(version 1)
(deny default (with partial-symbolication))
(allow ipc-posix-shm system-audit system-socket file-read-metadata)

(import "system.sb")
(import "com.apple.corefoundation.sb")

;; Distributed notifications, local pasteboard client
(corefoundation)

;; Read-only preferences and data
(allow file-read*
    ;; Basic system paths
    (subpath "/Library/Dictionaries")
    (subpath "/Library/Fonts")
    (subpath "/Library/Frameworks")
    (subpath "/Library/Keychains")
    (subpath "/private/var/db/mds")
    (subpath "/private/var/db/DetachedSignatures")
    (regex #"^/private/etc/(hosts|group|passwd)$")

    ;; Plugins
    (subpath "/Library/Internet Plug-Ins")
    (subpath (string-append (param "HOME_DIR") "/Library/Internet Plug-Ins"))

    ;; System and user preferences
    (literal "/Library/Preferences/.GlobalPreferences.plist")
    (literal "/Library/Preferences/com.apple.crypto.plist")
    (literal "/Library/Preferences/com.apple.security.plist")
    (literal "/Library/Preferences/com.apple.security.common.plist")
    (literal "/Library/Preferences/com.apple.security.revocation.plist")
    (literal (string-append (param "HOME_DIR") "/Library/Preferences/.GlobalPreferences.plist"))
    (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/ByHost/\.GlobalPreferences\."))
    (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.ATS.plist"))
    (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.HIToolbox.plist"))
    (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.LaunchServices.plist"))
    (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.WebFoundation.plist"))
    (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.security.plist"))
    (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.security.revocation.plist"))
    (literal (string-append (param "HOME_DIR") "/Library/Application Support/SyncServices/Local/ClientsWithChanges/com.apple.Keychain"))
    (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/com\.apple\.driver\.(AppleBluetoothMultitouch\.mouse|AppleBluetoothMultitouch\.trackpad|AppleHIDMouse)\.plist$"))

    ;; On-disk WebKit2 framework location, to account for debug installations
    ;; outside of /System/Library/Frameworks
    (subpath (param "WEBKIT2_FRAMEWORK_DIR"))

    ;; FIXME: This should be removed when <rdar://problem/8957845> is fixed.
    (subpath (string-append (param "HOME_DIR") "/Library/Fonts"))

    ;; FIXME: These should be removed when <rdar://problem/9217757> is fixed.
    (subpath (string-append (param "HOME_DIR") "/Library/Audio/Plug-Ins/Components"))
    (subpath (string-append (param "HOME_DIR") "/Library/Preferences/QuickTime Preferences"))
    (subpath "/Library/Audio/Plug-Ins/Components")
    (subpath "/Library/Audio/Plug-Ins/HAL")
    (subpath "/Library/Video/Plug-Ins")
    (subpath "/Library/QuickTime")

    ;; FIXME: This should be removed when <rdar://problem/9237619> is fixed.
    (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.universalaccess.plist"))

    ;; FIXME: This should be removed when <rdar://problem/9276253> is fixed.
    (subpath (string-append (param "HOME_DIR") "/Library/Keyboard Layouts"))

    ;; FIXME: This should be removed when <rdar://problem/9276268> is fixed.
    (subpath (string-append (param "HOME_DIR") "/Library/Input Methods"))

    ;; FIXME: This should be removed when <rdar://problem/9276430> is fixed.
    (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2"))

    (subpath (string-append (param "HOME_DIR") "/Library/Dictionaries"))

    ;; Extensions from UIProcess
    (extension)
)

(allow file-write*
    ;; Extensions from UIProcess
    (extension)
)

;; Writable preferences and temporary files
(allow file*
    (subpath (string-append (param "HOME_DIR") "/Library/Caches/com.apple.WebProcess"))
    (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/ByHost/com\.apple\.HIToolbox\."))
    (regex (string-append "^" (param "HOME_DIR") "/Library/Preferences/com\.apple\.WebProcess\."))
    (subpath (string-append (param "HOME_DIR") "/Library/Keychains"))

