| ; Copyright (C) 2010-2021 Apple Inc. All rights reserved. |
| ; |
| ; Redistribution and use in source and binary forms, with or without |
| ; modification, are permitted provided that the following conditions |
| ; are met: |
| ; 1. Redistributions of source code must retain the above copyright |
| ; notice, this list of conditions and the following disclaimer. |
| ; 2. Redistributions in binary form must reproduce the above copyright |
| ; notice, this list of conditions and the following disclaimer in the |
| ; documentation and/or other materials provided with the distribution. |
| ; |
| ; THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' |
| ; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, |
| ; THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
| ; PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS |
| ; BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
| ; CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF |
| ; SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS |
| ; INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN |
| ; CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
| ; ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF |
| ; THE POSSIBILITY OF SUCH DAMAGE. |
| |
| (version 1) |
| (deny default (with partial-symbolication)) |
| (deny nvram*) |
| (deny system-privilege) |
| (allow system-audit file-read-metadata) |
| |
| ;; We can remove the catch once we no longer need to support iOS 15 (or earlier)) |
| (catch (lambda) |
| (import "dyld-support.sb")) |
| |
| ;; Silence spurious logging due to rdar://20117923 and rdar://72366475 |
| (deny system-privilege (privilege-id PRIV_GLOBAL_PROC_INFO) (with no-report)) |
| |
| ;;; |
| ;;; The following rules were originally contained in 'common.sb'. We are duplicating them here so we can |
| ;;; remove unneeded sandbox extensions. |
| ;;; |
| |
| (import "util.sb") |
| |
| (define-once (allow-read-and-issue-generic-extensions . filters) |
| (allow file-read* |
| (apply require-any filters)) |
| (allow file-issue-extension |
| (require-all |
| (extension-class "com.apple.app-sandbox.read") |
| (apply require-any filters)))) |
| |
| (define-once (allow-read-write-and-issue-generic-extensions . filters) |
| (allow file-read* file-write* |
| (apply require-any filters)) |
| (allow file-read-metadata |
| (apply require-any filters)) |
| (allow file-issue-extension |
| (require-all |
| (extension-class "com.apple.app-sandbox.read-write" "com.apple.app-sandbox.read") |
| (apply require-any filters)))) |
| |
| (define-once (managed-configuration-read-public) |
| (allow file-read* |
| (well-known-system-group-container-subpath "/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo") |
| (front-user-home-subpath "/Library/ConfigurationProfiles/PublicInfo") |
| (front-user-home-subpath "/Library/UserConfigurationProfiles/PublicInfo"))) |
| |
| (define-once (managed-configuration-read . files) |
| (if (null? files) |
| (allow file-read* |
| (well-known-system-group-container-subpath "/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles") |
| (front-user-home-subpath "/Library/ConfigurationProfiles") |
| (front-user-home-subpath "/Library/UserConfigurationProfiles")) |
| (for-each |
| (lambda (file) |
| (allow file-read* |
| (well-known-system-group-container-literal |
| (string-append "/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/" file)) |
| (front-user-home-literal |
| (string-append "/Library/ConfigurationProfiles/" file) |
| (string-append "/Library/UserConfigurationProfiles/" file)))) |
| files))) |
| |
| (define-once (allow-preferences-common) |
| (allow file-read-metadata |
| (home-literal "") |
| (home-literal "/Library/Preferences"))) |
| |
| (define-once (mobile-preferences-read . domains) |
| (allow-preferences-common) |
| (for-each (lambda (domain) |
| (begin |
| (allow user-preference-read (preference-domain domain)) |
| (allow file-read* |
| (home-literal (string-append "/Library/Preferences/" domain ".plist"))))) |
| domains)) |
| |
| (define-once (framebuffer-access) |
| (deny iokit-open (with telemetry-backtrace) |
| (iokit-user-client-class "IOMobileFramebufferUserClient")) |
| |
| ; IOMobileFramebuffer |
| (with-filter (iokit-registry-entry-class "IOMobileFramebuffer") |
| (allow iokit-get-properties (with telemetry) |
| (iokit-property "AppleTV" |
| "DisplayPipePlaneBaseAlignment" |
| "DisplayPipeStrideRequirements" |
| "PerformanceStatistics" |
| "appleTV-VID0" |
| "appleTV-VID1" |
| "hdcp-hoover-protocol"))) |
| |
| (mobile-preferences-read "com.apple.iokit.IOMobileGraphicsFamily") |
| ) |
| |
| (define-once (asset-access . options) |
| (let ((asset-access-filter |
| (require-all |
| (require-any |
| (home-subpath "/Library/Assets") |
| (subpath "/private/var/MobileAsset")) |
| (extension "com.apple.assets.read")))) |
| ;; <rdar://problem/10710883> |
| ;; <rdar://problem/11569106> |
| (allow file-read* asset-access-filter) |
| (if (memq 'with-media-playback options) |
| (play-media asset-access-filter)) |
| (mobile-preferences-read "com.apple.MobileAsset"))) |
| |
| (define-once (play-media . filters) |
| (if (not (null? filters)) |
| ;; <rdar://problem/9875794> |
| (allow file-issue-extension |
| (require-all |
| (apply require-any filters) |
| (extension-class "com.apple.mediaserverd.read")))) |
| |
| (mobile-preferences-read |
| "com.apple.avfoundation" |
| "com.apple.coreaudio" |
| "com.apple.coremedia" |
| "com.apple.corevideo" |
| "com.apple.itunesstored" ; Needed by MediaPlayer framework |
| "com.apple.mobileipod" ; Ditto |
| "com.apple.audio.virtualaudio" ; <rdar://problem/57170333> |
| ) |
| |
| ;; AVF needs to see these network preferences: |
| (allow file-read* |
| (literal "/private/var/preferences/com.apple.networkd.plist")) |
| |
| ;; Allow mediaserverd to issue file extensions for the purposes of reading media |
| (allow file-issue-extension (require-all |
| (extension "com.apple.app-sandbox.read") |
| (extension-class "com.apple.mediaserverd.read"))) |
| ) |
| |
| (define-once (media-remote) |
| (mobile-preferences-read |
| "com.apple.mediaremote" |
| "com.apple.mobileipod") |
| ) |
| |
| (define-once (media-capture-support) |
| ;; Media capture, microphone access |
| (with-filter (extension "com.apple.webkit.microphone") |
| (allow device-microphone)) |
| |
| ;; Media capture, camera access |
| (with-filter (extension "com.apple.webkit.camera") |
| (allow user-preference-read |
| (preference-domain "com.apple.coremedia")) |
