(version 1)

(deny default)
(deny file-map-executable process-info* nvram*)
(deny dynamic-code-generation)
(deny mach-priv-host-port)

(import "system.sb")
(import "com.apple.corefoundation.sb")
(corefoundation)

(define
	(home-regex home-relative-regex)
	(regex
		(string-append
			"^"
			(regex-quote
				(param "HOME"))
			home-relative-regex)))
(define
	(home-subpath home-relative-subpath)
	(subpath
		(string-append
			(param "HOME")
			home-relative-subpath)))
(define
	(home-prefix home-relative-prefix)
	(prefix
		(string-append
			(param "HOME")
			home-relative-prefix)))
(define
	(home-literal home-relative-literal)
	(literal
		(string-append
			(param "HOME")
			home-relative-literal)))

(allow process-info* (target self))

; For resolving symlinks, realpath(3), and equivalents
(allow file-read-metadata)

; For validating clients’ entitlements
(allow process-info-codesignature)

; Preference domains
(allow user-preference-read
	(preference-domain "com.apple.AppleMediaServices")
	(preference-domain "kCFPreferencesAnyApplication"))
(allow user-preference-read user-preference-write
	(preference-domain "com.apple.backgroundassets.managed")
	(preference-domain "com.apple.backgroundassets.managed.helper.service"))

; File access
(allow file-read*
	(literal "/Library/Preferences/com.apple.networkd.plist")
	(literal "/Library/Preferences/com.apple.networkextension.uuidcache.plist")
	(regex #"\.app(/|$)"))
(allow file-read* file-write*
	(subpath
		(param "TMPDIR"))
	(subpath
		(param "DARWIN_CACHE_DIR"))
	(extension "com.apple.sandbox.container")
	(home-subpath "/Library/com.apple.AppleMediaServices/")
	(home-subpath "/Library/Application Support/Managed Background Assets Helper Service/")
	(home-subpath "/Library/Caches/com.apple.AppleMediaServices/")
	(home-subpath "/Library/Caches/com.apple.backgroundassets.managed.helper.service/")
	(home-subpath "/Library/HTTPStorages/com.apple.backgroundassets.managed.helper.service/")
	(home-subpath "/tmp/com.apple.backgroundassets.managed.helper.service/"))
(let
	((cache-path-filter
		(home-subpath "/Library/Caches/com.apple.backgroundassets.managed.helper.service")))
	(allow file-read* file-write* cache-path-filter)
	(allow file-issue-extension
		(require-all
			(extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write")
			cache-path-filter)))

(allow file-write-unlink
	(home-regex #"/Library/Containers/[^/]+/Data/tmp/"))

; Mach lookups
(allow mach-lookup
	(global-name "com.apple.AppSSO.service-xpc")
	(global-name "com.apple.appstoreagent.xpc")
	(global-name "com.apple.cfnetwork.AuthBrokerAgent")
	(global-name "com.apple.cfnetwork.cfnetworkagent")
	(global-name "com.apple.containermanagerd")
	(global-name "com.apple.coreservices.quarantine-resolver")
	(global-name "com.apple.lsd.mapdb")
	(global-name "com.apple.lsd.modifydb")
	(global-name "com.apple.spaceattributiond")
	(global-name "com.apple.usymptomsd")
	(global-name "com.apple.xpc.amsaccountsd"))

; Issuing read-only sandbox extensions
(with-filter (extension "com.apple.sandbox.container")
	(allow file-issue-extension
		(extension-class "com.apple.app-sandbox.read")))

; Networking
(allow network-outbound)