    ;; FIXME: This should be removed when <rdar://problem/9217757> is fixed.
    (literal (string-append (param "HOME_DIR") "/Library/Caches/com.apple.coreaudio.components.plist"))
)

;; Darwin temporary files and caches, if present
(if (positive? (string-length (param "DARWIN_USER_CACHE_DIR")))
    (allow file* (subpath (param "DARWIN_USER_CACHE_DIR"))))
(if (positive? (string-length (param "DARWIN_USER_TEMP_DIR")))
    (allow file* (subpath (param "DARWIN_USER_TEMP_DIR"))))

;; Database dir
(if (positive? (string-length (param "WEBKIT_DATABASE_DIR")))
    (allow file* (subpath (param "WEBKIT_DATABASE_DIR"))))

;; LocalStorage dir
(if (positive? (string-length (param "WEBKIT_LOCALSTORAGE_DIR")))
    (allow file* (subpath (param "WEBKIT_LOCALSTORAGE_DIR"))))
    
;; The NSURLCache directory.
(if (positive? (string-length (param "NSURL_CACHE_DIR")))
    (allow file* (subpath (param "NSURL_CACHE_DIR"))))

;; The bundle resource path of the UI process.
(if (positive? (string-length (param "UI_PROCESS_BUNDLE_RESOURCE_DIR")))
    (allow file-read* (subpath (param "UI_PROCESS_BUNDLE_RESOURCE_DIR"))))

;; FIXME: overly permissive since we can't pre-enumerate the client
;; classes for graphics cards
(allow iokit-open
   ;;(iokit-user-client-class "IOHIDParamUserClient")
   ;;(iokit-user-client-class "RootDomainUserClient")
)

;; Various services required by AppKit and other frameworks
(allow mach-lookup
    (global-name "com.apple.CoreServices.coreservicesd")
    (global-name "com.apple.DiskArbitration.diskarbitrationd")
    (global-name "com.apple.FileCoordination")
    (global-name "com.apple.FontObjectsServer")
    (global-name "com.apple.FontServer")
    (global-name "com.apple.SecurityServer")
    (global-name "com.apple.SystemConfiguration.configd")
    (global-name "com.apple.audio.VDCAssistant")
    (global-name "com.apple.audio.audiohald")
    (global-name "com.apple.audio.coreaudiod")
    (global-name "com.apple.cookied")
    (global-name "com.apple.cvmsServ")
    (global-name "com.apple.networkd")
    (global-name "com.apple.dock.server")
    (global-name "com.apple.ocspd")
    (global-name "com.apple.pasteboard.1")
    (global-name "com.apple.system.opendirectoryd.api")
    (global-name "com.apple.window_proxies")
    (global-name "com.apple.windowserver.active")
    (global-name-regex #"^com\.apple\.WebKit\.WebProcess-")
    (global-name-regex #"^com\.apple\.qtkitserver\.")

    ;; FIXME: This should be removed when <rdar://problem/9276393> is fixed.
    (global-name "com.apple.metadata.mds")
)

;; FIXME: <rdar://problem/9263428> These rules are required to avoid
;; sandbox violation spam, but some narrower rule should be
;; sufficient.
(allow network-outbound)
(deny network-outbound (regex ""))
(deny network-outbound (local ip))

(allow network-outbound
   ;; Local mDNSResponder for DNS, arbitrary outbound TCP
   (literal "/private/var/run/mDNSResponder")
   (remote tcp)
)

;; FIXME: Once <rdar://problem/8900275> has been fixed, these rules can be removed.
(allow mach-lookup (global-name "com.apple.pubsub.ipc"))
(allow network-outbound (regex #"^/private/tmp/launch-[^/]+/Render"))
(allow file-read*
   (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.Safari.RSS.plist"))
   (literal (string-append (param "HOME_DIR") "/Library/Preferences/com.apple.Syndication.plist"))
)

;; FIXME: Investigate these.
(allow appleevent-send (appleevent-destination "com.apple.WebProcess"))
(allow mach-lookup (global-name-regex #"^EPPC-"))