| (allow file-read* (subpath "/Library/CoreMediaIO/Plug-Ins/DAL")) |
| (allow device-camera)) |
| ) |
| |
| (define-once (accessibility-support) |
| (allow mach-register |
| (local-name "com.apple.iphone.axserver")) |
| (mobile-preferences-read "com.apple.Accessibility") |
| |
| ;; <rdar://problem/10809394> |
| (deny file-write-create |
| (home-prefix "/Library/Preferences/com.apple.Accessibility.plist") |
| (with no-report)) |
| ) |
| |
| (define-once (media-accessibility-support) |
| ;; <rdar://problem/12250145> |
| (mobile-preferences-read "com.apple.mediaaccessibility") |
| (mobile-preferences-read "com.apple.mediaaccessibility.public") |
| ) |
| |
| (define-once (url-translation) |
| ;; For translating http:// & https:// URLs referencing itms:// URLs. |
| ;; <rdar://problem/11587338> |
| (allow file-read* |
| (home-literal "/Library/Caches/com.apple.itunesstored/url-resolution.plist"))) |
| |
| ;;; |
| ;;; Declare that the application uses the OpenGL, Metal, and CoreML hardware & frameworks. |
| ;;; |
| (define-once (opengl) |
| ;; Items not seen in testing |
| (deny iokit-open (with telemetry) |
| (iokit-connection "IOGPU") |
| (iokit-user-client-class |
| "AGXCommandQueue" |
| "AGXDevice" |
| "AGXSharedUserClient" |
| "IOAccelContext" |
| "IOAccelDevice" |
| "IOAccelSharedUserClient" |
| "IOAccelSubmitter2" |
| "IOAccelContext2" |
| "IOAccelDevice2" |
| "IOAccelSharedUserClient2")) |
| |
| ;; Items with known uses |
| (allow iokit-open |
| (require-all |
| (extension "com.apple.webkit.extension.iokit") |
| (iokit-connection "IOGPU"))) |
| |
| (allow iokit-open |
| (require-all |
| (extension "com.apple.webkit.extension.iokit") |
| (iokit-user-client-class "AGXDeviceUserClient"))) ;; Used by WebGL |
| |
| (allow iokit-get-properties |
| (iokit-property "IOGLBundleName") |
| (iokit-property "IOGLESBundleName") |
| (iokit-property "IOGLESDefaultUseMetal") |
| (iokit-property "IOGLESMetalBundleName") |
| (iokit-property "MetalPluginClassName") |
| (iokit-property "MetalPluginName") |
| ) |
| |
| (allow sysctl-read |
| (sysctl-name #"kern.bootsessionuuid")) |
| |
| ;; <rdar://problem/47268166> |
| (allow mach-lookup |
| (require-all |
| (extension "com.apple.webkit.extension.mach") |
| (xpc-service-name "com.apple.MTLCompilerService") |
| ) |
| ) |
| ;; This is just for logging. Remove when GPU process is enabled by default. |
| (allow mach-lookup |
| (with telemetry) |
| (require-all |
| (require-not (extension "com.apple.webkit.extension.mach")) |
| (xpc-service-name "com.apple.MTLCompilerService") |
| ) |
| ) |
| |
| (mobile-preferences-read |
| "com.apple.Metal" ;; <rdar://problem/25535471> |
| "com.apple.opengl" ;; <rdar://problem/23321675> |
| ) |
| ) |
| |
| (define-once (internal-debugging-support) |
| (allow file-read* file-map-executable |
| (subpath "/Developer")) |
| |
| (allow ipc-posix-shm |
| (ipc-posix-name-prefix "stack-logs") |
| (ipc-posix-name-prefix "OA-") |
| (ipc-posix-name-prefix "/FSM-")) |
| |
| (allow ipc-posix-shm-read* ipc-posix-shm-write-data ipc-posix-shm-write-unlink |
| (ipc-posix-name-regex #"^gdt-[A-Za-z0-9]+-(c|s)$")) |
| |
| (with-filter (system-attribute apple-internal) |
| ;; <rdar://problem/8565035> |
| ;; <rdar://problem/23857452> |
| ;; <rdar://problem/72317112> |
| (allow file-read* file-map-executable |
| (subpath "/AppleInternal") |
| (subpath "/usr/local/lib") |
| (subpath "/usr/appleinternal/lib"))) |
| (with-elevated-precedence |
| (allow file-read* file-map-executable file-issue-extension |
| (front-user-home-subpath "/XcodeBuiltProducts"))) |
| |
| ;; <rdar://problem/8107758> |
| (allow file-read* file-map-executable |
| (subpath "/System/Library/Frameworks") |
| (subpath "/System/Library/PrivateFrameworks")) |
| |
| ;; <rdar://problem/32544921> |
| (mobile-preferences-read "com.apple.hangtracer")) |
| |
| (define-once (device-access) |
| (deny file-read* file-write* |
| (vnode-type BLOCK-DEVICE CHARACTER-DEVICE)) |
| |
| (allow file-read* file-write-data |
| (literal "/dev/null") |
| (literal "/dev/zero")) |
| |
| (with-filter (system-attribute apple-internal) |
| (allow file-read* file-write-data file-ioctl |
| (literal "/dev/dtracehelper")) |
| (allow nvram-get (nvram-variable "emu")) ;; <rdar://problem/78363040> |
| ) |
| |
| (allow file-read* |
| (literal "/dev/random") |
| (literal "/dev/urandom")) |
| ;; <rdar://problem/14215718> |
| (deny file-write-data (with no-report) |
| (literal "/dev/random") |
| (literal "/dev/urandom")) |
| |
| (allow file-read* file-write-data (with telemetry) |
| (literal "/dev/aes_0"))) |
| |
| (define required-etc-files |
| (literal "/private/etc/fstab" |
| "/private/etc/hosts" |
| "/private/etc/group" |
| "/private/etc/passwd" |
| "/private/etc/protocols" |
| "/private/etc/services")) |
| |
| (define-once (speech-synthesis-and-voiceover) |
| ;; Speak Selection & VoiceOver |
| ;; <rdar://problem/12030530> AX: Sandbox violation with changing Language while VO is on |
| ;; and <rdar://problem/13071747> |
| (mobile-preferences-read |
| "com.apple.SpeakSelection" ; Needed for WebSpeech |
| "com.apple.VoiceOverTouch" ; Needed for non-US english language synthesis |
| "com.apple.voiceservices") ; Ditto |
| |
| ;; <rdar://problem/14555119> Access to high quality speech voices |
| ;; Needed for WebSpeech |
| (allow file-read* |
| (home-subpath "/Library/VoiceServices/Assets") |
| (home-subpath "/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice")) |
| ) |
| |
| ;; Things required by UIKit |
| (define-once (uikit-requirements) |
| (mobile-preferences-read |
| "com.apple.UIKit" |
| "com.apple.WebUI" |
| "com.apple.airplay" |
| "com.apple.avkit" |
| "com.apple.coreanimation" |
| "com.apple.mt" |
| "com.apple.preferences.sounds") |
| |
| (deny mach-lookup |
| (global-name "com.apple.frontboard.systemappservices") ; -[UIViewServiceInterface _createProcessAssertion] -> SBSProcessIDForDisplayIdentifier() |
| ) |
| |
| (allow mach-lookup |
| (global-name "com.apple.CARenderServer")) |
| |
| ; UIKit-required IOKit nodes. |
| (deny iokit-open (with telemetry) |
| (iokit-user-client-class "IOSurfaceSendRight") |
| ) |
| |
| ; WebKit-required IOKit classes |
| (allow iokit-open |
| (require-all |
| (extension "com.apple.webkit.extension.iokit") |
| (iokit-user-client-class "IOSurfaceAcceleratorClient") ;; Media rendering into pixel buffers |
| ) |
| (when (defined? 'iokit-external-method) |
| (apply-message-filter |
| (deny (with telemetry) |
| iokit-async-external-method |
| iokit-external-trap) |
