apply-read-and-issue-extension op path-filter) (op file-read* path-filter) (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read") path-filter))) (define (apply-write-and-issue-extension op path-filter) (op file-write* path-filter) (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read-write") path-filter))) (define (read-only-and-issue-extensions path-filter) (apply-read-and-issue-extension allow path-filter)) (define (read-write-and-issue-extensions path-filter) (apply-read-and-issue-extension allow path-filter) (apply-write-and-issue-extension allow path-filter)) (read-only-and-issue-extensions (extension "com.apple.app-sandbox.read")) (read-write-and-issue-extensions (extension "com.apple.app-sandbox.read-write")) (if (defined? 'vnode-type) (deny file-write-create (vnode-type SYMLINK))) ;; Reserve a namespace for additional protected extended attributes. (deny file-read-xattr file-write-xattr (xattr-regex #"^com\.apple\.security\.private\."))