| ; Copyright (C) 2010-2021 Apple Inc. All rights reserved. |
| ; |
| ; Redistribution and use in source and binary forms, with or without |
| ; modification, are permitted provided that the following conditions |
| ; are met: |
| ; 1. Redistributions of source code must retain the above copyright |
| ; notice, this list of conditions and the following disclaimer. |
| ; 2. Redistributions in binary form must reproduce the above copyright |
| ; notice, this list of conditions and the following disclaimer in the |
| ; documentation and/or other materials provided with the distribution. |
| ; |
| ; THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' |
| ; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, |
| ; THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
| ; PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS |
| ; BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
| ; CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF |
| ; SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS |
| ; INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN |
| ; CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
| ; ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF |
| ; THE POSSIBILITY OF SUCH DAMAGE. |
| |
| (version 1) |
| (deny default (with partial-symbolication)) |
| (deny nvram*) |
| (deny system-privilege) |
| (allow system-audit file-read-metadata) |
| |
| ;; Silence spurious logging due to rdar://20117923 and rdar://72366475 |
| (deny system-privilege (privilege-id PRIV_GLOBAL_PROC_INFO) (with no-report)) |
| |
| ;;; |
| ;;; The following rules were originally contained in 'common.sb'. We are duplicating them here so we can |
| ;;; remove unneeded sandbox extensions. |
| ;;; |
| |
| (import "util.sb") |
| |
| (define-once (allow-read-and-issue-generic-extensions . filters) |
| (allow file-read* (with telemetry) |
| (apply require-any filters)) |
| (allow file-issue-extension |
| (require-all |
| (extension-class "com.apple.app-sandbox.read") |
| (apply require-any filters)))) |
| |
| (define-once (allow-read-write-and-issue-generic-extensions . filters) |
| (allow file-read* file-write* (with telemetry) |
| (apply require-any filters)) |
| (allow file-read-metadata |
| (apply require-any filters)) |
| (allow file-issue-extension |
| (require-all |
| (extension-class "com.apple.app-sandbox.read-write" "com.apple.app-sandbox.read") |
| (apply require-any filters)))) |
| |
| (define-once (managed-configuration-read-public) |
| (allow file-read* (with telemetry) |
| (well-known-system-group-container-subpath "/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") |
| (front-user-home-subpath "/Library/ConfigurationProfiles/PublicInfo") |
| (front-user-home-subpath "/Library/UserConfigurationProfiles/PublicInfo"))) |
| |
| (define-once (managed-configuration-read . files) |
| (if (null? files) |
| (allow file-read* (with telemetry) |
| (well-known-system-group-container-subpath "/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") |
| (front-user-home-subpath "/Library/ConfigurationProfiles") |
| (front-user-home-subpath "/Library/UserConfigurationProfiles")) |
| (for-each |
| (lambda (file) |
| (allow file-read* (with telemetry) |
| (well-known-system-group-container-literal |
| (string-append "/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/" file)) |
| (front-user-home-literal |
| (string-append "/Library/ConfigurationProfiles/" file) |
| (string-append "/Library/UserConfigurationProfiles/" file)))) |
| files))) |
| |
| (define-once (allow-preferences-common) |
| (allow file-read-metadata |
| (home-literal "") |
| (home-literal "/Library/Preferences"))) |
| |
| (define-once (mobile-preferences-read . domains) |
| (allow-preferences-common) |
| (for-each (lambda (domain) |
| (begin |
| (allow user-preference-read (with telemetry) (preference-domain domain)) |
| (allow file-read* |
| (home-literal (string-append "/Library/Preferences/" domain ".plist"))))) |
| domains)) |
| |
| (define-once (framebuffer-access) |
| (allow iokit-open (with telemetry) |
| (iokit-user-client-class "IOMobileFramebufferUserClient") |
| (when (defined? 'iokit-external-method) |
| (apply-message-filter |
| (deny (with telemetry) |
| iokit-async-external-method |
| iokit-external-trap) |
| (allow |
| iokit-external-method) |
| ) |
| ) |
| ) |
| (mobile-preferences-read "com.apple.iokit.IOMobileGraphicsFamily")) |
| |
| (define-once (asset-access . options) |
| (let ((asset-access-filter |
| (require-all |
| (require-any |
| (home-subpath "/Library/Assets") |
| (subpath "/private/var/MobileAsset")) |
| (extension "com.apple.assets.read")))) |