| (deny (with telemetry) (with message "IOSurfaceAcceleratorClient") |
| iokit-external-method) |
| (allow iokit-external-method |
| (iokit-method-number |
| 1 |
| ) |
| ) |
| ) |
| ) |
| ) |
| |
| (allow iokit-open |
| (require-all |
| (extension "com.apple.webkit.extension.iokit") |
| (iokit-user-client-class "IOSurfaceRootUserClient"))) ;; Needed by Tiled Grid code. |
| |
| ;; Silence sandbox violations from apps trying to create the empty plist if it doesn't exist. |
| ;; <rdar://problem/13796537> |
| (deny file-write-create |
| (home-prefix "/Library/Preferences/com.apple.UIKit.plist") |
| (with no-report)) |
| ) |
| |
| (define-once (dictionary-support) |
| ; <rdar://problem/8548856> Sub-TLF: Sandbox change for apps for read-only access to the dictionary directory/data |
| (allow file-read* |
| ; XXX - /Library ought to be allowed in all UI profiles but isn't (CF, MobileSafari) |
| (subpath "/Library/Dictionaries") |
| (home-subpath "/Library/Dictionaries")) |
| ) |
| |
| (deny file-map-executable) |
| |
| (deny file-write-mount file-write-unmount) |
| |
| (allow file-read-metadata |
| (vnode-type DIRECTORY)) |
| |
| (mobile-preferences-read "com.apple.security") |
| |
| (with-filter (system-attribute apple-internal) |
| (mobile-preferences-read "com.apple.PrototypeTools")) |
| |
| (with-elevated-precedence |
| (allow file-read* |
| (subpath "/usr/lib" |
| "/usr/share" |
| "/private/var/db/timezone")) |
| (allow-read-and-issue-generic-extensions |
| (subpath "/Library/RegionFeatures" |
| "/System/Library")) |
| (allow file-issue-extension |
| (require-all |
| (extension-class "com.apple.mediaserverd.read") |
| (subpath "/System/Library"))) |
| (let ((hw-identifying-paths |
| (require-any |
| (literal "/System/Library/Caches/apticket.der") |
| (subpath "/System/Library/Caches/com.apple.kernelcaches") |
| (subpath "/System/Library/Caches/com.apple.factorydata")))) |
| (deny file-issue-extension file-read* hw-identifying-paths)) |
| |
| (allow file-map-executable |
| (subpath "/System/Library") |
| (subpath "/usr/lib")) |
| (allow file-read-metadata |
| (vnode-type SYMLINK)) |
| |
| ;;; <rdar://problem/24144418> |
| (allow file-read* |
| (subpath "/private/var/preferences/Logging")) |
| |
| (allow user-preference-read (preference-domain "kCFPreferencesAnyApplication")) |
| (allow file-read* |
| (front-user-home-literal "/Library/Preferences/.GlobalPreferences.plist") |
| (front-user-home-literal "/Library/Preferences/.GlobalPreferences_m.plist")) |
| |
| (allow file-read* |
| (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist")) |
| (allow managed-preference-read (preference-domain "kCFPreferencesAnyApplication")) |
| |
| (allow file-read-metadata |
| (home-literal "/Library/Caches/powerlog.launchd")) |
| |
| (allow-read-and-issue-generic-extensions (executable-bundle)) |
| (allow file-map-executable (executable-bundle)) |
| |
| ;; <rdar://problem/13963294> |
| (deny file-read-data file-issue-extension file-map-executable |
| (require-all |
| (executable-bundle) |
| (regex #"/[^/]+/SC_Info/"))) |
| |
| (unless (defined? 'restrictive-extension) |
| (with-filter |
| (extension |
| "com.apple.app-sandbox.read" |
| "com.apple.app-sandbox.read-write" |
| "com.apple.sharing.airdrop.readonly") |
| (allow file-read* file-read-metadata) |
| (allow file-issue-extension |
| (extension-class "com.apple.app-sandbox.read" |
| "com.apple.mediaserverd.read" |
| "com.apple.sharing.airdrop.readonly"))) |
| (with-filter |
| (extension |
| "com.apple.app-sandbox.read-write") |
| (allow file-write*) |
| (allow file-issue-extension |
| (extension-class "com.apple.app-sandbox.read-write" |
| "com.apple.mediaserverd.read-write")))) |
| |
| ;; <rdar://problem/16079361> |
| (allow managed-preference-read |
| (extension "com.apple.security.exception.managed-preference.read-only")) |
| (allow user-preference-read |
| (extension "com.apple.security.exception.shared-preference.read-only")) |
| ) |
| |
| (with-filter (system-attribute apple-internal) |
| (internal-debugging-support) |
| ) |
| |
| (allow file-read* |
| required-etc-files |
| (literal "/")) |
| |
| (allow file-read* |
| (subpath "/private/var/MobileAsset/PreinstalledAssetsV2/InstallWithOs")) |
| |
| (device-access) |
| |
| (allow file-issue-extension |
| (require-all |
| (extension-class "com.apple.app-sandbox.read-write" "com.apple.app-sandbox.read") |
| (extension "com.apple.fileprovider.read-write"))) |
| |
| (allow mach-lookup |
| (global-name "com.apple.logd") |
| (global-name "com.apple.logd.events") |
| ) |
| |
| (deny mach-lookup (with no-report) |
| (global-name "com.apple.distributed_notifications@1v3")) |
| |
| (deny mach-lookup (with no-report) |
| (global-name "com.apple.lsd.mapdb")) |
| |
| ;; <rdar://problem/12413942> |
| (allow file-read* |
| (well-known-system-group-container-literal "/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist")) |
| (allow iokit-get-properties |
| (iokit-property "IORegistryEntryPropertyKeys")) |
| |
| (allow ipc-posix-sem-open (with telemetry) |
| (ipc-posix-name "containermanagerd.fb_check")) |
| |
| (with-filter (ipc-posix-name "purplebuddy.sentinel") |
| (deny ipc-posix-sem-create ipc-posix-sem-post ipc-posix-sem-unlink ipc-posix-sem-wait) |
| (allow ipc-posix-sem-open)) |
| |
| (deny mach-lookup (with no-report) |
| (global-name "com.apple.runningboard") |
| ) |
| |
| (allow system-sched |
| (require-entitlement "com.apple.private.kernel.override-cpumon")) |
| |
| (deny sysctl-read (with no-report) |
| (sysctl-name |
| "hw.cpufrequency_compat" |
| "hw.tbfrequency_compat" ;; <rdar://71740719> |
| "sysctl.proc_native")) |
| |
| (with-filter (system-attribute apple-internal) |
| (allow sysctl-read sysctl-write |
| (sysctl-name "vm.footprint_suspend"))) |
| |
| (with-filter (system-attribute apple-internal) |
| (allow network-outbound |
| (literal "/private/var/run/syslog")) |
| ) |
| |
| (allow mach-lookup |
| (global-name "com.apple.system.notification_center") |
| (apply-message-filter |
| (deny mach-message-send (with telemetry)) |
| (deny mach-message-send (with no-report) (message-number 1023)) |
| (allow mach-message-send (message-number |
| 1002 |
| 1009 |
| 1010 |
| 1011 |
| 1012 |
| 1016 |
| 1017 |
| 1018 |
| 1019 |
| 1021 |
| 1022 |
| 1025 |
| 1026 |
| 1028 |
| 1029 |
| 1030 |
| 1031 |
| 1032 |
| )) |
| ) |
| ) |
| (allow ipc-posix-shm-read* |
| (ipc-posix-name "apple.shm.notification_center")) |
| |
| (managed-configuration-read-public) |
| |
| (deny system-info (with no-report) |
