(version 1)
(deny default)

(import "system.sb")
(import "com.apple.corefoundation.sb")
(corefoundation)

(allow file-read-metadata)

(allow file-issue-extension
(subpath "/Library/Documentation/Help/MacHelp.help")
(regex #"/Library/Caches/com\.apple\.(appstore|iBooksX|iTunes|configurator\.ui)(/CommerceRequestCache/?)?")
(regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/com\.apple\.(appstore|iBooksX|iTunes|configurator\.ui)")
(regex #"/Library/Caches/storeassetd")
(regex #"[a-z0-9]+\.app(/|$)"))

(allow file-read*
(regex #"\.app(/|$)")
(regex #"/CommerceKit\.framework")
(literal "/private/etc/hosts")
(literal "/private/var/db/mds/system/mdsDirectory.db")
(literal "/private/var/db/mds/system/mdsObject.db")
(literal "/Library/Preferences/com.apple.AECT.plist")
(literal "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist")
(literal "/Library/Application Support/CrashReporter/SubmitDiagInfo.domains")
(literal "/Library/Preferences/com.apple.loginwindow.plist")
(literal "/private/var/db/PreviousSystemVersion.plist")
(literal "/Library/Preferences/com.apple.networkd.plist")
(subpath "/Applications")
(subpath "/Library/Documentation/Help/MacHelp.help")
(subpath "/Users/Shared")
(regex "/Library/Bundles/[^/]+.bundle")
(regex #"/Library/Preferences/com\.apple\.appstore\.plist$")
(regex #"/Library/Preferences/com.apple.LaunchServices.plist$")
(regex #"/Library/Preferences/(ByHost/)?\.GlobalPreferences\.plist$")
(regex #"/Library/Preferences/com.apple.security\.plist$")
(regex #"/\.CFUserTextEncoding$")
(regex "/private/var/db/mds/messages/([A-Za-z0-9]+/)?se_SecurityMessages"))

(allow file-read* file-write*
(literal "/Library/Caches/com.apple.DiagnosticReporting.Networks.plist")
(literal "/Library/Caches/com.apple.DiagnosticReporting.HasBeenAppleInternal")
(literal "/private/var/db/mds/system/mds.lock")
(subpath "/private/var/root/Library/Caches/com.apple.commerce")
(subpath "/private/var/tmp")
(subpath "/private/var/folders")
(subpath "/private/tmp")
(subpath "/Users/Shared/adi")
(subpath "/Users/Shared/SC Info")
(regex #"/Library/Caches/com\.apple\.commerce")
(regex #"/Library/Caches/com\.apple\.(appstore|iBooksX|iTunes|configurator\.ui)(/CommerceRequestCache/?)?")
(regex #"/Library/Caches/com\.apple\.WebKit2\.WebProcessService$")
(regex #"/Library/Cookies/com\.apple\.(appstore|iBooksX|ibooks|iTunes|configurator(\.ui)?)\.(binary)?cookies")
(regex #"/Library/Cookies/Cookies\.binarycookies")

(regex #"Library/Preferences/com\.apple\.security\.revocation\.plist")
(regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/com\.apple\.(appstore|iBooksX|iTunes|configurator\.ui)")
(regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/TemporaryItems(/|$)")
(regex #"^/private/var/folders/[^/]+/[^/]+/[A-Z]/mds(/|$)")
(regex #"/\.TemporaryItems(/|$)")
(regex #"/Library/Keychains/")
(regex #"^/etilqs_"))

(allow file-write-create
    (regex #"/Library/Cookies"))

(allow user-preference-read
    (preference-domain "kCFPreferencesAnyApplication"))

(allow user-preference*
    (preference-domain "com.apple.AppleMediaServices")
    (preference-domain "com.apple.AppleMediaServices.notbackedup")
    (preference-domain "com.apple.bookstoreagent")
    (preference-domain "com.apple.storeagent")
    (preference-domain "com.apple.iTunes")
    (preference-domain "com.apple.appstore")
    (preference-domain "com.apple.ibooks")
    (preference-domain "com.apple.commerce")
    (preference-domain "com.apple.commerce.configurator")
    (preference-domain "com.apple.appstore.commerce")
    (preference-domain "com.apple.iBooksX.commerce")
    (preference-domain "com.apple.configurator.ui.commerce"))