| ;; <rdar://problem/10710883> |
| ;; <rdar://problem/11569106> |
| (allow file-read* (with telemetry) asset-access-filter) |
| (if (memq 'with-media-playback options) |
| (play-media asset-access-filter)) |
| (mobile-preferences-read "com.apple.MobileAsset"))) |
| |
| (define-once (play-audio) |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.audio.AURemoteIOServer"))) |
| |
| (define-once (play-media . filters) |
| (if (not (null? filters)) |
| ;; <rdar://problem/9875794> |
| (allow file-issue-extension |
| (require-all |
| (apply require-any filters) |
| (extension-class "com.apple.mediaserverd.read")))) |
| ;; CoreMedia framework. |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.coremedia.admin") |
| (global-name "com.apple.coremedia.asset.xpc") |
| (global-name "com.apple.coremedia.assetimagegenerator.xpc") |
| (global-name "com.apple.coremedia.audiodeviceclock.xpc") ; Needed for CMTimeBase |
| (global-name "com.apple.coremedia.audioprocessingtap.xpc") |
| (global-name "com.apple.coremedia.capturesession") ; Actually for video capture |
| (global-name "com.apple.coremedia.capturesource") ; Also for video capture (<rdar://problem/15794291>). |
| (global-name "com.apple.coremedia.cpe.xpc") ; Needed for HDR playback. |
| (global-name "com.apple.coremedia.customurlloader.xpc") ; Needed for custom media loading |
| (global-name "com.apple.coremedia.formatreader.xpc") |
| (global-name "com.apple.coremedia.player.xpc") |
| (global-name "com.apple.coremedia.remaker") |
| (global-name "com.apple.coremedia.remotequeue") |
| (global-name "com.apple.coremedia.routediscoverer.xpc") |
| (global-name "com.apple.coremedia.routingcontext.xpc") |
| (global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc") |
| (global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc") |
| (global-name "com.apple.coremedia.sandboxserver.xpc") |
| (global-name "com.apple.coremedia.systemcontroller.xpc") |
| (global-name "com.apple.coremedia.visualcontext.xpc") |
| (global-name "com.apple.coremedia.volumecontroller.xpc")) |
| |
| (allow mach-lookup (with report) (with telemetry) |
| (global-name "com.apple.coremedia.cpeprotector.xpc") |
| (global-name "com.apple.coremedia.endpoint.xpc") |
| (global-name "com.apple.coremedia.figcontentkeysession.xpc") |
| (global-name "com.apple.coremedia.figcpecryptor") |
| (global-name "com.apple.coremedia.routingsessionmanager.xpc") |
| (global-name "com.apple.coremedia.sts")) |
| |
| (mobile-preferences-read |
| "com.apple.avfoundation" |
| "com.apple.coreaudio" |
| "com.apple.coremedia" |
| "com.apple.corevideo" |
| "com.apple.itunesstored" ; Needed by MediaPlayer framework |
| "com.apple.mobileipod" ; Ditto |
| "com.apple.audio.virtualaudio" ; <rdar://problem/57170333> |
| ) |
| |
| ;; AVF needs to see these network preferences: |
| (allow file-read* (with telemetry) |
| (literal "/private/var/preferences/com.apple.networkd.plist")) |
| |
| ;; Required by the MediaPlayer framework. |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.audio.AudioSession")) |
| |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.airplay.apsynccontroller.xpc")) |
| |
| ;; Allow mediaserverd to issue file extensions for the purposes of reading media |
| (allow file-issue-extension (require-all |
| (extension "com.apple.app-sandbox.read") |
| (extension-class "com.apple.mediaserverd.read"))) |
| ) |
| |
| (define-once (media-remote) |
| (mobile-preferences-read |
| "com.apple.mediaremote" |
| "com.apple.mobileipod") |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.mediaremoted.xpc")) |
| ) |
| |
| (define-once (media-capture-support) |
| ;; Media capture, microphone access |
| (with-filter (extension "com.apple.webkit.microphone") |
| (allow device-microphone)) |
| |
| ;; Media capture, camera access |
| (with-filter (extension "com.apple.webkit.camera") |
| (allow user-preference-read |
| (preference-domain "com.apple.coremedia")) |
| (allow file-read* (with telemetry) (subpath "/Library/CoreMediaIO/Plug-Ins/DAL")) |
| (allow mach-lookup (with telemetry) (extension "com.apple.app-sandbox.mach")) |
| (allow device-camera)) |
| |
| ;; Support incoming video connections |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.coremedia.compressionsession") |
| (global-name "com.apple.coremedia.decompressionsession") |
| (global-name "com.apple.coremedia.videoqueue")) |
| ) |
| |
| (define-once (accessibility-support) |
| (allow mach-register (with telemetry) |
| (local-name "com.apple.iphone.axserver")) |
| (mobile-preferences-read "com.apple.Accessibility") |
| |
| ;; <rdar://problem/10809394> |
| (deny file-write-create |