| (info-type "net.link.addr")) |
| |
| (allow file-read* |
| (subpath "/private/var/db/datadetectors/sys")) |
| |
| (allow-well-known-system-group-container-subpath-read |
| "/systemgroup.com.apple.icloud.findmydevice.managed/Library") |
| |
| (allow mach-task-name (target self)) |
| |
| ;;; process-info* defaults to allow; deny it and then allow operations we actually need. |
| (deny process-info*) |
| (allow process-info-pidinfo (target self)) |
| (allow process-info-pidfdinfo (target self)) |
| (allow process-info-pidfileportinfo (target self)) |
| (allow process-info-setcontrol (target self)) |
| (allow process-info-dirtycontrol (target self)) |
| (allow process-info-rusage (target self)) |
| |
| ;;; |
| ;;; End common.sb content |
| ;;; |
| |
| (deny mach-lookup (xpc-service-name-prefix "")) |
| (deny iokit-get-properties (with partial-symbolication)) |
| (deny lsopen) |
| |
| ;;; |
| ;;; The following rules were originally contained in 'UIKit-apps.sb'. We are duplicating them here so we can |
| ;;; remove unneeded sandbox extensions. |
| ;;; |
| |
| ;; Any app can play audio & movies. |
| (play-media) |
| |
| ;; Access to media controls |
| (media-remote) |
| |
| (url-translation) |
| |
| (mobile-preferences-read "com.apple.da") |
| |
| (speech-synthesis-and-voiceover) |
| |
| ;; Permit reading assets via MobileAsset framework. |
| (asset-access 'with-media-playback) |
| |
| ;; allow 3rd party applications to access nsurlstoraged's top level domain data cache |
| (allow-well-known-system-group-container-literal-read |
| "/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin") |
| |
| ;; Access the keyboards |
| (allow file-read* |
| (home-subpath "/Library/Caches/com.apple.keyboards")) |
| |
| (mobile-preferences-read |
| "com.apple.EmojiPreferences" |
| ; <rdar://problem/8477596> com.apple.InputModePreferences |
| "com.apple.InputModePreferences" |
| ; <rdar://problem/8206632> Weather(1038) deny file-read-data ~/Library/Preferences/com.apple.keyboard.plist |
| "com.apple.keyboard" |
| ; <rdar://problem/9384085> |
| "com.apple.Preferences" |
| "com.apple.lookup.shared" ; Needed for DataDetector (Spotlight) support |
| ) |
| |
| ;; Silently deny unnecessary accesses caused by MessageUI framework. |
| ;; This can be removed once <rdar://problem/47038102> is resolved. |
| (deny file-read* |
| (home-literal "/Library/Preferences/com.apple.mobilemail.plist") |
| (with no-log)) |
| |
| ;; <rdar://problem/12985925> Need read access to /var/mobile/Library/Fonts to all apps |
| (allow file-read* |
| (home-subpath "/Library/Fonts")) |
| |
| ;; <rdar://problem/7344719&26323449> LaunchServices app icons |
| (allow file-read* |
| (well-known-system-group-container-subpath "/systemgroup.com.apple.lsd.iconscache")) |
| (deny mach-lookup (with telemetry) |
| (xpc-service-name "com.apple.iconservices") |
| (global-name "com.apple.iconservices")) |
| |
| (allow-preferences-common) |
| |
| ;; Home Button |
| (with-filter (iokit-registry-entry-class "IOPlatformDevice") |
| (allow iokit-get-properties |
| (iokit-property "home-button-type"))) |
| |
| (uikit-requirements) |
| |
| (dictionary-support) |
| |
| ; <rdar://problem/8440231> |
| (allow file-read* |
| (home-literal "/Library/Caches/DateFormats.plist")) |
| ; Silently deny writes when CFData attempts to write to the cache directory. |
| (deny file-write* |
| (home-literal "/Library/Caches/DateFormats.plist") |
| (with no-log)) |
| |
| (framebuffer-access) |
| |
| ; <rdar://problem/7595408> , <rdar://problem/7643881> |
| (opengl) |
| |
| ; CRCopyRestrictionsDictionary periodically tries to CFPreferencesAppSynchronize com.apple.springboard.plist |
| ; which will attempt to create the plist if it doesn't exist -- from any application. Only SpringBoard is |
| ; allowed to write its plist; ignore all others, they don't know what they are doing. |
| ; See <rdar://problem/9375027> for sample backtraces. |
| (deny file-write* |
| (home-prefix "/Library/Preferences/com.apple.springboard.plist") |
| (with no-log)) |
| |
| ;; <rdar://problem/34986314> |
| (mobile-preferences-read "com.apple.indigo") |
| |
| ;;; |
| ;;; End UIKit-apps.sb content |
| ;;; |
| |
| (mobile-preferences-read "com.apple.AdLib.plist") |
| |
| (deny file-read* (with no-report) |
| (home-literal |
| "/Library/Preferences/com.apple.WebKit.WebContent.plist" |
| "/Library/Preferences/com.apple.CFNetwork.plist" |
| "/Library/Preferences/com.apple.AppSupport.plist" |
| ) |
| ) |
| |
| (with-filter (system-attribute apple-internal) |
| (mobile-preferences-read "com.apple.CFNetwork")) |
| |
| (deny sysctl*) |
| (allow sysctl-read |
| (sysctl-name |
| "hw.activecpu" ;; Needed by JSC engine. |
| "hw.availcpu" |
| "hw.byteorder" |
| "hw.cacheconfig" ;; <rdar://problem/78213563> |
| "hw.cachelinesize" |
| "hw.cachelinesize_compat" |
| "hw.cachesize" ;; <rdar://problem/78213563> |
| "hw.cpufamily" ;; <rdar://problem/58416475> |
| "hw.cpusubfamily" |
| "hw.cputhreadtype" |
| "hw.cputype" |
| "hw.l1dcachesize" ;; <rdar://problem/15721872> |
| "hw.l1icachesize" ;; <rdar://problem/15721872> |
| "hw.l2cachesize" |
| "hw.l3cachesize" ;; <rdar://problem/15721872> |
| "hw.logicalcpu" |
| "hw.logicalcpu_max" |
| "hw.ncpu" |
| "hw.machine" |
| "hw.memsize" |
| "hw.model" |
| "hw.ncpu" ;; <rdar://problem/76782530> |
| "hw.nperflevels" ;; <rdar://problem/76782530> |
| "hw.pagesize" ;; <rdar://problem/76782530> |
| "hw.pagesize_compat" |
| "hw.physicalcpu" |
| "hw.physicalcpu_max" |
| "hw.physmem" ;; <rdar://problem/76782530> |
| "hw.product" |
| "hw.vectorunit" |
| "kern.bootargs" |
| "kern.hostname" |
| "kern.hv_vmm_present" |
| "kern.maxfilesperproc" ;; <rdar://problem/65900517> |
| "kern.memorystatus_level" |
| "kern.osproductversion" |
| "kern.osrelease" |
| "kern.ostype" |
| "kern.osvariant_status" |
| "kern.osversion" |
| "kern.secure_kernel" ;; Needed by XPC bundle resolution |
| "kern.version" |
| "sysctl.name2oid" |
| "vm.footprint_suspend") |
| (sysctl-name-prefix "net.routetable") ;; <rdar://problem/57665153> |
| (sysctl-name-prefix "hw.optional.") ;; <rdar://problem/70973527> |
| (sysctl-name-prefix "hw.perflevel") ;; <rdar://problem/76782530> |
| ) |
| |
| (allow iokit-get-properties |
| (iokit-property "AAPL,DisplayPipe") |
| (iokit-property "AAPL,OpenCLdisabled") |
| (iokit-property "AAPL,IOGraphics_LER") |
| (iokit-property "AAPL,IOGraphics_LER_RegTag_0") |
| (iokit-property "AAPL,IOGraphics_LER_RegTag_1") |
| (iokit-property "AAPL,IOGraphics_LER_Busy_2") |
| (iokit-property "AAPL,alias-policy") |
