(version 1)
(deny default)
; (deny file-map-executable iokit-get-properties process-info* nvram*)
; (deny dynamic-code-generation)

(import "system.sb")
(import "com.apple.corefoundation.sb")
(import "bsd.sb")

(system-network)
(corefoundation)

;; Sandbox Extensions
(with-filter (extension "com.apple.app-sandbox.read")
    (allow file-read*))
(with-filter (extension "com.apple.app-sandbox.read-write")
    (allow file-read* file-write*))

(allow user-preference-read user-preference-write
       (preference-domain "com.apple.ContextStoreAgent")
       (preference-domain "com.apple.CoreDuet"))

(allow mach-lookup
    (global-name "com.apple.coreservices.launchservicesd")
    (global-name "com.apple.lsd.mapdb")
    (global-name "com.apple.iokit.powerdxpc")
    (global-name "com.apple.PowerManagement.control")
    (global-name "com.apple.coreduetd.context")
    (global-name "com.apple.ScreenTimeAgent")
    (global-name "com.apple.ScreenTimeAgent.private")
    (global-name "com.apple.mediaremoted.xpc")
    (global-name "com.apple.coremedia.routingcontext.xpc")
    (global-name "com.apple.server.bluetooth.general.xpc")
    (global-name "com.apple.biome.access.user")
    (global-name "com.apple.biome.access.system")
    (global-name "com.apple.biome.compute.source")
    (global-name "com.apple.biome.compute.source.user")
    (global-name "com.apple.biome.compute.publisher.service")
    (global-name "com.apple.biome.compute.publisher.service.user")
    (global-name "com.apple.private.corewifi.readonly-xpc"))
       
(allow file-read* file-write*
       (subpath (param "_USER_TEMP_DIR"))
       (subpath (string-append (param "_HOME") "/Library/Caches/ContextStoreAgent"))
       (literal (string-append (param "_HOME") "/Library/Preferences/ContextStoreAgent.plist"))
       (literal (string-append (param "_HOME") "/Library/Preferences/com.apple.CoreDuet.plist"))
       (subpath (string-append (param "_HOME") "/Library/Application Support/Knowledge"))
       (subpath (string-append (param "_HOME") "/Library/Application Support/com.apple.ContextStoreAgent")))

(allow file-read-metadata
    (subpath (string-append (param "_HOME") "/Library")))

(allow file-read-data
    (subpath "/System/Library/PrivateFrameworks/CoreDuetContext.framework/Resources/ContextStoreAgent")
    (literal "/Library/Preferences/.GlobalPreferences.plist")
    (literal (string-append (param "_HOME") "/Library/Preferences/.GlobalPreferences.plist"))
    (literal (string-append (param "_HOME") "/Library/Preferences/ContextStoreAgent.plist"))
    (literal (string-append (param "_HOME") "/Library/Preferences/com.apple.CoreDuet.plist"))
    (regex (string-append "^" (regex-quote (param "_HOME")) #"/Library/Preferences/ByHost/\.GlobalPreferences\.[^/]*\.plist$"))
    (regex (string-append "^" (regex-quote (param "_HOME")) #"/Library/Preferences/ByHost/ContextStoreAgent\.[^/]*\.plist$"))
    (regex (string-append "^" (regex-quote (param "_HOME")) #"/Library/Preferences/ByHost/com.apple.CoreDuet\.[^/]*\.plist$")))

(allow file-read-metadata
    (literal "/AppleInternal")
    (literal (param "_HOME")))

(allow file-read*
    (literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains")           ; for CrashReporter
    (literal "/System/Library/MessageTracer/SubmitDiagInfo.default.domains.searchtree"))    ; for MessageTracer

(allow file-read* (with report))  ; remove when resolved: <rdar://problem/63112119> adopt sandbox extension LS api

(when (param "EXEC_DIR")
    (allow file-read*
        (subpath (param "EXEC_DIR"))))