| (home-prefix "/Library/Preferences/com.apple.Accessibility.plist") |
| (with no-report)) |
| ) |
| |
| (define-once (media-accessibility-support) |
| ;; <rdar://problem/12801477> |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.accessibility.mediaaccessibilityd")) |
| |
| ;; <rdar://problem/12250145> |
| (mobile-preferences-read "com.apple.mediaaccessibility") |
| (mobile-preferences-read "com.apple.mediaaccessibility.public") |
| ) |
| |
| (define-once (url-translation) |
| ;; For translating http:// & https:// URLs referencing itms:// URLs. |
| ;; <rdar://problem/11587338> |
| (allow file-read* (with telemetry) |
| (home-literal "/Library/Caches/com.apple.itunesstored/url-resolution.plist"))) |
| |
| ;;; |
| ;;; Declare that the application uses the OpenGL, Metal, and CoreML hardware & frameworks. |
| ;;; |
| (define-once (opengl) |
| ;; Items not seen in testing |
| (deny iokit-open (with telemetry) |
| (iokit-connection "IOGPU") |
| (iokit-user-client-class |
| "AGXCommandQueue" |
| "AGXDevice" |
| "AGXSharedUserClient" |
| "IOAccelContext" |
| "IOAccelDevice" |
| "IOAccelSharedUserClient" |
| "IOAccelSubmitter2" |
| "IOAccelContext2" |
| "IOAccelDevice2" |
| "IOAccelSharedUserClient2")) |
| |
| (allow iokit-open (with telemetry) |
| (iokit-connection "IOGPU") |
| (iokit-user-client-class |
| "AGXDeviceUserClient")) |
| |
| (allow iokit-get-properties |
| (iokit-property "IOGLBundleName") |
| (iokit-property "IOGLESBundleName") |
| (iokit-property "IOGLESDefaultUseMetal") |
| (iokit-property "IOGLESMetalBundleName") |
| (iokit-property "MetalPluginClassName") |
| (iokit-property "MetalPluginName") |
| ) |
| |
| (allow sysctl-read (with telemetry) |
| (sysctl-name #"kern.bootsessionuuid")) |
| |
| (allow mach-lookup (with telemetry) |
| ;; <rdar://problem/47268166> |
| (xpc-service-name "com.apple.MTLCompilerService")) |
| |
| (mobile-preferences-read |
| "com.apple.Metal" ;; <rdar://problem/25535471> |
| "com.apple.opengl" ;; <rdar://problem/23321675> |
| ) |
| ) |
| |
| (define-once (internal-debugging-support) |
| (allow file-read* file-map-executable |
| (subpath "/Developer")) |
| |
| (allow ipc-posix-shm |
| (ipc-posix-name-prefix "stack-logs") |
| (ipc-posix-name-prefix "OA-") |
| (ipc-posix-name-prefix "/FSM-")) |
| |
| (allow ipc-posix-shm-read* ipc-posix-shm-write-data ipc-posix-shm-write-unlink |
| (ipc-posix-name-regex #"^gdt-[A-Za-z0-9]+-(c|s)$")) |
| |
| (with-filter (system-attribute apple-internal) |
| ;; <rdar://problem/8565035> |
| ;; <rdar://problem/23857452> |
| ;; <rdar://problem/72317112> |
| (allow file-read* file-map-executable |
| (subpath "/AppleInternal") |
| (subpath "/usr/local/lib") |
| (subpath "/usr/appleinternal/lib"))) |
| (with-elevated-precedence |
| (allow file-read* file-map-executable file-issue-extension |
| (front-user-home-subpath "/XcodeBuiltProducts"))) |
| |
| ;; <rdar://problem/8107758> |
| (allow file-read* file-map-executable |
| (subpath "/System/Library/Frameworks") |
| (subpath "/System/Library/PrivateFrameworks")) |
| |
| ;; <rdar://problem/32544921> |
| (mobile-preferences-read "com.apple.hangtracer")) |
| |
| (define-once (device-access) |
| (deny file-read* file-write* |
| (vnode-type BLOCK-DEVICE CHARACTER-DEVICE)) |
| |
| (allow file-read* file-write-data (with telemetry) |
| (literal "/dev/null") |
| (literal "/dev/zero")) |
| |
| (allow file-read* file-write-data file-ioctl (with telemetry) |
| (literal "/dev/dtracehelper")) |
| |
| (allow file-read* (with telemetry) |
| (literal "/dev/random") |
| (literal "/dev/urandom")) |
| ;; <rdar://problem/14215718> |
| (deny file-write-data (with no-report) |
| (literal "/dev/random") |
| (literal "/dev/urandom")) |
| |
| (allow file-read* file-write-data file-ioctl (with telemetry) |
| (literal "/dev/aes_0"))) |
| |
| (define required-etc-files |
| (literal "/private/etc/fstab" |
| "/private/etc/hosts" |
| "/private/etc/group" |
| "/private/etc/passwd" |
| "/private/etc/protocols" |
| "/private/etc/services")) |
| |
| (define-once (speech-synthesis-and-voiceover) |
| ;; Speak Selection & VoiceOver |
| ;; <rdar://problem/12030530> AX: Sandbox violation with changing Language while VO is on |
| ;; and <rdar://problem/13071747> |
| (mobile-preferences-read |
| "com.apple.SpeakSelection" ; Needed for WebSpeech |
| "com.apple.VoiceOverTouch" ; Needed for non-US english language synthesis |
| "com.apple.voiceservices") ; Ditto |
| |
| ;; <rdar://problem/14555119> Access to high quality speech voices |
| ;; Needed for WebSpeech |
| (allow file-read* (with telemetry) |
| (home-subpath "/Library/VoiceServices/Assets") |
| (home-subpath "/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) |