(allow ipc-posix-shm-read-data
(ipc-posix-name "/com.apple.AppSSO.version")
(ipc-posix-name "FNetwork.defaultStorageSession")
(ipc-posix-name-regex #"ls\.[a-f0-9\.]+")
(ipc-posix-name "apple.shm.notification_center")
(ipc-posix-name-regex #"^/tmp/com.apple.csseed.[0-9]+$"))

(allow ipc-posix-shm-read* ipc-posix-shm-write-data
(ipc-posix-name "com.apple.AppleDatabaseChanged"))

(allow mach-register (global-name "com.apple.commerce"))

(allow mach-lookup
(global-name "com.apple.corefollowup.agent")
(global-name "com.apple.apsd")
(global-name "com.apple.adid")
(global-name "com.apple.ak.anisette.xpc")
(global-name "com.apple.ak.auth.xpc")
(global-name "com.apple.fpsd")
(global-name "com.apple.askpermissiond")
(global-name "com.apple.AssetCacheLocatorService")
(global-name "com.apple.accountsd.accountmanager")
(global-name "com.apple.backupd.sandbox.xpc")
(global-name "com.apple.ctkd.token-client")
(global-name "com.apple.CoreAuthentication.agent.libxpc")
(global-name "com.apple.CoreAuthentication.agent")
(global-name "com.apple.securityd.xpc")
(global-name "com.apple.coreservices.launcherror-handler")
(global-name "com.apple.SystemConfiguration.configd")
(global-name "com.apple.SystemConfiguration.SCNetworkReachability")
(global-name "com.apple.networkd")
(global-name "com.apple.storehelper")
(global-name "com.apple.SecurityServer")
(global-name "com.apple.PowerManagement.control")
(global-name "com.apple.distributed_notifications@Uv3")
(global-name "com.apple.usernoted.client")
(global-name "com.apple.usernoted.daemon_client")
(global-name "com.apple.metadata.mds")
(global-name "com.apple.CoreServices.coreservicesd")
(global-name "com.apple.ls.boxd")
(global-name "com.apple.FileCoordination")
(global-name "com.apple.ocspd")
(global-name "com.apple.installd")
(global-name "com.apple.ProgressReporting")
(global-name "com.apple.windowserver.active")
(global-name "com.apple.lsd.mapdb")
(global-name "com.apple.coreservices.launchservicesd")
(global-name "com.apple.coreservices.appleevents")
(global-name "com.apple.cookied")
(global-name "com.apple.FontServer")
(global-name "com.apple.fonts")
(global-name "com.apple.FontObjectsServer")
(global-name "com.apple.DiskArbitration.diskarbitrationd")
(global-name "com.apple.cvmsServ")
(global-name "com.apple.logind")
(global-name "com.apple.coreservices.quarantine-resolver")
(global-name "com.apple.familycontrols")
(global-name "com.apple.pluginkit.pkd")
(global-name "com.apple.nsurlstorage-cache")
(global-name "com.apple.system.opendirectoryd.api")
(global-name "com.apple.CrashReporterSupportHelper")
(global-name "com.apple.cache_delete")
(global-name "com.apple.ManagedClient.agent")
(global-name "com.apple.cfnetwork.AuthBrokerAgent")
(global-name "com.apple.cfnetwork.cfnetworkagent")
(global-name "com.apple.AppSSO.service-xpc")
(global-name "com.apple.usymptomsd")
(global-name "com.apple.pasteboard.1")
(global-name "com.apple.xpc.amsaccountsd")
(global-name "com.apple.nesessionmanager.content-filter"))

(allow authorization-right-obtain
(right-name "system.install.app-store-software")
(right-name "system.install.apple-software")
(right-name "system.install.app-store-software.standard-user")
(right-name "system.install.apple-software.standard-user")
(right-name "system.install.apple-config-data")
(right-name "system.install.software")
(right-name "system.install.software.iap")
(right-name "system.install.software.mdm-provided"))

(allow iokit-open
(iokit-user-client-class "IOFramebufferSharedUserClient")
(iokit-user-client-class "RootDomainUserClient")
(iokit-user-client-class-regex #"AccelDevice$")
(iokit-user-client-class-regex #"SharedUserClient$")
(iokit-user-client-class-regex #"GLContext$"))

(allow network-outbound)
(system-network)
(allow system-socket)
(allow distributed-notification-post)
(allow appleevent-send)
(allow lsopen)