| (iokit-property "AAPL,boot-display") |
| (iokit-property "AAPL,display-alias") |
| (iokit-property "AAPL,mux-switch-state") |
| (iokit-property "AAPL,ndrv-dev") |
| (iokit-property "AAPL,primary-display") |
| (iokit-property "AAPL,slot-name") |
| (iokit-property "APTDevice") |
| (iokit-property "AVCSupported") |
| (iokit-property "AppleJPEGNumCores") |
| (iokit-property "AppleJPEGSupportsAppleInterchangeFormats") |
| (iokit-property "AppleJPEGSupportsMissingEOI") |
| (iokit-property "AppleJPEGSupportsRSTLogging") |
| (iokit-property "BaseAddressAlignmentRequirement") |
| (iokit-property "DisplayPipePlaneBaseAlignment") |
| (iokit-property "DisplayPipeStrideRequirements") |
| (iokit-property "HEVCSupported") |
| (iokit-property "HEVCCanDecodeTileToCanvas") |
| (iokit-property "IOGVABGRAEnc") |
| (iokit-property "IOGVACodec") |
| (iokit-property "IOGVAEncoderRestricted") |
| (iokit-property "IOGVAScaler") |
| (iokit-property "IOClassNameOverride") |
| (iokit-property "IOSurfaceAcceleratorCapabilitiesDict") |
| (iokit-property "LGHSupported") |
| (iokit-property "Protocol Characteristics") |
| (iokit-property "als-colorCfg") ;; <rdar://problem/52903475> |
| (iokit-property "artwork-device-idiom") ;; <rdar://problem/49497720> |
| (iokit-property "artwork-device-subtype") |
| (iokit-property "artwork-display-gamut") ;; <rdar://problem/49497788> |
| (iokit-property "artwork-dynamic-displaymode") ;; <rdar://problem/49497720> |
| (iokit-property "artwork-scale-factor") ;; <rdar://problem/49497788> |
| (iokit-property "canvas-height") |
| (iokit-property "canvas-width") |
| (iokit-property "chip-id") ;; <rdar://problem/52903477> |
| (iokit-property "class-code") |
| (iokit-property "color-accuracy-index") |
| (iokit-property "compatible") ;; <rdar://problem/47523516> |
| (iokit-property "compatible-device-fallback") ;; <rdar://problem/49497720> |
| (iokit-property "device-colors") ;; <rdar://problem/51322072> |
| (iokit-property "device-id") |
| (iokit-property "device-perf-memory-class") |
| (iokit-property "dfr") |
| (iokit-property "display-corner-radius") ;; <rdar://problem/50602737> |
| (iokit-property "emu") |
| (iokit-property "external") |
| (iokit-property "graphics-featureset-class") ;; <rdar://problem/49497720> |
| (iokit-property "graphics-featureset-fallbacks") ;; <rdar://problem/51322072> |
| (iokit-property "hdcp-hoover-protocol") |
| (iokit-property "iommu-present") |
| (iokit-property "oled-display") ;; <rdar://problem/51322072> |
| (iokit-property "product-description") ;; <rdar://problem/49497788> |
| (iokit-property "product-id") |
| (iokit-property "soc-generation") ;; <rdar://problem/52903476> |
| (iokit-property "software-behavior") |
| (iokit-property "vendor-id") |
| (iokit-property "udid-version") ;; <rdar://problem/52903475> |
| (iokit-property "ui-pip") ;; <rdar://problem/48867037> |
| ) |
| |
| ; IOPlatformExpertDevice |
| (with-filter (iokit-registry-entry-class "IOPlatformExpertDevice") |
| (allow iokit-get-properties |
| (iokit-property |
| "platform-name" ;; <rdar://problem/79334360> |
| "region-info" ;; <rdar://problem/52903475> |
| "regulatory-model-number" ;; <rdar://problem/52903475> |
| ) |
| ) |
| ) |
| |
| ;; Read-only preferences and data |
| (mobile-preferences-read |
| "com.apple.LaunchServices" |
| "com.apple.WebFoundation" |
| "com.apple.avfoundation.frecents" ;; <rdar://problem/33137029> |
| "com.apple.avfoundation.videoperformancehud" ;; <rdar://problem/31594568> |
| "com.apple.voiceservices.logging") |
| |
| ;; Sandbox extensions |
| (define (apply-read-and-issue-extension op path-filter) |
| (op file-read* path-filter) |
| (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read") path-filter))) |
| (define (apply-write-and-issue-extension op path-filter) |
| (op file-write* path-filter) |
| (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read-write") path-filter))) |
| (define (read-only-and-issue-extensions path-filter) |
| (apply-read-and-issue-extension allow path-filter)) |
| (define (read-write-and-issue-extensions path-filter) |
| (apply-read-and-issue-extension allow path-filter) |
| (apply-write-and-issue-extension allow path-filter)) |
| (read-only-and-issue-extensions (extension "com.apple.app-sandbox.read")) |
| (read-write-and-issue-extensions (extension "com.apple.app-sandbox.read-write")) |
| |
| ;; Access to client's cache folder & re-vending to CFNetwork. |
| (allow file-issue-extension (require-all |
| (extension "com.apple.app-sandbox.read-write") |
| (extension-class "com.apple.nsurlstorage.extension-cache"))) |
| |
| (accessibility-support) |
| |
| (media-accessibility-support) |
| |
| (deny mach-lookup (with no-report) |
| (global-name "com.apple.SystemConfiguration.configd") |
| (global-name "com.apple.aggregated") |
| (global-name "com.apple.diagnosticd") |
| (global-name "com.apple.fontservicesd") |
| ) |
| |
| (deny mach-lookup (with telemetry) |
| (global-name "com.apple.PowerManagement.control")) |
| |
| (deny file-write-create (vnode-type SYMLINK)) |
| (deny file-read-xattr file-write-xattr (xattr-prefix "com.apple.security.private.")) |
| |
| ;; Allow loading injected bundles. |
| (allow file-map-executable) |
| |
| #if !ENABLE(CONTENT_FILTERING_IN_NETWORKING_PROCESS) |
| ;; Allow ManagedPreference access |
| (allow file-read* (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist")) |
| #endif |
| |
| (allow file-read-data |
| (literal "/usr/local/lib/log") ; <rdar://problem/36629495> |
| ) |
| |
| ;; <rdar://problem/60983812> |
| (deny file-write* |
| (home-subpath "/Library/Preferences/") |
| (with no-log)) |
| |
| (deny mach-lookup (with no-log) (with telemetry) |
| (global-name "com.apple.containermanagerd") |
| ) |
| |
| (deny mach-lookup (with telemetry) |
| (global-name "com.apple.mobilegestalt.xpc") |
| ) |
| |
| (deny mach-lookup (with no-log) |
| (xpc-service-name "com.apple.audio.toolbox.reporting.service") |
| ) |
| |
| (allow iokit-open (with telemetry-backtrace) |
| (require-all |
| (require-not (extension "com.apple.webkit.extension.iokit")) |
| (iokit-user-client-class "IOSurfaceRootUserClient"))) |
| |
| (deny iokit-open (with telemetry) |
| (require-all |
| (require-not (extension "com.apple.webkit.extension.iokit")) |
| (iokit-user-client-class |
| "IOSurfaceAcceleratorClient" |
| ) |
| ) |
| ) |
| |
| (deny iokit-open (with no-log) |
| (iokit-user-client-class |
| "AppleJPEGDriverUserClient" |
| ) |
| ) |
| |
| (allow iokit-open (with report) (with telemetry-backtrace) |