| ) |
| |
| ;; Things required by UIKit |
| (define-once (uikit-requirements) |
| (mobile-preferences-read |
| "com.apple.UIKit" |
| "com.apple.WebUI" |
| "com.apple.airplay" |
| "com.apple.avkit" |
| "com.apple.coreanimation" |
| "com.apple.mt" |
| "com.apple.preferences.sounds") |
| |
| (allow mach-lookup |
| (global-name "com.apple.CARenderServer")) |
| |
| ; UIKit-required IOKit nodes. |
| (allow iokit-open (with telemetry) |
| (iokit-user-client-class "IOSurfaceAcceleratorClient") |
| (iokit-user-client-class "IOSurfaceSendRight") |
| ;; Requires by UIView -> UITextMagnifierRenderer -> UIWindow |
| (iokit-user-client-class "IOSurfaceRootUserClient")) |
| |
| ;; Silence sandbox violations from apps trying to create the empty plist if it doesn't exist. |
| ;; <rdar://problem/13796537> |
| (deny file-write-create |
| (home-prefix "/Library/Preferences/com.apple.UIKit.plist") |
| (with no-report)) |
| ) |
| |
| (define-once (dictionary-support) |
| ; <rdar://problem/8548856> Sub-TLF: Sandbox change for apps for read-only access to the dictionary directory/data |
| (allow file-read* (with telemetry) |
| ; XXX - /Library ought to be allowed in all UI profiles but isn't (CF, MobileSafari) |
| (subpath "/Library/Dictionaries") |
| (home-subpath "/Library/Dictionaries")) |
| ) |
| |
| (deny file-map-executable) |
| |
| (deny file-write-mount file-write-unmount) |
| |
| (allow file-read-metadata (with telemetry) |
| (vnode-type DIRECTORY)) |
| |
| (mobile-preferences-read "com.apple.security") |
| |
| (with-filter (system-attribute apple-internal) |
| (mobile-preferences-read "com.apple.PrototypeTools")) |
| |
| (with-elevated-precedence |
| (allow file-read* (with telemetry) |
| (subpath "/usr/lib" |
| "/usr/share" |
| "/private/var/db/timezone")) |
| (allow-read-and-issue-generic-extensions |
| (subpath "/Library/RegionFeatures" |
| "/System/Library")) |
| (allow file-issue-extension (with telemetry) |
| (require-all |
| (extension-class "com.apple.mediaserverd.read") |
| (subpath "/System/Library"))) |
| (let ((hw-identifying-paths |
| (require-any |
| (literal "/System/Library/Caches/apticket.der") |
| (subpath "/System/Library/Caches/com.apple.kernelcaches") |
| (subpath "/System/Library/Caches/com.apple.factorydata")))) |
| (deny file-issue-extension file-read* hw-identifying-paths)) |
| |
| (allow file-map-executable (with telemetry) |
| (subpath "/System/Library") |
| (subpath "/usr/lib")) |
| (allow file-read-metadata (with telemetry) |
| (vnode-type SYMLINK)) |
| |
| ;;; <rdar://problem/24144418> |
| (allow file-read* (with telemetry) |
| (subpath "/private/var/preferences/Logging")) |
| |
| (allow user-preference-read (preference-domain "kCFPreferencesAnyApplication")) |
| (allow file-read* |
| (front-user-home-literal "/Library/Preferences/.GlobalPreferences.plist") |
| (front-user-home-literal "/Library/Preferences/.GlobalPreferences_m.plist")) |
| |
| (allow file-read* |
| (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist")) |
| (allow managed-preference-read (preference-domain "kCFPreferencesAnyApplication")) |
| |
| (allow file-read-metadata (with telemetry) |
| (home-literal "/Library/Caches/powerlog.launchd")) |
| |
| (allow-read-and-issue-generic-extensions (executable-bundle)) |
| (allow file-map-executable (with telemetry) (executable-bundle)) |
| |
| ;; <rdar://problem/13963294> |
| (deny file-read-data file-issue-extension file-map-executable |
| (require-all |
| (executable-bundle) |
| (regex #"/[^/]+/SC_Info/"))) |
| |
| (unless (defined? 'restrictive-extension) |
| (with-filter |
| (extension |
| "com.apple.app-sandbox.read" |
| "com.apple.app-sandbox.read-write" |
| "com.apple.sharing.airdrop.readonly") |
| (allow file-read* file-read-metadata (with telemetry)) |
| (allow file-issue-extension |
| (extension-class "com.apple.app-sandbox.read" |
| "com.apple.mediaserverd.read" |
| "com.apple.sharing.airdrop.readonly"))) |
| (with-filter |
| (extension |
| "com.apple.app-sandbox.read-write") |
| (allow file-write* (with telemetry)) |
| (allow file-issue-extension (with telemetry) |
| (extension-class "com.apple.app-sandbox.read-write" |
| "com.apple.mediaserverd.read-write")))) |
| |
| ;; <rdar://problem/16079361> |
| (allow managed-preference-read |
| (extension "com.apple.security.exception.managed-preference.read-only")) |
| (allow user-preference-read |
| (extension "com.apple.security.exception.shared-preference.read-only")) |
| |
| (allow file-issue-extension (with telemetry) |
| (require-all |
| (extension-class "com.apple.nsurlstorage.extension-cache") |
