; Copyright (C) 2013-2017 Apple Inc. All rights reserved. ; ; Redistribution and use in source and binary forms, with or without ; modification, are permitted provided that the following conditions ; are met: ; 1. Redistributions of source code must retain the above copyright ; notice, this list of conditions and the following disclaimer. ; 2. Redistributions in binary form must reproduce the above copyright ; notice, this list of conditions and the following disclaimer in the ; documentation and/or other materials provided with the distribution. ; ; THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' ; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, ; THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR ; PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS ; BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR ; CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF ; SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS ; INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN ; CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ; ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF ; THE POSSIBILITY OF SUCH DAMAGE. (version 1) (deny default (with partial-symbolication)) (allow system-audit file-read-metadata) (import "system.sb") ;;; process-info* defaults to allow; deny it and then allow operations we actually need. (deny process-info*) (allow process-info-pidinfo) (allow process-info-setcontrol (target self)) (deny sysctl*) (allow sysctl-read (sysctl-name "hw.availcpu" "hw.ncpu" "hw.model" "kern.memorystatus_level" "vm.footprint_suspend")) (deny iokit-get-properties) #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300 (deny mach-lookup (xpc-service-name-prefix "")) #endif ;; Utility functions for home directory relative path filters (define (home-regex home-relative-regex) (regex (string-append "^" (regex-quote (param "HOME_DIR")) home-relative-regex))) (define (home-subpath home-relative-subpath) (subpath (string-append (param "HOME_DIR") home-relative-subpath))) (define (home-literal home-relative-literal) (literal (string-append (param "HOME_DIR") home-relative-literal))) #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300 ;; CFNetwork (allow file-read-data (path "/private/var/db/nsurlstoraged/dafsaData.bin")) #endif ;; Remove when is fixed. (define (HEX-pattern-match-generator pattern-descriptor) (letrec ((pattern-string "")) (for-each (lambda (repeat-count) (if (zero? repeat-count) (set! pattern-string (string-append pattern-string "-")) (let appender ((count repeat-count)) (if (> count 0) (begin (set! pattern-string (string-append pattern-string "[0-9A-F]")) (appender (- count 1))))))) pattern-descriptor) pattern-string)) ;; return a regex pattern matching string for 8-4-4-4-12 UUIDs: (define (uuid-HEX-pattern-match-string) (HEX-pattern-match-generator '(8 0 4 0 4 0 4 0 12))) ;; global to hold the computed UUID matching pattern. (define *uuid-pattern* "") (define (uuid-regex-string) (if (zero? (string-length *uuid-pattern*)) (set! *uuid-pattern* (uuid-HEX-pattern-match-string))) *uuid-pattern*) ;; Read-only preferences and data (allow user-preference-read (preference-domain "kCFPreferencesAnyApplication" "com.apple.DownloadAssessment" "com.apple.WebFoundation" "com.apple.networkConnect")) (allow file-read* ;; Basic system paths (subpath "/Library/Frameworks") (subpath "/Library/Managed Preferences") (literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains") ;; System and user preferences (regex #"^/Library/Managed Preferences/[^/]+/com\.apple\.networkConnect\.plist$") ;; On-disk WebKit2 framework location, to account for debug installations ;; outside of /System/Library/Frameworks (subpath (param "WEBKIT2_FRAMEWORK_DIR"))) (allow system-fsctl (fsctl-command (_IO "h" 47))) (allow file-read-data (literal "/usr/local/lib/log") ; ) ;; Sandbox extensions (define (apply-read-and-issue-extension op path-filter) (op file-read* path-filter) (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read") path-filter))) (define (apply-write-and-issue-extension op path-filter) (op file-write* path-filter) (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read-write") path-filter))) (define (read-only-and-issue-extensions path-filter) (apply-read-and-issue-extension allow path-filter)) (define (read-write-and-issue-extensions path-filter) (apply-read-and-issue-extension allow path-filter) (apply-write-and-issue-extension allow path-filter)) (read-only-and-issue-extensions (extension "com.apple.app-sandbox.read")) (read-write-and-issue-extensions (extension "com.apple.app-sandbox.read-write")) (allow file-read* file-write* (subpath (param "DARWIN_USER_CACHE_DIR"))) (allow file-read* file-write* (subpath (param "DARWIN_USER_TEMP_DIR"))) ;; IOKit