| (require-all |
| (require-not (extension "com.apple.webkit.extension.iokit")) |
| (iokit-connection "IOGPU") |
| ) |
| ) |
| |
| #if HAVE(SANDBOX_STATE_FLAGS) |
| ;; This rule enables the WebContent process to enable the "BlockIOKitInWebContentSandbox" sandbox variable |
| ;; by reading a preference from the domain "com.apple.WebKit.WebContent.BlockIOKitInWebContentSandbox". |
| (deny user-preference-read (with enable-state-flag "BlockIOKitInWebContentSandbox") |
| (preference-domain "com.apple.WebKit.WebContent.BlockIOKitInWebContentSandbox")) |
| |
| (with-filter (state-flag "BlockIOKitInWebContentSandbox") |
| (deny iokit-open (with telemetry-backtrace) |
| (require-all |
| (require-not (extension "com.apple.webkit.extension.iokit")) |
| (iokit-user-client-class "IOSurfaceRootUserClient"))) |
| (deny iokit-open (with telemetry-backtrace) |
| (require-all |
| (require-not (extension "com.apple.webkit.extension.iokit")) |
| (iokit-connection "IOGPU"))) |
| (deny mach-lookup (with telemetry-backtrace) |
| (require-all |
| (require-not (extension "com.apple.webkit.extension.mach")) |
| (xpc-service-name "com.apple.MTLCompilerService")))) |
| #endif |
| |
| (with-filter (system-attribute apple-internal) |
| (allow mach-lookup |
| (global-name "com.apple.diagnosticd") |
| (global-name "com.apple.osanalytics.osanalyticshelper"))) |
| |
| (allow mach-lookup |
| (require-all |
| (extension "com.apple.webkit.extension.mach") |
| (global-name |
| "com.apple.frontboard.systemappservices" |
| "com.apple.iphone.axserver-systemwide" |
| "com.apple.mobileassetd.v2" |
| "com.apple.mobilegestalt.xpc" |
| #if !ENABLE(CONTENT_FILTERING_IN_NETWORKING_PROCESS) |
| "com.apple.nehelper" |
| "com.apple.nesessionmanager.content-filter" |
| "com.apple.uikit.viewservice.com.apple.WebContentFilter.remoteUI" |
| #endif |
| "com.apple.tccd" |
| "com.apple.webinspector" |
| ))) |
| |
| ;; Silence warnings about these connections if we have decided not to extend access to them: |
| (deny mach-lookup (with no-report) |
| (require-all |
| (require-not (extension "com.apple.webkit.extension.mach")) |
| (global-name |
| "com.apple.audio.AudioComponentRegistrar" |
| ) |
| ) |
| ) |
| |
| (allow mach-lookup |
| (require-all |
| (extension "com.apple.webkit.extension.mach") |
| (global-name |
| "com.apple.iconservices"))) |
| |
| (allow iokit-open |
| (require-all |
| (extension "com.apple.webkit.extension.iokit") |
| (iokit-user-client-class |
| "AGXCommandQueue" |
| "AGXDevice" |
| "AGXSharedUserClient" |
| "IOAccelContext" |
| "IOAccelDevice" |
| "IOAccelSharedUserClient" |
| "IOAccelSubmitter2" |
| "IOAccelContext2" |
| "IOAccelDevice2" |
| "IOAccelSharedUserClient2" |
| ) |
| ) |
| ) |
| |
| (allow mach-lookup |
| (require-all |
| (extension "com.apple.webkit.extension.mach") |
| (xpc-service-name-prefix "com.apple.AGXCompilerService"))) |
| |
| (media-capture-support) |
| |
| ;; These services have been identified as unused during living-on. |
| ;; This list overrides some definitions above and in common.sb. |
| ;; FIXME: remove overridden rules once the final list has been |
| ;; established, see https://bugs.webkit.org/show_bug.cgi?id=193840 |
| (deny mach-lookup |
| (global-name "com.apple.webkit.camera") |
| ) |
| |
| (disable-syscall-inference) |
| |
| #if HAVE(SANDBOX_STATE_FLAGS) |
| (deny user-preference-read (with enable-state-flag "WebContentProcessLaunched") |
| (preference-domain "com.apple.WebKit.WebContent.Launch")) |
| #endif |
| |
| (define (syscall-unix-only-in-use-during-launch) |
| (syscall-number |
| SYS_bsdthread_register |
| SYS_chdir |
| SYS_dup2 |
| SYS_fsgetpath |
| SYS_getpid |
| SYS_kdebug_trace_string |
| SYS_objc_bp_assist_cfg_np |
| SYS_shared_region_check_np |
| SYS_sigaction |
| SYS_workq_open |
| SYS_writev)) |
| |
| (define (syscall-unix-in-use-after-launch) |
| (syscall-number |
| SYS___disable_threadsignal |
| SYS___mac_syscall |
| SYS_abort_with_payload ;; <rdar://problem/50967271> |
| SYS_access |
| SYS_bsdthread_create |
| SYS_bsdthread_ctl |
| SYS_bsdthread_terminate |
| SYS_change_fdguard_np |
| SYS_close |
| SYS_close_nocancel |
| SYS_csops ;; used by Corefoundation initialization |
| SYS_csops_audittoken ;; used by WK to get entitlments |
| SYS_exit |
| SYS_faccessat ;; <rdar://problem/56998930> |
| SYS_fcntl |
| SYS_fcntl_nocancel |
| SYS_fgetattrlist ;; <rdar://problem/50266257> |
| SYS_fileport_makefd |
| SYS_flock |
| SYS_fsetattrlist ;; MTLCompilerFSCache::openSync |
| SYS_fsetxattr ;; <rdar://problem/49795964> |
| SYS_fstat64 |
| SYS_fstat64_extended ;; <rdar://problem/61310019> |
| SYS_fstatfs64 |
| SYS_ftruncate |
| SYS_getattrlist ;; xpc_realpath and directory enumeration |
| SYS_getdirentries64 |
| SYS_getegid |
| SYS_getentropy |
| SYS_geteuid |
| SYS_getfsstat64 |
| SYS_getrlimit |
| SYS_getrusage |
| SYS_gettid |
| SYS_gettimeofday |
| SYS_getuid |
| SYS_guarded_close_np |
| SYS_guarded_open_dprotected_np ; <rdar://problem/48166729> |
| SYS_guarded_open_np |
| SYS_guarded_pwrite_np |
| SYS_ioctl ;; needed by tcgetattr (TIOCGETA - debugging |
| SYS_issetugid |
| SYS_kdebug_trace64 |
| SYS_kdebug_typefilter |
| SYS_kevent_id |
| SYS_kevent_qos |
| SYS_kqueue ;; <rdar://problem/49609201> |
| SYS_kqueue_workloop_ctl ;; <rdar://problem/50999499> |
| SYS_listxattr |
| SYS_lseek |
| SYS_lstat64 |
| SYS_madvise |
| SYS_memorystatus_control |
| SYS_mkdir |
| SYS_mmap |
| SYS_mprotect |
| SYS_msync |
| SYS_munmap |
| SYS_open |
| SYS_open_nocancel |
| SYS_openat |
| SYS_os_fault_with_payload |
| SYS_pathconf |
| SYS_pread |
| SYS_proc_info |
| SYS_psynch_cvbroad |
| SYS_psynch_cvclrprepost |
| SYS_psynch_cvsignal |
| SYS_psynch_cvwait |
| SYS_psynch_mutexdrop |
| SYS_psynch_mutexwait |
| SYS_psynch_rw_rdlock ;; <rdar://problem/51134351> |
| SYS_psynch_rw_unlock |
| SYS_read |
| SYS_read_nocancel |
| SYS_readlink |
| SYS_rename |
| SYS_sem_close |
| SYS_sem_open |
| SYS_shared_region_map_and_slide_2_np ;; <rdar://problem/60294880> |
| SYS_shm_open |
| SYS_stat64 |
| SYS_statfs64 |
| SYS_sysctl |
| SYS_sysctlbyname |
| SYS_thread_selfid |
| SYS_ulock_wait |
| SYS_ulock_wait2 ;; <rdar://problem/58743778> |
| SYS_ulock_wake |
| SYS_workq_kernreturn |
| SYS_write_nocancel)) |
| |
| (define (syscall-unix-rarely-in-use) |
| (syscall-number |
| SYS_dup |
| SYS_fgetxattr |
| SYS_fstatat64 |
| SYS_fsync |
| SYS_getattrlistbulk ;; xpc_realpath and directory enumeration |
| SYS_getgid |
| SYS_getxattr |
| SYS_iopolicysys |
| SYS_mkdirat |
| SYS_open_dprotected_np |
| SYS_openat_nocancel |