| (extension "com.apple.security.exception.files.home-relative-path.read-write") |
| (require-any |
| (prefix "/private/var/root/Library/Caches/") |
| (front-user-home-prefix "/Library/Caches/")))) |
| ) |
| |
| (with-filter (system-attribute apple-internal) |
| (internal-debugging-support) |
| ) |
| |
| (allow file-read* (with telemetry) |
| required-etc-files |
| (literal "/")) |
| |
| (allow file-read* (with telemetry) |
| (subpath "/private/var/MobileAsset/PreinstalledAssetsV2/InstallWithOs")) |
| |
| (device-access) |
| |
| (allow file-issue-extension (with telemetry) |
| (require-all |
| (extension-class "com.apple.app-sandbox.read-write" "com.apple.app-sandbox.read") |
| (extension "com.apple.fileprovider.read-write"))) |
| |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.logd") |
| (global-name "com.apple.logd.events") |
| (global-name "com.apple.distributed_notifications@1v3") |
| (global-name "com.apple.aggregated") |
| ) |
| |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.tccd")) |
| |
| (allow ipc-posix-shm-read* (with telemetry) |
| (ipc-posix-name-prefix "apple.cfprefs.")) |
| |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.lsd.mapdb")) |
| |
| ;; <rdar://problem/12413942> |
| (allow file-read* (with telemetry) |
| (well-known-system-group-container-literal "/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist")) |
| (allow iokit-get-properties |
| (iokit-property "IORegistryEntryPropertyKeys")) |
| |
| (allow ipc-posix-sem-open (with telemetry) |
| (ipc-posix-name "containermanagerd.fb_check")) |
| |
| (with-filter (ipc-posix-name "purplebuddy.sentinel") |
| (deny ipc-posix-sem-create ipc-posix-sem-post ipc-posix-sem-unlink ipc-posix-sem-wait) |
| (allow ipc-posix-sem-open (with telemetry))) |
| |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.runningboard")) ;; Needed by process assertion code (ProcessTaskStateObserver). |
| |
| (allow system-sched (with telemetry) |
| (require-entitlement "com.apple.private.kernel.override-cpumon")) |
| |
| (deny sysctl-read (with no-report) |
| (sysctl-name |
| "hw.tbfrequency_compat" ;; <rdar://71740719> |
| "sysctl.proc_native")) |
| |
| (with-filter (system-attribute apple-internal) |
| (allow sysctl-read sysctl-write (with telemetry) |
| (sysctl-name "vm.footprint_suspend")) |
| (allow nvram-get (with telemetry) (nvram-variable "emu")) ;; <rdar://problem/78363040> |
| ) |
| |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.system.logger")) |
| |
| (allow file-read-metadata (with telemetry) |
| (literal "/private/var/run/syslog")) |
| |
| ;; ObjC map_images needs to send logging data to syslog. <rdar://problem/39778918> |
| (with-filter (system-attribute apple-internal) |
| (allow network-outbound (with telemetry) |
| (literal "/private/var/run/syslog") |
| ) |
| ) |
| |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.system.notification_center")) |
| (allow ipc-posix-shm-read* (with telemetry) |
| (ipc-posix-name "apple.shm.notification_center")) |
| |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.diagnosticd")) |
| |
| (managed-configuration-read-public) |
| |
| (deny system-info (with no-report) |
| (info-type "net.link.addr")) |
| |
| (allow file-read* (with telemetry) |
| (subpath "/private/var/db/datadetectors/sys")) |
| |
| (allow-well-known-system-group-container-subpath-read |
| "/systemgroup.com.apple.icloud.findmydevice.managed/Library") |
| |
| (allow mach-task-name (with telemetry) (target self)) |
| |
| (allow process-info* (with telemetry)) |
| (allow process-info-pidinfo (target self)) |
| (allow process-info-pidfdinfo (target self)) |
| (allow process-info-pidfileportinfo (target self)) |
| (allow process-info-setcontrol (target self)) |
| (allow process-info-dirtycontrol (target self)) |
| (allow process-info-rusage (target self)) |
| (allow process-info-codesignature (target self)) |
| |
| ;;; |
| ;;; End common.sb content |
| ;;; |
| |
| (deny mach-lookup (xpc-service-name-prefix "")) |
| (deny iokit-get-properties (with partial-symbolication)) |
| (deny lsopen) |
| |
| ;;; |
| ;;; The following rules were originally contained in 'UIKit-apps.sb'. We are duplicating them here so we can |
| ;;; remove unneeded sandbox extensions. |
| ;;; |
| |
| ;; Any app can play audio & movies. |
| (play-audio) |
| (play-media) |
| |
| ;; Access to media controls |
| (media-remote) |
| |
| (url-translation) |
| |
| ;; TextInput framework |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.TextInput")) |
| |
| (mobile-preferences-read "com.apple.da") |
| |
| (speech-synthesis-and-voiceover) |
| |
| ;; Permit reading assets via MobileAsset framework. |
| (asset-access 'with-media-playback) |
