;;; Copyright (c) 2020 Apple Inc. All Rights reserved.
;;;
;;; WARNING: The sandbox rules in this file currently constitute
;;; Apple System Private Interface and are subject to change at any time and
;;; without notice.
;;;
(version 1)

(deny default)
;;(allow (with report) default)

(deny mach-priv-host-port)

(import "system.sb")
(system-graphics)

(import "com.apple.corefoundation.sb")
(corefoundation)

;;; Homedir-relative path filters
(define (home-subpath home-relative-subpath)
	(subpath (string-append (param "HOME") home-relative-subpath)))

(define (home-literal home-relative-literal)
	(literal (string-append (param "HOME") home-relative-literal)))

(allow process-info* (target self))

;; For resolving symlinks, realpath(3), and equivalents.
(allow file-read-metadata)

;; For validating the entitlements of clients.
(allow process-info-codesignature)

;; Your preference domain
(allow user-preference-read user-preference-write
	(preference-domain "com.apple.mcxprinting")
	(preference-domain "configd")
	(preference-domain "cupsfilter")
	(preference-domain "kCFPreferencesAnyApplication")
	(preference-domain "org.cups.PrintingPrefs")
	(preference-domain-prefix "com.apple.print")
	(preference-domain "com.apple.CoreGraphics")
	(preference-domain "com.apple.CoreServicesInternal")    ;; codesign_allocate
	(preference-domain "com.apple.LaunchServices")        ;; codesign_allocate
	(preference-domain "com.apple.HIToolbox")
)

;; Read/write access to a temporary directory.
(allow file-read* file-write*
	(home-subpath "/.cups")
	(home-subpath "/Library/Preferences")
	(literal "/Library/Preferences/.GlobalPreferences.plist")
	(subpath "/Library/Printers")
	(subpath "/private/etc/cups")
	(subpath "/private/tmp")	;; PMConvertFile.log
	(subpath "/private/var/folders")
	(subpath "/private/var/spool/cups")
	(subpath (param "DARWIN_CACHE_DIR"))
	(subpath (param "TMPDIR"))
    (mount-relative-regex "^/\\.TemporaryItems(/|$)") ;; NSData
)

;; Read/write cache access
(let ((cache-path-filter (home-subpath "/Library/Caches/com.apple.printtool")))
  (allow file-read* file-write* cache-path-filter)
  (allow file-issue-extension
	(require-all
	  (extension-class "com.apple.app-sandbox.read" "com.apple.app-sandbox.read-write")
	  cache-path-filter)))

(allow authorization-right-obtain
	(right-name "system.print.admin")
	(right-name "com.apple.ServiceManagement.daemons.modify")
)

;; Misc
(allow file-read*
	(home-literal "/.CFUserTextEncoding")
	(literal "/private/var/db/DetachedSignatures")
	(literal "/private/var/run/cupsd")
	(subpath "/Library/Frameworks")
	(subpath "/usr")
	(home-subpath "/Library/Input Methods")
	(home-subpath "/Library/Keyboard Layouts")
	(subpath "/Library/Input Methods")
	(subpath "/Library/Keyboard Layouts")
)

(allow mach-lookup
	(global-name "com.apple.colorsyncd")
	(global-name "com.apple.coreservices.launchservicesd")
	(global-name "com.apple.lsd.modifydb")
	(global-name "com.apple.printtool.agent")
	(global-name "com.apple.SystemConfiguration.configd")
	(global-name "com.apple.xpc.smd")
	(global-name "com.apple.CARenderServer")
	(global-name "com.apple.coreservices.appleevents")
	(global-name "com.apple.dock.fullscreen")
	(global-name "com.apple.dock.server")
	(global-name "com.apple.fonts")
	(global-name "com.apple.iconservices.store")
	(global-name "com.apple.iconservices")
	(global-name "com.apple.pasteboard.1")
	(global-name "com.apple.tccd.system")
	(global-name "com.apple.tccd")
	(global-name "com.apple.window_proxies")
	(global-name "com.apple.windowserver.active")
)

(allow user-preference-read (preference-domain "com.apple.HIToolbox"))

(allow iokit-open
    (iokit-user-client-class
        "IOSurfaceRootUserClient"
        "IGAccelDevice"
        "IGAccelSharedUserClient"
        "IGAccelCommandQueue"
    )
)

(system-network)
(allow network-outbound
	(literal "/private/var/run/cupsd")
)

(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))
(allow process-fork)
(allow file-read* process-exec*
	(literal "/usr/sbin/cupsfilter")
	(subpath "/System/Library/Printers/Libraries")
	(subpath "/usr/libexec/cups/filter")
)

(allow lsopen)
(allow distributed-notification-post)

(allow ipc-posix-shm-read*
       ipc-posix-shm-write-create
       ipc-posix-shm-write-data
    (ipc-posix-name "com.apple.AppleDatabaseChanged")
)

(allow file-issue-extension (extension-class "com.apple.app-sandbox.read"))

(allow system-audit)
(allow file-read* (literal "/Library/Preferences/com.apple.ViewBridge.plist"))