| SYS_pread_nocancel |
| SYS_rmdir |
| SYS_sendto |
| SYS_setrlimit |
| SYS_sigaltstack |
| SYS_sigprocmask |
| #if PLATFORM(WATCHOS) |
| SYS_sigreturn |
| #endif |
| SYS_thread_selfusage |
| SYS_unlink |
| SYS_write |
| SYS_writev)) |
| |
| (define (syscall-unix-rarely-in-use-need-backtrace) |
| (syscall-number |
| SYS___pthread_kill |
| SYS___pthread_sigmask |
| SYS___semwait_signal |
| #if !ENABLE(CONTENT_FILTERING_IN_NETWORKING_PROCESS) |
| SYS_necp_client_action |
| SYS_necp_open |
| #endif |
| SYS_psynch_rw_wrlock |
| SYS_umask |
| SYS_work_interval_ctl)) |
| |
| (when (defined? 'syscall-unix) |
| (deny syscall-unix (with telemetry) (with send-signal SIGKILL)) |
| (allow syscall-unix |
| (syscall-unix-only-in-use-during-launch) |
| (syscall-unix-in-use-after-launch)) |
| |
| #if HAVE(SANDBOX_STATE_FLAGS) |
| (with-filter (require-not (state-flag "WebContentProcessLaunched")) |
| (allow syscall-unix |
| (syscall-unix-only-in-use-during-launch))) |
| (with-filter (state-flag "WebContentProcessLaunched") |
| (deny syscall-unix |
| (with telemetry) |
| (with message "Unix syscall used after launch") |
| (syscall-unix-only-in-use-during-launch))) |
| #endif |
| |
| (allow syscall-unix (with telemetry) |
| (syscall-unix-rarely-in-use)) |
| |
| (allow syscall-unix (with report) (with telemetry-backtrace) |
| (syscall-unix-rarely-in-use-need-backtrace)) |
| ) |
| |
| (deny syscall-unix (syscall-number |
| SYS_connect |
| SYS_socket)) |
| |
| (when (defined? 'SYS_map_with_linking_np) |
| (allow syscall-unix (syscall-number SYS_map_with_linking_np))) |
| |
| (with-filter (system-attribute apple-internal) |
| (when (defined? 'syscall-unix) |
| (allow syscall-unix |
| (syscall-number SYS_kdebug_trace_string)))) ;; Needed for performance sampling, see <rdar://problem/48829655>. |
| |
| (deny file-ioctl (with telemetry)) |
| |
| (deny file-ioctl (with telemetry) |
| (literal "/dev/aes_0")) |
| |
| (deny socket-ioctl (with telemetry)) |
| |
| (when (defined? 'system-fcntl) |
| (deny system-fcntl (with telemetry)) |
| (allow system-fcntl |
| (fcntl-command |
| F_ADDFILESIGS_RETURN ;; ImageLoaderMachO::loadCodeSignature |
| F_BARRIERFSYNC |
| F_CHECK_LV ;; ImageLoaderMachO::loadCodeSignature |
| F_GETCONFINED |
| F_GETFD ;; libwebrtc.dylib (no backtrace) |
| F_GETFL ;; LibJPEGReadPlugin::copyImageBlockSetStandard |
| F_GETPATH ;; used by dyld4 and CGFontURLCreate, getcwd (at least) |
| F_GETSIGSINFO |
| F_RDADVISE |
| F_SETCONFINED |
| F_SETFD ;; libwebrtc.dylib (no backtrace) |
| F_SETFL ;; CMCapture uses when camera is enabled |
| F_SETNOSIGPIPE)) ;; CMCapture uses when camera is enabled |
| |
| (allow system-fcntl (with telemetry-backtrace) |
| (fcntl-command |
| F_GETLK |
| F_OFD_SETLK)) |
| |
| (define (appcache-fcntl-commands) |
| (fcntl-command |
| F_OFD_GETLK |
| F_OFD_SETLKWTIMEOUT)) |
| |
| #if HAVE(SANDBOX_STATE_FLAGS) |
| ;; This rule enables the WebContent process to flip the "AppCacheDisabled" sandbox variable |
| ;; by reading a preference from the domain "com.apple.WebKit.WebContent.AppCacheDisabled". |
| (deny user-preference-read (with enable-state-flag "AppCacheDisabled") |
| (preference-domain "com.apple.WebKit.WebContent.AppCacheDisabled")) |
| |
| (with-filter (require-not (state-flag "AppCacheDisabled")) |
| (allow system-fcntl (appcache-fcntl-commands))) |
| (with-filter (state-flag "AppCacheDisabled") |
| (deny system-fcntl (with telemetry-backtrace) (appcache-fcntl-commands))) |
| #else |
| (allow system-fcntl (appcache-fcntl-commands)) |
| #endif |
| |
| (allow system-fcntl |
| (fcntl-command F_GETPROTECTIONCLASS) |
| (fcntl-command F_SETPROTECTIONCLASS)) |
| ) |
| |
| (when (defined? 'process-codesigning*) |
| ;; csops/csops_audittoken |
| (deny process-codesigning-status-set (with telemetry)) |
| (deny process-codesigning-text-offset-get (with telemetry)) |
| (deny process-codesigning-cdhash-get (with telemetry)) |
| (deny process-codesigning-blob-get (with telemetry)) |
| (deny process-codesigning-teamid-get (with telemetry)) |
| (allow process-codesigning-identity-get (target self)) ;; codeSigningIdentifierForCurrentProcess |
| (allow process-codesigning-entitlements-blob-get) ;; WK reading entitlments via SecTaskCopyValueForEntitlement and _getSelfParsedEntitlements (accessibility) |
| (allow process-codesigning-status-get) ;; _xpc_get_entitlements |
| (allow process-codesigning-status-set (target self)) |
| (deny process-info-codesignature (with no-report)) ;; SecTaskCopyValueForEntitlement - granting this grants all the process-codesign-* checks |
| ) |
| |
| (when (not (defined? 'process-codesigning*)) |
| (allow process-info-codesignature (target self)) |
| ) |
| |
| (when (defined? 'socket-option-get) |
| ;; getsockopt |
| (deny socket-option-get (with telemetry)) |
| ) |
| |
| (when (defined? 'socket-option-set) |
| ;; setsockopt |
| (deny socket-option-set (with telemetry)) |
| ) |
| |
| (define-once (mach-bootstrap-message-numbers) |
| (message-number 206 207 711 712 718 800 802 803 804 805 904)) |
| |
| (define (allow-mach-bootstrap-with-filter) |
| (allow mach-bootstrap |
| (apply-message-filter |
| (deny mach-message-send (with telemetry)) |
| (allow mach-message-send |
| (mach-bootstrap-message-numbers))))) |
| |
| #if HAVE(SANDBOX_STATE_FLAGS) |
| (if (require-ancestor-with-entitlement "com.apple.private.security.enable-state-flags") |
| (allow mach-bootstrap |
| (apply-message-filter |
| (allow mach-message-send (with telemetry-backtrace)))) |
| ;; else |
| (allow-mach-bootstrap-with-filter)) |
| |
| (with-filter |
| (require-any |
| (require-not (state-flag "WebContentProcessLaunched")) |
| (state-flag "EnableMachBootstrap")) |
| (allow-mach-bootstrap-with-filter)) |
| #else |
| (allow-mach-bootstrap-with-filter) |
| #endif |
| |
| (define (syscall-mach-only-in-use-during-launch) |
| (machtrap-number |
| MSC_mach_generate_activity_id |
| MSC_mach_timebase_info_trap |
| MSC_swtch_pri |
| MSC_task_self_trap)) |
| |
| (define (syscall-mach-in-use-after-launch) |
| (machtrap-number |
| MSC__kernelrpc_mach_port_allocate_trap |
| MSC__kernelrpc_mach_port_construct_trap |
| MSC__kernelrpc_mach_port_deallocate_trap |
| MSC__kernelrpc_mach_port_destruct_trap |
| MSC__kernelrpc_mach_port_extract_member_trap |
| MSC__kernelrpc_mach_port_get_attributes_trap |
| MSC__kernelrpc_mach_port_guard_trap |
| MSC__kernelrpc_mach_port_insert_member_trap |
| MSC__kernelrpc_mach_port_insert_right_trap |
| MSC__kernelrpc_mach_port_mod_refs_trap |