| |
| ;; allow 3rd party applications to access nsurlstoraged's top level domain data cache |
| (allow-well-known-system-group-container-literal-read |
| "/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") |
| |
| ;; Access the keyboards |
| (allow file-read* (with telemetry) |
| (home-subpath "/Library/Caches/com.apple.keyboards")) |
| |
| (mobile-preferences-read |
| "com.apple.EmojiPreferences" |
| ; <rdar://problem/8477596> com.apple.InputModePreferences |
| "com.apple.InputModePreferences" |
| ; <rdar://problem/8206632> Weather(1038) deny file-read-data ~/Library/Preferences/com.apple.keyboard.plist |
| "com.apple.keyboard" |
| ; <rdar://problem/9384085> |
| "com.apple.Preferences" |
| "com.apple.lookup.shared" ; Needed for DataDetector (Spotlight) support |
| ) |
| |
| ;; Silently deny unnecessary accesses caused by MessageUI framework. |
| ;; This can be removed once <rdar://problem/47038102> is resolved. |
| (deny file-read* |
| (home-literal "/Library/Preferences/com.apple.mobilemail.plist") |
| (with no-log)) |
| |
| ;; <rdar://problem/12985925> Need read access to /var/mobile/Library/Fonts to all apps |
| (allow file-read* (with telemetry) |
| (home-subpath "/Library/Fonts")) |
| |
| ;; <rdar://problem/7344719&26323449> LaunchServices app icons |
| (allow file-read* (with telemetry) |
| (well-known-system-group-container-subpath "/systemgroup.com.apple.lsd.iconscache")) |
| |
| (allow-preferences-common) |
| |
| ;; Home Button |
| (with-filter (iokit-registry-entry-class "IOPlatformDevice") |
| (allow iokit-get-properties |
| (iokit-property "home-button-type"))) |
| |
| (uikit-requirements) |
| |
| (dictionary-support) |
| |
| ; <rdar://problem/8440231> |
| (allow file-read* (with telemetry) |
| (home-literal "/Library/Caches/DateFormats.plist")) |
| ; Silently deny writes when CFData attempts to write to the cache directory. |
| (deny file-write* |
| (home-literal "/Library/Caches/DateFormats.plist") |
| (with no-log)) |
| |
| (framebuffer-access) |
| |
| ; <rdar://problem/7595408> , <rdar://problem/7643881> |
| (opengl) |
| |
| ; CRCopyRestrictionsDictionary periodically tries to CFPreferencesAppSynchronize com.apple.springboard.plist |
| ; which will attempt to create the plist if it doesn't exist -- from any application. Only SpringBoard is |
| ; allowed to write its plist; ignore all others, they don't know what they are doing. |
| ; See <rdar://problem/9375027> for sample backtraces. |
| (deny file-write* |
| (home-prefix "/Library/Preferences/com.apple.springboard.plist") |
| (with no-log)) |
| |
| ;; <rdar://problem/34986314> |
| (mobile-preferences-read "com.apple.indigo") |
| |
| ;;; |
| ;;; End UIKit-apps.sb content |
| ;;; |
| |
| (mobile-preferences-read "com.apple.AdLib.plist") |
| |
| (deny sysctl*) |
| (allow sysctl-read (with telemetry) |
| (sysctl-name |
| "hw.activecpu" |
| "hw.availcpu" |
| "hw.cacheconfig" ;; <rdar://problem/78213563> |
| "hw.cachelinesize" |
| "hw.cachesize" ;; <rdar://problem/78213563> |
| "hw.cpufamily" ;; <rdar://problem/15721872> |
| "hw.cpusubfamily" |
| "hw.cputhreadtype" |
| "hw.cputype" |
| "hw.l1dcachesize" ;; <rdar://problem/15721872> |
| "hw.l1icachesize" ;; <rdar://problem/15721872> |
| "hw.l2cachesize" |
| "hw.l3cachesize" ;; <rdar://problem/15721872> |
| "hw.logicalcpu" |
| "hw.logicalcpu_max" |
| "hw.ncpu" |
| "hw.nperflevels" ;; <rdar://problem/76782530> |
| "hw.pagesize" ;; <rdar://problem/76782530> |
| "hw.machine" |
| "hw.memsize" |
| "hw.model" |
| "hw.ncpu" |
| "hw.nperflevels" |
| "hw.pagesize" ;; <rdar://problem/76782530> |
| "hw.pagesize_compat" |
| "hw.physicalcpu" |
| "hw.physicalcpu_max" |
| "hw.physmem" ;; <rdar://problem/76782530> |
| "hw.product" ;; <rdar://problem/81334849> |
| "hw.vectorunit" ;; <rdar://problem/76782530> |
| "kern.bootargs" |
| "kern.hostname" |
| "kern.hv_vmm_present" |
| "kern.memorystatus_level" |
| "kern.osproductversion" |
| "kern.osrelease" |
| "kern.osvariant_status" |
| "kern.osversion" |
| "kern.secure_kernel" |
| "kern.version" |
| "sysctl.name2oid" |
| "vm.footprint_suspend") |
| (sysctl-name-prefix "hw.optional.") ;; <rdar://problem/70973527> |
| (sysctl-name-prefix "hw.perflevel") ;; <rdar://problem/76782530> |
| ) |
| |
| (allow iokit-get-properties |
| (iokit-property "AAPL,DisplayPipe") |
| (iokit-property "AAPL,OpenCLdisabled") |
| (iokit-property "AAPL,IOGraphics_LER") |
| (iokit-property "AAPL,IOGraphics_LER_RegTag_0") |
| (iokit-property "AAPL,IOGraphics_LER_RegTag_1") |
| (iokit-property "AAPL,IOGraphics_LER_Busy_2") |
| (iokit-property "AAPL,alias-policy") |
| (iokit-property "AAPL,boot-display") |
| (iokit-property "AAPL,display-alias") |