user clients (allow iokit-open (iokit-user-client-class "RootDomainUserClient")) ;; cookied. ;; FIXME: Update for . (allow ipc-posix-shm-read-data (ipc-posix-name "FNetwork.defaultStorageSession") (ipc-posix-name-regex #"\.PrivateBrowsing-") (ipc-posix-name-regex #"^WebKit Test-")) ;; Various services required by CFNetwork and other frameworks (allow mach-lookup (global-name "com.apple.FileCoordination") (global-name "com.apple.PowerManagement.control") (global-name "com.apple.SystemConfiguration.configd") #if __MAC_OS_X_VERSION_MIN_REQUIRED >= 101300 (global-name "com.apple.analyticsd") #endif (global-name "com.apple.cookied") (global-name "com.apple.cfnetwork.AuthBrokerAgent") (global-name "com.apple.cfnetwork.cfnetworkagent") (global-name "com.apple.lsd.mapdb") (global-name "com.apple.nesessionmanager.flow-divert-token") ) ;; Security framework (allow mach-lookup (global-name "com.apple.ctkd.token-client") (global-name "com.apple.securityd.xpc") (global-name "com.apple.CoreAuthentication.agent.libxpc") (global-name "com.apple.ocspd") (global-name "com.apple.SecurityServer")) ;; FIXME: This should be removed when is fixed. ;; Restrict AppSandboxed processes from creating /Library/Keychains, but allow access to the contents of /Library/Keychains: (allow file-read-data file-read-metadata file-write* (subpath "/Library/Keychains") (home-subpath "/Library/Keychains")) ;; Except deny access to new-style iOS Keychain folders which are UUIDs. (deny file-read* file-write* (regex (string-append "/Library/Keychains/" (uuid-regex-string) "(/|$)")) (home-regex (string-append "/Library/Keychains/" (uuid-regex-string) "(/|$)"))) (allow file-read* file-write* (subpath "/private/var/db/mds/system")) ;; FIXME: This should be removed when is fixed. (allow user-preference-read (preference-domain "com.apple.crypto" "com.apple.security" "com.apple.security.common" "com.apple.security.revocation")) (allow file-read* (subpath "/private/var/db/mds") (literal "/private/var/db/DetachedSignatures") ; The following are needed until the causes of are resolved. (literal "/Library/Preferences/com.apple.security.plist") (literal "/Library/Preferences/com.apple.security.common.plist") (literal "/Library/Preferences/com.apple.security.revocation.plist") (home-literal "/Library/Application Support/SyncServices/Local/ClientsWithChanges/com.apple.Keychain") (home-literal "/Library/Preferences/com.apple.security.plist") (home-literal "/Library/Preferences/com.apple.security.revocation.plist")) (allow ipc-posix-shm-read* ipc-posix-shm-write-data (ipc-posix-name "com.apple.AppleDatabaseChanged")) (system-network) (allow network-outbound ;; Local mDNSResponder for DNS, arbitrary outbound TCP (literal "/private/var/run/mDNSResponder") (remote tcp)) ;; FIXME should be removed when + related radar in Safari is fixed (allow mach-lookup (global-name "org.h5l.kcm") (global-name "com.apple.GSSCred") (global-name "com.apple.system.logger") (global-name "com.apple.system.notification_center")) (allow network-outbound (remote udp)) (allow user-preference-read (preference-domain "com.apple.GSS" "com.apple.Kerberos" "edu.mit.Kerberos")) (allow file-read* (literal "/private/etc/krb5.conf") (literal "/private/etc/services") (literal "/private/etc/host") (subpath "/Library/KerberosPlugins/GSSAPI") (subpath "/Library/KerberosPlugins/KerberosFrameworkPlugins")) (if (defined? 'vnode-type) (deny file-write-create (vnode-type SYMLINK))) ;; Reserve a namespace for additional protected extended attributes. (deny file-read-xattr file-write-xattr (xattr-regex #"^com\.apple\.security\.private\.")) (deny file-read* file-write* (with no-log) ;; FIXME: Should be removed after is fixed. (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2") (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-journal")) (macro (with-filter form) (let* ((ps (cdr form)) (extra-filter (car ps)) (rules (cdr ps))) `(letrec ((collect (lambda (l filters non-filters) (if (null? l) (list filters non-filters) (let* ((x (car l)) (rest (cdr l))) (if (sbpl-filter? x) (collect rest (cons x filters) non-filters) (collect rest filters (cons x non-filters))))))) (inject-filter (lambda args (let* ((collected (collect args '() '())) (filters (car collected)) (non-filters (cadr collected))) (if (null? filters) (cons ,extra-filter non-filters) (cons (require-all (apply require-any filters) ,extra-filter) non-filters))))) (orig-allow allow) (orig-deny deny) (wrapper (lambda (action) (lambda args (apply action (apply inject-filter args)))))) (set! allow (wrapper orig-allow)) (set! deny (wrapper orig-deny)) ,@rules (set! deny orig-deny) (set! allow orig-allow)))) ;; FIXME should be removed when is fixed. (allow network* (local udp) (remote udp) (local tcp) (remote tcp))