| MSC__kernelrpc_mach_port_request_notification_trap |
| MSC__kernelrpc_mach_port_type_trap |
| MSC__kernelrpc_mach_port_unguard_trap |
| MSC__kernelrpc_mach_vm_allocate_trap |
| MSC__kernelrpc_mach_vm_deallocate_trap |
| MSC__kernelrpc_mach_vm_map_trap |
| MSC__kernelrpc_mach_vm_protect_trap |
| MSC__kernelrpc_mach_vm_purgable_control_trap |
| MSC_host_create_mach_voucher_trap |
| MSC_host_self_trap |
| MSC_mach_msg_trap |
| MSC_mach_reply_port |
| MSC_mach_voucher_extract_attr_recipe_trap |
| MSC_mk_timer_arm |
| MSC_mk_timer_cancel |
| MSC_mk_timer_create |
| MSC_mk_timer_destroy |
| MSC_pid_for_task |
| MSC_semaphore_signal_trap |
| MSC_semaphore_timedwait_trap |
| MSC_semaphore_wait_trap |
| MSC_syscall_thread_switch |
| MSC_task_name_for_pid |
| MSC_thread_get_special_reply_port |
| MSC_thread_self_trap)) |
| |
| (when (defined? 'syscall-mach) |
| (deny syscall-mach |
| (machtrap-number MSC_mach_wait_until)) |
| |
| (deny syscall-mach (with telemetry)) |
| (allow syscall-mach |
| (syscall-mach-only-in-use-during-launch) |
| (syscall-mach-in-use-after-launch)) |
| |
| (when (defined? 'MSC_mach_msg2_trap) |
| (allow syscall-mach |
| (machtrap-number MSC_mach_msg2_trap))) |
| |
| #if HAVE(SANDBOX_STATE_FLAGS) |
| (with-filter (require-not (state-flag "WebContentProcessLaunched")) |
| (allow syscall-mach |
| (syscall-mach-only-in-use-during-launch))) |
| (with-filter (state-flag "WebContentProcessLaunched") |
| (deny syscall-mach |
| (with telemetry) |
| (with message "Mach syscall used after launch") |
| (syscall-mach-only-in-use-during-launch))) |
| #endif |
| ) |
| |
| (define (kernel-mig-routine-in-use-watchos) |
| (kernel-mig-routine |
| io_connect_set_notification_port |
| mach_make_memory_entry |
| mach_make_memory_entry_64 |
| vm_copy |
| vm_remap_external)) |
| |
| (define (kernel-mig-routine-only-in-use-during-launch) |
| (kernel-mig-routine |
| host_get_special_port |
| host_info |
| io_server_version |
| mach_port_get_context_from_user |
| task_restartable_ranges_register |
| task_set_special_port)) |
| |
| (define (kernel-mig-routine-in-use) |
| (kernel-mig-routine |
| (when (defined? '_mach_make_memory_entry) _mach_make_memory_entry) |
| host_get_clock_service ;; After <rdar://85931614> has been fixed, we should evaluate if this is only used on launch. |
| host_get_io_master |
| io_connect_async_method |
| io_connect_map_memory_into_task ;; <rdar://88300200> |
| io_connect_method |
| io_connect_set_notification_port_64 |
| io_iterator_next |
| io_registry_entry_from_path |
| io_registry_entry_get_property_bin_buf |
| io_registry_entry_get_property_bytes |
| io_registry_entry_get_registry_entry_id |
| io_service_get_matching_service_bin |
| io_service_get_matching_services_bin |
| io_service_open_extended |
| #if (PLATFORM(IOS) && __IPHONE_OS_VERSION_MIN_REQUIRED < 160000) |
| mach_port_get_refs |
| #endif |
| mach_port_set_attributes |
| mach_vm_copy |
| mach_vm_map_external |
| mach_vm_remap_external |
| semaphore_create |
| semaphore_destroy |
| task_create_identity_token |
| task_get_special_port_from_user |
| task_info_from_user |
| task_restartable_ranges_synchronize |
| thread_get_state_to_user |
| thread_resume |
| thread_set_exception_ports |
| thread_suspend)) |
| |
| (define (kernel-mig-routine-rarely-used-need-backtrace) |
| (kernel-mig-routine |
| clock_get_time |
| io_connect_add_client |
| io_service_close |
| mach_exception_raise |
| mach_port_request_notification |
| mach_vm_region |
| mach_vm_region_recurse |
| task_threads_from_user)) |
| |
| (define (kernel-mig-routine-rarely-used) |
| (kernel-mig-routine |
| mach_memory_entry_ownership |
| task_set_exc_guard_behavior |
| thread_info |
| thread_policy |
| thread_policy_set)) |
| |
| (when (defined? 'mach-kernel-endpoint) |
| (allow mach-kernel-endpoint |
| (apply-message-filter |
| (deny mach-message-send (with telemetry)) |
| (allow mach-message-send (with telemetry-backtrace) |
| (kernel-mig-routine-rarely-used-need-backtrace)) |
| |
| (allow mach-message-send (with telemetry) |
| (kernel-mig-routine-rarely-used)) |
| |
| (allow mach-message-send |
| (kernel-mig-routine-only-in-use-during-launch) |
| (kernel-mig-routine-in-use)) |
| |
| #if PLATFORM(WATCHOS) |
| (allow mach-message-send |
| (kernel-mig-routine-in-use-watchos)) |
| #endif |
| |
| #if HAVE(SANDBOX_STATE_FLAGS) |
| (with-filter (require-not (state-flag "WebContentProcessLaunched")) |
| (allow mach-message-send |
| (kernel-mig-routine-only-in-use-during-launch))) |
| (with-filter (state-flag "WebContentProcessLaunched") |
| (deny mach-message-send |
| (with telemetry) |
| (with message "kernel mig routine used after launch") |
| (kernel-mig-routine-only-in-use-during-launch))) |
| #endif |
| |
| (when (defined? 'mach_port_is_connection_for_service) |
| (allow mach-message-send (kernel-mig-routine mach_port_is_connection_for_service)) |
| ) |
| ) |
| ) |
| ) |
| |
| (deny darwin-notification-post (with no-log) (with telemetry)) |
| (allow darwin-notification-post |
| (notification-name |
| "_AXNotification_AXSClassicInvertColorsPreference" |
| "com.apple.WebContentFilter.remoteUI.WebContentAnalysisUI-com.apple.uikit.viewService.connectionRequest" |
| "com.apple.accessibility.AirPodsSpatialAudioLockToDeviceChanged" |
| "com.apple.accessibility.QuickSpeakEnabled" |
| "com.apple.accessibility.application.status" |
| "com.apple.accessibility.automation.enabled.status" |
| "com.apple.accessibility.darken.system.colors" |
| "com.apple.accessibility.enhance.background.contrast.status" |
| "com.apple.accessibility.monoaudio.status" |
| "com.apple.accessibility.reduce.motion.status" |
| "com.apple.accessibility.status" |
| "com.apple.accessibility.text.legibility.status" |
| "com.apple.accessibility.voiceovertouch.status" |
| "com.apple.accessibility.wob.status" |
| "com.apple.automation.stringlookupinfoenabled" |
| "com.apple.webinspectord.availability_check")) |
| |
| #if ENABLE(SYSTEM_CONTENT_PATH_SANDBOX_RULES) |
| #include <WebKitAdditions/SystemContentSandbox-ios.defs> |
| |
| (allow file-read* file-test-existence |
| (apply subpath file-read-existence-secondary-paths)) |
| |
| (allow file-map-executable |
| (apply subpath secondary-framework-and-dylib-paths)) |
| |
| (allow-read-and-issue-generic-extensions |
| (apply subpath issue-extension-secondary-paths)) |
| |
| (allow file-issue-extension |
| (require-all |
| (extension-class "com.apple.mediaserverd.read") |
| (require-any |
| (apply subpath issue-extension-secondary-paths) |
| ))) |
| #endif |