| (iokit-property "AAPL,mux-switch-state") |
| (iokit-property "AAPL,ndrv-dev") |
| (iokit-property "AAPL,primary-display") |
| (iokit-property "AAPL,slot-name") |
| (iokit-property "APTDevice") |
| (iokit-property "AVCSupported") |
| (iokit-property "AppleJPEGNumCores") |
| (iokit-property "AppleJPEGSupportsAppleInterchangeFormats") |
| (iokit-property "AppleJPEGSupportsMissingEOI") |
| (iokit-property "AppleJPEGSupportsRSTLogging") |
| (iokit-property "BaseAddressAlignmentRequirement") |
| (iokit-property "DisplayPipePlaneBaseAlignment") |
| (iokit-property "DisplayPipeStrideRequirements") |
| (iokit-property "HEVCSupported") |
| (iokit-property "IOGVABGRAEnc") |
| (iokit-property "IOGVACodec") |
| (iokit-property "IOGVAEncoderRestricted") |
| (iokit-property "IOGVAScaler") |
| (iokit-property "IOClassNameOverride") |
| (iokit-property "IOPlatformUUID") |
| (iokit-property "IOSurfaceAcceleratorCapabilitiesDict") |
| (iokit-property "Protocol Characteristics") |
| (iokit-property "als-colorCfg") ;; <rdar://problem/52903475> |
| (iokit-property "artwork-device-idiom") ;; <rdar://problem/49497720> |
| (iokit-property "artwork-device-subtype") |
| (iokit-property "artwork-display-gamut") ;; <rdar://problem/49497788> |
| (iokit-property "artwork-dynamic-displaymode") ;; <rdar://problem/49497720> |
| (iokit-property "artwork-scale-factor") ;; <rdar://problem/49497788> |
| (iokit-property "canvas-height") |
| (iokit-property "canvas-width") |
| (iokit-property "chip-id") ;; <rdar://problem/52903477> |
| (iokit-property "class-code") |
| (iokit-property "color-accuracy-index") |
| (iokit-property "compatible") ;; <rdar://problem/47523516> |
| (iokit-property "compatible-device-fallback") ;; <rdar://problem/49497720> |
| (iokit-property "device-colors") ;; <rdar://problem/51322072> |
| (iokit-property "device-id") |
| (iokit-property "device-perf-memory-class") |
| (iokit-property "dfr") |
| (iokit-property "display-corner-radius") ;; <rdar://problem/50602737> |
| (iokit-property "emu") |
| (iokit-property "graphics-featureset-class") ;; <rdar://problem/49497720> |
| (iokit-property "graphics-featureset-fallbacks") ;; <rdar://problem/51322072> |
| (iokit-property "hdcp-hoover-protocol") |
| (iokit-property "iommu-present") |
| (iokit-property "oled-display") ;; <rdar://problem/51322072> |
| (iokit-property "product-description") ;; <rdar://problem/49497788> |
| (iokit-property "product-id") |
| (iokit-property "soc-generation") ;; <rdar://problem/52903476> |
| (iokit-property "software-behavior") |
| (iokit-property "vendor-id") |
| (iokit-property "udid-version") ;; <rdar://problem/52903475> |
| (iokit-property "ui-pip") ;; <rdar://problem/48867037> |
| ) |
| |
| ; IOPlatformExpertDevice |
| (with-filter (iokit-registry-entry-class "IOPlatformExpertDevice") |
| (allow iokit-get-properties |
| (iokit-property |
| "model" |
| "model-number" |
| "platform-name" ;; <rdar://problem/79334360> |
| "region-info" ;; <rdar://problem/52903475> |
| "regulatory-model-number" ;; <rdar://problem/52903475> |
| ) |
| ) |
| ) |
| |
| ;; Read-only preferences and data |
| (mobile-preferences-read |
| "com.apple.LaunchServices" |
| "com.apple.WebFoundation" |
| "com.apple.avfoundation.frecents" ;; <rdar://problem/33137029> |
| "com.apple.avfoundation.videoperformancehud" ;; <rdar://problem/31594568> |
| "com.apple.voiceservices.logging") |
| |
| ;; Sandbox extensions |
| (define (apply-read-and-issue-extension op path-filter) |
| (op file-read* (with telemetry) path-filter) |
| (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read") path-filter))) |
| (define (apply-write-and-issue-extension op path-filter) |
| (op file-write* (with telemetry) path-filter) |
| (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read-write") path-filter))) |
| (define (read-only-and-issue-extensions path-filter) |
| (apply-read-and-issue-extension allow path-filter)) |
| (define (read-write-and-issue-extensions path-filter) |
| (apply-read-and-issue-extension allow path-filter) |
| (apply-write-and-issue-extension allow path-filter)) |
| (read-only-and-issue-extensions (extension "com.apple.app-sandbox.read")) |
| (read-write-and-issue-extensions (extension "com.apple.app-sandbox.read-write")) |
| |
| ;; Access to client's cache folder & re-vending to CFNetwork. |
| (allow file-issue-extension (with telemetry) (require-all |
| (extension "com.apple.app-sandbox.read-write") |
| (extension-class "com.apple.nsurlstorage.extension-cache"))) |
| |
| (accessibility-support) |
| |
| (media-accessibility-support) |
| |
| ;; Various services required by CFNetwork and other frameworks |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.analyticsd")) |
| |
| ;; Silence reports about things we do not want access to: |
| (deny mach-lookup (with no-report) |
| (global-name "com.apple.fontservicesd") |
| ) |
| |
| (deny file-write-create (vnode-type SYMLINK)) |
| (deny file-read-xattr file-write-xattr (xattr-prefix "com.apple.security.private.")) |
| |
| ;; Allow loading injected bundles. |
| (allow file-map-executable (with telemetry)) |
| |
| ;; Allow ManagedPreference access |
| (allow file-read* (with telemetry) (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist")) |
| |
| (allow file-read-data (with telemetry) |
| (literal "/usr/local/lib/log") ; <rdar://problem/36629495> |
| ) |
| |
| (allow mach-lookup (with telemetry) |
| (require-all |
| (extension "com.apple.webkit.extension.mach") |
| (global-name |
| "com.apple.PowerManagement.control" |
| "com.apple.frontboard.systemappservices" |
| "com.apple.iconservices" |
| ) |
| ) |
| ) |
| |
| (allow iokit-open (with telemetry) |
| (require-all |
| (extension "com.apple.webkit.extension.iokit") |
| (iokit-user-client-class |
| "AGXCommandQueue" |
| "AGXDevice" |
| "AGXSharedUserClient" |
| "IOAccelContext" |
| "IOAccelDevice" |
| "IOAccelSharedUserClient" |
| "IOAccelSubmitter2" |
| "IOAccelContext2" |
| "IOAccelDevice2" |
| "IOAccelSharedUserClient2" |
| ) |
| ) |
| ) |
| |
| (deny mach-lookup (with no-log) |
| (xpc-service-name "com.apple.audio.toolbox.reporting.service") |
| ) |
| |
| (deny mach-lookup (with telemetry) |
| (xpc-service-name "com.apple.iconservices") |
| (global-name |
| "com.apple.PowerManagement.control" |
| "com.apple.iconservices" |
| "com.apple.frontboard.systemappservices" |
| ) |
| ) |
| |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.systemstatus.activityattribution") |
| ) |
| |
| (allow mach-lookup (with telemetry) |
| (require-all |
| (extension "com.apple.webkit.extension.mach") |
| (global-name "com.apple.iphone.axserver-systemwide" "com.apple.tccd"))) |
| |
| (allow mach-lookup (with telemetry) |
| (require-all |
| (extension "com.apple.webkit.extension.mach") |
| (xpc-service-name-prefix "com.apple.AGXCompilerService"))) |
| |
| (media-capture-support) |
| |
| (allow mach-lookup (with telemetry) |
| (global-name "com.apple.audio.AudioQueueServer") |
| ) |
| |
| ;; These services have been identified as unused during living-on. |
| ;; This list overrides some definitions above and in common.sb. |
| ;; FIXME: remove overridden rules once the final list has been |
| ;; established, see https://bugs.webkit.org/show_bug.cgi?id=193840 |
| (deny mach-lookup |
| (global-name "com.apple.webkit.camera") |
| ) |
| |
| (when (defined? 'syscall-unix) |
| (allow syscall-unix (with telemetry)) |
| (allow syscall-unix (syscall-number |
| SYS___disable_threadsignal |
| SYS___mac_syscall |
| SYS___pthread_sigmask |
| SYS___semwait_signal |
| SYS_access |
| SYS_bsdthread_create |
| SYS_bsdthread_ctl |
| SYS_bsdthread_register |
| SYS_bsdthread_terminate |
| SYS_change_fdguard_np |
| SYS_chdir |
| SYS_close |
| SYS_close_nocancel |
| SYS_connect |
| SYS_csops |
| SYS_csops_audittoken |
| SYS_exit |
| SYS_fcntl |
| SYS_flock |
| SYS_fsetattrlist |
| SYS_fsetxattr |
| SYS_fsgetpath |
| SYS_fstat64 |
| SYS_fstatat64 |
| SYS_fstatfs64 |
| SYS_ftruncate |
| SYS_getattrlist |
| SYS_getdirentries64 |
| SYS_getegid |
| SYS_getentropy |
| SYS_geteuid |
| SYS_getfsstat64 |
| SYS_getgid |
| SYS_getpid |
| SYS_getrlimit |
| SYS_gettid |
| SYS_gettimeofday |
| SYS_getuid |
| SYS_ioctl |
| SYS_issetugid |
| SYS_kdebug_trace64 |
| SYS_kdebug_trace_string |
| SYS_kdebug_typefilter |
| SYS_kevent_id |
| SYS_kevent_qos |
| SYS_kqueue_workloop_ctl |
| SYS_lseek |
| SYS_lstat64 |
| SYS_madvise |
| SYS_memorystatus_control |
| SYS_mkdir |
| SYS_mmap |
| SYS_mprotect |
| SYS_msync |
| SYS_munmap |
| SYS_objc_bp_assist_cfg_np |
| SYS_open |
| SYS_open_nocancel |
| SYS_openat |
| SYS_os_fault_with_payload |
| SYS_pathconf |
| SYS_pread |
| SYS_proc_info |
| SYS_psynch_cvbroad |
| SYS_psynch_cvclrprepost |
| SYS_psynch_cvsignal |
| SYS_psynch_cvwait |
| SYS_psynch_mutexdrop |
| SYS_psynch_mutexwait |
| SYS_psynch_rw_rdlock |
| SYS_psynch_rw_unlock |
| SYS_psynch_rw_wrlock |
| SYS_read |
| SYS_read_nocancel |
| SYS_readlink |
| SYS_rename |
| SYS_sem_close |
| SYS_sem_open |
| SYS_sendto |
| SYS_shared_region_check_np |
| SYS_shm_open |
| SYS_sigaction |
| SYS_socket |
| SYS_stat64 |
| SYS_sysctl |
| SYS_sysctlbyname |
| SYS_thread_selfid |
| SYS_ulock_wait |
| SYS_ulock_wake |
| SYS_work_interval_ctl |
| SYS_workq_kernreturn |
| SYS_workq_open |
| SYS_write_nocancel |
| SYS_writev))) |
